docs: comprehensive README/CHANGELOG audit and corrections for v1.9.0

- Fix ENABLE_WORKERS env var references to CYBERCHEF_ENABLE_WORKERS across
  README.md, docs/releases/v1.9.0.md, and example configurations
- Update upstream-monitor cron schedule references from "every 6 hours" to
  "weekly (Sundays at noon UTC)" in README.md CI/CD section and features list
- Update Dockerfile base image references from node:18-alpine to Chainguard
  distroless in docs/architecture/architecture.md and CLAUDE.md
- Expand architecture diagram to include transport layer and worker pool
- Update CLAUDE.md: coverage thresholds (75%/90%/70%), full MCP tools list,
  complete CI/CD workflow table (10 workflows), Chainguard base image
- Add [Unreleased] section to CHANGELOG.md documenting upstream-monitor
  schedule change and all documentation corrections
- Mark all v1.2.0-v1.9.0 releases as "Released" in ROADMAP.md with status
  column, update v1.9.0 description to reflect actual features delivered
- Stage upstream-monitor.yml cron schedule change (6h -> weekly Sunday noon)
- Update ref-proj/CyberChef submodule to latest upstream

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: doublegate

.github/workflows/upstream-monitor.yml

@@ -2,8 +2,8 @@ name: Upstream Release Monitor
 
 on:
   schedule:
-    # Run every 6 hours
-    - cron: '0 */6 * * *'
+    # Run once per week: Sunday at 12:00 UTC (mid-day)
+    - cron: '0 12 * * 0'
   workflow_dispatch: # Allow manual trigger
 
 permissions:

CHANGELOG.md

@@ -7,6 +7,16 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Changed
+- **Upstream Monitor Schedule**: Changed cron from every 6 hours to weekly (Sundays at noon UTC) to reduce unnecessary CI runs
+
+### Fixed
+- **Documentation**: Corrected `ENABLE_WORKERS` env var references to `CYBERCHEF_ENABLE_WORKERS` across README.md, CLAUDE.md, and release notes
+- **Documentation**: Updated upstream monitor schedule references from "every 6 hours" to "weekly" in README.md
+- **Documentation**: Updated Dockerfile base image references from `node:18-alpine`/`node:22-alpine` to Chainguard distroless in architecture docs and CLAUDE.md
+- **Documentation**: Updated coverage threshold references in CLAUDE.md to match current thresholds (75% lines/stmts, 90% functions, 70% branches)
+- **Documentation**: Expanded MCP tools listing and CI/CD workflow table in CLAUDE.md
+
 ## [1.9.0] - 2026-02-05
 
 ### Added

CLAUDE.md

@@ -39,7 +39,7 @@ npm run build           # Production build
 npm run lint            # ESLint (zero errors required)
 npm test                # Core unit tests
 npm run test:mcp        # MCP server tests (689 tests)
-npm run test:coverage   # Coverage report (thresholds: 70% lines/functions)
+npm run test:coverage   # Coverage report (thresholds: 75% lines/stmts, 90% functions, 70% branches)
 npm run testnodeconsumer # Test CJS/ESM consumers
 ```
 
@@ -66,14 +66,18 @@ MCP Client (AI/IDE) <--> CyberChef MCP Server <--> CyberChef Node API <--> Cyber
 | `src/node/index.mjs` | Node.js API bridge (**generated** by Grunt) |
 | `src/core/config/OperationConfig.json` | Operation metadata (**generated** by Grunt) |
 | `src/core/operations/*.mjs` | Individual operation implementations |
-| `Dockerfile.mcp` | MCP server container (node:22-alpine) |
+| `Dockerfile.mcp` | MCP server container (Chainguard distroless) |
 | `Gruntfile.js` | Build orchestration for config generation |
 
 ### MCP Tools Structure
 
 1. **`cyberchef_bake`** - Meta-tool for complex recipe chains
 2. **`cyberchef_search`** - Operation discovery via `help()` function
 3. **`cyberchef_<op_name>`** - 300+ dynamically generated tools from OperationConfig
+4. **`cyberchef_worker_stats`** - Worker thread pool monitoring (v1.9.0)
+5. **`cyberchef_deprecation_stats`** / **`cyberchef_migration_preview`** - v2.0.0 migration tools (v1.8.0)
+6. **Recipe tools** - `cyberchef_recipe_create/get/list/update/delete/execute/export/import/validate/test` (v1.6.0)
+7. **`cyberchef_batch`** / **`cyberchef_telemetry_export`** / **`cyberchef_cache_stats`** / **`cyberchef_cache_clear`** / **`cyberchef_quota_info`** (v1.7.0)
 
 Tool naming: Operations are sanitized to snake_case with `cyberchef_` prefix (e.g., "AES Decrypt" -> `cyberchef_aes_decrypt`).
 
@@ -99,7 +103,14 @@ Run these manually if developing locally on Node 22+.
 |----------|---------|---------|
 | `core-ci.yml` | Push to master | Lint + tests + Codecov coverage |
 | `mcp-docker-build.yml` | Push to master | Build and verify Docker image |
-| `mcp-release.yml` | Tags `v*` | Publish to GHCR |
+| `mcp-release.yml` | Tags `v*` | Publish to Docker Hub + GHCR |
+| `security-scan.yml` | Push/PR/weekly | Trivy + npm audit |
+| `upstream-monitor.yml` | Weekly (Sun noon UTC) | Check for upstream releases |
+| `upstream-sync.yml` | Label/manual | Selective upstream sync |
+| `rollback.yml` | Manual | Emergency rollback |
+| `pull_requests.yml` | PRs | PR validation |
+| `performance-benchmarks.yml` | Push | Performance regression testing |
+| `codeql.yml` | Push/PR/weekly | CodeQL security scanning |
 
 ### Release Process
 ```bash

