fix: resolve 8 P3 release-readiness findings (docs drift, web headers, resolve config)

Docs drift: README and status.md test counts updated from live data
(10,400+ unit tests, 789 .ci files, 57 fuzz targets). Race detector
claim narrowed to unit tests only. Subsystem wiring doc annotated as
pre-migration with tense corrections. BFD architecture and guide docs
updated from "skeleton" to implemented status. TACACS guide expanded
from 4 to 8 test entries, single-connect and tooling notes updated.
BGP API commands.md fixed watchdog syntax (next -> nhop set) with
wire-mode not-yet-implemented note.

Web security headers: addSecurityHeaders applied to 401 responses
in both AuthMiddleware (unauthenticated) and LoginHandler (failed
login), closing the gap where pre-login pages lacked clickjacking,
CSP, HSTS, and cache-control headers.

Resolve config path: DNS ResolverConfig carries ResolvConfPath,
resolveSystemDNS reads from configured path instead of hardcoded
/etc/resolv.conf, wired through newResolvers in hub startup.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: thomas-mangin

README.md

@@ -1,6 +1,6 @@
 # Ze
 
-> **Pre-release** -- Ze is under active development and has not been released yet. The core BGP engine works and is extensively tested (8,000+ unit tests, 550+ functional tests, fuzz testing, chaos testing, interop tests against FRR, BIRD, and GoBGP), but some advanced features are still incomplete. APIs and config syntax may change.
+> **Pre-release** -- Ze is under active development and has not been released yet. The core BGP engine works and is extensively tested (10,400+ unit tests, 789 functional tests, 57 fuzz targets, chaos testing, interop tests against FRR, BIRD, and GoBGP), but some advanced features are still incomplete. APIs and config syntax may change.
 
 Ze is an open-source network operating system for Linux. It speaks BGP, manages network interfaces, programs the FIB, and serves a config editor over SSH and a web UI. Everything beyond the core is a plugin. Plugins can be Go modules or external processes in any language. An MCP server can let AI assistants discover all its features (including plugins) and operate them directly.
 
@@ -54,10 +54,10 @@ If you are an ExaBGP user, we would love your feedback on the migration experien
 
 | Type | Scope |
 |------|-------|
-| Unit tests | 18,000+ test functions |
+| Unit tests | 10,400+ test functions |
 | Linting | 26 linters |
-| Functional tests | Config parsing, wire encoding, plugin behavior |
-| Fuzz testing | All external input parsing |
+| Functional tests | 789 `.ci` files: config parsing, wire encoding, plugin behavior |
+| Fuzz testing | 57 targets covering external input parsing |
 | Chaos testing | Deterministic replay with [configurable scenarios](docs/guide/chaos-testing.md) |
 
 ### Deployment

cmd/ze/hub/main.go

@@ -1415,9 +1415,10 @@ func runOrchestratorWithData(store storage.Storage, configPath string, data []by
 // and a Cymru resolver wired to it. Called once at hub startup.
 func newResolvers(sc system.SystemConfig) *resolve.Resolvers {
 	cfg := resolveDNS.ResolverConfig{
-		Timeout:   sc.DNSTimeout,
-		CacheSize: sc.DNSCacheSize,
-		CacheTTL:  sc.DNSCacheTTL,
+		Timeout:        sc.DNSTimeout,
+		ResolvConfPath: sc.ResolvConfPath,
+		CacheSize:      sc.DNSCacheSize,
+		CacheTTL:       sc.DNSCacheTTL,
 	}
 	if len(sc.NameServers) > 0 {
 		cfg.Server = sc.NameServers[0]

docs/architecture/api/commands.md

@@ -493,9 +493,13 @@ watchdog withdraw <name> [peer]           # Withdraw all routes in pool from pee
 
 Routes are tagged with a pool when announced:
 ```bash
-update text next 10.0.0.1 nlri ipv4/unicast add prefix 1.0.0.0/24 watchdog set mypool
+update text nhop set 10.0.0.1 nlri ipv4/unicast add prefix 1.0.0.0/24 watchdog set mypool
 ```
 
