OneFineStarstuff.github.io

15d67348 - feat(dashboard+ci): close DASH-04/06/07, add login route, wire CI for pilot + dashboard tests

feat(dashboard+ci): close DASH-04/06/07, add login route, wire CI for pilot + dashboard tests Dashboard security — all 8 findings now resolved (was 5/8): - DASH-04: app/api/risk/scores returns synthetic:true + DEMO disclaimer so mock series can't be mistaken for an SR 11-7 model output. - DASH-06: next.config.js sets CSP + X-Content-Type-Options/X-Frame-Options/ Referrer-Policy/Permissions-Policy/HSTS; middleware.ts + lib/http/rateLimit.ts add per-client rate limiting (120 req/min) on /api/*. - DASH-07: consentLedger.ts signs each event hash (HMAC stand-in for the Dilithium/ML-DSA HSM signer), verifies the chain on export, and FAILS CLOSED on prevHash read errors (no silent new chain). Also fixed pre-existing invalid 'catch (e: Error)' TypeScript in this file. - Added app/api/auth/login/route.ts: demo login issuing a signed, HttpOnly, SameSite=Strict sentinel_session cookie via mintToken (real IdP/OIDC in prod). - Tests extended to assert the fixes: vitest 19/19 pass (16 security + 3 gov). New/modified files typecheck clean (0 TS errors). CI (.github/workflows/runnable-assurance.yml): - Install solc (contracts) so assurance steps 7 (zk relayer) + 10 (contract compile) actually run in CI; install Terraform 1.9.8 for the pilot IaC gate. - Add contract-logic pytest to unit tests. - Add '2028 pilot acceptance-gate checklist' step (6/6 automated gates). - Add separate 'dashboard-tests' job running next-app vitest. - Trigger on governance_blueprint/** and next-app/** too. Regression: run_runnable_assurance.sh 11/11 PASS; pilot 6/6 automated; vitest 19/19.