Merge pull request #6 from HelixDevelopment/task/ATM-1809-pr-delivery-audit2-followups

docs(changelog): the follow-up entry records the re-audit of 4738d01d (NO-GO, R1 fixed by adbdd013, BW1 covered by 78bd4adb), the counts measured on 78bd4adb, and the wider over-report of short accounts that hold an i or an l (ATM-1809)

test(gates): the account-name mutation test covers the hyphen of the skeleton word class (a hyphenated account whose last part is written with digits) and says where its golden accounts do hit (audit-3 re-audit BW1 and a nit)

fix(gates): the note paragraph of both anchor-wired gates ends only at a blank line or a real ATX heading, so a line such as "#1 ..." or "####### ..." under or above a note is pinned text (audit-3 re-audit R1)

docs(changelog): the follow-up entry states how the series was applied and delivered, records audit 3 (NO-GO, B1 and B2 fixed) and its open follow-ups, and corrects the stale status sentences of the PR-5 entry with a pointer (ATM-1809)

Merge pull request #5 from HelixDevelopment/task/ATM-1809-pr-delivery-rules

docs(changelog): the unreleased §11.4.297 / §11.4.298 entry lists the fixes of the independent audit of 3220f22d (NO-GO), the merge of the moved upstream main and the counts measured on this tip; the entry of PR 4 no longer names an account

merge: upstream main e5fed962 (PR #4, hardening of test_guard_work_track_binding.sh) into task/ATM-1809-pr-delivery-rules: the base moved under the task branch, so it is merged, never rebased (§11.4.297(B)(5), §11.4.188)

fix(gates): CM-PR-DELIVERY-ACCOUNT-NAME-FREE scans every file class the change added or changed, in the raw text and in a normalised form (look-alike letters, invisible characters, full-width forms), reads the assignee list too and can add every file changed since a commit

fix(constitution): §11.4.297/§11.4.298 audit fixes: a merge needs a GO recorded for the merged head and a reviewed head that contains the remote base tip; branch deletion only after mirror parity; a first build stays BLOCKED-NO-BASELINE until the operator decides; load-bearing sentences and every gate-state cell pinned by the wired gates

Merge pull request #4 from HelixDevelopment/task/ATM-1809-guard-test-hardening-2

docs(changelog): unreleased entry for the hardening of test_guard_work_track_binding.sh after the review of PR 3, with the factual corrections to the PR 3 entry

test(hooks): test_guard_work_track_binding.sh resolves TMPDIR to an existing physical directory, covers the hook's track derivation from the cwd, and names each refusal's cause

Merge pull request #3 from HelixDevelopment/task/ATM-1809-guard-test-tmpdir

docs(changelog): unreleased entry for the test_guard_work_track_binding.sh TMPDIR fix: red and green counts, five paired mutants, what is not verified

Merge branch 'main' of github.com:HelixDevelopment/HelixConstitution

Auto-commit 1793970817873

Merge pull request #1 from HelixDevelopment/task/ATM-1809-gate-fixes

Merge upstream main 2739c26b4 into task/ATM-1809-gate-fixes (land the two reviewed gate fixes on the moved upstream tip)

docs(changelog): record independent review round 1 (NO-GO) on the unreleased gate-fix entry, the findings addressed, the counts before and after, the pre-check pack finding, and that round 2 is pending

fix(gates): CM-MULTITRACK-ENGINE-IN-CONSTITUTION compiles a python-declaring script, reads env options that take an argument, matches python exactly, and exits 2 when no temp file can be made; its mutation test gains eight gate mutants and a strict expect_fail (review round 1 findings 3 to 6)

fix(gates): CM-KILLPG-PGID-GUARD --exclude may not prune the scan root or an ancestor, is taken literally, and may not empty the scan into a SKIP (review round 1 findings 1 and 2)

docs: CONTINUATION Rev 15 (test servers, Anton SMB, rate-limit isolation)

merge: feat/test-servers (NFS/FTP/FTPS/SFTP/WebDAV/SMB:1445 live test servers)

qa: rootless live test servers (SMB/FTP/FTPS/SFTP/WebDAV/HTTP/NFS) over one deterministic corpus

docs: register SMB subdir + local-mode items; reclassify front-door item

merge: qa/second-host-20261106 live evidence (docs only)

merge: qa/anton-smb-20261106 live evidence (docs only)

qa: second-source login bucket isolation on stack 3 (3/3)

docs(qa): anton SMB live corpus evidence

docs: CONTINUATION Rev 14 wrap-up; register Tauri wizard ACL defect + desktop follow-ups

chore(full-suite): accept the excluded set lock (53 rows, adds tests/layout/hermetic_lint.py) on the operator's order (ownership wave 2)

