chore(audit): execute 2026-06-04 audit — VPS lifecycle guard, single-source guardrails, client timeouts, self-verifying rename#119

Merged

agjs merged 11 commits into

mainfrom

chore/audit-fixes-20260604-0044

Jun 3, 2026

Commits on Jun 3, 2026

docs(contracts): plugin tables match package.json — parity enforced by lint-meta
agjs
committed
docs: stop teaching retired default credentials; document new security behaviors
agjs
committed
fix(ui): purge 16 dead locale keys; new i18n-locale-keys-used guardrail
agjs
committed
fix(ci): shellcheck the root gate scripts; trigger validate-compose on scripts/** pushes
agjs
committed
fix(infra): bootstrap inputs fail closed — explicit SSH CIDRs, validated repo URL
agjs
committed
fix(infra): lifecycle-guard the VPS — user_data drift must never replace the server
agjs
committed
fix(infra): install Docker from the GPG-verified apt repo, not curl|sh
agjs
committed
perf(ci): cache bun installs in every workflow that runs them
agjs
committed
fix(scripts): rename-project.sh is now inventory-driven and self-verifying
agjs
committed
fix(api): explicit time budgets on every external client
agjs
committed
fix(infra): single-source the compose guardrails — CI and local gate run the same script
agjs
committed