epic: enterprise hardening — trustworthy v0.4 release #305

Activity

1. m-khan-97

   added

   coreCore team ownership not for studentsCore team ownership not for students

   priority: criticalMust be fixed immediately, breaks core functionalityMust be fixed immediately, breaks core functionality

   on Aug 21, 2026
2. m-khan-97 commented on Aug 21, 2026

   

   m-khan-97

   on Aug 21, 2026

   CollaboratorAuthor

   More actions

   First enterprise-hardening implementation batch is ready for lead review. Nothing has been merged yet.

   • fix(api): return readiness connections to the pool #306 fixes the public /ready connection-pool leak. Draft, DCO-signed, mergeable, and all 20 checks are green.
   • fix(core): enforce severity contract v1 #308 introduces severity contract v1 and repairs CRITICAL scoring across scanner, database, APIs, Sentinel, and dashboard. Draft, DCO-signed, mergeable, and all 20 checks are green. This needs a production-sized staging migration run before merge.
   • fix(platform): enforce container runtime gate #309 makes the image migration-aware and bootable, adds a local-only API/worker/frontend/PostgreSQL Compose contract, and turns container boot/readiness/non-root/Trivy into a required CI gate. Draft, DCO-signed, mergeable, and all 21 checks are green. Runtime evidence: /ready passed, runtime UID was 999, and Trivy found no blocking CRITICAL/HIGH result on the tested tag.

   Integration order:

   1. Review and merge fix(api): return readiness connections to the pool #306 first.
   2. Run fix(core): enforce severity contract v1 #308's migration against a production-sized staging copy, complete two-lead review, then merge it.
   3. Rebase fix(platform): enforce container runtime gate #309 onto the resulting dev, rerun the container gate so it exercises the combined migration chain, then review and merge it.

   Do not merge #309 before #306: its recurring Compose readiness probe depends on #306 returning probe connections to the pool.

   This is progress on Phase 0, not an enterprise-ready declaration. Public auth/token containment (#294), website/PAT containment (#297), effective branch enforcement (#298), evidence semantics (#263), and the remaining #299 deployment/worker gates are still release blockers.
3. m-khan-97 commented on Aug 28, 2026

   

   m-khan-97

   on Aug 28, 2026

   CollaboratorAuthor

   More actions

   Enterprise-hardening status update — 28 August 2026

   Completed and merged into dev:

   • fix(api): return readiness connections to the pool #306 — readiness connections are returned to the database pool.
   • fix(platform): enforce container runtime gate #309 — container runtime, migration, readiness, non-root, and image scanning gates.
   • fix(scanner): replace broken AZ-NET-012 NSG flow-log logic with VNet flow-log evidence #316 — replaced AZ-NET-012’s nonexistent NSG flow-log call with supported VNet flow-log evidence.
   • fix(deps): move chromadb out of core install (CVE-2026-45830, CVE-2026-45833) #317 — removed vulnerable ChromaDB from the core install path.
   • fix(core): enforce severity contract v1 #308 — severity contract v1, CRITICAL scoring, database/API/Sentinel/dashboard alignment.
   • feat: add rule AZ-CMP-007 management ports open without JIT VM access #307 — AZ-CMP-007 management-port/JIT control.

   Active release-hardening queue:

   • Add enterprise network and perimeter security controls #277 — substantive review findings fixed and independently verified; final rebase onto current dev requested before lead approval.
   • fix(compliance): make framework reports evidence-based and non-certifying #310 — migration chain and empty-scan scoring blockers fixed; waiting for TFT444 to clear the older blocking review.
   • fix(api): rate-limit /ready and /metrics, expose db pool telemetry #319 / bug: stop the public readiness endpoint from exhausting the database pool #296 — readiness/metrics rate limiting and pool telemetry. Lead review found unbounded per-source limiter state; change requested with regression requirements.
   • fix(website): harden Astro CSP and verify the built output against it #318 / security(website): remove the browser PAT flow and restore safe dynamic rendering #297 — browser PAT removal and XSS/CSP hardening. Lead review confirmed the main sanitization direction but requested real production-CSP browser coverage and removal of unsafe-inline from script-src.
   • feat(scanner): add enterprise data protection and database rules #278, Feat (ci-rules) : Add AZ-CI-001..004 CI/CD workflow security rules (issue #259 PR 1/3) #280, feat: add enterprise governance and tenant controls #292, and feat: implement enterprise privileged access and identity security rules (AZ-IDN-016-025) #279 — rebases requested before further review; obsolete temporary ChromaDB audit exceptions must be removed where present.
   • Add enterprise AKS and workload security controls #293 — still draft and waiting on the namespace-policy correction.

