ID-121 {121.4} PLAN — Security & code-quality baseline: resolution waves

import { Aside } from “@astrojs/starlight/components”;

Theme-14 / ID-121. PRODUCT + TECH are **folded into this PLAN** (appropriate-sizing per the product-owner: this is a finding-triage-and-resolution campaign, not a feature). The finding inventory is `{121.1}` RESEARCH.md; the S391 decisions + outcomes are RESEARCH §8.

Acceptance (PRODUCT-lite)

Launch-ready baseline = no un-triaged CodeQL finding. Every finding is either:

• fixed (code change, gate-green), or
• dismissed with a documented reason via the tooling’s own dismiss mechanism.

Plus: recurrence-prevention enforcement in place (eslint unused-imports — done S391; noImplicitReturns — Wave C), and the code-scanning / Dependabot / secret-scanning posture documented. Hosted code-scanning open security alerts = 0 (achieved S391).

Mechanisms (TECH-lite)

• Reproduction: CodeQL CLI v2.25.6 (~/.codeql-bundle), database create --build-mode none + database analyze javascript-code-quality-extended.qls / javascript-security-and-quality.qls → SARIF. The parse-sarif.ts aggregator was machine-local scratch and is gone — re-author it against the SARIF this recipe produces.
• Dismiss channels (D3): (a) hosted security alerts → code-scanning REST PATCH …/code-scanning/alerts/{n} with dismissed_reason (done for the 3 FPs). (b) Code-Quality dashboard findings (the 49 return-style, ~33 TODO, quality-tagged) are NOT in the REST API → dismiss via the dashboard UI or an in-repo suppression config (.github/codeql/codeql-config.yml query filters / inline // codeql[rule-id]). Wave C must pick one — recommend the in-repo config so suppressions are reviewable + durable across rescans.
• Enforcement: noImplicitReturns: true in tsconfig.json (type-aware backstop for the return-style class — staff-eng memo); eslint unused-imports at error (done).
• jscpd coordination: retire-batch scripts archive to the knowledge-hub-archive repo and leave canonical → skip fixing findings in archive-bound scripts (migrate-ledger-ids-to-string.ts); compare-quality.ts stays (test-covered).

Resolution waves (→ subtasks {121.5+})

Wave	Subtask	Scope	Disposition
A — security fixes	{121.5}	lib/validation/index.ts remote-property-injection ×4 (Object.create(null) / key-guard); 4 reliability warnings (useless-comparison-test ×2 lib/attention.ts:368+lib/reorient.ts:485, unreachable-statement, react/unused-or-undefined-state-property error-boundary.tsx:24)	FIX
B — maintainability	{121.6}	delete the 22 commented-out-code blocks (jscpd-coordinated — spot-check vs clone-dedup; skip archive-bound files)	FIX
C — quality dismissals	{121.7}	49 return-style (idiom, “won’t fix”) + ~33 TODO FPs + test/script security (24 insecure-temp-file, 5 file-system-race, 2 regex-anchor) — via the chosen suppression channel; enable noImplicitReturns	DISMISS + enforce
D — AI suggestions	{121.8}	enumerate the 14 dashboard AI suggestions (not CLI-reproducible) + triage fix/dismiss	TRIAGE
E — posture	{121.9}	document code-scanning/Dependabot/secret-scanning posture; triage the 3 open Dependabot PRs (#46 checkout, #45 app-token, #17 eslint 9→10 — may interact with the S391 eslint config)	DOC + triage

Already shipped (S391, Stream-2, origin/s391-security-closeouts): eslint unused-imports gate; T4-island retire (bl-351); item-J poller retire. 3 hosted security alerts dismissed.

Open mechanism decision carried to Wave C

Dismissal channel for dashboard/quality findings: in-repo .github/codeql suppression (reviewable, durable) vs dashboard UI (manual, per-rescan). Recommend in-repo.