[Epic] Phase 16 · Trust surface hardening: remaining steps S4–S16 #903

Epic · Roadmap · 15 issue(s)

Scope

The remaining steps of Phase 16 — Trust Surface Hardening, the execution plan approved on 2026-07-30 for the 83 remediation units of the 2026-07-29/30 full-project review. Pre-work and steps S1-S3 are delivered (13 of the 83 units closed); the 70 units in S4-S16 and the two standards those steps depend on are open.

Order. Behaviour → the contracts that describe behaviour → the documents that describe the contracts; work the steps in S4 → S16 order — no step reopens a file an earlier step settled for the same reason. S12 needs the SBOM / supply-chain standard and S13 the Docker standard first.

Each step is one root-cause family committed on its own, followed by an Opus review round and then a Sonnet review round, each with verified findings fixed before the next step begins. Every step issue lists the October 2026 review issues that track its units; close those from the step's PR where it fixes them.

How to work on it

Work the steps in S4 → S16 order (S12 and S13 also wait for their standard); claim a whole step, not a fragment of one, because each step lands as one root-cause family with its own review rounds. The two standards can be written at any time. See CONTRIBUTING.md, Finding Work: Issues and the Project Board; progress shows in the sub-issue list and in the project's Sub-issues progress field.

Done when

• Every sub-issue is closed (done, or closed with a reason).

_{Planned in docs/roadmap/phase-16-trust-surface-hardening.md (read at f94595f). Unit IDs (F-W20260729-…) come from the 2026-07-29/30 full-project review; the issue numbers next to them are the October 2026 review's records of the same defects.}