README.md

@@ -66,7 +66,7 @@ The server exposes CyberChef operations as MCP tools:
         - Lists all 8 deprecation codes (DEP001-DEP008) with details
 *   **Worker Thread Pool** (v1.9.0): CPU-intensive operations offloaded to worker threads
     *   `cyberchef_worker_stats` - Monitor worker pool utilization, active/completed tasks, and pool configuration
-    *   Enable with `ENABLE_WORKERS=true` environment variable
+    *   Enable with `CYBERCHEF_ENABLE_WORKERS=true` environment variable
     *   Configurable pool size, idle timeout, and minimum input size for worker routing
 
 ### Technical Highlights
@@ -82,7 +82,7 @@ The server exposes CyberChef operations as MCP tools:
 *   **Advanced Features** (v1.7.0): Enterprise-grade capabilities with batch processing (parallel/sequential execution of up to 100 operations), privacy-first telemetry collection (disabled by default, no input/output data captured), sliding window rate limiting for resource protection, enhanced caching with inspection tools, and resource quota tracking (concurrent operations, data sizes). All features are configurable via environment variables with secure defaults. See [Release Notes](docs/releases/v1.7.0.md) for details.
 *   **Enhanced Observability** (v1.5.0): Structured JSON logging with Pino for production monitoring, comprehensive error handling with actionable recovery suggestions, automatic retry logic with exponential backoff, request correlation with UUID tracking, circuit breaker pattern for cascading failure prevention, and streaming infrastructure for progressive results on large operations. See [Release Notes](docs/releases/v1.5.0.md) for details.
 *   **Performance Optimized** (v1.4.0): LRU cache for operation results (100MB default), automatic streaming for large inputs (10MB+ threshold), configurable resource limits (100MB max input, 30s timeout), memory monitoring, and comprehensive benchmark suite. See [Performance Tuning Guide](docs/architecture/performance-tuning.md) for configuration options.
-*   **Upstream Sync Automation** (v1.3.0): Automated monitoring of upstream CyberChef releases every 6 hours, one-click synchronization workflow, comprehensive validation test suite with 689 tests, and emergency rollback mechanism.
+*   **Upstream Sync Automation** (v1.3.0): Automated monitoring of upstream CyberChef releases weekly (Sundays at noon UTC), one-click synchronization workflow, comprehensive validation test suite with 689 tests, and emergency rollback mechanism.
 *   **Security Hardened** (v1.4.5+): Chainguard distroless base image with zero-CVE baseline, non-root execution (UID 65532), automated Trivy vulnerability scanning with build-fail thresholds, dual SBOM strategy (Docker Scout attestations + CycloneDX), read-only filesystem support, SLSA Build Level 3 provenance, and 7-day SLA for critical CVE patches. Fixed 11 of 12 code scanning vulnerabilities including critical cryptographic randomness weakness and 7 ReDoS vulnerabilities. See [Security Policy](SECURITY.md) and [Security Fixes Report](docs/security/SECURITY_FIX_REPORT.md) for details.
 *   **Production Ready**: Comprehensive CI/CD with CodeQL v4, automated testing, and dual-registry container publishing (Docker Hub + GHCR) with complete supply chain attestations.
 
