ID-121 {121.1} RESEARCH — Security & code-quality launch baseline

import { Aside } from “@astrojs/starlight/components”;

Theme-14 (Security & code-quality launch baseline). Authored S391 from a CodeQL CLI 2.25.6 enumeration (parity with the hosted runner's 2.25.6) of the public `canonical` repo @ `4f0b987a`. The SARIF + aggregator were machine-local scratch and are gone; regenerate them from the CLI recipe in {121.4} PLAN §Mechanisms. This document is the actionable inventory that survived; it grounds {121.2} PRODUCT (acceptance), {121.3} TECH (mechanisms), {121.4} PLAN (resolution waves).

1. Method

• CLI: ~/.codeql-bundle/codeql/codeql v2.25.6 (downloaded bundle = CLI + precompiled queries), database create --build-mode=none --language=javascript-typescript. Scanned 2305/2324 JS/TS files + 13/13 Actions files.
• Packs run: javascript-code-quality-extended.qls (the comprehensive quality/maintainability/reliability set) and javascript-security-and-quality.qls (broad security + a quality subset). Both → SARIF.
• Hosted comparison: GitHub default setup is configured (query_suite: default, threat_model: remote, weekly) — security-only, 3 open alerts at HEAD. No .github/workflows/codeql.yml (default setup is UI-managed). The Code Quality dashboard (maintainability/reliability/AI) is a separate product (GA 2026-07-20, paid) — its findings are dashboard-only, NOT in the REST API; the CLI quality pack is the local reproduction path.

2. Inventory — code-quality-extended (132 findings, all repo-source)

n	rule	level	class	disposition (recommended)
39	js/todo-comment	note	cosmetic	policy call — accept (TODOs are legitimate) vs sweep
25	js/implicit-return	note	maintainability/style	policy call — accept-as-style vs normalise
24	js/mixed-returns	note	maintainability/style	policy call — accept-as-style vs normalise
22	js/commented-out-code	note	maintainability	fix — delete dead commented code (real cleanup)
10	js/unused-local-variable	note	unused-code	fix via eslint (recurrence-prevention layer)
8	js/unused-parameter	note	unused-code	fix via eslint
2	js/useless-comparison-test	warning	reliability	fix — genuine logic smell (lib/attention.ts:368, lib/reorient.ts:485)
1	js/unreachable-statement	warning	reliability	fix (__tests__/lib/queue/handlers/procurement-draft-all.test.ts:249)
1	js/react/unused-or-undefined-state-property	warning	reliability	fix (components/shared/error-boundary.tsx:24)

Shape: 110 cosmetic note-level (TODO + implicit/mixed returns + commented-out) · 18 unused-code (eslint-enforceable) · 4 reliability warnings = the genuine-fix core.

3. Inventory — security-and-quality (36 security + 14 quality + 4 correctness)

n	rule	level	class	locations / disposition
24	js/insecure-temporary-file	warning	security	ALL test/fixture/e2e (type-drift-detect.test.ts ×17, db-row-count-diff.test.ts ×3, ast-dataflow fixture, e2e ×1) → dismiss test-scope or batch-fix to fs.mkdtemp
5	js/file-system-race	warning	security	2 test, 2 scripts, 1 lib/workflow-evaluation/token-rollup.ts:328 (dev infra) → low; dismiss/fix lib one
4	js/remote-property-injection	warning	security	lib/validation/index.ts:111-120 — GENUINE production review (user-controlled property access)
2	js/regex/missing-regexp-anchor	warning	correctness	both __tests__/components/reader/source-metadata.test.tsx → test
1	js/file-access-to-http	warning	security	scripts/ledger-server-lifecycle.ts:318 → script, low
1	js/http-to-file-access	warning	security	scripts/run-supabase-advisors.ts:401 → script, low
1	js/weak-cryptographic-algorithm	warning	security	lib/q-a-pairs/sidecar-path.ts:49 — FALSE POSITIVE (SHA-1 mandated by RFC 4122 §4.3 for uuid5, pinned bit-for-bit to Python uuid.uuid5; not a security primitive) → dismiss
1	js/incomplete-sanitization	warning	correctness	lib/supabase/escape.ts:26 — BY DESIGN (correct single-pass g-flag escape; a CodeQL autofix introduced the double-backslash bug we reverted — the “fix” it wants IS the bug) → dismiss
1	js/incomplete-multi-character-sanitization	warning	correctness	__tests__/components/kb-integration-review.test.tsx:92 — test → dismiss

4. The hosted-vs-CLI delta (important)

The hosted default setup reports only 3 open security alerts — exactly the weak-cryptographic-algorithm / incomplete-sanitization / incomplete-multi-character-sanitization trio, all false-positive / by-design. The broad CLI security-and-quality pack reveals ~33 additional security findings (insecure-temp-file, file-system-race, remote-property-injection, …) the hosted narrow suite does not surface. Decision input for PRODUCT/TECH: do we (a) hold the launch bar at the hosted 3 (clean already, modulo dismissals), or (b) adopt the broader pack as the bar (then the 33 — mostly test/script + the 4 real validation findings — must be resolved)?

