Tracking: enforcement-baseline — deterministic security enforcement per ADR-401

[aaronsb]

Successor cluster to internet-hardening (#442, May 2026). That round fixed what the endpoints enforce; this round makes the conventions machine-enforced so they survive maintainer gaps — motivated by finding a #439-class regression (#501) two weeks after the May fixes landed.

Decision record: ADR-401 — Deterministic Security Enforcement Baseline (docs/architecture/authentication-security/)
Audit: docs/security/security-consistency-audit-2026-06-09.md

Work items, in ADR priority order:

• CI: make lint_queries.py blocking (remove '|| true') and fix stale baseline annotations #496 — CI: make lint_queries.py blocking; fix stale baseline annotations
• lint_queries.py: detect raw string interpolation into Cypher; fix two dormant injection sites #497 — lint_queries.py interpolation rule; fix two dormant injection sites
• Error-detail hygiene: lint against HTTPException(detail=str(e)) and burn down 155 instances #498 — Error-detail hygiene: str(e) lint + 155-instance burn-down
• Route-contract lint: require response_model= and explicit auth dependency or '# public:' marker on every endpoint #499 — Route-contract lint: response_model + auth/# public: marker
• CI: run the API auth/permission test suite on every PR (compose-based job) #500 — CI: run the auth/permission test suite on every PR
• Infra config asserts: prod port exposure, nginx security headers/HSTS, weak .env.example secrets + startup refusal #502 — Infra config asserts: ports, nginx headers, weak-secret refusal
• Baseline supply-chain & secret hygiene: gitleaks, pip-audit/npm audit/cargo-audit, dependabot #503 — gitleaks, dependency audits, dependabot

Quick fix (not gated on tooling):

• SECURITY (low): query_definitions.py uses get_current_user — disabled accounts retain access (regression/miss from #439) #501 — query_definitions.py get_current_active_user

Per ADR-401: new security conventions introduced after this cluster ship with their enforcement check in the same PR. Close this when all items above are closed and ADR-401 moves to Accepted.