[chaffed]

What and why

plans/HOUSEKEEPING_PLAN.md: small things left after every plan's buildable work shipped, with the product owner's decisions HK-D1 to HK-D4.

• HK1, CodeQL alert #176 (medium, py/stack-trace-exposure). Reviewing an outside service under Settings caught a ValueError and showed its text to the person. Today that text is only OpenClear's own sentence, but anything deeper raising ValueError later would have shown its own message. The module now raises OutsideServiceError, and the router shows a fixed sentence. The alert should close when CodeQL scans main.
• HK2, ASVS 2.3.4 (business-logic locking for limited resources) moves from Partly to Met, making 215 of 242 met. The locks were built in 1.27.0 (FR1–FR3). The three Postgres tests that prove them now carry asvs("2.3.4"): two decisions at once, a check presented twice, two outbox runs at once. The crosswalk no longer says the remaining gaps are "planned for 1.24 and 1.25".
• HK3: TEST_SPEED_PLAN.md TS4 is closed with today's times. CI takes about 5 minutes, which meets its target. The local Postgres suite takes 7 minutes; the suite has grown 13% since its 4-minute target was set.
• HK5, the image is 1.39 GB, down from 2.41 GB. The Dockerfile's last step ran chown -R openclear:openclear /data /app /venv, which copied every file under /venv and /app into a layer of its own, so the 738 MB venv was stored twice.
  • The final stage now sets ownership with COPY --chown. The last step changes only /data and /app themselves.
  • Built and checked locally: every file has the same owner as before, the app imports, and /app and /data are writable.
  • A test keeps recursive chown out of the final stage.
  • The measurements are in the plan. The fraud-scoring stack (scipy, pandas, numpy, scikit-learn: 348 MB) is the bulk of what remains; the recommendation is to keep one image.
• A flaky-test fix. Every page's <head> carries Unix timestamps (the session-expiry meta tags). Two tests asserted a short number ("4001", the test bank's house account "0001") appeared nowhere on the page, so they failed whenever the clock's digits contained it. tests/items.py gains shows_number, which matches a number only where it stands alone. No other test makes that assertion.

HK4 (branches) changed nothing in the repository; what was done locally, and what waits, is in the plan's log.

Checks

• Tests added or updated, and the suites pass:
  • SQLite 2259 passed.
  • Postgres: 2308 passed in the full run. The one failure there was the timestamp flake fixed in this PR, and the affected and ASVS-marked tests now pass on Postgres.
  • Bandit is clean.
• CHANGELOG.md has entries under "Unreleased": the image size and the ASVS count.
• ASVS status updated; docs/compliance/asvs.md regenerated.
• No schema change; no new dependencies.

Security (OWASP WSTG)

• HK1 removes an exception's text from a response (WSTG-ERRH).
• The image runs as the same openclear user, with the same ownership on every file.

🤖 Generated with Claude Code