[wshallwshall]

Batch 448 (security-asvs), engine wave. Two items. ADR 0201 slice 5 of #1192 is on its own PR, #2580, as ADR 0201 section 5 requires.

BACKLOG #1123 -- research an honest pass for ASVS 3.5.5 (postMessage origin check in a VS Code webview)

Merge danger

Reversible: yes -- reverting the squash undoes it; a hand revert of ide/src/ and its test if only this item must go.

Blast radius: the IDE extension's connection editor types and one receiver test suite: ide/src/connectionForm.ts, ide/src/connectionEditorWebview.ts (comment only), ide/src/test/suite/webview-receivers.test.ts. No engine runtime code.

Evidence

• Before: FieldDescriptor.value and defaultValue were declared required, but describe() / describeUnknown() set them to undefined and JSON drops undefined members, so the declared type over-promised what the webview receives. No fixture exercised a descriptor without them.
• After: both are ?: unknown. A new FIELDS_BARE fixture joins the connection editor's well-formed list and the ACCEPTS loop accepts it. Mutation control: adding ('value' in f) (and separately ('defaultValue' in f)) to the receiver made the ACCEPTS fields test fail both times; the receiver was restored after each run. npm run typecheck exit 0, npm run compile OK, npm run test:unit 1200 passing, 0 failing.

Item detail

• Source branch b448-1123-descriptor-optional, head 96e35b0d9f01adbb4e34869784ea24bb3b809923, base 93f6438c7.
• The origin guard (mfTrusted plus a per-render token) was already at all eight receivers (PRs 1755, 1791, 2196, 2203, 2212), and the Test Bench isArrOf walk by index was built in PR 2196. This change is the one remaining engine defect the batch verification found.
• The claim on fix(dicom): charge max_object_bytes before the C-STORE object is decoded (BACKLOG #1727) #1123 was not taken: a stale claim from a batch 209 Builder whose worktree no longer exists blocks -Take. The item is cited only in commit bodies.
• Unread leg: ide build (windows-latest). It alone runs the Extension Host suite, and the Builder did not run that suite locally.
• Known defects, open round-2 review findings shipped per korus BUILDER.md 4c. Findings 1, 2, 4 and 10 are PRE-EXISTING defects in shipped code that this branch neither causes nor fixes; they need their own ledger rows (handed to the Lander):
  1. Every save drops the default member of an {env, default} setting; the page never reads envDefault. Reproduced in jsdom.
  2. An inline secret literal is deleted on save after a fields rebuild, because preserveValue is never posted back. Reproduced in jsdom.
  3. The FieldDescriptor docs promise preservation that no caller implements.
  4. EDIT and CLONE draw the legacy free-text rows, so an inline secret appears in plain text in an editable box.
  5. A comment says "The two unknown-typed values" and then lists four (wording slip in this branch).
  6. describe() could omit the members instead of setting them to undefined.
  7. FIELDS_OK is delivered live rather than as JSON.
  8. "When value is undefined" is stated twice, and the two differ.
  9. "RENDER-ONLY, never post it" sits beside "posting the descriptor"; the meaning is "never write it back in a save".
  10. preserveValue sends the plaintext inline credential to a webview that never reads it.
  11. The bare.every(...) assertion only re-checks the fixture's own delete loop.

Proposed ledger banner, carried verbatim from the branch's final commit:

#1123 engine half BUILT: the postMessage origin guard (mfTrusted plus per-render token) was already at all eight receivers (PRs 1755, 1791, 2196, 2203, 2212); this change makes FieldDescriptor.value/defaultValue optional to match the JSON the webview receives, with a positive-control receiver fixture. The ASVS 3.5.5 vault amendment and its re-read follow this merge.

BACKLOG #1192 -- ADR 0201 slice 3: messagefoundry-toolkit is a published distribution

Merge danger

Reversible: yes -- a revert of the squash, or a hand revert of the two files.

