chore(audit): execute 2026-06-02 audit — security invariants, fail-closed guardrails, audit-trail completeness, queue+MFA tests

[agjs]

Summary

Executes the 2026-06-02 19:32 audit report (produced by audit-monorepo, executed via execute-audit). Every finding was independently verified against main before any fix — 5 parallel read-only review agents checked all 22 findings' evidence. 17 findings fixed, 4 rejected with evidence, 1 confirmed as documented design. 0 failed.

Verification outcome (22 findings)

• 16 confirmed (2 with corrections), 3 refuted, 2 rejected during execution with proof, 1 no-change (documented design):
  • F010 refuted — branch-protection contexts match job names, not workflow display names; infra-bootstrap-validate's job is explicitly named tofu fmt + validate, so no ambiguity exists.
  • F021 refuted — core → features imports violate no repo contract (import-boundary table + eslint plugins say nothing about it); architecture opinion, not a defect.
  • F017 rejected — knip is green: its package.json script parser covers src/templates/email/build.ts, and the src/**/index.ts globstar covers src/index.ts.
  • F015 rejected — apps-api-openapi-drift.yml runs on every PR and triggers on both drift sources (apps/api/src/** and schema.d.ts); UI-only changes cannot create drift.
  • F007 no-change — fail-open rate limiting on Valkey errors is documented intent with Traefik edge limiting as the explicit backup layer.

Security

• F002 — new prod env invariant: CACHE_ENABLED requires CACHE_PROVIDER=valkey (JWT revocation state must survive restarts / propagate across replicas). The prod compose api service never set the var — it silently inherited the per-process memory default; now pinned. SECURITY.md documents it.
• F001 — JWT revocation cache-failure policy made explicit and configurable: JWT_REVOCATION_FAIL_CLOSED (default false; exposure bounded by the 15-min JWT TTL, while fail-closed would turn any Valkey blip into a global auth outage). Both check paths log failMode; SECURITY.md lists the events to alert on.
• F003 — join-requests.approve() UPDATE now filters by accountId, matching deny(). Defense-in-depth only (the transaction's SELECT was already scoped); cross-account approve test added.
• F012 + F013 — Stripe webhook plan mutations (checkout.session.completed, subscription upsert/delete) now write stripe.reconciled audit rows as a system actor with resource account:{id}. record() persists the previously-never-written targetAccountId column, and all entity-resource account events (billing checkout/portal, invitations, join requests) set it — these were invisible to GET /accounts/:id/audit-log.

Guardrails (lint as a contract)

• F004 — pre-push-ci-parity silently no-oped in both apps (the audit only caught ui): ui's manifest had a stale stages shape; api's pointed at .github/workflows/ci.yml which exists nowhere. The rule now resolves the workflow by walking up to the monorepo root and fails closed on malformed manifests / unresolvable workflows. RED proven live in both apps before the manifest fixes.
• F014 — the audit's specific claim was refuted (no setup-node usage anywhere), but the adjacent gap was real: 10 workflow bun-version: pins had no guard. engine-pin-parity now scans the resolved monorepo workflows and checks every pin against packageManager.
• F022 — stale eslint override (tests/auth/role-schema-parity.test.ts) removed + new eslint-override-paths-exist lint-meta rule: literal test paths in eslint.config.* must exist on disk. RED→GREEN demonstrated live.
• F020 — eslint-plugin-structured-logging 0.1.1→0.1.2 in ui (lockfile refreshed); shared-tool-version-parity now matches the whole @boring-stack-pkg/ scope by prefix, so any first-party plugin declared in two apps must stay in lockstep. The extension surfaced exactly this drift as RED before the bump.
• F005 (docs) — new scripts/check-fragments.mjs verifies every intra-site #fragment against built HTML ids and runs as the last build:ci step. lychee --include-fragments was evaluated and rejected: it false-positives on pretty-URL directory links (8 of 9 errors were false). The new gate caught a second genuinely dead anchor the audit missed (/api/acl/#status-driven-features → #feature-gates).

CI / infra

• F011 — prod-image-build now triggers on apps/api/** / apps/ui/** (the prod Dockerfiles COPY . ., so the whole app tree is image input; previously only Dockerfile/lockfile edits triggered it).
• F018 — infra pre-push yamllint globbed infra/compose/.github/workflows/*.yml (matches nothing) — workflow YAML was silently unlinted locally. Now mirrors the CI yamllint job exactly. Full 3-stage gate run locally: green.
• F006 + F019 (docs) — Cloudflare build documented as build:ci (docs-data freshness + fragment gate; sibling defaults resolve without env vars) and .nvmrc 22→24 to match engines.node >=24. Operator action: update the CF Pages dashboard to match (build command + Node version).

Tests

• F009 — MFA lockout branches (mfa.routes.ts 57–61 / 100–104, previously DA:0) covered: max-attempts lockout on both verify-login and verify-recovery, no cookies issued, consumed challenge reports expiry.
• F008 — QueueManager (0/7 functions covered) was untestable by construction: its input demanded concrete worker classes (private fields defeat structural stubs; the merge bar bans casts). It now declares the minimal structural surface it touches (IManagedQueue / IEnqueueableQueue / IManagedWorker) — real BullMQ instances satisfy these implicitly — and 8 stub-based unit tests cover all enqueue paths (retry envelopes, web-push null no-op), getStats, and close(), with no Valkey dependency. setupQueues boot stays covered by full-stack-smoke e2e; its inline-fallback accessor contract is pinned.
• F016 — AGENT_CONTRACT no longer oversells bun run validate: push/CI additionally enforce the coverage ratchet + dist build. Folding test:coverage into validate was measured and rejected — the 70% function floor fails without the integration stack (68.61% with DB-skipped tests).

Validation

• bun run check green in api + ui; check:docs-data green; docs build:ci (incl. new fragment gate) green
• api suite vs live integration DB: 1096 tests, 0 fail (2 skip)
• compose config validated across every overlay combo (infra pre-push, all 3 stages)
• Pre-push full-stack smoke gate ran at push time

Follow-ups (not in this PR)

• CF Pages dashboard: build command → bun run build:ci, Node 24
• boringstack-xyz/eslint-plugins: extend audit-log mutatingPrefixes with ^handle so webhook handlers are plugin-covered (instances fixed here)

Full decision log: .audit/execution-summary.json (local, gitignored).