[kixelated]

Problem

The 2026-10-27 pre-cut security audit epic has no Required children left. Verify completion against current source and recorded decisions before removing it.

Approach

Remove the completed epic and its milestone link. Replace the m0 epic's live link with a pinned historical triage record, preserving the maintainer's dropped findings and external ownership. This closes the recorded audit only; it makes no new broad audit claim.

Verified on the current branch:

Recorded scope	Landed work and current evidence
RELAY-1, SETUP Path	moq-dev/moq#7206: URI bindings refuse SETUP Path in rs/moq-net/src/lite/setup.rs:409 and ietf/session.rs:546; runtimes use the shared handshake.
MUX-2, fMP4	moq-dev/moq#7232: import.rs:356 streams media and skips discarded boxes; begin_metadata at line 485 bounds held metadata, and mod.rs:41 bounds fragment planning. Preserve the 2026-10-31 maintainer decision accepting metadata bounds, which supersedes the earlier incremental-only plan.
MUX-3, MKV	moq-dev/moq#7234: mkv/import.rs:360 descends metadata masters, streams blocks, skips unused fields, and replaces repeated consumed fields (set, line 923). Consumed variable-size leaves remain separately owned below.
FFI-1/2	moq-dev/moq#7209: rs/moq-c/src/id.rs:40 wraps and skips occupied entries; bandwidth.rs, ffi.rs, and the C guide document terminal callbacks and thread safety.
RELAY-6/7, HTTP	moq-dev/moq#7210: web.rs:419 adds private/no-store and nosniff, line 1227 sets octet-stream; internal.rs:382 validates Origin and socket authority.
RELAY-3, iroh key	moq-dev/moq#7213: iroh.rs uses secret::load_or_create, which exclusively creates private files and validates existing opened files without following symlinks.
NET-2, legacy fill backstop	moq-dev/moq#7215: lite/subscriber.rs:8710 ties held fills to shared reader demand; the unrelated default refusal allowance is gone.
JS-2/4, browser inputs	moq-dev/moq#7216: metadata.ts:60 schemas are passed to JSON consumers; connect.ts:740 aborts fingerprint fetches and accepts exactly 64 hex characters. The any-host development path stays as decided.
SUP-1/2/4/6/7, CI pins	moq-dev/moq#7217: shared full-commit generator pins and NASM pin actions, versioned scanner nextest, same-repo/push winget trigger, and OIDC only on consuming jobs.

Also verified the separately landed provenance work moq-dev/moq#7224 and E2EE documentation moq-dev/moq#7341. Neither requires residual epic work.

Impact

• Public API: none.
• Wire: none.

Alternatives

Keep an empty epic or reopen dropped audit findings. Neither is needed: the recorded children landed, and the maintainer's keep/drop decisions still apply. No runtime changes, version bumps, or unrelated cleanup.

Follow-ups

No new follow-ups planned. Existing owners retain their scope:

• NET-1: quest/m1/subscribe-ranges/fill-linear.md, claimed by moq-dev/moq#7542.
• NET-3: quest/m2/qmux-receive-lease.md; parser fuzzing: quest/m2/media-fuzz.md.
• Credential redaction on release: m0 log-secrets, moq-dev/moq#7477 and moq-dev/moq#7482. Main redaction landed in moq-dev/moq#7200; outbound trust in moq-dev/moq#7199, with release backport moq-dev/moq#7298, completed by moq-dev/moq#7278.
• Known importer residuals remain real: MKV CodecID, DocType, and CodecPrivate still use Action::Read (mkv/import.rs:365-373) and grow Body::Read.data (mkv/ebml.rs:274-276). The approved leaf-limits plan remains in open moq-dev/moq#7468, alongside fMP4 refusal framing (fmp4/import.rs:407-419 drops the rest of the refused call). The existing quest/m2/import-metadata-policy.md also records that owner and policy reconciliation. These are not reported as fixed by deleting this epic. quest: plan follow-ups from the 2026-10-31 /quest-complete requeue session #7468 currently adds them under this epic's Required list, so its eventual conflict resolution must retain both quests and link them directly from m1 rather than resurrect the completed audit. That planning PR retains ownership; this PR does not edit it.
• The separate SETUP-path/iroh-key release backport remains in quest/m0/backport-security-fixes.md.