   Unowned release blockers still requiring lead assignment:

   • security: remove the public demo bearer and establish real authorization boundaries #294 — real authorization boundaries.
   • ci: enforce required checks and two-person promotion on dev and main #298 — required checks and two-person promotion enforcement.
   • core: harden scan transactions, leases, idempotency, and durable background work #303 — scan transactions, leases, idempotency, and durable work.
   • infra: establish one reproducible enterprise deployment and operations baseline #304 — reproducible enterprise deployment and operations baseline.

   The current priority remains stabilization of existing behavior and evidence correctness. Agent-automation issues #311–#315 should not displace these release blockers.
4. m-khan-97 commented on Aug 31, 2026

   

   m-khan-97

   on Aug 31, 2026

   CollaboratorAuthor

   More actions

   Enterprise-hardening lead update — 31 August 2026

   Merged into dev since the previous update:

   • Add enterprise network and perimeter security controls #277 — enterprise network/perimeter controls, including the final UNKNOWN-state corrections.
   • fix(api): enforce token expiry, role, and subscription authorization #320 — mandatory JWT expiry, role-based write authorization, and subscription scan allowlisting.
   • docs: update learn page statistics and add CI/CD workflow #230 — generated rule/playbook statistics and documentation synchronization.

   Lead reviews completed today:

   • fix(api): rate-limit /ready and /metrics, expose db pool telemetry #319 approved after verifying bounded global probe-limiter state, deterministic eviction, expiry sweeping, Retry-After, and green regression coverage.
   • fix(website): harden Astro CSP and verify the built output against it #318 approved after independent local execution: unit tests passed and all 37 Playwright/axe/CSP/XSS tests passed against the production-header harness. Browser PAT removal, DOMPurify routing, real CSP enforcement, and removal of inline script execution were verified.
   • fix(compliance): make framework reports evidence-based and non-certifying #310 remains blocked: mapping provenance and no-data semantics are strong, but failed-rule outcomes are incorrectly preserved with the immutable mapping snapshot across same-scan retries. Requested an atomic replay regression and separation/update of per-attempt outcomes.
   • Feat (ci-rules) : Add AZ-CI-001..004 CI/CD workflow security rules (issue #259 PR 1/3) #280 remains blocked: AZ-CI-002 checks only top-level permission values and treats any non-null job-level permissions as safe, allowing write-all job overrides to pass. Requested effective-permission evaluation and three regression cases.

   Architecture coordination:

   • feat(engine): add rule evaluation coverage contract (#263) #321 is the canonical feat: persist PASS/FAIL/ERROR/NOT_APPLICABLE per rule per resource, fix compliance score #263 rule-evaluation semantic contract.
   • fix(core): harden scan durability and idempotency (#303) #325 is the canonical core: harden scan transactions, leases, idempotency, and durable background work #303 durability/fencing/admission/enrichment layer and must reuse or stack on feat(engine): add rule evaluation coverage contract (#263) #321 rather than define a competing evaluation table.
   • feat(automation): finding lifecycle engine, scan outcome contracts, and pattern detection [1/5] #326 automation lifecycle work is paused. It currently overlaps both contracts, has failing backend CI, and must rebase onto the accepted feat(engine): add rule evaluation coverage contract (#263) #321/fix(core): harden scan durability and idempotency (#303) #325 foundation before lifecycle/pattern work continues.

   Still blocked before review:

   • feat(scanner): add enterprise data protection and database rules #278, feat: implement enterprise privileged access and identity security rules (AZ-IDN-016-025) #279, Fix/az net 003 az db 002 scanner correctness #291 and feat(automation): finding lifecycle engine, scan outcome contracts, and pattern detection [1/5] #326 have failing CI.
   • feat: add enterprise governance and tenant controls #292 has merge conflicts.
   • Add enterprise AKS and workload security controls #293 remains draft with its namespace-policy request unresolved.

   Next lead focus after developer updates: rereview #319/#318 merge readiness if dev moves, review the reconciled #321/#325 stack, then return to #310 and #280 when their focused fixes land.
5. github-actions commented on Oct 1, 2026

   

   github-actionsbot

   on Oct 1, 2026 – with GitHub Actions

   Contributor

   More actions

   This issue has been inactive for 30 days and will be closed in 7 days unless there is activity.
6. github-actions

   added

   stale

   on Oct 1, 2026
7. github-actions commented on Oct 9, 2026

   

   github-actionsbot

   on Oct 9, 2026 – with GitHub Actions

   Contributor

   More actions

   Closing due to inactivity. Feel free to reopen if still relevant.
8. github-actions

   closed this as not plannedon Oct 9, 2026