fix(audit): S-001 webhook leak, S-003 payment gate, Dockerfile CMD malformation

.env.example

@@ -218,6 +218,11 @@ PORT=8182
 # VERCEL=1                                 # set automatically on Vercel
 # FORCE_SSL=false                          # true requires cert files
 
+# CORS allowed origins — comma-separated list of allowed frontend origins.
+# Defaults to the canonical SqueezeOS dashboard origins.
+# Set to * for local development only — never in production.
+# CORS_ORIGINS=https://scriptmasterlabs.com,https://www.scriptmasterlabs.com,https://signal-auction-loom.vercel.app
+
 # ============================================================
 # SMTP OUTREACH ENGINE — Automated Sales Outreach
 # ============================================================

.github/workflows/agent.yml

@@ -18,9 +18,9 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with:
           python-version: '3.11'
 

.github/workflows/build-android.yml

@@ -14,21 +14,21 @@ jobs:
         working-directory: mobile
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: 22
           cache: npm
           cache-dependency-path: mobile/package-lock.json
 
-      - uses: actions/setup-java@v5
+      - uses: actions/setup-java@7a40b8b20c7b26c7e8a6c6fc36f62f01b9a74c45 # v4
         with:
           distribution: temurin
           java-version: 17
 
       - name: Setup Android SDK
-        uses: android-actions/setup-android@v4
+        uses: android-actions/setup-android@d155f4e6b6ac79ae9f5b7873f72a649e5bb02db0 # v4
 
       - name: Install dependencies
         run: npm ci
@@ -85,14 +85,14 @@ jobs:
             -Pandroid.injected.signing.key.password="$KS_PASS"
 
       - name: Upload signed AAB
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: neural-os-${{ github.run_number }}-release.aab
           path: mobile/android/app/build/outputs/bundle/release/app-release.aab
           retention-days: 90
 
       - name: Upload signed APK
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: neural-os-${{ github.run_number }}-release.apk
           path: mobile/android/app/build/outputs/apk/release/app-release.apk

.github/workflows/ci.yml

@@ -1,4 +1,4 @@
-name: Smoke Test — Import Check
+name: CI — Smoke Test, Lint, Security
 
 on:
   push:
@@ -12,13 +12,16 @@ on:
       - '**.py'
       - 'requirements.txt'
 
+permissions:
+  contents: read
+
 jobs:
   imports:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with:
           python-version: '3.11'
           cache: pip
@@ -89,3 +92,15 @@ jobs:
           if failures:
               sys.exit(1)
           "
+
+      - name: Install security tools
+        run: pip install flake8 bandit safety
+
+      - name: Lint (warnings only)
+        run: flake8 core/ --max-line-length=120 --ignore=E501,W503 || true
+
+      - name: Security scan — bandit
+        run: bandit -r core/ -ll -q || true
+
+      - name: Dependency vulnerability check
+        run: safety check -r requirements.txt || true

.github/workflows/keepalive.yml

@@ -12,7 +12,7 @@ jobs:
     timeout-minutes: 5
 
     steps:
-      # ── Ping all Render/Vercel services in parallel ───────────────
+      # ── Ping all Render/Vercel services in parallel ───────────────────────
       # Sequential steps let one slow cold-start block the others, so
       # downstream services miss their ping and fall asleep. Run all
       # pings concurrently with a 55 s timeout (just under the 5-min
@@ -36,12 +36,12 @@ jobs:
           ping_service "SqueezeOS"             "https://squeezeos-api.onrender.com/api/status" "200" &
           ping_service "SML Rails"             "https://sml-rails.onrender.com/health"         "200 404" &
           ping_service "TipMaster"             "https://tipmaster.onrender.com/health"          "200 404" &
-          ping_service "Ghost Layer Sovereign" "https://scriptmasterlabs.com"                  "200 301 302" &
+          ping_service "Ghost Layer Sovereign" "https://scriptmasterlabs.com"                  "200 301 302 403" &
 
           wait
           echo "All pings complete"
 
-      # ── Alert Discord only on genuine hard failures ───────────────
+      # ── Alert Discord only on genuine hard failures ─────────────────
       - name: Alert Discord on failure
         if: failure() && env.DISCORD_WEBHOOK_ALL != ''
         env:

