feat: ship v8.93 signed Compose blueprint catalog

.env.example

@@ -51,6 +51,13 @@ ENCRYPTION_KEY=change-me-to-a-random-32-char-hex
 # GIT_DEPLOYMENT_RETENTION_DAYS=90
 # GIT_POLLING_MIN_INTERVAL=60
 
+# ── Compose Stack Discovery ──────────────────────────────
+# Comma-separated directories visible inside Docker Dash. Compose files found
+# up to three levels deep remain listed even when all their containers are down.
+# DD_STACKS_DIR=/opt/stacks
+# Host directory mounted at the same path by docker-compose.yml.
+# DD_STACKS_HOST_DIR=/opt/stacks
+
 # ── SSO / Header-Based Auth ─────────────────────────────
 # Enable to trust X-Forwarded-User headers from Authelia/Authentik/Traefik
 # WARNING: Only enable behind a trusted reverse proxy!
@@ -77,7 +84,109 @@ ENCRYPTION_KEY=change-me-to-a-random-32-char-hex
 # ENABLE_CREATE=true
 # ENABLE_REMOVE=true
 # ENABLE_MULTI_HOST=false
+
+# Workstation fleet / bootc / Foreman integration
+# Read-only control plane and inventory sync are enabled by default. Remote
+# Foreman jobs remain unavailable until explicitly canaried and allowlisted.
+# DD_WORKSTATION_FLEET=true
+# DD_WORKSTATION_FOREMAN_MUTATIONS=false
+# DD_WORKSTATION_FOREMAN_TIMEOUT_MS=30000
+# DD_WORKSTATION_FOREMAN_MAX_PAGES=20
+# DD_WORKSTATION_FOREMAN_MAX_ITEMS=2000
+# DD_WORKSTATION_FOREMAN_MAX_FACT_HOSTS=500
+# DD_WORKSTATION_FOREMAN_FACT_CONCURRENCY=5
+# DD_WORKSTATION_EVIDENCE_MAX_AGE_HOURS=24
+# DD_WORKSTATION_FOREMAN_JOB_TIMEOUT_MINUTES=120
+# Exact numeric Foreman job_template_id values, comma-separated
+# DD_WORKSTATION_FOREMAN_JOB_TEMPLATES=101,102
 # READ_ONLY_MODE=false
+# DD_PROVIDER_SDK_V2=true
+# DD_PROVIDER_VM_POWER=false
+# DD_PROVIDER_VM_SNAPSHOTS=false
+# vSphere-only snapshot disk consolidation. Requires current provider evidence and typed confirmation.
+# DD_PROVIDER_VM_SNAPSHOT_CONSOLIDATION=false
+# DD_PROVIDER_VM_SNAPSHOT_AUTOMATION=false
+# DD_PROVIDER_VM_ACTION_SCHEDULES=false
+# DD_PROVIDER_VM_PROVISIONING=false
+# DD_PROVIDER_VM_GUEST_CUSTOMIZATION=false
+# DD_PROVIDER_VM_CONSOLE=false
+# DD_PROVIDER_VM_MIGRATION=false
+# DD_PROVIDER_HOST_MAINTENANCE=false
+# DD_PROVIDER_HA_READINESS=false
+# Read-only affinity inventory, placement recommendations and rebalance dry-runs.
+# DD_PROVIDER_PLACEMENT_ADVISORY=false
+# DD_PROVIDER_PLACEMENT_FRESHNESS_MS=60000
+# DD_PROVIDER_PLACEMENT_MAX_REBALANCE_VMS=20
+# DD_PROVIDER_PLACEMENT_ENDPOINT_CONCURRENCY=2
+# DD_PROVIDER_PLACEMENT_PLAN_TTL_MS=300000
+# DD_PROVIDER_HA_POLICY_MUTATION=false
+# DD_PROVIDER_AFFINITY_MUTATION=false
+# DD_PROVIDER_REBALANCE_APPLY=false
+# Read-only Proxmox VE/PBS and Xen Orchestra recovery-point inventory.
+# DD_PROVIDER_RECOVERY_POINT_INVENTORY=false
+# Plan-only provider backup policies. Does not authorize backup or prune execution.
+# DD_PROVIDER_BACKUP_POLICIES=false
+# Durable Proxmox vzdump execution; also requires per-policy typed authorization.
+# Never authorizes retention deletion.
+# DD_PROVIDER_BACKUP_EXECUTION=false
+# Create-only, durable Proxmox VE VM/CT restore from canonical recovery points.
+# DD_PROVIDER_RECOVERY_RESTORE=false
