From ab75fc5e1f4aa846649755f4c9b56cab45b41025 Mon Sep 17 00:00:00 2001 From: Bastien Chanot Date: Wed, 26 Aug 2026 20:35:35 +0200 Subject: [PATCH] fix(harden): severity rule defers to the calibrated guide; SSL Labs late-finalize gets an assigned actor (main loop edits HARDEN.md row) --- skills/harden/SKILL.md | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/skills/harden/SKILL.md b/skills/harden/SKILL.md index 674e64e..e867928 100644 --- a/skills/harden/SKILL.md +++ b/skills/harden/SKILL.md @@ -493,10 +493,10 @@ else fi ``` -Update `.harden-cache/external-scores.md` with the final SSL Labs verdict -so the HARDEN.md "External validators" table reflects it. If the user -already read HARDEN.md, they can re-run `/harden ` to pick up the -cached (now-READY) SSL Labs result. +Update `.harden-cache/external-scores.md` with the final SSL Labs verdict, +then edit the SSL Labs row of HARDEN.md's "External validators" table in +place — YOU do this in the main loop (the agent that wrote HARDEN.md in +STEP 1 has already exited; without this edit the late grade never lands). --- @@ -621,8 +621,10 @@ NEXT STEPS : Astro / Cloudflare Pages project. Use the framework-native mechanism (next.config.js headers(), astro middleware, _headers). - **Security headers and redirects are non-negotiable defaults of this - skill** — every public site must ship them. Flag absence as Critique, - not Moyenne. + skill** — every public site must ship them. Grade each absence at the + severity guide's level (CSP absent = Critique, HSTS/X-Frame-Options = + Haute, Referrer-Policy = Moyenne); the guide's table is authoritative — + never demote a missing default below it. - **External validators are authoritative on live headers, not the code.** If Observatory/SecurityHeaders/SSL Labs and the code audit disagree, the external grade reflects the deployed production config — the code