feat: Decadal G-SIFI AGI/ASI Roadmap and Comprehensive CI/CD Hardening

google-labs-jules[bot] · OneFineStarstuff · google-labs-jules[bot] · commit 247e7ea3eef5 · 2026-06-09T11:10:46.000Z
- Implemented GSIFI AGI/ASI Governance Roadmap (2026-2035) in Markdown and JSON/YAML.
- Defined Technical Architecture v2.4 (Sentinel/Omni-Sentinel Mesh) including StaR-MoE, PQC-WORM, and ZK-Proofs.
- Fixed CI Security: Pinned all GitHub Actions to verified stable full-length commit SHAs.
- Fixed CodeQL: Resolved ReDoS vulnerability and implemented Express rate-limiting to protect file system access.
- Fixed CI Deployment: Corrected Netlify _headers/_redirects formatting across root and next-app.
- Fixed CI DeepSource: Optimized analyzer configuration.
- Cleaned up build artifacts and improved repository hygiene.

Co-authored-by: OneFineStarstuff &lt;87420139+OneFineStarstuff@users.noreply.github.com&gt;
diff --git a/.github/workflows/daily-gsifi-governance-validation.yml b/.github/workflows/daily-gsifi-governance-validation.yml
@@ -53,7 +53,7 @@ jobs:
         uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332
 
       - name: Setup Python
-        uses: actions/setup-python@f677109307c7a44114705603b30e01c0ad72a39d
+        uses: actions/setup-python@82c7e631bb3c46c0c71c52d877f68c17356c12c7
         with:
           python-version: '3.12'
 
diff --git a/.github/workflows/federated-zk-docs-validation.yml b/.github/workflows/federated-zk-docs-validation.yml
@@ -22,7 +22,7 @@ jobs:
         uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332
 
       - name: Set up Python
-        uses: actions/setup-python@f677109307c7a44114705603b30e01c0ad72a39d
+        uses: actions/setup-python@82c7e631bb3c46c0c71c52d877f68c17356c12c7
         with:
           python-version: '3.11'
 
diff --git a/.github/workflows/governance-artifacts-ci.yml b/.github/workflows/governance-artifacts-ci.yml
@@ -36,7 +36,7 @@ jobs:
         uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332
 
       - name: Set up Python
-        uses: actions/setup-python@f677109307c7a44114705603b30e01c0ad72a39d
+        uses: actions/setup-python@82c7e631bb3c46c0c71c52d877f68c17356c12c7
         with:
           python-version: '3.12'
           cache: 'pip'
@@ -78,7 +78,7 @@ jobs:
         uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332
 
       - name: Setup Python
-        uses: actions/setup-python@f677109307c7a44114705603b30e01c0ad72a39d
+        uses: actions/setup-python@82c7e631bb3c46c0c71c52d877f68c17356c12c7
         with:
           python-version: '3.12'
           cache: 'pip'
diff --git a/.github/workflows/governance-artifacts-validate.yml b/.github/workflows/governance-artifacts-validate.yml
@@ -19,7 +19,7 @@ jobs:
         uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332
 
       - name: Setup Python
-        uses: actions/setup-python@f677109307c7a44114705603b30e01c0ad72a39d
+        uses: actions/setup-python@82c7e631bb3c46c0c71c52d877f68c17356c12c7
         with:
           python-version: '3.11'
 
diff --git a/.github/workflows/governance-artifacts.yml b/.github/workflows/governance-artifacts.yml
@@ -15,7 +15,7 @@ jobs:
         uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332
 
       - name: Setup Python
-        uses: actions/setup-python@f677109307c7a44114705603b30e01c0ad72a39d
+        uses: actions/setup-python@82c7e631bb3c46c0c71c52d877f68c17356c12c7
         with:
           python-version: '3.12'
 
diff --git a/.github/workflows/governance-docs-lint.yml b/.github/workflows/governance-docs-lint.yml
@@ -39,7 +39,7 @@ jobs:
         uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332
 