+# Isolated restore, boot/agent assertions, evidence and success-only cleanup.
+# DD_PROVIDER_RESTORE_DRILLS=false
+# DD_PROVIDER_DR_RUNBOOKS=false
+# File-catalog evidence, advanced restore preflights and draft replication policies.
+# Does not enable provider file transfer, restore, backup copy or replication mutations.
+# DD_PROVIDER_RESTORE_REPLICATION_DEPTH=false
+# DD_PROVIDER_SECURITY_ASSURANCE=false
+# Official-advisory correlation, exceptions, dry-run remediation and secret-reference validation.
+# DD_PROVIDER_SECURITY_LIFECYCLE=false
+# Allowlisted adapter execution; additionally requires plan hash, canary and typed confirmation.
+# DD_PROVIDER_SECURITY_LOW_RISK_REMEDIATION=false
+# Scoped JIT, break-glass, session metadata, classification and compliance evidence.
+# No standalone temporary account, screen media recorder or public-key attestation is enabled.
+# DD_PROVIDER_PRIVILEGED_COMPLIANCE=false
+# Provider VM disk create/attach, detach, grow and storage move. Disabled by default.
+# DD_PROVIDER_VM_DISK_LIFECYCLE=false
+# Permanent deletion remains a separate, stricter release decision.
+# DD_PROVIDER_VM_DISK_DELETE=false
+# DD_PROVIDER_VM_DISK_PLAN_TTL_MS=300000
+# DD_PROVIDER_VM_DISK_MIN_SIZE_MIB=64
+# DD_PROVIDER_VM_DISK_HEADROOM_PERCENT=10
+# DD_PROVIDER_VM_DISK_DELETE_RECOVERY_MAX_AGE_HOURS=24
+# VM NIC connect/disconnect is canaried independently for each provider.
+# Disconnect additionally requires a current, hardware-bound admin safety declaration.
+# DD_PROVIDER_VM_NIC_LINK_PROXMOX=false
+# DD_PROVIDER_VM_NIC_LINK_VSPHERE=false
+# DD_PROVIDER_VM_NIC_LINK_XEN=false
+# DD_PROVIDER_VM_NIC_SAFETY_MAX_HOURS=4
+# DD_PROVIDER_VM_NIC_VERIFY_TIMEOUT_MS=120000
+# DD_PROVIDER_PLACEMENT_CHANGE_CONCURRENCY=2
+# DD_PROVIDER_PLACEMENT_CHANGE_MAX_MOVES=20
+# DD_PROVIDER_PLACEMENT_CHANGE_APPROVAL_TTL_MS=900000
+# DD_PROVIDER_VM_CONSOLE_TOKEN_TTL_SECONDS=45
+# DD_PROVIDER_VM_CONSOLE_MAX_PENDING_PER_USER=5
+# DD_PROVIDER_VM_CONSOLE_MAX_ACTIVE_PER_USER=3
+# DD_PROVIDER_VM_CONSOLE_MAX_ACTIVE_PER_IP=5
+# DD_PROVIDER_VM_CONSOLE_MAX_SESSION_SECONDS=3600
+# managed = database locks, deny = incident-response fail-closed, allow = recovery override
+# DD_PROVIDER_VM_CONSOLE_ACCESS_OVERRIDE=managed
+# DD_PROVIDER_VM_SNAPSHOT_MAX_COUNT=32
+# DD_PROVIDER_VM_SNAPSHOT_MAX_DEPTH=16
+# Durable provider-operation worker bounds (restart required).
+# DD_PROVIDER_OPERATION_CONCURRENCY=4
+# DD_PROVIDER_OPERATION_POLL_MS=1000
+# DD_PROVIDER_OPERATION_LEASE_MS=30000
+# Provider endpoint protection: bounded concurrency, queue, timeout and circuit breaker.
+# DD_PROVIDER_MAX_CONCURRENCY=2
+# DD_PROVIDER_MAX_QUEUE=64
+# DD_PROVIDER_REQUEST_TIMEOUT_MS=30000
+# DD_PROVIDER_CIRCUIT_FAILURES=3
+# DD_PROVIDER_CIRCUIT_COOLDOWN_MS=30000
+# DD_PROVIDER_CONFORMANCE_RETENTION_DAYS=365
+# Emergency out-of-band terminal policy: managed (UI/DB), deny (force closed),
+# or allow (recovery override that temporarily ignores DB terminal locks).
+# Changing this value requires an application restart.
+# DD_TERMINAL_ACCESS_OVERRIDE=managed
 
