yak(sobelow-in-the-lens-pass-vr40): sobelow in the Lens pass

doc/improve-verification.md

@@ -129,14 +129,24 @@ Expected gaps in firehose, by module type:
 
 ### Phase 6 — Sobelow
 
-- [ ] Add to the Lens pass for `app` (Phoenix surface). blogex is a library
+- [x] Add to the Lens pass for `app` (Phoenix surface). blogex is a library
       without endpoints; decide whether to run it there anyway — in ex_crap's
       own history sobelow caught a `String.to_atom` in a library, so it's not
-      strictly web-only value.
-- [ ] **Fail when sobelow is not installed** (stickies: user explicitly
+      strictly web-only value. Decided 2026-10-28: **app only**; blogex's
+      sobelow scope is a separate yak.
+- [x] **Fail when sobelow is not installed** (stickies: user explicitly
       removed the skip — a silently-skipped check is a lying sensor).
-- [ ] Fix findings or add per-check skips *with rationale comments*
+      `make -C app sobelow` has no fallback: a missing task is a hard Mix
+      error, and `verify`'s `|| exit 1` loop fails the pass.
+- [x] Fix findings or add per-check skips *with rationale comments*
       (stickies: `Config.CSP` skipped because the plug is invisible to sobelow).
+      Baseline 2026-10-28 (sobelow 0.17.0), 3 findings: `Config.HTTPS` (High),
+      `Config.CSP` (High), `Traversal.FileModule` (Low). All three are skipped
+      in `app/.sobelow-skips`, each with a written rationale: HTTPS and CSP are
+      deployment/design decisions with follow-up yaks, and the Traversal flag
+      is a false positive (the path is matched against the server-scanned list
+      before `File.read`). Unlike stickies, the CSP skip is *not* "the plug is
+      invisible" — this app genuinely has no CSP yet.
 
 ### Phase 7 — Boundary