John Smith 5321a4cea2 fix: fleet audit remediation — RCE/SSRF/traversal fail-closed, catalog re-grounding, CI hardening ...

- Stage1 P0 security: allowlist introspect (npx,node,python3), argv-only, drop CORS *, per-boot token, SSRF private-range+userinfo block, targetDir absolute/.. block, content_file pattern+containment, test/local-server.test.js 29 tests
- Stage2 P0 catalog: synthetic:true for 14 placeholder entries, real repos/tools for k8s/notion/filesystem/figma/postgres, Codex command/args/env, hyphen-preserving normalize, README npx fix, sst->anomalyco
- Stage3 P1 hardening: dup-id negative tests, check-pr scripts/** fail-closed+wired, ai-review invented-tool/harness/kind/deny-first enforcement, reviewer bare allows, _site clean, engines >=22.12.0, workflows SHA-pinned fetch-depth:1 minimal scopes, CODEOWNERS, ajv->devDeps
- Stage4 P2/P3 polish: install --recipe base64url, SOURCE_DATE_EPOCH idempotency, ? single-char, favicon data-URI, empty warn deny-only, prose fixes, stage4 12 tests

Gates: VALIDATED 63 OK, SITE_BUILT 63, tests 102/102, ai-review REVIEW_OK/SELFTEST_OK
Note: scripts/generate-rigs.py + verify-rigs.sh do not exist; real equivalents used (documented in REMEDIATION_LOG.md)

2026-10-19 11:53:15 -04:00

..

agents

fix: fleet audit remediation — RCE/SSRF/traversal fail-closed, catalog re-grounding, CI hardening

2026-10-19 11:53:15 -04:00

commands

feat(m10): issue forms and maintainer automation scripts

2026-10-19 02:05:46 -04:00