@@ -286,7 +286,7 @@ CYBERCHEF_MAX_INPUT_SIZE=104857600       # Maximum input size (100MB)
 CYBERCHEF_OPERATION_TIMEOUT=30000        # Operation timeout in milliseconds (30s)
 CYBERCHEF_STREAMING_THRESHOLD=10485760   # Streaming threshold (10MB)
 CYBERCHEF_ENABLE_STREAMING=true          # Enable streaming for large operations
-CYBERCHEF_ENABLE_WORKERS=false           # Enable worker threads (disabled by default)
+CYBERCHEF_ENABLE_WORKERS=false           # Enable worker thread pool (disabled by default)
 CYBERCHEF_CACHE_MAX_SIZE=104857600       # Cache maximum size (100MB)
 CYBERCHEF_CACHE_MAX_ITEMS=1000           # Cache maximum items
 ```
@@ -341,7 +341,7 @@ docker run -i --rm \
 **Worker Thread Pool for CPU-Intensive Operations (v1.9.0+)**
 ```bash
 docker run -i --rm \
-  -e ENABLE_WORKERS=true \
+  -e CYBERCHEF_ENABLE_WORKERS=true \
   -e CYBERCHEF_WORKER_MAX_THREADS=8 \
   -e CYBERCHEF_WORKER_IDLE_TIMEOUT=60000 \
   ghcr.io/doublegate/cyberchef-mcp_v1:latest
@@ -656,7 +656,7 @@ This project uses GitHub Actions to ensure stability and security:
 *   **Release** ([`mcp-release.yml`](.github/workflows/mcp-release.yml)): Publishes Docker image to GHCR with SBOM attachment on version tags (`v*`), automatically creates GitHub releases
 
 **Upstream Sync Automation (v1.3.0+):**
-*   **Upstream Monitor** ([`upstream-monitor.yml`](.github/workflows/upstream-monitor.yml)): Monitors GCHQ/CyberChef for new releases every 6 hours, creates GitHub issues for review
+*   **Upstream Monitor** ([`upstream-monitor.yml`](.github/workflows/upstream-monitor.yml)): Monitors GCHQ/CyberChef for new releases weekly (Sundays at noon UTC), creates GitHub issues for review
 *   **Upstream Sync** ([`upstream-sync.yml`](.github/workflows/upstream-sync.yml)): Selective file synchronization workflow - copies only `src/core/operations/*.mjs` files, prevents restoration of deleted web UI components, creates PR for review
 *   **Rollback** ([`rollback.yml`](.github/workflows/rollback.yml)): Emergency rollback mechanism with state comparison and ref-proj guidance
 

docs/architecture/architecture.md

@@ -6,11 +6,13 @@ The solution involves creating a new entry point in the `src/node/` directory th
 
 ```mermaid
 graph TD
-    A[MCP Client AI/IDE] -->|Stdio| B[CyberChef MCP Server]
-    B -->|Imports| C[CyberChef Node API]
-    C -->|Uses| D[CyberChef Core]
-    D -->|Config| E[OperationConfig.json]
-    D -->|Logic| F[Operations]
+    A[MCP Client AI/IDE] -->|Stdio/HTTP| B[Transport Layer]
+    B -->|Routes| C[CyberChef MCP Server]
+    C -->|Imports| D[CyberChef Node API]
+    D -->|Uses| E[CyberChef Core]
+    E -->|Config| F[OperationConfig.json]
+    E -->|Logic| G[Operations]
+    C -->|Offloads| H[Worker Thread Pool]
 ```
 
 ## Components
@@ -49,9 +51,10 @@ Programmatically generated tools for every supported CyberChef operation.
 
 ### 3. Containerization (`Dockerfile.mcp`)
 A specialized Docker build for the server.
--   **Base:** `node:18-alpine`.
--   **Context:** Copies `src/`, `package.json`.
+-   **Base:** Chainguard distroless Node.js 22 (`cgr.dev/chainguard/node:latest`).
+-   **Context:** Multi-stage build; copies `src/`, `package.json`.
 -   **Command:** `node src/node/mcp-server.mjs`.
+-   **Security:** Non-root (UID 65532), zero-CVE baseline, read-only filesystem support.
 
