OneFineStarstuff.github.io

6e90a066 - feat(governance): roadmap phases 5-8 first-class, runnable 2028 pilot gates, close dashboard High findings

feat(governance): roadmap phases 5-8 first-class, runnable 2028 pilot gates, close dashboard High findings - Roadmap YAML: promoted extension entries to first-class segments phase_5..phase_8 (2031-2035), each with feasibility_tier, objectives, exit_criteria, and gating preconditions for the Tier C/D phases. 9 phases total; YAML parses clean. - Pilot: governance_artifacts/pilot/run_pilot_acceptance_gates.py operationalizes decadal-plan section 14 as a runnable checklist. Executes the 6 Tier-A gates (terraform validate, OPA gates, PQC WORM tamper, containment TLC, zk relayer, full assurance) and reports 6 Tier-B/hardware gates as PENDING-EVIDENCE with precise criteria (never faked). Current: 6/6 automated gates PASS. + README. - Dashboard security: closed DASH-01/02/03/05/08. * lib/auth/session.ts - HMAC-signed tokens; principal derived server-side only (Bearer/cookie), constant-time sig check, expiry enforced; canAccessSubject authz. * lib/http/guard.ts - 16 KiB body cap + safe JSON parse; SSE/log-injection sanitizer. * consent route: identity bound to authenticated principal (no body userId); export requires ownership or dpo role (IDOR closed). * chat stream route: authn + body cap; unauthenticated GET text-gen removed; moderation 'block' now ENFORCED (suppresses reply); SSE values sanitized. * intent route: authn + body cap + validation. * tests rewritten to assert FIXED behaviour: vitest 14/14 pass (11 security + 3 gov). * DASHBOARD_SECURITY_REVIEW.md status table updated (Resolved/Open). * My new files typecheck clean (0 TS errors); pre-existing repo TS errors untouched. - Decadal plan: noted first-class phases 0-8 and the runnable pilot checklist. Regression: run_runnable_assurance.sh still 11/11 PASS.