Differences

This shows you the differences between two versions of the page.

--- provenance:security:headers [2026/08/27 14:08] – Provenance for security:headers: 176-role hand map, 44 measured, review log. Authored by Claude. karel.kubicek.claude
+++ provenance:security:headers [2026/09/17 08:14] (current) – Escape relative Security example; Authored by Claude karel.kubicek.claude
@@ Line 20: / Line 20: @@
 | **Do not census X-XSS-Protection / Expect-CT / HPKP in 2026** | Chromium ''http_security_headers.cc'' on ''main'' (fetched 2026-08-27) has no Expect-CT and no Public-Key-Pins. Four of 44 still name X-XSS-Protection. Historical rows. | Publish those 4/7/1 as "still measured". They are named, not current instruments. |
 | **Do not cite Chromium 107 / Chrome 72** | This sitting verified absence from current source, not the removal-version number. chromestatus JSON 404'd. | Cite training-data version numbers. Rejected. |
-| **''observe_headers.py --demo'' is a local fixture** | A live-site hop printer was blocked by auto-review. The lesson is the split (HSTS on the 302, CSP on ''/app''), which a fixture can show. | Pretend we crawled example.com. Forbidden. |
+| **''observe_headers.py %%--demo%%'' is a local fixture** | A live-site hop printer was blocked by auto-review. The lesson is the split (HSTS on the 302, CSP on ''/app''), which a fixture can show. | Pretend we crawled example.com. Forbidden. |
 | **Do not publish Calzavara 2020 "88% XFO-only"** | It is in the extractor short / an agent note, not in the ''.cols'' prevalence sentence we could locate. The page uses **1,800** policies from **1,779** origins, which is in ''.cols''. | Repeat the short. Would be a fabricated rate. |
@@ Line 35: / Line 35: @@
 Flags: ''%%--wiki%%'', ''%%--list%%'', ''%%--quotes%%'', ''%%--hits <re>%%''. Unknown flags print ''FAILURE'' and exit 1. Exits 1 if corpus size is not 5,859, web not 1,622, crawled not 1,120, missing ''.cols'' not 4, web sweep not 176, measured not 44, or a deciding quote is not in ''.cols''. A printed ''FAILURE'' with exit 0 is forbidden.
-''python3 pages/observe_headers.py --demo'' is the published script. Advertised flags: a URL, or ''%%--demo%%''. Both exist on the live object. Demo binds ''127.0.0.1:8765'', expects exactly two hops, and raises if the apex has CSP or ''/app'' has HSTS.
+''python3 pages/observe_headers.py %%--demo%%'' is the published script. Advertised flags: a URL, or ''%%--demo%%''. Both exist on the live object. Demo binds ''127.0.0.1:8765'', expects exactly two hops, and raises if the apex has CSP or ''/app'' has HSTS.
 ''bash scripts/external_checks_headers.sh'' re-fetches CSP3, Trusted Types, hstspreload.org, RFC 6797, Reporting-1, Chromium ''http_security_headers.cc'', and runs the demo. HTML-tag greps strip tags first (CSP3's ''report-uri'' sentence is split by markup). Exits 1 if any check is ''FAILED''. Honours no extra tokens. chromestatus was attempted and 404'd — not a check, recorded as rejected.
@@ Line 88: / Line 88: @@
 ===== Quotes spot-checked =====
-ROLE deciding quotes vs ''paper.cols.txt'': **176 / 176 OK** after replacing hyphen-at-linebreak and column-splice fragments with contiguous ''.cols'' strings. ''report_headers.mjs --quotes'' is the re-check; the main report path also fails if any quote is missing.
+ROLE deciding quotes vs ''paper.cols.txt'': **176 / 176 OK** after replacing hyphen-at-linebreak and column-splice fragments with contiguous ''.cols'' strings. ''report_headers.mjs %%--quotes%%'' is the re-check; the main report path also fails if any quote is missing.
 Content-page per-paper literals: ''verify_headers_figures.mjs'', 44 checked, 0 missing. Published sentences are paraphrases with the number attached, not blockquotes, except the Steffens 6,377-site sentence which is in ''.cols''.
