3 Commits

Include renames

Author	SHA1	Message	Date
cgalo5758	b245bdb0a9	Fix security audit findings from 2026-09-21 scan ... Remediate six confirmed security issues: deployment-only config keys, bounded provider responses, short-lived registration sessions, private init file mode, FedWiki workflow authorization, and switch preview gates. - Add DeploymentOnly config key declaration; refuse runtime overrides for keys that decide where secrets are sent - Create httplimit package; bound all provider response reads at 8 MiB - Set fifteen-minute deadline on /register sessions - Write mc-config.yaml with 0600 permissions - Derive FedWiki workflow IDs from site IDs; re-authorize sites before mutating activities - Apply switch authorization gates to the proration preview	2026-09-21 13:57:57 -05:00
cgalo5758	88db730fcc	Add dual licensing and SPDX headers ... Introduce a commercial license option alongside AGPL-3.0-only, require a CLA for contributors, and document the terms in COMMERCIAL.md and NOTICE. Add a script to stamp SPDX headers on Go files and apply it across the tree.	2026-09-06 02:29:42 -05:00
cgalo5758	e581bf81c3	Add typed config keys and config CLI ... Parse every config value through a single declared type at save, boot, and validate, and expose the settings seam from the terminal so operators can list, set, clear, and validate overrides without SQL.	2026-09-05 17:47:04 -05:00