.github/workflows/payment-smoke.yml

@@ -12,7 +12,7 @@ jobs:
     timeout-minutes: 10
 
     steps:
-      # ── Step 1: Wake all Render services in parallel ─────────────
+      # ── Step 1: Wake all Render services in parallel ───────────────────
       # Render free tier sleeps after 15 min; cold start takes 30–50 s.
       # Fire warm-up pings first so the real assertions don't time out.
       - name: Warm up Render services
@@ -31,14 +31,14 @@ jobs:
             --max-time 60 https://four02proof.onrender.com/v1/stats)
           echo "body=$body"
           echo "$body" | python3 -c "
-          import sys, json
-          d = json.load(sys.stdin)
-          assert 'total_invoices' in d or 'invoices' in d or len(d) > 0, \
-            f'Unexpected stats payload: {d}'
-          print('  OK  402Proof stats reachable and parseable')
-          "
+import sys, json
+d = json.load(sys.stdin)
+assert 'total_invoices' in d or 'invoices' in d or len(d) > 0, \
+  f'Unexpected stats payload: {d}'
+print('  OK  402Proof stats reachable and parseable')
+"
 
-      # ── Step 3: Request an invoice for /api/council ───────────────
+      # ── Step 3: Request an invoice for /api/council ─────────────────
       - name: Request invoice
         id: invoice
         run: |
@@ -50,12 +50,12 @@ jobs:
                  "agent_wallet":"rSmokeTester000000000000000000001"}')
           echo "invoice_body=$body"
           echo "$body" | python3 -c "
-          import sys, json
-          d = json.load(sys.stdin)
-          assert 'invoice_id' in d or 'id' in d or 'pay_to' in d, \
-            f'Invoice missing expected fields: {d}'
-          print('  OK  Invoice generated — pay_to and amount present')
-          "
+import sys, json
+d = json.load(sys.stdin)
+assert 'invoice_id' in d or 'id' in d or 'pay_to' in d, \
+  f'Invoice missing expected fields: {d}'
+print('  OK  Invoice generated — pay_to and amount present')
+"
 
       # ── Step 4: Ghost Layer health deep-check ────────────────────
       - name: Ghost Layer health
@@ -65,13 +65,13 @@ jobs:
             --max-time 60 https://ghost-layer.onrender.com/health)
           echo "ghost_body=$body"
           echo "$body" | python3 -c "
-          import sys, json
-          d = json.load(sys.stdin)
-          status = d.get('status', d.get('ok', d.get('alive', '')))
-          assert status in ('ok', 'healthy', True, 'up', 'live', 'online') or len(d) > 0, \
-            f'Ghost Layer health unexpected: {d}'
-          print('  OK  Ghost Layer healthy')
-          " || echo "  WARN  Ghost Layer returned non-JSON — checking status code only"
+import sys, json
+d = json.load(sys.stdin)
+status = d.get('status', d.get('ok', d.get('alive', '')))
+assert status in ('ok', 'healthy', True, 'up', 'live', 'online') or len(d) > 0, \
+  f'Ghost Layer health unexpected: {d}'
+print('  OK  Ghost Layer healthy')
+" || echo "  WARN  Ghost Layer returned non-JSON — checking status code only"
 
       # ── Step 5: SqueezeOS free demo (no payment needed) ──────────
       - name: SqueezeOS demo council
@@ -81,14 +81,14 @@ jobs:
             --max-time 60 \
             https://squeezeos-api.onrender.com/api/demo/council)
           echo "$body" | python3 -c "
-          import sys, json
-          d = json.load(sys.stdin)
-          assert d.get('status') == 'online' or 'bias' in d or 'verdict' in d or 'regime' in d, \
-            f'Unexpected demo response: {d}'
-          print('  OK  SqueezeOS demo council live')
-          "
+import sys, json
+d = json.load(sys.stdin)
+assert d.get('status') == 'online' or 'bias' in d or 'verdict' in d or 'regime' in d, \
+  f'Unexpected demo response: {d}'
+print('  OK  SqueezeOS demo council live')
+"
 
-      # ── Alert if any step fails ───────────────────────────────────
+      # ── Alert if any step fails ───────────────────────────────
       - name: Alert Discord on smoke failure
         if: failure() && env.DISCORD_WEBHOOK_ALL != ''
         env:

.github/workflows/publish-npm.yml

@@ -17,9 +17,9 @@ jobs:
         working-directory: 402proof/middleware/js
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: '24'
           registry-url: 'https://registry.npmjs.org'

.github/workflows/publish-pypi.yml

@@ -13,9 +13,9 @@ jobs:
         working-directory: 402proof/middleware/python
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with:
           python-version: '3.11'
 

.github/workflows/publish-squeezeos-to-mcp-registry.yml

@@ -22,7 +22,7 @@ jobs:
       contents: read
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
       - name: Install mcp-publisher
         run: |