# v1.5 Post-Close Follow-Ups — Disposition

**Date:** 2026-07-01 · **Author:** architect · **Range:** on top of `ec528f7` (v1.5 close) → `c534cea`
**Trigger:** co-driver requested addressing all tracked follow-ups from the v1.4 + v1.5 milestone closes.
**Substrate:** SMTC daemon running (`:8080`) but **no `mcp__smtc__*` MCP client in this harness**; delegation via the `task` tool; cert tiers Structural/Empirical.

These are the tracked **debt/hardening** follow-ups — NOT the deferred *features* (bulk multi-tag,
tag metadata, hierarchy, undo, analytics, `#tag`-in-react-markdown, copy-code button,
insert-at-cursor templates, description-in-search-cards), which remain future-milestone scope.

## Disposition

| # | Follow-up | Status | Evidence |
|---|---|---|---|
| 1 | **F-02** — global JSON body `MaxBytesReader` cap (v1.4-F02 + SEC-v1.5-F02) | ✅ **DONE** | `c534cea` — `limitJSONBody` middleware on `/api/v1` (10 MiB const; Content-Length fast-path → clean **413** + `MaxBytesReader` defense-in-depth for chunked bodies; gated to POST/PUT/PATCH/DELETE, **skips multipart** so attachment uploads keep their own cap). `TestCreatePageJSONBodyCap` (11 MiB → 413) PASS. |
| 2 | **F-01** — pin mermaid/dompurify + CI `npm audit` | ✅ **DONE** | `51f89d4` — mermaid pinned exact `11.16.0` (caret removed); dompurify pinned `3.4.11` via `overrides` (future-protective). `.github/workflows/ci.yml` (64 ln): Go job (build/vet/test + **govulncheck**) + web job (npm ci/test/**audit --audit-level=high**/build). `npm audit --omit=dev` = **0 vulnerabilities**. |
| 3 | **TC-01 LOW** — dedicated rename conflict/dedupe seeded test | ✅ **DONE** | `c534cea` — `TestTagRename_DedupesWhenBothTagsPresent` PASS (a page carrying BOTH old+new tags collapses to a single `devops`; both dedupe paths — `containsNormalized` guard + trailing-else skip — exercised). |
| 4 | **govulncheck re-run** (was blocked: Go-1.26 `ForEachElement` panic in `x/vuln@v1.4.0`) | ✅ **DONE — UNBLOCKED** | `govulncheck@v1.5.0` fixes the panic. Full-tree scan: **"Your code is affected by 0 vulnerabilities"** (18 in required modules + 1 imported, none reachable). Also wired into CI (item 2) with a comment noting v1.5.0+ is required on go1.26. |
| 5 | **Phase-26 manual UAT ×2** — concurrent multi-diagram render; embedded-script inertness | ✅ **DONE** | Agent-driven real-Chromium UAT against the running server. **(a) Concurrent render:** 3 mermaid diagrams on one page render as **distinct SVGs with unique ids `mmd-0/1/2`** (no collision). **(b) Inertness:** an injection block (`<img src=x onerror='…'>` + `click "javascript:…"`) fell to the **raw-code fallback** (rendered as literal text in `<pre>`); `liveOnerrorImgs=[]`, `jsHrefs=[]`, injected scripts=[], and the `window.__xss_fired` tripwire was **never set** → handlers never executed. Confirms the v1.4-F01 strict+DOMPurify sandbox empirically. Screenshot: `v1.5-followup-p26uat-inertness.png`. |
| 6 | **blast_radius re-run** for the CM-editor map (was blocked: SMTC offline) | 🟡 **PARTIAL — Structural tier done; semantic tier blocked** | After enabling smtc in `~/.omp/agent/mcp.json` (`disabledServers: []`) + a `/mcp reload`, the harness still didn't bind `mcp__smtc__*` in this session (log: the reloading session never attempted smtc; a separate OMP process holds it). Worked around it by driving the SMTC daemon **directly over MCP-over-HTTP** from `eval` (`:8080/mcp`, session-handshake, 79 tools). **Structural tier is live + workspace-accurate:** `find_declarations` (byte-precise spans) + `find_name_occurrences` resolved the real CM6 dependency ring — it converges on `mode.ts`; the theme margin→padding change has one production consumer (`mode.ts`); `inlineTagsFromBody` ripples to `PropertiesPanel`/`TagSuggest`/`tag-reconcile`. Recorded in `MAP-cm-editor-subsystem.md` §Blast radius. **Semantic call-graph tier (`blast_radius`/`change_impact`) is COLD:** `analysis_freshness` = `file_count 0, built 2026-06-17` — the cross-file call-graph index was never built for this root; there is NO agent-reachable index-build tool (`onboard_project` is read-only; no reindex/analyze tool among the 79), so transitive-caller ranking needs the **daemon restarted against this workspace root** (daemon-ops, would disrupt the other live smtc session). NOT faked. |

## Result

5 of 6 tracked follow-ups **fully closed**; the 6th (`blast_radius`) is **partially closed** — the
Structural-tier SMTC blast radius is done + recorded (a real upgrade over the map's hand-traced note),
while the semantic call-graph tier remains blocked on a daemon reindex that isn't agent-reachable
(documented honestly, not papered over). Final gate at HEAD `c534cea`: backend `go build/vet/test ./...`
— 18 pkgs ok; `govulncheck ./...` — 0 vulnerabilities; from web/ `tsc -b` 0, `vitest` **804/65**,
`npm audit` 0, `npm run build` 0. The pre-existing DoS-hardening (F-02) + supply-chain
(F-01/govulncheck) items the v1.4 security review recommended are now closed, and CI enforces them
going forward.

**To fully close item 6** (optional, daemon-ops): restart `smtc-mcp-server` with this workspace as its
indexed root (so `analysis_freshness` reports `file_count > 0`), then `blast_radius`/`change_impact`
will return the transitive-caller closure. The direct MCP-over-HTTP path proven here (`eval` →
`:8080/mcp`) means no harness tool-binding is required to run it once the index is warm.

## Commits

- `51f89d4 ci: pin mermaid+dompurify + add CI (go test/vet/govulncheck + npm test/audit/build) (F-01)`
- `c534cea fix(server): cap JSON write bodies (MaxBytesReader, 413) + rename-dedupe test (F-02, TC-01)`
- (govulncheck: tooling update `@v1.5.0` — no repo change beyond the CI step; verified clean locally)
