docs(audit): record F-01-F-08 enterprise audit-fix evidence

Author: Aitomates

.planning/audits/260610-enterprise-audit-fix/CLASSIFICATION.md

@@ -0,0 +1,14 @@
+# Enterprise Audit-Fix Classification
+
+Source: `gsd-audit-fix --severity all --max 8`
+
+| ID | Severity | Classification | Finding |
+|---|---|---|---|
+| F-01 | High | Auto-fixable | Clean clone could not collect the shipped full test suite because required runtime modules and dependency/bootstrap files were missing. |
+| F-02 | High | Auto-fixable | CI ran only two static contract tests and could report green while the broader suite was broken. |
+| F-03 | High | Auto-fixable | `SessionStore` composed unvalidated session, stage, and attempt identifiers into filesystem paths. |
+| F-04 | High | Auto-fixable | Dashboard CORS allowed wildcard origins with credentials. |
+| F-05 | Medium | Auto-fixable | Repo write operations accepted arbitrary encodings and used non-atomic direct writes. |
+| F-06 | Medium | Auto-fixable | Missing `.gitignore` exposed secrets and runtime/test artifacts to accidental commits. |
+| F-07 | Medium | Manual-only | Legacy dashboard and MAF runtime contracts overlap and require an architectural consolidation decision. |
+| F-08 | Medium | Manual-only | Production authentication, worker isolation, and remote deployment boundaries remain intentionally unimplemented. |

.planning/audits/260610-enterprise-audit-fix/SUMMARY.md

@@ -0,0 +1,25 @@
+# Enterprise Audit-Fix Summary
+
+## Result
+
+Six auto-fixable findings were resolved. Two architecture/deployment findings remain manual-only.
+
+| ID | Status | Commit |
+|---|---|---|
+| F-01 | Fixed | `65cb4f2`, `f2b1210` |
+| F-02 | Fixed | `fa78d6b` |
+| F-03 | Fixed | `48bdb95` |
+| F-04 | Fixed | `92e3adf` |
+| F-05 | Fixed | `76eda85` |
+| F-06 | Fixed | `4975e0b` |
+| F-07 | Manual-only | Architecture decision required |
+| F-08 | Manual-only | Production boundary decision required |
+
+## Outcome
+
+- Restored a runnable clean-clone contract with declared dependencies, example configuration, launcher, and required runtime modules.
+- Replaced narrow green CI with full Windows/Linux validation.
+- Closed durable-state path traversal and wildcard credentialed CORS risks.
+- Made agent-driven repo writes atomic and UTF-8-only.
+- Protected local secrets and generated state from accidental commits.
+- Updated README claims to match the verified repository state.

.planning/audits/260610-enterprise-audit-fix/VERIFICATION.md

@@ -0,0 +1,23 @@
+# Enterprise Audit-Fix Verification
+
+## Automated Checks
+
+- `python -m pytest -q --tb=short`: 71 passed, 4 subtests passed
+- `python -m compileall autogen_starter autogen_dashboard maf_starter main.py -q`: passed
+- `node --check autogen_dashboard/static/app.js`: passed
+- `git diff --check`: passed
+- `python main.py providers`: launcher and provider inventory passed
+- `git check-ignore -v .env .pytest_cache .tmp-tests example.err.log`: expected ignore rules passed
+
+## Environment Note
+
+`python -m pip check` reports an unrelated workstation-level preview dependency mismatch:
+`agent-framework-core 1.0.0rc5` expects `azure-ai-projects>=2.0.0,<3.0`, while the shared environment contains `azure-ai-projects 2.0.0b3`.
+CI installs from `requirements.txt` in a clean environment and now treats dependency consistency as a required gate.
+
+## Manual Verification Remaining
+
+- Observe the Windows and Linux GitHub Actions jobs on PR #1 after push.
+- Exercise one real provider-backed dashboard run with a non-production key.
+- Decide whether to consolidate or retire the parallel legacy and MAF runtime contracts.
+- Define production authentication and isolated worker execution before any non-loopback deployment.