Repository navigation

Harden security, operations, and add R2 shadow delivery - #68

Merged

hmmhmmhm merged 78 commits into

mainfrom

feat/security-operations-data-delivery

Jul 15, 2026

Merged

Harden security, operations, and add R2 shadow delivery#68
hmmhmmhm merged 78 commits into
mainfrom
feat/security-operations-data-delivery

Commits on Jul 13, 2026
- docs: design security operations and R2 hardening
  hmmhmmhm
  committed
  afefc1e
- docs: plan security operations and R2 delivery
  hmmhmmhm
  committed
  437fa5b
- test(security): enforce production audit severity
  hmmhmmhm
  committed
  7174f88
- fix(security): harden production audit runner
  hmmhmmhm
  committed
  4eea800
- fix(security): reject incomplete audit processes
  hmmhmmhm
  committed
  c9b3037
- chore(api): upgrade and pin elysia runtime
  hmmhmmhm
  committed
  82e30e9
- chore(web): remediate production dependency advisories
  hmmhmmhm
  committed
  7b1a171
- fix(web): align swc helper peer
  hmmhmmhm
  committed
  c3f266d
- chore(actions): pin automation and add dependabot
  hmmhmmhm
  committed
  8269d87
- fix(actions): cover all workflow pins
  hmmhmmhm
  committed
  9c28a4d
- fix(actions): scope dependabot groups
  hmmhmmhm
  committed
  63243a2
- feat(security): codify repository governance
  hmmhmmhm
  committed
  7a8e691
- ci: enforce production security policy
  hmmhmmhm
  committed
  9b81e61
- fix(security): align governance with GitHub API
  hmmhmmhm
  committed
  5b94cad
- docs(security): record repository controls
  hmmhmmhm
  committed
  5d8b62c
- chore(tooling): pin Bun and TypeScript
  hmmhmmhm
  committed
  a6d98cc
- docs: complete security governance plan
  hmmhmmhm
  committed
  9a0f4cc
- fix(api): initialize metrics clock on first request
  hmmhmmhm
  committed
  55aa474
- feat(api): emit structured completion logs
  hmmhmmhm
  committed
  d0f8ddf
- test(smoke): validate metrics clock and runtime metadata
  hmmhmmhm
  committed
  da7cb3b
Commits on Jul 14, 2026
- feat(smoke): add quick and full profiles
  hmmhmmhm
  committed
  7ecce48
- fix(smoke): preserve failures across notification attempts
  hmmhmmhm
  committed
  0b7eb30
- docs(operations): define service objectives and runbook
  hmmhmmhm
  committed
  6ff509b
- ci(smoke): use profiles and sparse checkout
  hmmhmmhm
  committed
  9796817
- chore(ci): pin bun and wrangler toolchain
  hmmhmmhm
  committed
  6d70638
- fix(operations): make objectives and rollback verifiable
  hmmhmmhm
  committed
  56e8e6b
- fix(operations): make status filters executable
  hmmhmmhm
  committed
  4395a16
- fix(api): defer worker app initialization
  hmmhmmhm
  committed
  9c5ee2a
- test(ci): bind workflow toolchain contracts
  hmmhmmhm
  committed
  6ae1378
- test(ci): enforce direct bun action inputs
  hmmhmmhm
  committed
  3b361c1
- ci(deploy): enforce production concurrency
  hmmhmmhm
  committed
  f001e51
- fix(deploy): wait for active worker commit
  hmmhmmhm
  committed
  9a5070a
- test(coverage): define lcov policy enforcement
  hmmhmmhm
  committed
  a1fdebb
- fix(smoke): retry transient deployment responses
  hmmhmmhm
  committed
  d886c70
- fix(coverage): validate policy targets and paths
  hmmhmmhm
  committed
  79d773f
- fix(coverage): reject malformed and unsafe reports
  hmmhmmhm
  committed
  1918543
- test(ground-codes): add maintained-source coverage
  hmmhmmhm
  committed
  9591fe4
- fix(coverage): validate lcov summary records