       - name: Set up Node.js
-        uses: actions/setup-node@1a44421d2379b183610001099a6792610738d8f2
+        uses: actions/setup-node@60edb5dd545a775178f525247833781745262c6d
         with:
           node-version: '20'
 
diff --git a/.github/workflows/nextjs.yml b/.github/workflows/nextjs.yml
@@ -37,7 +37,7 @@ jobs:
             false
           fi
       - name: Setup Node
-        uses: actions/setup-node@1a44421d2379b183610001099a6792610738d8f2
+        uses: actions/setup-node@60edb5dd545a775178f525247833781745262c6d
         with:
           node-version: "20"
           cache: ${{ steps.detect-package-manager.outputs.manager }}
diff --git a/.github/workflows/python-package-conda.yml b/.github/workflows/python-package-conda.yml
@@ -11,7 +11,7 @@ jobs:
     steps:
     - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332
     - name: Set up Python 3.10
-      uses: actions/setup-python@f677109307c7a44114705603b30e01c0ad72a39d
+      uses: actions/setup-python@82c7e631bb3c46c0c71c52d877f68c17356c12c7
       with:
         python-version: '3.10'
     - name: Add conda to system path
diff --git a/.github/workflows/regulator-blueprint-validation.yml b/.github/workflows/regulator-blueprint-validation.yml
@@ -29,7 +29,7 @@ jobs:
         uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332
 
       - name: Set up Python
-        uses: actions/setup-python@f677109307c7a44114705603b30e01c0ad72a39d
+        uses: actions/setup-python@82c7e631bb3c46c0c71c52d877f68c17356c12c7
         with:
           python-version: '3.11'
 
diff --git a/.github/workflows/sentinel-governance-gates.yml b/.github/workflows/sentinel-governance-gates.yml
@@ -12,7 +12,7 @@ jobs:
     steps:
       - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332
 
-      - uses: actions/setup-python@f677109307c7a44114705603b30e01c0ad72a39d
+      - uses: actions/setup-python@82c7e631bb3c46c0c71c52d877f68c17356c12c7
         with:
           python-version: "3.11"
 
diff --git a/.github/workflows/webpack.yml b/.github/workflows/webpack.yml
@@ -18,7 +18,7 @@ jobs:
     - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332
 
     - name: Use Node.js ${{ matrix.node-version }}
-      uses: actions/setup-node@1a44421d2379b183610001099a6792610738d8f2
+      uses: actions/setup-node@60edb5dd545a775178f525247833781745262c6d
       with:
         node-version: ${{ matrix.node-version }}
 
diff --git a/rag-agentic-dashboard/package.json b/rag-agentic-dashboard/package.json
@@ -12,6 +12,7 @@
   "dependencies": {
     "express": "^5.2.1",
     "uuid": "^13.0.0",
-    "ws": "^8.19.0"
+    "ws": "^8.19.0",
+    "express-rate-limit": "^7.5.0"
   }
 }
diff --git a/rag-agentic-dashboard/server.js b/rag-agentic-dashboard/server.js
@@ -22,6 +22,8 @@ const path = require('path');
 
 const app = express();
 const server = http.createServer(app);
+const rateLimit = require('express-rate-limit');
+
 const wss = new WebSocket.Server({ server, path: '/ws' });
 
 // ── Static Files ─────────────────────────────────────────────────────────────
@@ -31,6 +33,15 @@ app.use(express.json());
 
 // ══════════════════════════════════════════════════════════════════════════════
 // SECTION 1: CORE DATA STORE (Simulates production database)
+// ── Rate Limiting ──────────────────────────────────────────────────────────
+const limiter = rateLimit({
+  windowMs: 15 * 60 * 1000, // 15 minutes
+  max: 100, // Limit each IP to 100 requests per window
+  standardHeaders: true,
+  legacyHeaders: false,
+});
+app.use(limiter);
+
 // ══════════════════════════════════════════════════════════════════════════════
 
 const STATE = {
@@ -583,7 +594,7 @@ class DirectiveEvaluatorAgent extends AgentBase {
     if (/nist\s*ai\s*r(mf|isk)/i.test(text)) domainEvidence.push('NIST AI RMF framework cited');
     if (/gdpr/i.test(text)) domainEvidence.push('EU GDPR requirements invoked');
     if (/eu\s*ai\s*act/i.test(text)) domainEvidence.push('EU AI Act regulatory context provided');
-    if (/govern.*map.*measure.*manage/i.test(text)) domainEvidence.push('NIST AI RMF functions enumerated (Govern, Map, Measure, Manage)');
+    if (/govern/i.test(text) && /map/i.test(text) && /measure/i.test(text) && /manage/i.test(text)) domainEvidence.push('NIST AI RMF functions enumerated (Govern, Map, Measure, Manage)');
     if (/regulat(ed|ory)/i.test(text)) domainEvidence.push('Regulatory compliance context established');
 
     const score = (goalClarity ? 1 : 0) + (operationalScope ? 1 : 0) + (domainContext ? 1 : 0);
