ilpanich / axiam / 36122929889

92%

push

github

docs(website): announce 1.0.0-beta16 and beta17, and extend phase 20 (wave 3)

Wave 3 of website-security-beta17-update-plan.md. One Release post dated
2026-09-25 covers both releases, because beta16 was tagged without one and
beta17 is tagged after this pass:

- 1.0.0-beta16 — the MCP authorization surfaces (RFC 8414 discovery, public
  clients and the loopback port rule, resource indicators, dynamic client
  registration, client ID metadata documents, per-tenant issuers, contract
  1.48's §28 helpers), the T21.8 review with MCP-02 fixed in the task and
  its four filed findings closed the same day (T-272, T-275, T-276, T-280),
  and the 2026-09-18 sweep with its hedge.
- 1.0.0-beta17 — the dogfooding remediation told from the operator's side:
  T-281 … T-288 each linked to its diagram, the three corrections stated as
  corrections (the four legacy secret names that were ignored are named
  here, deliberately), the upgrade notes, and what the 1.52 review found in
  every SDK.

The model: 288 threats, 275 mitigated / 13 open. Every #/security anchor on
the site was checked against the regenerated model (none mismatched).

Phase 20 stays ongoing; its focus gains the MCP surfaces and the
remediation. No phase is closed or added.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LBUGLzX7VKzcZGCTmfu2P6

3912 of 4321 branches covered (90.53%)

Branch coverage included in aggregate %.

92202 of 100255 relevant lines covered (91.97%)

760.17 hits per line