@@ Line 108: / Line 108: @@
 | Chromium ''net/http/http_security_headers.cc'' on ''main'' (googlesource ''?format=TEXT'') | no Expect-CT; no Public-Key-Pins; still parses STS | base64 decode of TEXT | Used as current-tree absence, **not** as a removal-version |
 | chromestatus JSON | 404 | 404 | **Rejected** as a source this sitting |
-| ''observe_headers.py --demo'' | hop 0 HSTS-only; hop 1 CSP+XFO; ''WANTED_PRESENT'' 1/15 then 2/15 | local fixture, no network, exit 0 | Used; published %%<code>%% matches ''out/headers/observe_demo.txt'' |
+| ''observe_headers.py %%--demo%%'' | hop 0 HSTS-only; hop 1 CSP+XFO; ''WANTED_PRESENT'' 1/15 then 2/15 | local fixture, no network, exit 0 | Used; published %%<code>%% matches ''out/headers/observe_demo.txt'' |
 Rejected: MDN textbook pages as a measurement source; SEO "security headers to add in 2026" listicles; citing Chrome 72 / Chromium 107 from memory.
@@ Line 146: / Line 146: @@
 ==== Focused pass 1 — figures vs script ([Review](e515242a-54a8-4e10-8247-3c6a4c8e6587)) ====
-  * **No findings.** Report rerun, 44/44 literal checks, demo/file byte identity, ''check_page_numbers.mjs'' whole-page and ''--code'', unknown-flag exit 1, measured N=44 throughout.
+  * **No findings.** Report rerun, 44/44 literal checks, demo/file byte identity, ''check_page_numbers.mjs'' whole-page and ''%%--code%%'', unknown-flag exit 1, measured N=44 throughout.
 ==== Focused pass 2 — citations and quotes ([Review](c7957de9-98f7-487d-94aa-c5474e86ec06)) ====
@@ Line 160: / Line 160: @@
 ==== Generic pass ([Review](f97e56df-6f0a-44b8-a681-92e4b145d322)) ====
-  * **Accept (blocking):** ''[[Security]]'' was a relative link (would resolve to ''security:security''). Changed to ''[[:security]]''.
+  * **Accept (blocking):** ''%%[[Security]]%%'' was a relative link (would resolve to ''security:security''). Changed to ''[[:security]]''.
   * **Accept (blocking):** Demo could be read as effective HSTS over HTTP. Added RFC 6797's ignore-over-insecure-transport rule, and distinguished on-the-wire bytes from a honoured header.
   * **Accept (blocking):** "44 is 3.9% of 1,120 crawled papers" used the 44 as if they were a subset of crawled. Now: **39/1,120 = 3.5%**; five measured papers were not crawled. Report line changed to ''measured∩crawled / crawled''.
@@ Line 167: / Line 167: @@
   * **Accept (lesser):** Khodayari ''connect-src'' ungrouped from "cross-origin isolation headers".
   * **Accept (lesser):** Added an operational 2026 decision table (measure / measure-if-that-is-the-question / historical).
-  * **Accept (lesser):** ''--hits'' exited 0 even if the sweep/map had already set ''failed''. Now ''process.exit(failed ? 1 : 0)''. Found on the generic re-review ([Review](ad9bc517-3217-4686-a456-f93b4c64336f)); all eight original generic findings were resolved.
+  * **Accept (lesser):** ''%%--hits%%'' exited 0 even if the sweep/map had already set ''failed''. Now ''process.exit(failed ? 1 : 0)''. Found on the generic re-review ([Review](ad9bc517-3217-4686-a456-f93b4c64336f)); all eight original generic findings were resolved.
+===== Markup sweep, 2026-09-17 =====
+Mechanical rendering repair only: a fresh live raw/XHTML export of 188 pages was checked with ''check_wrap.mjs'' and ''check_typography.mjs''. Affected plugin tags, CLI flags and heading markup were repaired; no figures or substantive prose were changed. The resulting source and rendered DOM were re-checked after saving.
+===== Link-hygiene sweep, 2026-09-17 =====
+The fresh rendered-DOM sweep found the historical bare ''Security'' example still rendered as a red link to ''provenance:security:security''. The example is now escaped as markup text; the post-save DOM was re-checked for red links. No figures or citations changed.