+> **Note:** `watchdog set` in wire-mode updates is parsed but not yet
+> implemented. The watchdog announce/withdraw pool commands work
+> independently of this tagging.
+
 ### RIB Commands
 
 ```

docs/architecture/bfd.md

@@ -1,10 +1,9 @@
 # BFD — Bidirectional Forwarding Detection
 
-**Status:** skeleton merged, NOT wired into the engine startup path. The plugin
-compiles, the codec and FSM are tested under `-race`, and a loopback engine
-test exercises the full three-way handshake. The `RunBFDPlugin` entry point
-is a no-op stub; opening real UDP sockets and exposing the Service over RPC
-lands in a follow-up commit.
+**Status:** implemented and wired. The plugin runs as an internal plugin with
+UDP transport, RFC 5880 FSM, detection timers, echo mode (RFC 5880 §6.8.9),
+and multi-hop support (RFC 5883). Static route next-hop tracking via the BFD
+Service is live. Session keying includes local address for multi-hop uniqueness.
 
 ## Source
 

docs/architecture/subsystem-wiring.md

@@ -1,13 +1,20 @@
 # Subsystem Wiring: Reactor as ze.Subsystem
 
+> **Note (2026-04-24):** This document was written during the arch-0 migration.
+> The startup path has since evolved: the plugin server uses topological tier
+> ordering (`startup.go`), the coordinator owns config distribution, and the
+> reactor starts via the BGP plugin's `OnStarted` hook rather than direct
+> `LoadReactorWithPlugins`. The diagrams below describe the pre-migration state
+> and the planned target; the live code in `cmd/ze/hub/main.go` is authoritative.
+
 This document describes the migration from direct reactor startup to Engine-supervised
 startup with Bus integration, completing the arch-0 component boundary work.
 
-## Current Architecture
+## Pre-Migration Architecture
 
-The reactor is created and started directly by `cmd/ze/hub/main.go`. It holds a
+The reactor was created and started directly by `cmd/ze/hub/main.go`. It held a
 `*pluginserver.Server` and `*EventDispatcher` for plugin communication. The Engine,
-Bus, and Subsystem interface exist but are not wired into the startup path.
+Bus, and Subsystem interface existed but were not wired into the startup path.
 
 ```mermaid
 flowchart TB

docs/guide/bfd.md

@@ -110,16 +110,11 @@ packet sets `RequiredMinEchoRxInterval` to the configured rate.
 Peers that see a non-zero advertisement learn that the local end
 is willing to reflect echo packets.
 
-**Current coverage:** the YANG surface, wire advertisement, and
-session state plumbing ship in Stage 6. The actual echo transport
-(UDP 3785 socket, per-session TX scheduler, RX demux, RTT
-histogram, detection-time switchover, async slow-down) is tracked
-as `spec-bfd-6b-echo-transport`. Configurations written against
-the Stage 6 surface remain valid when the transport half lands.
-The `ze_bfd_echo_tx_packets_total` and `ze_bfd_echo_rx_packets_total`
-metric families are registered now so downstream alerting can
-reference them from day one, even though the counters stay at
-zero until the transport half lands.
+**Current coverage:** echo mode is fully implemented including the
+YANG surface, wire advertisement, per-session TX scheduler, RX
+demux with RTT measurement, echo detection timer, and async
+slow-down (RFC 5880 §6.8.9). The `ze_bfd_echo_tx_packets_total`
+and `ze_bfd_echo_rx_packets_total` Prometheus metrics are live.
 
 ### Authentication
 

docs/guide/status.md

@@ -77,12 +77,12 @@ Over 40 built-in plugins covering protocol features, all address families, BFD,
 
 | Type | Count |
 |------|-------|
-| Unit test functions | 18,000+ |
-| Functional test files (.ci) | 417 |
-| Fuzz targets | 121 |
+| Unit test functions | 10,400+ |
+| Functional test files (.ci) | 789 |
+| Fuzz targets | 57 |
 | Linters | 26 |
 
-All tests run with the race detector enabled.
+Unit tests run with the race detector enabled (`-race`). Functional, browser, and compatibility suites do not currently use the race detector.
 <!-- source: Makefile -- ze-unit-test, ze-functional-test, ze-lint, ze-fuzz-test targets -->
 
 ## What Does NOT Work Yet

docs/guide/tacacs.md

@@ -115,14 +115,18 @@ queued after `Stop()` are dropped silently.
 