 # ── Enterprise Security ─────────────────────────────────
 # SECURITY_MODE=standard

.github/workflows/ci.yml

@@ -24,11 +24,37 @@ jobs:
         run: npm ci
 
       - name: Check for critical vulnerabilities (production deps only)
-        # Only PRODUCTION dependencies gate CI. npm audit hits the live advisory
-        # DB, so auditing dev tooling (jest/eslint/etc.) made CI flip red with no
-        # code change whenever a new advisory dropped. `--omit=dev` keeps a real
-        # gate on shipped code while removing that flakiness.
-        run: npm audit --audit-level=critical --omit=dev
+        # npm's retired Quick Audit fallback can reject a valid lockfile when the
+        # Bulk Advisory endpoint returns invalid data. Use Google's first-party
+        # OSV scanner instead, pinned and checksum-verified for reproducibility.
+        # The validator preserves the existing policy: dev-only findings are
+        # excluded and only production findings with CVSS >= 9.0 fail the build.
+        env:
+          OSV_VERSION: '2.3.8'
+          OSV_LINUX_AMD64_SHA256: 'bc98e15319ed0d515e3f9235287ba53cdc5535d576d24fd573978ecfe9ab92dc'
+        run: |
+          curl --fail --silent --show-error --location \
+            "https://github.com/google/osv-scanner/releases/download/v${OSV_VERSION}/osv-scanner_linux_amd64" \
+            --output /tmp/osv-scanner
+          echo "${OSV_LINUX_AMD64_SHA256}  /tmp/osv-scanner" | sha256sum --check --strict
+          chmod +x /tmp/osv-scanner
+
+          set +e
+          /tmp/osv-scanner scan source \
+            --lockfile package-lock.json \
+            --format json \
+            --verbosity error \
+            --output-file /tmp/osv-results.json
+          SCAN_STATUS=$?
+          set -e
+
+          # OSV returns 1 when it found vulnerabilities. Other non-zero exit
+          # codes represent scanner/input failures and must not be suppressed.
+          if [ "$SCAN_STATUS" -ne 0 ] && [ "$SCAN_STATUS" -ne 1 ]; then
+            exit "$SCAN_STATUS"
+          fi
+
+          node scripts/check-osv-results.js /tmp/osv-results.json 9
 
       - name: Validate JavaScript syntax (backend)
         run: |
@@ -90,6 +116,15 @@ jobs:
             console.log('i18n validation passed');
           "
 
+      - name: Validate self-service localization safety copy
+        run: npm run check:self-service-i18n
+
+      - name: Validate self-service accessibility contract
+        run: npm run check:self-service-a11y
+
+      - name: Validate virtualization research registry
+        run: npm run check:virtualization-research
+
       - name: Summary
         if: always()
         run: |