M16 Capstone — audit remediation (v5.3.0)#17

Open

flyingrobots wants to merge 26 commits intomainfrom

Commits on Mar 4, 2026

docs: add forensic architectural audit report
flyingrobots
committed
feat(roadmap): add M16 Capstone milestone — audit remediation
flyingrobots
committed
fix(errors): guard Error.captureStackTrace for cross-runtime portability
flyingrobots
committed
chore(hooks): rename git-hooks → hooks, add pre-commit lint gate
flyingrobots
committed
fix(lint): fix curly brace and unused imports from 16.8/16.9
flyingrobots
committed
fix(crypto): normalize adapter behavioral contracts across runtimes
flyingrobots
committed
feat(restore): add maxRestoreBufferSize guard for buffered restore
flyingrobots
committed
feat(cli): add passphrase file input and interactive TTY prompt
flyingrobots
committed
feat(chunking): enforce 100 MiB upper bound on chunk size
flyingrobots
committed
feat(crypto): add encryption buffer guard to WebCryptoAdapter
flyingrobots
committed
feat(store): warn when CDC chunking is combined with encryption
flyingrobots
committed
feat(store): track orphaned blobs on stream failure
flyingrobots
committed
perf(chunking): replace Buffer.concat loop with pre-allocated buffer
flyingrobots
committed
refactor(api): rename lifecycle methods with deprecated aliases
flyingrobots
committed
feat(security): add KDF brute-force awareness metrics and CLI delay
flyingrobots
committed
feat(security): add encryption counter and move SECURITY.md to root
flyingrobots
committed
docs(roadmap): add V7 (OTLP observability adapter) and V8 (auto-rotation)
flyingrobots
committed
test(vault): wire observability port into VaultService tests
flyingrobots
committed
docs(changelog): fix test count (46, not 78)
flyingrobots
committed
docs(changelog): drop exact test count from observability entry
flyingrobots
committed
fix(cli): defer passphrase prompt until vault encryption is confirmed
flyingrobots
committed
fix: validate constructor params for buffer/chunk size bounds
flyingrobots
committed
fix(restore): enforce size limit after decompression
flyingrobots
committed
test: harden error-path assertions to fail on missing throws
flyingrobots
committed
docs: fix JSDoc return types, add maxRestoreBufferSize param, fix heading level
flyingrobots
committed
docs(changelog): add PR feedback fixes to unreleased section
flyingrobots
committed