docs(audit): record F-01 through F-08 GSD results

Author: Aitomates

.planning/audits/260610-promptimprover-enterprise-audit-fix.md

@@ -0,0 +1,39 @@
+# GSD Audit-Fix: Promptimprover Enterprise Readiness
+
+**Date:** 2026-06-10
+**Invocation:** `$gsd-audit-fix --severity all --max 8`
+**Source:** Direct repository evidence fallback; no `.planning/phases` UAT artifacts exist.
+
+## Classification and Results
+
+| ID | Finding | Severity | Classification | Result |
+|---|---|---|---|---|
+| F-01 | Correlation behavior fails the full test suite | High | Auto-fixable | Fixed in `726200b` |
+| F-02 | npm audit reports vulnerable transitive dependencies | High | Auto-fixable | Fixed in `c4dc532` |
+| F-03 | npm tarball leaks local state, planning, source, tests, and nested archive | High | Auto-fixable | Fixed in `a216215` |
+| F-04 | Build uses Windows-only shell commands | High | Auto-fixable | Fixed in `6420017` |
+| F-05 | CI skips a test and does not validate build/package or Windows | High | Auto-fixable, push-blocked | Fixed locally in `audit/promptimprover-full-enterprise-local`; GitHub rejected workflow push because OAuth lacks `workflow` scope |
+| F-06 | Git tracks dependencies, generated outputs, runtime memory, and archives | High | Auto-fixable | Fixed in `69561f8` |
+| F-07 | Dashboard network binding is not explicitly loopback-only | High | Auto-fixable | Fixed in `ed20725` |
+| F-08 | Installer is Windows-only and lacks fail-fast validation | Medium | Auto-fixable | Fixed in `b954a3c` |
+
+## Verification
+
+- `npm ci --no-fund`: passed
+- `npm audit --omit=dev --audit-level=high`: 0 vulnerabilities
+- `npx tsc --noEmit`: passed
+- `npm test`: 15 files, 43 tests passed
+- `npm run build`: passed
+- `npm pack --dry-run`: 25 runtime-only entries
+- Windows installer: passed end-to-end
+- POSIX installer: shell syntax passed
+- Installed command: dashboard HTTP 200 on `127.0.0.1`
+- Git hygiene: 13,566 generated/runtime/dependency files removed from tracking
+
+## Manual-Only Follow-Up
+
+- Push the prepared CI workflow commit using a GitHub token with `workflow` scope.
+- Decide whether to retire or independently maintain duplicated `gemini-extension` and legacy `mcp-server` packages.
+- Design production remote HTTP MCP deployment with OAuth 2.1 or managed identity; current runtime is local stdio plus loopback dashboard.
+- Add release provenance, signed GitHub releases, SBOM generation, and a versioning policy.
+- Replace `universal-refiner/register-global.ps1` hard-coded paths and direct configuration mutation with an idempotent registration command.