feat: multi-entity consolidated reporting and tax automation

.claude/mcp.json

@@ -6,9 +6,9 @@
       "args": [
         "-y",
         "@modelcontextprotocol/server-filesystem",
-        "/Volumes/chitty"
+        "/Users/nb/Desktop/Projects/github.com/CHITTYAPPS/chittyfinance"
       ],
-      "description": "File system access for ChittyOS development volume"
+      "description": "File system access for the ChittyFinance repository"
     }
   }
 }

.github/workflows/codeql.yml

@@ -0,0 +1,31 @@
+name: CodeQL
+
+on:
+  pull_request:
+    branches: [main]
+  push:
+    branches: [main]
+  schedule:
+    - cron: "0 6 * * 1"
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      contents: read
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v3
+        with:
+          languages: javascript-typescript
+
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@v3
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v3

.github/workflows/security-gates.yml

@@ -0,0 +1,98 @@
+name: Security Gates
+
+on:
+  pull_request:
+    branches: [main]
+  push:
+    branches: [main, develop]
+  workflow_dispatch:
+
+concurrency:
+  group: security-gates-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  workflow-secret-policy:
+    name: Workflow Secret Policy
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Enforce workflow secret policy
+        run: ./scripts/security/check-workflow-secrets.sh
+
+  working-tree-secret-scan:
+    name: Working Tree Secret Scan
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Scan for high-risk secret patterns
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          if grep -RInE \
+            --exclude-dir=.git \
+            --exclude-dir=node_modules \
+            --exclude-dir=dist \
+            --exclude-dir=.wrangler \
+            --exclude='*.png' \
+            --exclude='*.jpg' \
+            --exclude='*.jpeg' \
+            --exclude='*.gif' \
+            'ghp_[A-Za-z0-9]{20,}|sk_live_[A-Za-z0-9]{20,}|AKIA[0-9A-Z]{16}|BEGIN (RSA|EC|OPENSSH|PGP)? ?PRIVATE KEY' .; then
+            echo "Secret-like pattern detected in working tree."
+            exit 1
+          fi
+
+          echo "Working tree secret scan passed."
+
+  dependency-audit:
+    name: Dependency Audit (High+)
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Install pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 10
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          cache: 'pnpm'
+
+      - name: Resolve package root
+        id: pkg
+        run: |
+          set -euo pipefail
+          if [ -f package.json ]; then
+            echo "dir=." >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          if [ -f development/chittyschema/package.json ]; then
+            echo "dir=development/chittyschema" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          echo "dir=" >> "$GITHUB_OUTPUT"
+          echo "No Node package root detected; skipping dependency audit."
+
+      - name: Install dependencies
+        if: steps.pkg.outputs.dir != ''
+        run: |
+          set -euo pipefail
+          cd "${{ steps.pkg.outputs.dir }}"
+          pnpm install --frozen-lockfile
+
+      - name: Enforce audit high threshold
+        if: steps.pkg.outputs.dir != ''
+        run: |
+          set -euo pipefail
+          cd "${{ steps.pkg.outputs.dir }}"
+          pnpm audit --prod --audit-level high

.gitignore

@@ -3,7 +3,6 @@ dist
 .DS_Store
 server/public
 vite.config.ts.*
-*.tar.gz
 
 # Environment files with secrets
 .env
@@ -22,4 +21,23 @@ vite.config.ts.*
 *.db
 *.db-shm
 *.db-wal
-migrations/
+migrations/
+
+# Chat agent (separate project, has its own node_modules)
+chat-agent/
+
+# Lockfile (using pnpm)
+package-lock.json
+
+# Large binary/archive files
+*.zip
+*.tar.gz
+
+# Replit artifacts
+.replit
+replit.md
+attached_assets/
+generated-icon.png
+
+# One-off patches and scripts
+*.patch