)]}'
{
  "commit": "b48befb048c7b27649281c7a97ba12a05f0e7355",
  "tree": "ccdc82566e9f41351b80009a9aa2089da4002743",
  "parents": [
    "b499cb9f0f6f1204f772a1772cf23cf0d2aa95f3"
  ],
  "author": {
    "name": "Andrea Cosentino",
    "email": "ancosen@gmail.com",
    "time": "Tue Sep 08 14:29:43 2026 +0200"
  },
  "committer": {
    "name": "Andrea Cosentino",
    "email": "ancosen@gmail.com",
    "time": "Tue Sep 08 14:29:43 2026 +0200"
  },
  "message": "chore: fold maintainer answers into the threat model\n\n@mgubaidullin answered waves 1-3 on #1642. Every hypothesis in the first\ndraft is now confirmed, corrected, or superseded: 57 documented /\n40 maintainer / 0 inferred, down from 28 inferred.\n\nRulings that changed the model rather than confirming it:\n\n- Q11 corrected the draft. The non-invalidating\n  /platform/internal/sources/{projectId}/{filename} route is by design,\n  not an oversight; the single-use guarantee is scoped to the\n  whole-project route only.\n- Q5 confirmed the negative side-effect inventory is accurate but\n  declined to commit to it as an invariant, so it is recorded as a\n  description of the current release rather than a promise.\n- Q1 ruled the default platform.password an install-time convenience\n  set via secret or env var and changed through the UI, making reports\n  against it OUT-OF-MODEL: non-default-build.\n\nQ9 was answered \"already fixed\", which rebinds the document. CsrfFilter\n(d211d71f), PathUtils name validation (5e425249) and the Kubernetes\nresource allow-list all landed after the 4.22.0 tag, so the model now\nbinds to main at 677a293a and says explicitly that a report against\n4.22.0 or earlier is triaged against a model without those three. CSRF\nmoved from a section 4.9 false friend to a claimed property in 4.8.\n\nThe Kubernetes resource validation is described as defence in depth and\nexplicitly not a boundary: it does not cover the builder pod path,\nbuild.sh, or the Docker compose path.\n\nQ13 and Q14, on document ownership and revision policy, remain open.\nAppendix B records every ruling so a disputed disposition can be traced\nto the answer behind it.\n\nCo-Authored-By: Claude Opus 5 (1M context) \u003cnoreply@anthropic.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "e0e1db2f0884b8d1c2ae49f223516ba008ab1ac8",
      "old_mode": 33188,
      "old_path": "docs/threat-model.md",
      "new_id": "f38a0fd21e330961ef729efedf910b79e1504827",
      "new_mode": 33188,
      "new_path": "docs/threat-model.md"
    }
  ]
}