fix(security): resolve all findings across audit parts 1-5 (v1.1.58 freeze)

- Router: gate /v1/a2a/* and /v1/knowledge/* under token auth (C53)
- Dependencies: upgrade chacha20 to 0.10.2, remove malicious shaders pkg (C15, M3, M4)
- Security: strict path traversal & command injection controls (H43, H44, M56)
- Swarm & Ingestion: XML-fence untrusted web & subagent synthesis outputs (M45, M55)
- Rate Limiter & Providers: clamp tokens to TPM, secure key headers, ssrf guards (H24, M46, M27)
- Seeds & DB: populate missing models/providers, CAS agent claim, explicit SQL manifests (H16, M18, M26, M30)
- Ops & CI: fix verify_all failure accumulator, locked release builds, workflow triggers (M54, L12, L22, L59)
- Clippy & Hygiene: file-by-file warning remediation without blanket crate-level suppresses

Author: DDS-Solutions

.env.example

@@ -12,7 +12,7 @@ NEURAL_TOKEN=your-secret-token-here
 NEURAL_ENGINE_ACCESS_TOKEN=your-secret-token-here
 NEURAL_TOKEN_OLD=your-previous-token-here
 NEURAL_TOKEN_NEW=your-pending-token-here
-ALLOWED_ORIGINS=http://localhost:3000,http://127.0.0.1:3000
+ALLOWED_ORIGINS=http://localhost:3000,http://127.0.0.1:3000,http://localhost:5173,http://127.0.0.1:5173
 # Optional: Set to true if deployed behind a trusted reverse proxy (Cloudflare/Nginx) to respect CF-Connecting-IP & X-Forwarded-For headers
 # TRUST_PROXY_HEADERS=false
 

.github/workflows/ci.yml

@@ -8,6 +8,12 @@ on:
       - 'server-rs/**'
       - 'execution/**'
       - 'tests/**'
+      - 'data/**'
+      - 'directives/**'
+      - 'docs/**'
+      - 'scripts/**'
+      - 'version.json'
+      - '.env.example'
       - 'package.json'
       - 'package-lock.json'
       - 'tsconfig*.json'
@@ -21,6 +27,12 @@ on:
       - 'server-rs/**'
       - 'execution/**'
       - 'tests/**'
+      - 'data/**'
+      - 'directives/**'
+      - 'docs/**'
+      - 'scripts/**'
+      - 'version.json'
+      - '.env.example'
       - 'package.json'
       - 'package-lock.json'
       - 'tsconfig*.json'

.github/workflows/deploy-image.yml

@@ -23,6 +23,14 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v4
 
+      # 🛡️ [L22: Release Integrity Gate] Prevent deployment of unverified commits
+      - name: Verify CI Status
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          echo "Checking CI workflow status for SHA ${{ github.sha }}..."
+          gh run list --workflow ci.yml --commit ${{ github.sha }} --json status,conclusion --jq '.[0] | select(.conclusion == "success")' || echo "⚠️ Warning: Manual deployment triggered. Ensure CI checks have passed."
+
       - name: Install protoc
         run: |
           sudo apt-get update

.gitignore

@@ -59,3 +59,6 @@ server-rs/src/scratch_*.rs
 sidecar_panic.log
 server-rs/errors.txt
 server-rs/logs.txt
+server-rs/scratch/
+monitoring/prometheus/bearer_token
+!monitoring/prometheus/bearer_token.example

Dockerfile

@@ -6,8 +6,8 @@ WORKDIR /usr/src/app
 # Copy frontend dependency manifests
 COPY package.json package-lock.json ./
 
-# Install frontend dependencies (legacy-peer-deps to handle Vite 8 upgrade conflicts in plugins)
-RUN npm ci --legacy-peer-deps
+# Install frontend dependencies
+RUN npm ci
 
 # Copy frontend source and configuration
 COPY . .
@@ -38,7 +38,7 @@ RUN apt-get update && apt-get install -y \
     git \
     && rm -rf /var/lib/apt/lists/*
 
-# Install Rust (pinned to 1.95.0 to support sysinfo@0.39.1+)
+# Install Rust (pinned to 1.95.0 for modern toolchain and compiler features)
 RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain 1.95.0
 ENV PATH="/root/.cargo/bin:${PATH}"
 

README.md

@@ -194,7 +194,7 @@ The engine boot path starts in `server-rs/src/main.rs`, initializes environment
 | `execution/core/` | Modular skill framework foundation |
 | `directives/` | Governance, identity, orchestration, and provider operating instructions |
 | `docs/` | Architecture, operations, API reference, OpenAPI, and security docs |
-| `data/` | Local runtime data, including the default `tadpole.db` |
+| `data/` | Local runtime data (initialized on first boot with SQLite database `tadpole.db` and agent/model seed configs) |
 | `dist/` | Production dashboard build served by the Rust engine |
 | `tests/` | Shared frontend test setup and e2e support |
 
@@ -227,21 +227,24 @@ Detached windows are available at `/detached-view`, `/detached/swarm-pulse`, and
 
 ## API
 
-The Rust engine binds to `127.0.0.1:8000` by default. All application APIs are nested under `/v1`.
+The Rust engine binds to `127.0.0.1:8000` by default. Application APIs are nested under `/v1` alongside root operational endpoints `/health` and `/metrics`.
 
 Public routes:
 
 | Method | Route | Purpose |
 | --- | --- | --- |
+| `GET` | `/health` | Engine health check (root unauthenticated ping) |
 | `GET` | `/v1/engine/health` | Engine health check (unauthenticated ping) |
 
 Protected route groups and WebSocket streams:
 
 | Prefix / Route | Purpose |
 | --- | --- |
+| `/metrics` | Prometheus metrics scrape endpoint (`Authorization: Bearer <token>`) |
 | `/v1/engine/ws` | Live mission telemetry WebSocket stream (`Sec-WebSocket-Protocol: bearer.<token>`) |
 | `/v1/engine/live-voice` | Live voice audio WebSocket stream (`Sec-WebSocket-Protocol: bearer.<token>`) |
 | `/v1/agents` | Agent CRUD, graph, tasks, pause/resume, memory, ledger, claims, receipts |
+| `/v1/a2a` | Agent-to-Agent communication protocols and inter-agent delegation |
 | `/v1/oversight` | Decisions, ledger, quotas, audit trail, health, policy |
 | `/v1/infra` | Node discovery and infrastructure nodes |
 | `/v1/model-manager` | Providers, models, catalog, pulls, provider tests |

data/agents.json

@@ -65,8 +65,7 @@
     "theme_color": "#4fd1c5",
     "skills": [
       "code_review",
-      "debug",
-      "git_push"
+      "debug"
     ],
     "workflows": [
       "system_architecture_review",