Merge vehicle/ownership-wave2 (eacec3dc) into main bdc3ac43; land ownership wave 2 (review round 4 GO-with-follow-ups), re-mint its items as CON-108..CON-111, register follow-ups CON-112..CON-115

fix(ownership): wave 2 review round 3: dispatcher interactive routes run with timeout --foreground, real-pty dispatcher tests, RN1-RN3 killing legs, umask-honouring default mode, C02 lint advisory, follow-ups CON-072/CON-073 (sections 11.4.276, 11.4.289, 11.4.250, 11.4.202)

Merge main ecfe432 into vehicle/ownership-wave2; re-mint the vehicle's tracker items as CON-070/CON-071 (review round 3 N2, N7; sections 11.4.54, 11.4.93)

fix(ownership): wave 2 review round 3: tty-only adopt-install, rollback rename-over-link with fchmod, pinned runner and reviewer mutants, lint gaps, docs, CON-050 note (sections 11.4.101, 11.4.276, 11.4.287, 11.4.54)

docs: TRUSTED_PROXIES follow-ups, register status

merge: TRUSTED_PROXIES hardening — prod compose fixed proxy IP + ip_range, auto refused in release, fail-closed, nginx XFF (PROVISIONAL; GO-with-follow-ups round 2/5)

docs+test: TRUSTED_PROXIES round 2 (upgrade steps, DOCKER_NETWORK default, nginx scan)

fix(security): TRUSTED_PROXIES review round 1 (ip_range, upstream, nginx XFF, structural tests)

fix(security): TRUSTED_PROXIES prod compose pins, deprecate forgeable auto, fail closed

docs: re-scope front-door item; register TRUSTED_PROXIES F1/F2/F3-6

merge: TRUSTED_PROXIES policy extraction + characterization tests (GO-with-follow-ups round 1/5; defect NOT closed)

test: pin ClientIP derivation behind the nginx front door (CAT-FRONTDOOR-RATELIMIT-1)

docs: register front-door rate-limit bug + QA cleanup items

merge: live security evidence 2026-11-06 (prom auth, pprof, SSRF verified; front-door rate-limit attribution FAILED)

qa: live security verification evidence on stack 3 (2026-11-06)

docs: D7-R4 round-1 follow-ups

merge: D7-R4 contrast fixes + island detector (PROVISIONAL; GO-with-follow-ups round 1/5)

fix(catalog-web): D7-R4 contrast follow-ups (upload error text, pending chip, fetch restore, island detector)

docs: register Prom-auth, verify lan-bind, D7-R4 items (register rev 2)

merge: on-demand SonarQube QA service (rootless podman, guards+mutations; PROVISIONAL tooling; evidence is the OLD first run, fresh pinned-image run owed; GO-with-follow-ups round 3/5)

test(qa/sonarqube): review round 3 follow-ups FU-1..FU-4

fix(qa/sonarqube): review round 2 - no pipefail/SIGPIPE flakiness in up.sh checks, stronger guard tests

docs/fix(qa/sonarqube): honest evidence status, SHA256SUMS verify from tree, Docker Hub rate-limit handling

fix(qa/sonarqube): review round 1 - ownership labels, nproc load gate, digest pins, disk floor, tests+mutations

docs: Prometheus auth applied live; verify.py LAN-bind assertion follow-up

docs: Prometheus auth follow-ups

merge: Prometheus basic auth (CAT-PROM-AUTH-1; PROVISIONAL until applied+verified live; GO-with-follow-ups round 2/5)

fix(qa-monitoring): review round 1 for QA-PROM-AUTH (down.sh secrets, secret-leak assertions, input validation, wiring test)

feat(qa-monitoring): basic auth on Prometheus web.config.file (QA-PROM-AUTH)

docs: D7 round-4 follow-ups

merge: D7 follow-ups (FormatConverter dark boxes, UploadManager row, per-status badge tests; PROVISIONAL until web image rebuild + live check; GO-with-follow-ups round 1/5)

fix(web): dark variants for FormatConverter job boxes, distinct UploadManager queued row; D7 follow-up coverage

docs: follow-ups after live UI rerun

merge: live UI rerun on main-17ec3c1f (D7 class, D5/D6, D8, D1-D3, pprof gate; 3/3 identical; evidence docs/qa/ui-live-rerun-20261105-b)

docs(qa): live UI rerun on stack 3 main-17ec3c1f (D7 clean, N=3)

chore(full-suite): accept the excluded set lock (52 rows) on the operator's order (CON-031)

Merge vehicle/manifest-triage (7560e0f8) into main b939266a; land manifest triage (fix round 2, review r2 GO-with-follow-ups)

test(full-suite): probe, helpers and node tools become excluded rows; rows for the round-2 tests; census 850 (review F4, F5, F6, F10)

docs(tracker): register the manifest-triage round-1 follow-ups CON-100..CON-109 (review F3, F10, F11, F12, F13, inventory A-D; section 11.4.202, 11.4.276(G.2))

fix(test): install fixture upstream main is always the commit under test, in both layouts (review F8)

docs: workable-items register (29 items registered), CONTINUATION Rev 13 queue as pointer table