 ## Verification
 
-The four `.ci` tests in `test/plugin/` cover the main behaviours:
+The `.ci` tests in `test/plugin/` cover the main behaviours:
 
 | Test | Asserts |
 |------|---------|
 | `tacacs-auth.ci` | TACACS+ PASS + priv-lvl 15 -> admin profile, no local fallback consulted |
+| `tacacs-author.ci` | TACACS+ command authorization PASS/FAIL with local fallback |
 | `tacacs-fallback.ci` | Server unreachable -> local bcrypt accepted, log shows `source=local` |
 | `tacacs-local-only.ci` | No `tacacs` block -> existing local-only auth path unchanged |
+| `tacacs-readonly.ci` | Read-only profile restricts write commands |
 | `tacacs-acct.ci` | `accounting true` -> mock receives ACCT START followed by STOP |
+| `tacacs-singleconnect.ci` | Single-connect mode TCP reuse |
+| `tacacs-show.ci` | `ze tacacs show` offline config display |
 
 For ad-hoc verification, point the daemon at a real TACACS+ server and
 run any command via `ze cli -c "summary"` -- the daemon log tags the
@@ -145,12 +149,10 @@ local bcrypt user accepted the credentials.
   replaces them with `/* SECRET-DATA */`.
 - **VRF**: when the SSH server runs in a non-default VRF, TACACS+ TCP
   connections inherit the same VRF context.
-- **Single-connect mode** (RFC 8907 §4.4) is not negotiated today; every
-  AUTHEN/AUTHOR/ACCT exchange opens its own TCP connection. This is
-  compatible with every server we have tested.
-- **Operational tooling** (`ze show tacacs` per-server reachability +
-  counters) is tracked in `plan/deferrals.md` against
-  `spec-tacacs-observability`.
+- **Single-connect mode** (RFC 8907 §4.4) is tested via `tacacs-singleconnect.ci`.
+- **Operational tooling**: `ze tacacs show <config>` displays the parsed
+  TACACS+ configuration offline. Runtime `ze show tacacs` per-server
+  reachability and counters are tracked in `plan/deferrals.md`.
 
 ## RFC reference
 

internal/component/resolve/dns/resolver.go

@@ -17,10 +17,11 @@ import (
 
 // ResolverConfig holds DNS resolver configuration from YANG.
 type ResolverConfig struct {
-	Server    string // DNS server address (e.g., "8.8.8.8:53"). Empty uses system default.
-	Timeout   uint16 // Query timeout in seconds.
-	CacheSize uint32 // Max cached entries. 0 disables caching.
-	CacheTTL  uint32 // Max cache TTL in seconds. 0 means use response TTL only.
+	Server         string // DNS server address (e.g., "8.8.8.8:53"). Empty uses system default.
+	ResolvConfPath string // Path to resolv.conf (empty uses /etc/resolv.conf).
+	Timeout        uint16 // Query timeout in seconds.
+	CacheSize      uint32 // Max cached entries. 0 disables caching.
+	CacheTTL       uint32 // Max cache TTL in seconds. 0 means use response TTL only.
 }
 
 // Resolver provides DNS query services to Ze components.
@@ -47,8 +48,11 @@ func NewResolver(cfg ResolverConfig) *Resolver {
 			server = net.JoinHostPort(server, "53")
 		}
 	} else {
-		// Resolve system default DNS server once at construction.
-		server = resolveSystemDNS()
+		resolvPath := cfg.ResolvConfPath
+		if resolvPath == "" {
+			resolvPath = "/etc/resolv.conf"
+		}
+		server = resolveSystemDNS(resolvPath)
 	}
 
 	return &Resolver{
@@ -65,8 +69,8 @@ func NewResolver(cfg ResolverConfig) *Resolver {
 // resolveSystemDNS reads the system DNS server from /etc/resolv.conf.
 // Falls back to 8.8.8.8:53 (Google Public DNS) if the file is missing or empty,
 // so DNS resolution always works out of the box.
-func resolveSystemDNS() string {
-	config, err := mdns.ClientConfigFromFile("/etc/resolv.conf")
+func resolveSystemDNS(resolvConfPath string) string {
+	config, err := mdns.ClientConfigFromFile(resolvConfPath)
 	if err != nil || len(config.Servers) == 0 {
 		return "8.8.8.8:53"
 	}

internal/component/web/auth.go

@@ -198,6 +198,7 @@ func AuthMiddleware(store *SessionStore, authenticator authz.Authenticator, logi
 		}
 
 		// Unauthenticated: return 401 without WWW-Authenticate header.
+		addSecurityHeaders(w)
 		w.WriteHeader(http.StatusUnauthorized)
 		loginRenderer(w, r)
 	})
@@ -226,6 +227,7 @@ func LoginHandler(store *SessionStore, authenticator authz.Authenticator, loginR
 		})
 		if err != nil || !result.Authenticated {
 			logger.Warn("login failed", "username", username, "remote", r.RemoteAddr)
+			addSecurityHeaders(w)
 			w.WriteHeader(http.StatusUnauthorized)
 			loginRenderer(w, r)