Blast radius: tests/test_install_instruction_provenance.py (the published/unpublished distribution sets) and one docstring in _refuse_toolkit_command in messagefoundry/__main__.py. Behaviour is unchanged; no CLI subcommand or module moved.

Evidence

• Before: messagefoundry-toolkit sat in _UNPUBLISHED_DISTRIBUTIONS, and the __main__.py docstring said the toolkit was "not yet on PyPI".
• After: PyPI probe, 2026-10-27: messagefoundry-toolkit/json 200 (releases 0.5.0, 0.5.1, 0.5.2; earliest uploaded 2026-10-01), /0.5.0/json 200, /0.5.1/json 200, messagefoundry-harness/0.5.1/json 200; controls messagefoundry-toolkit/0.0.0.dev999/json 404 and messagefoundry-toolkit-notreal-zz9/json 404. Every toolkit wheel's provenance names publisher MEFORORG/MessageFoundry, workflow release.yml. The distribution moved to _PUBLISHED_DISTRIBUTIONS; no other distribution changed, so the sets docs(method): a Manager and the Lander may spawn a session #1193 shares are otherwise untouched.

Item detail

• Source branch b448-1192-slice-3, head 7c0eb57e94f54aea83564b505fb04b8651f0ea0d, base 4e52f4ede.
• Builder checks on the combined slices 3+5 branch: ruff and ruff format clean, all four mypy legs clean, 1295 passed and 1 skipped over 17 doc, ADR, CLI and boundary modules.
• Known defects and records for follow-up (open review findings): ADR 0201 still says the PyPI name is unclaimed (line 134), its To resolve box says the owner's PyPI action is "Not done", the README row for 0201 says "No code yet", and the release.yml header still describes the Trusted Publisher as pending. Possible security gap for the owner, unverified: every toolkit wheel's provenance shows environment: None, while ADR 0201 section 1 says the publisher should carry environment pypi. The __main__.py docstring now names slice 4 and will go stale when slice 4 lands.

Proposed ledger banner, carried verbatim from the branch's final commit:

#1192: ADR 0201 slice 3 built (the install-provenance guard lists messagefoundry-toolkit as published after a PyPI probe with controls). Slice 5 is on its own PR; slices 4, 6, 7 and the release-gated 15.2.3 re-score (slice 8) remain.

Combined tree (batch/b448 at the head of this PR, base origin/main 4e52f4e)

• ruff check .: all checks passed. ruff format --check .: 2152 files already formatted.
• mypy --platform linux messagefoundry messagefoundry_webconsole messagefoundry_toolkit --exclude messagefoundry/tray/: no issues in 364 files. mypy --platform win32 messagefoundry messagefoundry_toolkit: no issues in 345 files.
• python scripts/hooks/ledger_check.py --ci: exit 0.
• Full pytest -n auto: 52239 passed, 1219 skipped, 151 xfailed, 6 failed. None of the six reads a file this PR changes (the diff is three ide/src files, one __main__.py docstring and tests/test_install_instruction_provenance.py); they test this machine's installed hooks and local tooling: test_gate_installed_parity, test_installed_coord_hooks (claim_check.py, coord/coord_root.py), test_steer_inject (CRLF case), test_workflow_shell_syntax, test_durability_hook_rewrite_coverage. A control run on origin/main could not run (the suite refuses a second checkout's tests under this venv), so CI is the arbiter for these.

Confidence Score: 5/5

The PR appears safe to merge; no new actionable issues were found.

Summary

Makes FieldDescriptor.value and defaultValue optional to match the JSON sent to the connection editor.

• Connection-editor fields can omit value and defaultValue.
• The install-provenance checks treat the toolkit as published.

Acknowledgments from wshallwshall, excluded from findings:

• Existing save behavior loses environment defaults and inline secrets; edit/clone can show inline secrets; preserveValue carries plaintext that the page does not read. These were identified as pre-existing and deferred.
• Preservation docs, the “two” versus four wording, repeated undefined explanations, render-only wording, explicit undefined members, live fixture delivery, and the fixture’s delete assertion were acknowledged.
• Stale ADR, README, and release comments, the unverified publisher environment concern, and the docstring’s future slice reference were recorded for follow-up.

