fix: audit remediation — P0 correctness/security fixes + P1 product hardening#71

Merged

CodeWithJuber merged 13 commits into

claude/loop-goal-worktree-bugs-gqrxp8

Jul 17, 2026

Commits on Jul 17, 2026

fix(onboarding): safe settings write, hook-path parity, state/source separation
claude
committed
docs+wording: honest claims, terminology renames, drop scanner certification language
claude
committed
fix(core): inventory-aware atlas freshness, evidence-aware verify verdicts, resolvable ledger refs
claude
committed
fix(security): close shell secret-read bypass, jq-free redaction, tighter perms
claude
committed
fix(sync): validate managed-file body, not just the embedded marker
claude
committed
merge: workstream D — inventory-aware atlas, evidence-aware verify, resolvable ledger refs
claude
committed
merge: workstream G — honest claims, terminology renames, no scanner certification
claude
committed
style(biome): normalize formatting under root config
claude
committed
feat(mcp): context7 opt-in via forge integrations; update-aware emitters; wire honest labels
claude
committed
feat(pricing+release): effective-date model pricing; require full quality gate before publish
claude
committed
feat(product): policy profiles, repo config, obligation matrix, subsystem health, labs grouping
claude
committed
Merge remote-tracking branch 'origin/master' into claude/loop-goal-worktree-bugs-gqrxp8
claude
committed
chore(gitleaks): allowlist the placeholder token in the redactor test
claude
committed