 ## Data Flow
 1.  **Discovery:** Client requests `listTools`. Server iterates `OperationConfig` and generates tool schemas.

docs/planning/ROADMAP.md

@@ -77,19 +77,19 @@ gantt
 
 ### Phase 1-3 (v1.2.0 - v2.0.0)
 
-| Release | Theme | Key Features | Effort | Risk |
-|---------|-------|--------------|--------|------|
-| **v1.2.6** | Container Optimization | nginx:alpine-slim for web app, non-root permissions | S | Low |
-| **v1.2.5** | Security Patch | GitHub alerts, OWASP Argon2 hardening, build fixes | S | Low |
-| **v1.2.0** | Security Hardening | Docker DHI, non-root, security scanning | L | Medium |
-| **v1.3.0** | Upstream Sync | Automated CyberChef updates, validation testing | XL | Medium | ✅ **Completed** |
-| **v1.4.0** | Performance | Streaming optimization, worker threads, memory management | L | Low |
-| **v1.5.0** | Streaming & Errors | Large operation support, enhanced error handling | L | Medium |
-| **v1.6.0** | Recipe Management | Save/load/share recipes, recipe library | XL | Medium |
-| **v1.7.0** | Advanced Features | Batch processing, telemetry, rate limiting | L | Low |
-| **v1.8.0** | Breaking Changes Prep | Deprecation warnings, migration guides | M | High |
-| **v1.9.0** | Pre-v2.0.0 Polish | Final testing, documentation, migration tools | M | Medium |
-| **v2.0.0** | Major Release | Breaking changes, API stabilization, type system | XL | High |
+| Release | Theme | Key Features | Effort | Risk | Status |
+|---------|-------|--------------|--------|------|--------|
+| **v1.2.6** | Container Optimization | nginx:alpine-slim for web app, non-root permissions | S | Low | Released |
+| **v1.2.5** | Security Patch | GitHub alerts, OWASP Argon2 hardening, build fixes | S | Low | Released |
+| **v1.2.0** | Security Hardening | Docker DHI, non-root, security scanning | L | Medium | Released |
+| **v1.3.0** | Upstream Sync | Automated CyberChef updates, validation testing | XL | Medium | Released |
+| **v1.4.0** | Performance | Streaming optimization, worker threads, memory management | L | Low | Released |
+| **v1.5.0** | Streaming & Errors | Large operation support, enhanced error handling | L | Medium | Released |
+| **v1.6.0** | Recipe Management | Save/load/share recipes, recipe library | XL | Medium | Released |
+| **v1.7.0** | Advanced Features | Batch processing, telemetry, rate limiting | L | Low | Released |
+| **v1.8.0** | Breaking Changes Prep | Deprecation warnings, migration guides | M | High | Released |
+| **v1.9.0** | Pre-v2.0.0 Polish | Streaming, workers, HTTP transport, security | M | Medium | Released |
+| **v2.0.0** | Major Release | Breaking changes, API stabilization, type system | XL | High | Planned |
 
 ### Phase 4-6 (v2.1.0 - v3.0.0)
 

docs/releases/v1.9.0.md

@@ -22,7 +22,7 @@ This release delivers MCP streaming with progress notifications, a Piscina-based
 - Configurable via `CYBERCHEF_WORKER_MIN_THREADS`, `MAX_THREADS`, `IDLE_TIMEOUT` env vars
 - Worker routing in CallTool handler before streaming execution
 - New `cyberchef_worker_stats` tool for monitoring pool utilization
-- Enable with `ENABLE_WORKERS=true` environment variable
+- Enable with `CYBERCHEF_ENABLE_WORKERS=true` environment variable
 
 ### Streamable HTTP Transport
 - New `src/node/transports.mjs` transport factory