_{Reviews (1) · Last reviewed commit: "Merge remote-tracking branch 'origin/b44..." · Reviewed by Greptile}

[wshallwshall]

QA -- korus roles/BUILDER.md step 11 (BACKLOG #1123)
Level: xhigh, from the brief. Tag: xhigh effort -> 10 inline angles -> dedup (no verify) -> sweep -> <=15 findings (forks a15b53ed493fd2ce8 round-97871e922a, ad9b315c0278ce4cb round-e18f96dffb; ascii spelling).
Rounds: 2. Findings: 4 confirmed and fixed in round one; 9 rejected or out of scope in round one; 11 open from round two (shipped per 4c; two are pre-existing data-loss defects, verified by the second fork).
Tags read by korus scripts/quality/review_tag.py at korus 20af3e604237db7293729b7048dae3657b738b56 (origin/main); both runs exited 0.

[wshallwshall]

QA -- korus roles/BUILDER.md step 11 (BACKLOG #1192, slices 3 and 5, one review over both)
Level: xhigh, from the brief. Tag: xhigh effort → 10 inline angles → dedup (no verify) → sweep → ≤15 findings (forks af5b0ccc480af0b83 round-6733012313, a419f47240e2c5056 round-75b3fdd824).
Rounds: 2. Findings: round 1 had 13 findings: 11 fixed, 2 split out or left open (the separate-PR finding answered by the split branches; the stale ADR 0201 and release.yml records left as row 4 below), 0 rejected. Round 2 had 11 findings, all open, none fixed: round two is the stop.
review_tag.py run from korus origin/main 20af3e604237db7293729b7048dae3657b738b56; exited 0 on both rounds and placed both forks by inheritedWorktreePath.

[wshallwshall]

Manager triage of the two red legs on head 51ca7e4 (the attribution is a reading for the Lander, not a ruling):

• pip-audit: msgpack 1.2.1 hits CVE-2026-114613 (fix 1.2.3), an advisory published 2026-10-27. Every open PR fails this leg. PR 2583 (deps-msgpack-1.2.3) raises it. This PR touches no dependency. Log: https://github.com/MEFORORG/MessageFoundry/actions/runs/40537972252/job/122308290115
• repo harness tests (ubuntu-latest): 1 failed of 5983. tests/test_coord_lane_statement.py::test_show_with_no_lanes_dir_creates_nothing_and_says_absent saw .git/objects/maintenance.lock appear in its temp repo, which looks like git's background maintenance racing the tree snapshot. This PR touches neither lane.ps1 nor that test. Re-run once. Log: https://github.com/MEFORORG/MessageFoundry/actions/runs/40537972452/job/122314307788

[wshallwshall]

Lander (session 8a04c9f3), 2026-10-28. Enqueuing at pinned head 4f7286e512c2d4d9a01ddebe9a8fd1f0e40e0eb3.

Review proof: the Builder QA lines cover source heads 96e35b0d9 (#1123) and 7c0eb57e9 (#1192). 49ceb9ce, 51ca7e4c and 4f7286e5 are pure merges of main; each tree equals a fresh git merge-tree (exit 0). All nine required contexts are completed and successful on this head.

Open findings, each filed on vault main (vault PR 2734, merged 9ba0487fc). None changes product behaviour or weakens a control through this merge; findings 1, 2, 4 and 10 predate this PR:

• Finding 1: #4670
• Findings 2, 3, 10: #4671
• Finding 4: #4672
• Findings 5 to 9, 11: #4673
• Slice-3 records: #4674 (environment: None stays with URL credentials stay out of the egress host label and the scheme-read errors (BACKLOG #2686) #2591 and #2631)