sales-trainer/docs/engineering-log/2026-08-15-legacy-security-review-retries.md

Legacy security review — repeated bounded retries

Date: 2026-08-15 Status: blocked; no independent approval yet

What changed

The legacy-security review gate remains fail-closed after three independent reviewer attempts timed out without a complete verdict:

• deleg_ffba9adf — timeout after 600.11 seconds; no JSON
• deleg_03d06f1f — timeout after 600.10 seconds; no JSON
• deleg_0cc095f8 — timeout after 600.09 seconds; no JSON

All three are no verdict, not approval. No reviewer was allowed to edit files, run production operations, use network access, or rotate credentials.

A final one-call bounded reviewer, deleg_e61f99ff, completed the extraction but returned passed=false because 93,176 characters of requested function bodies were omitted by the tool capture window. This is a complete five-key payload, but it is explicitly a limitation/no-approval verdict.

Three fresh scoped exact-current reviewers are now running in parallel under deleg_a274603c:

• tenant/group/persona redaction and trainee analytics
• auth fields/tokens, JsonStore locking/corruption, and fail-closed rate limits
• analytics/export tokens, CSV formula injection, upload preflight, and API/IDOR boundaries

Each must return exactly the five required keys. A scoped review counts only for its own area; the overall gate remains blocked until every area has a valid passed=true verdict with empty blocking arrays.

Local evidence

• Backend regression evidence remains 209 passed from the current working tree.
• Documentation diff checks were rerun after recording the retry state.
• Local tests are not a substitute for the required independent verdict.

Operational boundary

No commit, push, deploy, public access restoration, production migration, credential rotation, or live authenticated smoke occurred. JSON stores remain runtime-authoritative.

Next action

Validate deleg_e61f99ff when it returns. If it times out or returns incomplete/unparseable JSON, keep the legacy-security gate blocked and do not infer findings or approval.