Repository navigation
Split security-appsec.md so app reviews load fewer must-load tokens - #1959
Merged
Merged
Conversation
security-appsec.md is must-load for the web, mobile, api/service and agent/LLM/MCP archetypes, and it was the biggest must-load reference in the web row. Four conditional blocks move verbatim into three lazy references, each opening with a "Read this when" trigger that fires on the target or the diff: - appsec-egress.md: SSRF custom-transport footguns and the parallel-lane version-drift tail. - appsec-flows.md: the A06 business-flow detect steps (state machines, check-then-act, rate-limit keys). - appsec-corroboration.md: the proof-to-claim map and SARIF/OSV ingestion. Every safety check stays in the parent: the SSRF bullet, the untrusted-egress census, the client-trust fields bullet (isAdmin, price, tier from the request body), injection, authz and secrets. Corroboration gets its own cross-cutting heading in the parent. Must-load tokens, before -> after: web 20049 -> 18841, mobile 14675 -> 13467, api/service 19589 -> 18381, agent/LLM/MCP 19610 -> 18402 (each -1208). The Phase 0-2 floors rise 17 tokens (light 18534 -> 18551, full 26513 -> 26530) because the mustload gate counts only SKILL.md and full-map.md as route sources. The parent is 27956 B (from 32790), above the 27000 target, because the census and client-trust bullets stay in it. Review quality was not measured. scripts/test_appsec_split.py pins line survival as a multiset with an explicit allowlist of added and edited lines, so a dropped, edited or duplicated line fails; it also pins routing and the safety bullets. An independent review of the first cut found 🔴2 🟡1 🔵3 (the client-trust and census bullets had moved out of must-load; the survival test used a set). All are fixed; the delta review is 🔴0 🟡0 🔵1, and that nit is queued. Tests: 26/26 (test_appsec_split 7, test_fullmap_core_split 6, test_review_load_bytes 7, test_always_loaded_bytes 6); gates size, size-ratchet, rules, mustload, check_section_pointers, skill_index --check, bench_check --changed ok Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Split security-appsec.md so app reviews load fewer must-load tokens
security-appsec.md is must-load for the web, mobile, api/service and
agent/LLM/MCP archetypes, and it was the biggest must-load reference in
the web row. Four conditional blocks move verbatim into three lazy
references, each opening with a "Read this when" trigger that fires on
the target or the diff:
version-drift tail.
check-then-act, rate-limit keys).
Every safety check stays in the parent: the SSRF bullet, the
untrusted-egress census, the client-trust fields bullet (isAdmin, price,
tier from the request body), injection, authz and secrets. Corroboration
gets its own cross-cutting heading in the parent.
Must-load tokens, before -> after: web 20049 -> 18841, mobile 14675 ->
13467, api/service 19589 -> 18381, agent/LLM/MCP 19610 -> 18402 (each
-1208). The Phase 0-2 floors rise 17 tokens (light 18534 -> 18551, full
26513 -> 26530) because the mustload gate counts only SKILL.md and
full-map.md as route sources. The parent is 27956 B (from 32790), above
the 27000 target, because the census and client-trust bullets stay in
it. Review quality was not measured.
scripts/test_appsec_split.py pins line survival as a multiset with an
explicit allowlist of added and edited lines, so a dropped, edited or
duplicated line fails; it also pins routing and the safety bullets.
An independent review of the first cut found 🔴2 🟡1 🔵3 (the client-trust
and census bullets had moved out of must-load; the survival test used a
set). All are fixed; the delta review is 🔴0 🟡0 🔵1, and that nit is
queued.
Tests: 26/26 (test_appsec_split 7, test_fullmap_core_split 6,
test_review_load_bytes 7, test_always_loaded_bytes 6); gates size,
size-ratchet, rules, mustload, check_section_pointers, skill_index --check,
bench_check --changed ok
This branch is the lane commits squashed onto main
76c4faefb90b7f9d5c2fff0683dfab6124f708d7; they applied without conflicts. CI on the exact SHA is the blocking gate.🤖 Generated with Claude Code