chore(audit): execute 2026-06-02 audit — security invariants, fail-closed guardrails, audit-trail completeness, queue+MFA tests - #115

Merged

agjs merged 17 commits into

mainfrom

chore/audit-fixes-20260602-1932

Jun 2, 2026

Commits on Jun 2, 2026

fix(lint-meta): pre-push-ci-parity fails closed and resolves monorepo workflows
agjs
committed
3288cca
fix(lint-meta): engine-pin-parity scans monorepo workflows and guards bun-version pins
agjs
committed
bf0f7ea
fix(api): drop stale eslint override path, add eslint-override-paths-exist rule
agjs
committed
752ba14
fix(api): scope join-request approve UPDATE by accountId
agjs
committed
bf831f8
fix(api): require CACHE_PROVIDER=valkey in production when cache is enabled
agjs
committed
49d42a7
fix(docs): align .nvmrc with engines.node >=24
agjs
committed
b8c2ca6
fix(deps): align eslint-plugin-structured-logging at 0.1.2, guard @boring-stack-pkg parity
agjs
committed
fc8657c
chore(docs): regen lint-meta catalog for new guardrail rules
agjs
committed
485cc74
fix(docs): mount CostCalculator on why-boringstack, gate intra-site fragments
agjs
committed
ae83b23
fix(docs): Cloudflare Pages build command -> build:ci
agjs
committed
cc55945
fix(api): audit Stripe webhook plan mutations and persist targetAccountId
agjs
committed
db91bb8
feat(api): configurable JWT revocation fail mode (JWT_REVOCATION_FAIL_CLOSED)
agjs
committed
37b2770
fix(infra): pre-push yamllint actually lints workflow YAML
agjs
committed
268a722
fix(ci): prod-image-build triggers on app source changes
agjs
committed
9f8c02e
docs(api): AGENT_CONTRACT documents the full push gate, not just validate
agjs
committed
fc2c87d
test(api): cover MFA lockout branches on verify-login and verify-recovery
agjs
committed
cc1adce
test(api): QueueManager lifecycle tests via structural queue/worker interfaces
agjs
committed
4245f7b

Navigation Menu

Uh oh!

chore(audit): execute 2026-06-02 audit — security invariants, fail-closed guardrails, audit-trail completeness, queue+MFA tests - #115

chore(audit): execute 2026-06-02 audit — security invariants, fail-closed guardrails, audit-trail completeness, queue+MFA tests#115
agjs merged 17 commits into
mainfrom
chore/audit-fixes-20260602-1932

Commits on Jun 2, 2026

fix(lint-meta): pre-push-ci-parity fails closed and resolves monorepo workflows

fix(lint-meta): engine-pin-parity scans monorepo workflows and guards bun-version pins

fix(api): drop stale eslint override path, add eslint-override-paths-exist rule

fix(api): scope join-request approve UPDATE by accountId

fix(api): require CACHE_PROVIDER=valkey in production when cache is enabled

fix(docs): align .nvmrc with engines.node >=24

fix(deps): align eslint-plugin-structured-logging at 0.1.2, guard @boring-stack-pkg parity

chore(docs): regen lint-meta catalog for new guardrail rules

fix(docs): mount CostCalculator on why-boringstack, gate intra-site fragments

fix(docs): Cloudflare Pages build command -> build:ci

fix(api): audit Stripe webhook plan mutations and persist targetAccountId

feat(api): configurable JWT revocation fail mode (JWT_REVOCATION_FAIL_CLOSED)

fix(infra): pre-push yamllint actually lints workflow YAML

fix(ci): prod-image-build triggers on app source changes

docs(api): AGENT_CONTRACT documents the full push gate, not just validate

test(api): cover MFA lockout branches on verify-login and verify-recovery

test(api): QueueManager lifecycle tests via structural queue/worker interfaces