3 people 7be725cc13 fix(security): disposition all 104 code-scanning + dependabot alerts (#375) ...

Fix the 4 real CodeQL path-injection alerts (open_conventions_pr trusted the
API-settable project.workspace_path with no containment) plus defense-in-depth
segment validation at the get_workspace_path chokepoint. Bump next 16.1.1->16.1.7
and transitive lockfile deps to clear 24 Dependabot alerts. Close the intake
subagent-ban gap: the Claude intake driver still carried the Task tool and the
prompter prompt told it to fan out research subagents, contradicting the
fleet-wide ban. The remaining 47 CodeQL + 29 Dependabot alerts are dismissed on
GitHub with per-alert justifications (guard patterns CodeQL can't model across
call hops; next 16.2.x blocked by the verified tab-hostage router regression).

Co-authored-by: Renn F <rennf93@users.noreply.github.com>

2026-07-10 00:15:04 +02:00

..

board.md

feat(marketing): HoM feature-spotlight X drafts + brand-voice charter (v0.18.0 B)

2026-07-04 07:34:40 +02:00

cell_pm.md

feat(gateway): root-owned acceptance criteria via declare_coverage (#357)

2026-07-09 03:17:20 +02:00

developer.md

chore(prompts): reflow hard-wrapped prose to satisfy the markdown gate

2026-07-04 07:36:58 +02:00

documenter.md

chore(comms): finalize #306 teardown — changelog + purge dangling refs

2026-07-04 03:42:04 +02:00

main_pm.md

feat(gateway): root-owned acceptance criteria via declare_coverage (#357)

2026-07-09 03:17:20 +02:00

pr_reviewer.md

Chore: 141 Gaps fill-in (#283)

2026-06-29 05:38:21 +02:00

prompter.md

fix(security): disposition all 104 code-scanning + dependabot alerts (#375)

2026-07-10 00:15:04 +02:00

qa.md

chore(comms): finalize #306 teardown — changelog + purge dangling refs

2026-07-04 03:42:04 +02:00

secretary.md

chore(comms): purge dead say()/channel refs the first sweep missed

2026-07-04 05:20:17 +02:00