fix(bootstrap): round-3 reviewer findings on PR #74 (RAN-47)

Four blockers raised on `1dad7e7`:

1. `<failOnError>false</failOnError>` weakens the CVE gate (silent pass on
   feed/DB failure). Replaced with the right mitigation:
   - Keep failOnError at default true (gate is hard again)
   - Add `<dataDirectory>` so the H2 NVD cache lives at a stable path
   - Add `<nvdApiKey>${env.NVD_API_KEY}</nvdApiKey>` so a configured secret
     drives the authenticated NVD endpoint (drastically lower throttle/5xx)
   - ci-java.yml: actions/cache for the NVD data dir keyed on run + restore
     so the H2 cache is incrementally updated rather than rebuilt every PR
   - ci-java.yml: pass `NVD_API_KEY: ${{ secrets.NVD_API_KEY }}` (no-op when
     the secret is unset; configured under RAN-42)
   The fail-open path is gone. CVE findings AND scanner-operational
   failures both red the build.

2. `rollback.md` documented `git revert -m 1 <merge-sha>` for squash
   merges. Squash merges are single-parent; `-m` only applies to true
   multi-parent merge commits. Replaced with `git revert <squash-sha>`
   plus a one-line explanation of when `-m 1` is correct.

3. `CLAUDE.md` Deploy section claimed `release-java.yml` is triggered by
   `vX.Y.Z` tag pushes. Reality (and now the runbook in `release.md` §3)
   is `workflow_dispatch`-only — the workflow itself creates the release
   commit and pushes the signed annotated tag. Updated CLAUDE.md to match.

4. `engineering-standards.md` §1 quality-gate table promised an OSV-Scanner
   gate "weekly cron + on PR" that no workflow in this PR implements.
   Dropped the row and added a "Planned, not yet enforced" footnote
   pointing at RAN-42. The table now reflects what is actually wired:
   OWASP Dependency-Check on every PR is the single CVE gate.

Refs RAN-47.

Author: aksOps

.github/workflows/ci-java.yml

@@ -18,7 +18,25 @@ jobs:
           distribution: 'temurin'
           java-version: '25'
           cache: 'maven'
-      - run: mvn clean verify -B
+      # Cache the OWASP Dependency-Check NVD data directory across runs so the
+      # CVE gate does not need to re-download the full feed on every PR.
+      # `key` is unique per run (forces a save on every run), `restore-keys`
+      # falls back to the most recent prior cache so the H2 DB is incrementally
+      # updated rather than rebuilt.
+      - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        with:
+          path: ~/.m2/repository/org/owasp/dependency-check-data
+          key: dependency-check-${{ runner.os }}-${{ github.run_id }}
+          restore-keys: |
+            dependency-check-${{ runner.os }}-
+      - name: Build + verify (jacoco 85% + SpotBugs + dependency-check)
+        env:
+          # When the NVD_API_KEY secret is unset, dependency-check falls back
+          # to the unauthenticated NVD endpoint (rate-limited but functional
+          # once the cache is warm). Provisioning the secret is tracked under
+          # RAN-42.
+          NVD_API_KEY: ${{ secrets.NVD_API_KEY }}
+        run: mvn -B -ntp clean verify
       - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v4.6.2
         if: always()
         with:

CLAUDE.md

@@ -431,7 +431,7 @@ bean for code paths that haven't been ported yet.
 
 ## Deploy
 
-codeiq's deploy surface is **Maven Central + GitHub Releases** (per RAN-46 AC #10 ruling, option a). The single Java JAR (with the React UI bundled inside) is published via `.github/workflows/beta-java.yml` (`workflow_dispatch` → Sonatype Central beta + GitHub pre-release) and `.github/workflows/release-java.yml` (`vX.Y.Z` tag → Sonatype Central GA + GitHub Release). There is no static-CDN frontend, no hosted backend, no VPS — codeiq runs on the developer's machine. See [`shared/runbooks/release.md`](shared/runbooks/release.md) and [`shared/runbooks/engineering-standards.md`](shared/runbooks/engineering-standards.md) §7.1.
+codeiq's deploy surface is **Maven Central + GitHub Releases** (per RAN-46 AC #10 ruling, option a). The single Java JAR (with the React UI bundled inside) is published via two `workflow_dispatch`-only workflows: `.github/workflows/beta-java.yml` (manual beta cut → Sonatype Central beta + GitHub pre-release) and `.github/workflows/release-java.yml` (manual GA cut with a `version` input → the workflow builds a GPG-signed release commit on a detached HEAD, deploys from that exact tree, then creates and pushes a GPG-signed annotated `vX.Y.Z` tag pointing at the release commit + a GitHub Release). There is no static-CDN frontend, no hosted backend, no VPS — codeiq runs on the developer's machine. See [`shared/runbooks/release.md`](shared/runbooks/release.md) and [`shared/runbooks/engineering-standards.md`](shared/runbooks/engineering-standards.md) §7.1.
 