  hmmhmmhm
  committed
  f92ad2f
- fix(coverage): accept summary-only lcov metrics
  hmmhmmhm
  committed
  3b12357
- test(apps): add api and web coverage
  hmmhmmhm
  committed
  444a7c8
- test(web): isolate coverage mocks
  hmmhmmhm
  committed
  6df1c59
- test(operations): cover automation policy modules
  hmmhmmhm
  committed
  43e7f91
- test(coverage): lock measured branch baselines
  hmmhmmhm
  committed
  28ead3c
- fix(coverage): harden branch probe portability
  hmmhmmhm
  committed
  11145ba
- fix(coverage): reject malformed branch reports
  hmmhmmhm
  committed
  78eb060
- fix(api): flush completion logs before response
  hmmhmmhm
  committed
  4593d66
- fix(api): preserve metrics wrapper on compile
  hmmhmmhm
  committed
  b6a8fa5
- fix(api): retain completion logs after compile
  hmmhmmhm
  committed
  dcfae00
- ci: enforce coverage policy
  hmmhmmhm
  committed
  97cb57a
- fix(coverage): secure and serialize report generation
  hmmhmmhm
  committed
  4fc2121
- fix(build): pin pages release toolchain
  hmmhmmhm
  committed
  9bb0f38
- test(build): lock pages toolchain graph
  hmmhmmhm
  committed
  4749a90
- fix(coverage): calibrate api baseline to ci
  hmmhmmhm
  committed
  2b40929
- docs(deploy): record reproducible release commands
  hmmhmmhm
  committed
  0d8ff9c
- fix(docs): make rollback commands fail closed
  hmmhmmhm
  committed
  90a4711
- fix(docs): clarify dry-run auth boundary
  hmmhmmhm
  committed
  a56dcfd
- fix(docs): preserve incident objective contract
  hmmhmmhm
  committed
  92deacb
- docs: complete metrics and smoke plan
  hmmhmmhm
  committed
  7446b95
- docs: complete ci deployment coverage plan
  hmmhmmhm
  committed
  aa8bcf9
- test(region-data): define immutable manifest contract
  hmmhmmhm
  committed
  79c5670
- fix(region-data): reject linked manifest roots
  hmmhmmhm
  committed
  1c246a8
- fix(region-data): harden immutable manifest contract
  hmmhmmhm
  committed
  20b8a44
- fix(region-data): stabilize manifest guard failures
  hmmhmmhm
  committed
  be2681e
- fix(region-data): secure directory enumeration
  hmmhmmhm
  committed
  8d72f83
- fix(region-data): restore manifest public API
  hmmhmmhm
  committed
  fb054a6
- feat(region-data): generate content-addressed releases
  hmmhmmhm
  committed
  b90cc9b
- test(region-data): enforce single-byte release mutation
  hmmhmmhm
  committed
  ce105f3
- fix(region-data): seal release generation against races
  hmmhmmhm
  committed
  a5514b8
- fix(region-data): make release activation durable
  hmmhmmhm
  committed
  cd2c422
- fix(region-data): seal pointer activation transaction
  hmmhmmhm
  committed
  66f3098
- feat(region-data): add verified r2 synchronizer
  hmmhmmhm
  committed
  62391ab
- feat(region-data): publish immutable r2 releases
  hmmhmmhm
  committed
  f2dd779
Commits on Jul 15, 2026
- test(region-data): verify complete release materialization
  hmmhmmhm
  committed
  1856c85
- docs(region-data): document r2 delivery operations
  hmmhmmhm
  committed
  8547f41
- feat(region-data): publish initial r2 release
  hmmhmmhm
  committed
  731385b
- ci(region-data): shadow materialize from r2
  hmmhmmhm
  committed
  83deb24
- fix(ci): restore production audit endpoint
  hmmhmmhm
  committed
  4497a41
- fix(ci): approve standalone native build
  hmmhmmhm
  committed
  b9f5c8f

Commits

Commits on Jul 13, 2026

Commits on Jul 14, 2026

Commits on Jul 15, 2026