Audit remediation: 12 findings, plus the pb-nebula bump that makes Nebula revocation real - #9

Merged

skeeeon merged 14 commits into

mainfrom

fix/audit-remediation

Sep 9, 2026

Commits on Sep 9, 2026

fix(authz): a blank organization is not a tenancy match

skeeeon
and
claude
committed
f903acf
fix(leaf-sync): reconnect to the local bus forever, not 60 times

skeeeon
and
claude
committed
b016e2f
fix(leaf-sync): retry a failed twin relay, and never purge on a short fetch

skeeeon
and
claude
committed
ba90e15
fix(decommission): revoke the Nebula certificate too, not just the NATS one

skeeeon
and
claude
committed
a626930
fix(testutil,demoseed): make the harness agree with the binary, and revoke properly

skeeeon
and
claude
committed
78499ce
docs(security): state what at-rest encryption covers, and what it does not

skeeeon
and
claude
committed
f235d0b
ci: run the checks that already existed, and unblock the gofmt gate

skeeeon
and
claude
committed
53a1104
fix(metrics): stop counting every rule rejection as a server error

skeeeon
and
claude
committed
4131abe
fix(dashboard): one source of widget defaults, and a compiler-checked config map

skeeeon
and
claude
committed
8b00869
docs: correct the bootstrap step count, the contract layer, and the check count

skeeeon
and
claude
committed
0f6852a
test(ui): cover the five files most dangerous to change blind

skeeeon
and
claude
committed
3359610
fix(ui): make ConfirmDialog an actual dialog

skeeeon
and
claude
committed
7a44700
docs: note the Windows gofmt noise, and the frontend test entry point

skeeeon
and
claude
committed
12f1bf8
deps: pb-nebula v0.2.0, so the Nebula revocation half stops being inert

skeeeon
and
claude
committed
989762c