Aaron Bockelie 73b3276453 harden(bases): runtime-computed-member escape test + scope scanner claim ... Advisor review follow-up on #186: - Add SECURITY cases note[("cons"+"tructor")] / file[("__pro"+"to__")]: runtime-computed member names our static pre-walk intentionally does NOT catch (property is BinaryExpression, not Identifier/Literal) — they must fail closed via expression-eval's own access guard. Test-grounds the defense-in-depth claim instead of asserting it. 60/60 green. - CLAUDE.md 'Known accepted review findings': the Bases new Function is REMOVED (ADR-201, #180/#185/#186), not pending #175. Documents the honest caveat — grep 'new Function' main.js != 0 by design: residual is transitive ajv@6.14.0 validator codegen + a deprecation shim, a pre-existing library-internal class not reachable from vault content, present on the reviewed 0.11.25, non-gating. Scanner finding was attributed to the Bases path; this closes that path. Refs #180, ADR-201		2026-05-16 23:03:43 -05:00
..
base-corpus.ts	harden(bases): runtime-computed-member escape test + scope scanner claim	2026-05-16 23:03:43 -05:00