Skip to content

P2 remediation gate report

Generated: 2026-07-07T07:39:54Z

Gate verdict

P2 remediation from Audit B is closed on origin/main through merge commit abdc90db12517958ef0fe0042a9fbadd52d9b27d.

  • All scoped P2 implementation, documentation, review-captain, security, and QA gate PRs listed below are merged.
  • GitHub checks were green for each community PR before merge.
  • The Enterprise SSO compatibility PR required by the auth hardening gate is merged with green checks.
  • The only remaining open community PRs at this gate are Dependabot maintenance updates (#291-#308), not P2 remediation work.
  • No release tag was created.
  • No deployment or production action was performed.

Covered P2 items

Area PR Merge commit Evidence
Config list/history payload slimming #288 81cbae030d841b7207b83c9b1fa8445d03eee674 List/history metadata endpoints omit YAML content by default; detail routes fetch content explicitly; backend/frontend/API tests and CI green.
Alert engine pagination #277 81129572b939f7209786aebd9b1e79cd88fbc563 Alert evaluation now scans bounded deterministic workload pages with store pagination coverage; CI green.
Queryable workload JSON projection #278 745103747948821bd485a16e021d5015b4b7d702 Added DB-neutral workload_attributes projection refreshed during workload upserts; store tests and CI green.
Composite DB indexes #279 384b8c1836182867c9323bc73af8379180b6a68e Added migration 00024_composite_indexes.sql plus SQLite query-plan regression coverage; CI green.
WebSocket cache patching and large-list virtualization #289 4cf478e5d2de833a4185ee54d37e09f19909cc50 Frontend WebSocket patching and virtualized workload/instance lists landed with targeted Playwright coverage; CI green.
opamp.Server.onMessage refactor #280 b9a370f3bcff751e1bd37172325549cbc4062e16 Split the critical OpAMP message path into focused helpers while preserving behavior; OpAMP tests and CI green.
Handler coverage and smoke path #281 abdc90db12517958ef0fe0042a9fbadd52d9b27d Added handler coverage for auth methods/config fetch/alert resolve/SPA fallback plus httptest full-stack smoke; rebased by the gate and CI green before merge.
Browser/session auth hardening #287, #290 cdad88cb48761e2b7412dc77d4d811057869b63d, 63421ec648db9b538fb8ebd2539b51fb5276b8b4 Added om_session HttpOnly cookie flow, security headers, sensitive-query redaction, WebSocket token-expiry behavior, and follow-up session failure handling; CI green.
Enterprise SSO compatibility for session cookies Enterprise PR #49 (Magnify-Labs/otel-magnify-enterprise) 11c58b0f150804031505eb3558ec29d83443b884 SAML ACS now sets the om_session cookie, clears it on failures, and avoids raw JWTs in success redirects; Enterprise checks green.
Developer/API/feature-flag/Helm documentation #276 97663d680b619afb8d821da21247bd2bd4963e7e Expanded API auth/REST docs, backend/deployment guidance, environment reference, installation, and configuration docs; CI green.
Workload archive UX/API decision and wiring #283 124383e5dcbb9a3e8063ba05c206cd6a5444bc84 Implemented disconnected-only manual archive, hidden-by-default archived workloads, include-archived views/detail/audit history, and reconnect unarchive behavior; CI green.

Final gate checks

The review-captain final gate performed these checks against the isolated branch audit-p2/final-review-merge-gate reset to current origin/main:

  • Rebased PR #281 onto current origin/main, ran ad-hoc targeted verification, force-pushed the rebased head 2550c9af57e0f15535a04a4c381072e667e50e70, waited for all 18 GitHub checks to pass, and squash-merged it.
  • Queried community PR #276, #277, #278, #279, #280, #281, #283, #287, #288, #289, and #290; every PR is MERGED, every merge commit is an ancestor of origin/main, and every status check was completed successfully before merge.
  • Queried Enterprise PR #49; it is MERGED with all 5 checks completed successfully.
  • Queried open community repository PRs. The remaining open PRs are Dependabot updates #291-#308 only; PR #307 has a Prettier check failure and remains outside this P2 remediation gate.
  • Scanned the final gate diff for conflict markers and generated clutter; no node_modules, dist, or unrelated dirty files are included.

Remaining P3 risks explicitly out of scope

These items are not P2 gate blockers and remain candidates for later polish or release-hardening waves:

  • CodeMirror diff performance for very large YAML/config diffs.
  • Visibility-aware frontend polling to reduce background load.
  • Frontend code-splitting to reduce initial bundle size.
  • Shared handler audit-test helpers to reduce backend test duplication.
  • Further oteldiff decomposition for maintainability.
  • Routine frontend dependency cleanup, including the open Dependabot queue.
  • Remaining inline-style cleanup into CSS classes for Signal Deck consistency.
  • Client-side token-expiration UX validation.
  • Broader test performance/flakiness cleanup (t.Parallel, fewer time.Sleep calls).
  • Dedicated pre-tag release gate, targeted Go benchmarks, and deeper webhook SSRF guard decisions.
  • A true guided rollback diff and minor documentation batch cleanups.

Release/deploy status

No tag was created, no GitHub release was cut, and no production/deployment action was taken as part of this P2 gate.