 ## Updating This File
 

pom.xml

@@ -407,18 +407,26 @@
                 <artifactId>dependency-check-maven</artifactId>
                 <version>${owasp.dependency-check.version}</version>
                 <configuration>
-                    <!-- Fail build on High/Critical CVEs (CVSS >= 7) per security.md -->
+                    <!-- Hard gate: build fails on High/Critical CVEs (CVSS >= 7)
+                         per security.md AND on operational failures of the
+                         scanner itself. failOnError stays at the default (true)
+                         so a silent NVD-feed degradation does NOT pass as a
+                         green build (Reviewer round-3 finding #1). -->
                     <failBuildOnCVSS>7</failBuildOnCVSS>
-                    <!-- Do NOT fail the build on NVD-feed download/connection
-                         hiccups (the upstream NVD API is rate-limited and
-                         occasionally returns 5xx, which would otherwise red-X
-                         every PR). The gate still fails on real CVE findings
-                         via failBuildOnCVSS above; transient NVD outages just
-                         skip the analysis for that run.
-                         RAN-42 tracks making the gate fully robust (NVD API
-                         key, cached data, etc.); this is the minimal compromise
-                         to satisfy RAN-46 AC #5 without breaking PRs. -->
-                    <failOnError>false</failOnError>
+                    <!-- Stable on-disk cache directory. ci-java.yml caches
+                         this path between runs (actions/cache), which is the
+                         primary mitigation for transient NVD-feed/H2 issues:
+                         after the first successful run on a fresh runner, the
+                         cache holds a pre-populated H2 DB and incremental
+                         updates are short. -->
+                    <dataDirectory>${user.home}/.m2/repository/org/owasp/dependency-check-data</dataDirectory>
+                    <!-- Use NVD_API_KEY when available (drastically reduces
+                         throttle / 5xx rates from the NVD API). The build
+                         falls back to the unauthenticated path when the
+                         secret is unset; that path is rate-limited but works
+                         once the cache is warm. RAN-42 tracks the secret
+                         provisioning + a dedicated nightly NVD-refresh job. -->
+                    <nvdApiKey>${env.NVD_API_KEY}</nvdApiKey>
                 </configuration>
                 <executions>
                     <!-- Bind dependency-check:check into the verify phase so

shared/runbooks/engineering-standards.md

@@ -14,13 +14,14 @@ The rule of last resort: **`/home/dev/.claude/rules/*.md` wins.** This file does
 | JaCoCo coverage | ≥ 85% line, ≥ 75% branch (project-wide, post-exclusions) | `jacoco-maven-plugin` rule in `pom.xml` | Block merge |
 | SonarCloud Quality Gate | `Passed` (`Sonar way` profile + 80% new-code coverage) | `ci-java.yml` | Block merge |
 | SpotBugs | Zero High/Critical findings; `spotbugs-exclude.xml` justified per-entry | `mvn spotbugs:check` | Block merge |
-| OWASP Dependency-Check | No High/Critical CVEs (`failBuildOnCVSS=7`); Medium tracked | `mvn dependency-check:check` (CI nightly + on `release-java.yml`) | Block release |
-| OSV-Scanner | Clean, or every finding has a justification commit on file | weekly cron + on PR | Block release on High/Critical |
+| OWASP Dependency-Check | No High/Critical CVEs (`failBuildOnCVSS=7`); Medium tracked | `mvn -B -ntp clean verify` (the `dependency-check:check` execution is bound to the `verify` phase in `pom.xml`); `ci-java.yml` runs on every PR + push to `main` | Block merge |
 | OpenSSF Scorecard | Best-effort; no hard score floor; `Pinned-Dependencies` is a soft target | `scorecard.yml` (push to `main` + weekly) | Surface in security tab; do **not** gate merge |
 | Signed commits | Every commit on `main` must verify | Branch protection + `gh api ... /commits/{sha}/check-runs` | Block merge |
 
 Coverage exclusions are enumerated in `pom.xml` `<jacoco>` config — only generated ANTLR sources, the `application/` Spring Boot main, and pure data records are excluded. Adding to that list requires TechLead sign-off.
 
+**Planned, not yet enforced:** OSV-Scanner as a second-source CVE feed (cross-checks OWASP Dependency-Check against the OSV / GitHub Advisory Database). Tracked under [RAN-42](/RAN/issues/RAN-42); will land as `.github/workflows/osv-scanner.yml` and a row added to the table above. Until then OSV is **not** part of the gate — only OWASP Dependency-Check is.
+
 ---
 
 ## 2. Code style

shared/runbooks/rollback.md

@@ -25,7 +25,13 @@ If you are not sure, default to §2 and revert.
 ```bash
 git fetch origin main
 git switch -c revert/<short-name> origin/main
-git revert -m 1 <merge-sha>      # for squash merges, target the squash commit
+
+# Squash-merged PRs land as a single commit with one parent. Plain `git revert`
+# applies — do NOT pass `-m`, which only makes sense for true (multi-parent)
+# merge commits. Use `-m 1` only if `main` ever carries an actual merge commit
+# (which the squash-merge-only branch protection should prevent).
+git revert <squash-merge-sha>
+
 git push -u origin revert/<short-name>
 gh pr create --base main --fill --title "revert: <short-name>" --label "type:revert"
 gh pr merge --squash --auto