Repository navigation

M10: model the URL parser, sixteen audit rounds, and a 3x smaller position map - #12

Merged

oxyc merged 124 commits into

masterfrom

m10-simplify

Sep 3, 2026

Merged

M10: model the URL parser, sixteen audit rounds, and a 3x smaller position map#12
oxyc merged 124 commits into
masterfrom
m10-simplify

Commits on Aug 30, 2026
Commits on Aug 31, 2026
- Read every spelling the forward pass can emit, and decode where the parser does
  generoi-deploy
  committed
  cb3446a
- Ask the scheme question per host, not per map
  generoi-deploy
  committed
  b93a725
- Ask the application which database it reads, and stop diff passing on redirects
  generoi-deploy
  committed
  1dac433
- Round-trip every corpus shape through every surface, not just href
  generoi-deploy
  committed
  8d2940d
- Make the instruments measure what they report
  generoi-deploy
  committed
  8ff7e09
- Put the two encodings above the URL parser into the corpus
  generoi-deploy
  committed
  69dee2e
- Correct the record on how a reference-encoded origin is covered
  generoi-deploy
  committed
  f49ffd3
- Catch composed encodings, and stop the checks pointing at remedies that fail
  generoi-deploy
  committed
  4d28039
- Demote the database gate: keep the signal, give up the authority
  generoi-deploy
  committed
  8c01f37
- Stack the views, bound the bracket scans, and make every view report
  
  generoi-deploy
  and
  claude
  committed
  2029ac6
- Make the corpus say how much it covers, and the verdict match the proxy
  
  generoi-deploy
  and
  claude
  committed
  ffdf1f9
- Assert Validate's fixed-point promise where the views are reachable
  
  generoi-deploy
  and
  claude
  committed
  4c4aec8
- Run wp-cli from the docroot, and compare declarations instead of file existence
  
  generoi-deploy
  and
  claude
  committed
  5dd3a30
- Ask Docker for the rivals the directory scan cannot see
  
  generoi-deploy
  and
  claude
  committed
  a22e0f8
- Name the project the way DDEV names it, in the new collision scan too
  
  generoi-deploy
  and
  claude
  committed
  d5e8c36
- Move the last two request-body arms to the request direction
  
  generoi-deploy
  and
  claude
  committed
  570fd41
- Share the reference decode, and make the allocation ceiling a tracked number
  
  generoi-deploy
  and
  claude
  committed
  db58100
- Compare canonical origins, and test overlap rather than equality
  
  generoi-deploy
  and
  claude
  committed
  6892491
- Undo an allocation optimisation that was a leak, and count what is rewritten
  
  generoi-deploy
  and
  claude
  committed
  d81ac74
- Let the database settle the parent-declares question, and stop refusing on it
  
  generoi-deploy
  and
  claude
  committed
  128d9fa
- Strip reference-spelled controls in every decoder, not only the fall-through
  
  generoi-deploy
  and
  claude
  committed
  5176a0c
- Stop the WP_HOME warning dying to SIGPIPE, and let the subset test speak
  
  generoi-deploy
  and
  claude
  committed
  53e2dc9
- Make the diff scorer run the proxy's arms, and stop corrupting serialized bodies
  
  generoi-deploy
  and
  claude
  committed
  7f3eec3
- Repair serialized length prefixes instead of skipping the body
  
  generoi-deploy
  and
  claude
  committed
  d171bdb
- Recurse on the input, scan both spellings in one pass, and repair every arm
  
  generoi-deploy
  and
  claude
  committed
  659ae87
- Decline a stale length rather than believe a false boundary
  
  generoi-deploy
  and
  claude
  committed
  691d9d4
- Walk the grammar, and refuse a parse that leaves a string's tail behind
  
  generoi-deploy
  and
  claude
  committed
  afc712e
- Replace a test that could not fail, and pin the depth-limit decline
  
  generoi-deploy
  and
  claude
  committed
  5b39788
- Repair only a value that occupies its whole field
  
  generoi-deploy
  and
  claude
  committed
  9c4808c
- Scope a decline to one field, and commit before declining on shape
  
  generoi-deploy
  and
  claude
  committed
  3aeec6d
- Assert served serialized payloads parse, and handle the rest of the grammar
  
  generoi-deploy
  and
  claude
  committed
  fca97c3
- Rewrite custom payloads, and take field boundaries from the content type
  
  generoi-deploy
  and
  claude
  committed
  f4e02dc
- Repair in the HTML arm too, and stop blaming the proxy for the database
  
  generoi-deploy
  and
  claude
  committed
  6d0db63
- Pair the delimiters, and refuse to measure what cannot be measured
  
  generoi-deploy
  and
  claude
  committed
  ee65a8a
- Repair the serialized spelling Elementor actually ships
  
  generoi-deploy
  and
  claude
  committed
  50d56b9
- Look for a nested payload wherever it starts, not only at offset zero
  
  generoi-deploy
  and
  claude
  committed
  a1a7bf0
- Measure what a decline was quietly getting wrong
  
  generoi-deploy
  and
  claude
  committed
  cdf74a1
- Report every note a page earned, and say what went wrong in the summary
  