Validation

• quest check --base origin/main --branch quest/m1/security-audit/README: pass, 622 documents.
• git diff --check: pass.
• quest gate just ci origin/main: fails, exit 1. Markdown, quest, shell, large-file, TOML, Nix, justfile, and GitHub workflow lints pass. The GitHub tooling test phase reaches sh/rs/test-lints.test.py and fails before its expected Clippy diagnostic because mbx cannot spawn Cargo: Argument list too long (os error 7). Existing owner: moq-dev/moq#7594. No assertion, environment, or production path was changed to hide it.
• The gate stops there, before runner namespace validation; namespace denial is a known host limit, not a failure newly reproduced in this attempt. Full just gate and runtime/interop suites were not run for this quest-only diff.
• No fresh broad security or performance suite is claimed.

Review

quest review --base origin/main --deep: Claude Code, claude-fable-5-1, medium effort, two rounds on 5ed7461118a71176a0757fadbf2fd9a4c2b76129. Round 2 reports 0 findings.

Round 1 dispositions:

• Refuted, accepted in round 2: pending importer children prevent closure. The task explicitly permits recorded external owners; quest: plan follow-ups from the 2026-10-31 /quest-complete requeue session #7468 owns the later follow-ups, as quest/m2/import-metadata-policy.md:26 records. All original Required children landed. Its pending parent conflict and required direct m1 links are documented above; no residual is claimed fixed.
• Refuted, accepted in round 2: m0's dated two-child decision and aggregate goal are stale. They preserve the original scope; quest: finish outbound HTTP trust (release backport #7298) #7278 removed the completed outbound-trust child after fix(relay): isolate outbound HTTP trust on release (backport #7199) #7298 landed. Required accurately retains the redaction child. Historical decisions do not count remaining work.

Recommendation: review this completion independently of the pending importer plan and existing gate-environment owner. No maintainer API, wire, or triage decision is open here. No merge, monitoring, or follow-up planning performed.

(Written by GPT-6.1 Sol)

[pullfrog]

The model never responded, so Pullfrog stopped this run after 2 minutes. The request went out but nothing came back. This is usually temporary, so re-trigger to try again.

  ^{｜ Rerun failed job ➔ ｜ View workflow run ｜ via Pullfrog ｜ Using deepseek-v4.1-flash (free via Pullfrog for OSS)}

[kixelated]

Automated review by review (OpenAI)

Reviewed commit: 5ed7461.

No actionable bugs found in this quest-only change. Removing the empty epic and its milestone entry is simpler than retaining a completed work owner; the pinned triage document preserves the dropped findings and external ownership. I verified the cited implementation PRs are merged and the importer-policy quest still points to open #7468, so this cleanup does not imply those residual importer issues are fixed.

Verification: static review of the changed documents, historical triage target, related ownership record, and GitHub merge history. No tests or gates run, and no fresh security audit of the underlying implementations; the reported local gate failure is not treated as a pass.

(Written by OpenAI)

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 8f67399d-c349-46e1-b154-1de00ec3e19b

Commits

Reviewing files that changed from the base of the PR and between f45f5cd and 5ed7461.

Files selected for processing: 3

• quest/m0/security-audit/README.md
• quest/m1/README.md
• quest/m1/security-audit/README.md

Files with no reviewable changes: 2

• quest/m1/README.md
• quest/m1/security-audit/README.md

Included review availability: This review used your included allowance. Your plan provides up to 4 included reviews per hour; 1 remain after this review.

Walkthrough

The M1 Required list no longer includes the security-audit quest, and the M1 security-audit plan was deleted. The M0 security-audit plan now links to the completed pre-cut epic’s triage record.

Merge Risk: Minimal · up to 5ed74

The audit documentation is updated without runtime or public API changes, so it is mergeable after normal checks.

Pre-merge checks: 5

Check name	Status	Explanation
Title check		The title "chore(quest): complete the recorded pre-cut security audit" matches the main change: the PR removes the completed 2026-10-27 security audit epic and its milestone link, and replaces the m0 …
Description check		The description states the problem, approach, verification table, impact, alternatives, follow-ups, and validation. It directly describes the removal of the completed epic, the replacement of the m0 l…
Docstring Coverage		No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Title check

Explanation

The title "chore(quest): complete the recorded pre-cut security audit" matches the main change: the PR removes the completed 2026-10-27 security audit epic and its milestone link, and replaces the m0 live link with a historical triage record. It is specific and concise, and a teammate scanning history would understand the primary change.

Full details: Description check

Explanation

The description states the problem, approach, verification table, impact, alternatives, follow-ups, and validation. It directly describes the removal of the completed epic, the replacement of the m0 link with a pinned triage record, and the related verification and follow-up ownership, so it is clearly related to the changeset.

Full details: Docstring Coverage

Explanation

No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

Finishing Touches

Simplify code

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn