11 commits

Author	SHA1	Message	Date
Brad Groux	1c96a326aa	Enforce v5 password-session boundary ... Limit password-session cookies to local-owner loopback clients and document device/session-token requirements for remote and multi-user v5 GA access.	2026-06-05 14:53:17 -05:00
Brad Groux	0b33699684	Add editable time breakdown exports (#635)	2026-06-05 09:43:04 -05:00
Brad Groux	f6f0bd31ca	Add source-backed evidence timeline (#634)	2026-06-05 09:24:54 -05:00
Brad Groux	f7d442595b	Add operations digest UI and filters (#632)	2026-06-05 08:45:15 -05:00
Brad Groux	bd60860681	Narrow production CSP style policy ... Closes #396	2026-06-03 17:11:11 -07:00
Brad Groux	7fac1b8977	Add skill risk gates	2026-06-03 07:02:44 -07:00
Brad Groux	a9217784b3	Add skill security scanner (#538)	2026-06-03 06:33:05 -07:00
Brad Groux	fd96f73408	Harden v5 security review surfaces (#531)	2026-06-03 03:55:22 -07:00
Brad Groux	0676970825	Harden realtime sync delivery ... Harden realtime sync delivery for v5 remote multi-client use.	2026-06-03 03:31:29 -07:00
Brad Groux	522162ae89	test: add v5 permission coverage manifest gate ... ## Summary - adds a v5 permission coverage manifest with classifications, required permissions, denial reasons, and review justifications across REST, WebSocket, CLI, MCP, workflow, transition hook, command palette, and background job surfaces - adds a Node-based coverage checker that fails when tracked surfaces are missing from the manifest or when REST route prefixes drift from the shared permission map - wires the checker into CI and documents the manifest gate in the security guide Closes #420. ## Verification - `node scripts/check-permission-coverage.mjs` - `./node_modules/.bin/prettier --check package.json .github/workflows/ci.yml scripts/check-permission-coverage.mjs docs/security/permission-coverage.json docs/security.md` - `git diff --check` - `pnpm lint:budget` - `pnpm build` - `pnpm audit --prod --audit-level=high` (passes high gate; 3 existing moderate findings) - GitHub Actions: Build, Lint & Type Check, Security Audit, Workspace Unit Tests	2026-05-31 05:02:26 -05:00
Brad Groux	c89c5e5d7e	docs: add v4 governance security audit (#265) ... Co-authored-by: bradgroux <brad@digitalmeld.io>	2026-03-23 20:16:41 -05:00