5. Genuine-fix core (production, non-cosmetic)

1. js/remote-property-injection ×4 — lib/validation/index.ts:111-120. Highest priority: user-controlled key into property access. Review for prototype-pollution / unsafe dynamic access; fix or prove-safe + dismiss.
2. js/useless-comparison-test ×2 — lib/attention.ts:368, lib/reorient.ts:485. Logic smells (comparison always true/false). Fix.
3. js/unreachable-statement ×1, js/react/unused-or-undefined-state-property ×1 (components/shared/error-boundary.tsx:24 — a real React state bug class). Fix.
4. js/commented-out-code ×22 — delete dead commented code (clean maintainability win).

6. Recurrence prevention (adopted S391, Stream-2)

eslint-tightening path (a) adopted this session: un-ignore scripts/+supabase/, eslint-plugin-unused-imports at error (no-unused-imports, no-unused-vars with ^_ exempt). This enforces the 18 unused-code findings going forward. NOTE: CodeQL shows unused-var/param are repo-wide, not just scripts/ — so the enforcement surface is larger than the prompt’s ~27 estimate.

7. Open decisions for {121.2} PRODUCT

• D1 — cosmetic bucket (110 note-level): sweep (delete commented-out, normalise returns, resolve/annotate TODOs) vs accept-as-style + dismiss. Sizes the whole theme.
• D2 — launch bar: hosted-3 (narrow) vs broad CLI pack (the 36 security). Determines whether the 33 test/script findings are in-scope.
• D3 — dismissal channel: hosted security alerts → code-scanning REST/UI dismiss-with-reason. Code-Quality dashboard findings → dashboard UI (separate product). CLI-only findings (not on dashboard) → in-repo suppression (.github/codeql config / inline) — needs a mechanism decision.
• D4 — CI enforcement: keep default-setup + local CLI (current choice), vs later wire quality-extended into CI (advanced setup, +Actions minutes). Deferred per S391; revisit at GA (2026-07-20).
• D5 — 14 AI suggestions: dashboard-only, not CLI-reproducible. Enumerate from the GitHub UI for triage in a later wave.

8. S391 execution outcomes (product-owner decisions applied)

Decisions (Liam, S391): D1 = split (fix commented-out + unused-code via eslint; document/prioritise TODOs; staff-engineer assessment for return-style); D2 = resolve the broad pack; D3 = dismiss the 3 hosted false-positives with reasons. Cross-cutting constraint: coordinate with the in-flight jscpd dedup audit.

• 3 hosted security alerts DISMISSED (verified — 0 open at HEAD): #22 weak-cryptographic-algorithm (false positive — RFC 4122 uuid5 SHA-1), #21 incomplete-sanitization (false positive — the autofix-introduced bug we reverted), #5 multi-char-sanitization (used in tests). Reasons recorded in the code-scanning audit trail.
• js/remote-property-injection ×4 (lib/validation/index.ts:106-122) re-adjudicated: REAL but low-severity → FIX, not dismiss. parseSearchParams writes raw[key] with a user-controlled URL param name; pollution is confined to a fresh local raw object that is immediately Zod-validated (not Object.prototype). Cheap defensive fix: Object.create(null) for raw (or guard __proto__/constructor/prototype). Slated for the security fix wave.
• Stream-2 closeouts shipped (branch gh-security, 4 commits off 4f0b987a): a58879f5+9bb4fd88 retire the T4 workspace island (bl-351 done); 37ebe7fa retire the orphaned item-J poller trio (route + by-id test + fetchPipelineRun + pipelineRuns.detail); 2d0e7b81 adopt the eslint unused-imports gate (the recurrence-prevention layer, D1).
• jscpd coordination (D1/D2 constraint): the retire batch archives ~18 one-shot scripts to the knowledge-hub-archive repo (they leave canonical entirely → their CodeQL findings vanish on archive). Do not fix findings in archive-bound scripts — confirmed overlap: migrate-ledger-ids-to-string.ts (skip); compare-quality.ts is explicitly keep (test-covered, fix it). Commented-out-code deletion is orthogonal to clone-dedup (low overlap) — spot-check at fix time.
• Analysis feeding {121.4} PLAN: staff-engineer assessment of the 49 return-style findings (returns-assessment.md) + the 39-TODO prioritised register (todo-register.md) — both machine-local scratch, now gone; their conclusions are the bullets above and in {121.4} PLAN.