  generoi-deploy
  and
  claude
  committed
  214784e
- Branch only where the readings actually diverge, and measure where the
  
  generoi-deploy
  and
  claude
  committed
  b0b2be3
- Look inside a string the way the string is actually written
  
  generoi-deploy
  and
  claude
  committed
  a7b47bb
- Fix the percent openers, which had never fired
  
  generoi-deploy
  and
  claude
  committed
  d383140
- Stop treating `"` as ambiguous under esc_attr
  
  generoi-deploy
  and
  claude
  committed
  0dd9d34
- Match PHP inside a string, and repair the request line and headers
  
  generoi-deploy
  and
  claude
  committed
  7b8e25d
- See a payload glued to the label in front of it
  
  generoi-deploy
  and
  claude
  committed
  e5a9f25
- Let the enclosing parse choose between readings
  
  generoi-deploy
  and
  claude
  committed
  e430b7b
- Settle what a Set-Cookie carries, since PLAN said both things
  
  generoi-deploy
  and
  claude
  committed
  43a4f0e
- Run the decoder views from inside the serialized walk, on every path
  
  generoi-deploy
  and
  claude
  committed
  677673b
- Re-emit a delimiter exactly as it arrived
  
  generoi-deploy
  and
  claude
  committed
  3b9913f
- Ask the decoder that finds hosts where a field ends
  
  generoi-deploy
  and
  claude
  committed
  dbdfc2c
- Read a value that was HTML-escaped and then percent-encoded
  
  generoi-deploy
  and
  claude
  committed
  c8fa558
- Close the rest of the transport-by-escaping product
  
  generoi-deploy
  and
  claude
  committed
  c6052d0
- Read the hex spelling of a JSON quote, and stop enumerating
  
  generoi-deploy
  and
  claude
  committed
  f7ed4c5
- Keep a proxy flag the developer set by hand
  
  generoi-deploy
  and
  claude
  committed
  8584711
- Say when a value was rewritten in a spelling nothing could read
  
  generoi-deploy
  and
  claude
  committed
  fec762b
Commits on Sep 1, 2026
- Rebuild the unread-value check, which was wrong in both directions
  
  generoi-deploy
  and
  claude
  committed
  83f0a8a
- Make check look at the page it already fetched
  
  generoi-deploy
  and
  claude
  committed
  7762bf9
- Give check a verdict, and ask the engine what an origin looks like
  
  generoi-deploy
  and
  claude
  committed
  849f0a8
- State what a decline actually promises
  
  generoi-deploy
  and
  claude
  committed
  bee6822
- Say so before crawling the client's live site
  
  generoi-deploy
  and
  claude
  committed
  a400b53
- Narrow the scorer's self-redirect carve-out to the proxy's
  
  generoi-deploy
  and
  claude
  committed
  8346569
- Dial this project's web container, not whichever one answers
  
  generoi-deploy
  and
  claude
  committed
  c97ff7d
- Make the guardrail and the dialer ask one function
  
  generoi-deploy
  and
  claude
  committed
  3f29c9d
- Name the hostname DDEV advertises; stop failing on one dns-prefetch
  
  generoi-deploy
  and
  claude
  committed
  fd90503
- Bound the line-count check instead of deleting it; fix the note's condition
  
  generoi-deploy
  and
  claude
  committed
  b2f4044
- Check that loopback containment exists; pair diff's bases by site
  
  generoi-deploy
  and
  claude
  committed
  0db7ec6
- Ask the size question in bytes; stop reports asserting what they skipped
  
  generoi-deploy
  and
  claude
  committed
  49ea066
- Fit each condition to its defect; warn when the image predates the engine
  
  generoi-deploy
  and
  claude
  committed
  4d464de
- Read the escape WordPress writes into every block delimiter
  
  generoi-deploy
  and
  claude
  committed
  b58848a
- Give each budget its own bound, and stop the suite failing on a slow machine
  
  generoi-deploy
  and
  claude
  committed
  3e052b8
- Read the escape an IDN needs, and stop the safety notice arming the trap
  
  generoi-deploy
  and
  claude
  committed
  cebe774
- Preserve the spelling an IDN was declared with, on the way back
  
  generoi-deploy
  and
  claude
  committed
  835234f
- Change all three arms, not two, and preserve the spelling actually written
  
  generoi-deploy
  and
  claude
  committed
  8de582d
- Make the bases the map, and write the separator back as it was found
  
  generoi-deploy
  and
  claude
  committed
  90432b3
- Refuse on measured production links, and read the separator's bytes
  
  generoi-deploy
  and
  claude
  committed
  0a5cc36
- Stop enumerating separator encodings; copy the span verbatim
  
  generoi-deploy
  and
  claude
  committed
  7518510
- Ask the page, not the map; and a JSON escape is not a host boundary
  
  generoi-deploy
  and
  claude
  committed
  ccca0c4
- A backslash is not one thing: give the escape alphabet its surface
  
  generoi-deploy
  and
  claude
  committed
  c146fba
Commits on Sep 2, 2026
Commits on Sep 3, 2026

Commits

Commits on Aug 30, 2026

Commits on Aug 31, 2026

Commits on Sep 1, 2026

Commits on Sep 2, 2026

Commits on Sep 3, 2026