Wave 1 follow-up: CORS + npm-policy CI fixes, docs/reality alignment, FFI cleanup (#20)

* fix(worker): restrict CORS to configured origins; comply with npm-avoidant policy

Follow-up fixes for CI findings on PR #19:

- Security (CWE-942 / Hypatia js_wildcard_cors, critical): replace the hardcoded
  wildcard Access-Control-Allow-Origin with an env-configurable allowlist
  (CORS_ALLOW_ORIGIN), defaulting to the portal origin. CORS headers are now
  applied centrally in fetch(); request Origin is echoed only when allowlisted.
  Added 3 CORS tests (default origin, echo-allowed, never-wildcard).

- Governance (npm-avoidant policy / standards JS-RUNTIME-POLICY): stop tracking
  worker/package-lock.json (now gitignored) and pin devDependencies to exact
  versions for reproducibility; CI uses `npm install` instead of `npm ci`.

- Workflows: add timeout-minutes to worker-ci, worker-deploy and boj-build
  (Hypatia workflow_audit).

Verified: 33/33 tests pass, eslint + prettier clean, wrangler dry-run OK,
no tracked package-lock.json.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UCnxjXkN6uDj9YSANuGEgR

* docs+chore: align docs with reality, fill placeholders, drop vestigial FFI stubs

In-repo Wave 1 hygiene (no external credentials needed):

- ROADMAP.adoc: replace the generic template with the real 8-phase plan
  (mirrors .machine_readable/6a2/STATE.a2ml).
- TEST-NEEDS.md: correct false claims ("Zig FFI integration tests", `cargo test`,
  "CRG C achieved"); document the actual Vitest suite (33 tests) + CI gating.
- README.adoc: Phase 3 -> "In progress (~60%)"; Phase 4 label -> ReScript/typed-WASM
  (aligns with ADR-004 and the overview).
- .envrc, .well-known/security.txt: fill load-bearing template placeholders.
- src/interface/ffi: remove non-compiling {{project}} Zig template stubs (main.zig,
  build.zig, integration_test.zig) — this project has no FFI surface; keep the RSR
  dirs with an explanatory README (cf. PROOF-NEEDS.md).

No functional Worker changes; 33/33 tests still pass.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UCnxjXkN6uDj9YSANuGEgR

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: hyperpolymath

.envrc

@@ -18,7 +18,7 @@ if has nix && [ -f flake.nix ]; then
 fi
 
 # Project environment variables
-export PROJECT_NAME="{{PROJECT_NAME}}"
+export PROJECT_NAME="gv-clade-index"
 export RSR_TIER="infrastructure"
 # export DATABASE_URL="..."
 # export API_KEY="..."

.github/workflows/boj-build.yml

@@ -7,6 +7,7 @@ on:
 jobs:
   trigger-boj:
     runs-on: ubuntu-latest
+    timeout-minutes: 5
     steps:
       - name: Checkout
         uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4

.github/workflows/worker-ci.yml

@@ -26,6 +26,7 @@ jobs:
   build-test:
     name: Lint, format, test, bundle
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -34,11 +35,10 @@ jobs:
         uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
         with:
           node-version: '22'
-          cache: npm
-          cache-dependency-path: worker/package-lock.json
 
+      # No tracked package-lock.json (npm-avoidant policy) → npm install, not npm ci.
       - name: Install dependencies
-        run: npm ci
+        run: npm install --no-audit --no-fund
 
       - name: Lint (eslint)
         run: npm run lint

.github/workflows/worker-deploy.yml

@@ -34,6 +34,7 @@ jobs:
   deploy:
     name: Deploy
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     # Manual dispatch picks the env (production requires approval if the
     # "production" GitHub Environment has protection rules); push → staging.
     environment: ${{ github.event_name == 'workflow_dispatch' && inputs.environment || 'staging' }}
@@ -45,11 +46,10 @@ jobs:
         uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
         with:
           node-version: '22'
-          cache: npm
-          cache-dependency-path: worker/package-lock.json
 
+      # No tracked package-lock.json (npm-avoidant policy) → npm install, not npm ci.
       - name: Install dependencies
-        run: npm ci
+        run: npm install --no-audit --no-fund
 
       - name: Test before deploy
         run: npm test

.well-known/security.txt

@@ -2,10 +2,8 @@
 # RFC 9116 - security.txt
 # https://securitytxt.org/
 
-Contact: mailto:{{SECURITY_EMAIL}}
-Expires: {{CURRENT_YEAR}}-12-31T23:59:59.000Z
-Encryption: {{PGP_KEY_URL}}
+Contact: mailto:j.d.a.jewell@open.ac.uk
+Expires: 2026-12-31T23:59:59.000Z
 Preferred-Languages: en
-Canonical: https://{{FORGE}}/{{OWNER}}/{{REPO}}/.well-known/security.txt
-Policy: https://{{FORGE}}/{{OWNER}}/{{REPO}}/blob/main/SECURITY.md
-Hiring: https://{{WEBSITE}}/careers
+Canonical: https://github.com/hyperpolymath/gv-clade-index/.well-known/security.txt
+Policy: https://github.com/hyperpolymath/gv-clade-index/blob/main/SECURITY.md

README.adoc

@@ -122,8 +122,8 @@ This repo includes a `clade-hygiene.a2ml` contractile:
 | 0 | Clade taxonomy, repo seed, VCL schema | *Complete*
 | 1 | Deploy CLADE.a2ml to all 200 repos | Pending
 | 2 | VeriSimDB instance on VPS | Pending
-| 3 | Cloudflare Worker API | Pending
-| 4 | AffineScript/typed-WASM portal | Pending
+| 3 | Cloudflare Worker API (hardened, tested, CI-gated) | In progress (~60%)
+| 4 | ReScript/typed-WASM portal | Pending
 | 5 | LLM query endpoint | Pending
 | 6 | Bot write endpoints | Pending
 | 7 | Contributor OAuth | Pending

ROADMAP.adoc

@@ -1,22 +1,45 @@
 // SPDX-License-Identifier: MPL-2.0
-= Gv Clade Index Roadmap
+= gv-clade-index Roadmap
 
-== Current Status
+Mirrors the canonical phase plan in `.machine_readable/6a2/STATE.a2ml`. The registry
+is the *map* of the hyperpolymath ecosystem; "production" means a hardened, observable,
+CI-deployed Cloudflare Worker API backed by a live VeriSimDB.
 
-Initial development phase.
+== Current status
 
-== Milestones
+* Maturity: *alpha*. Phase 0 complete; Phase 3 (Worker API) in progress.
+* The Cloudflare Worker is import-fixed, hardened, tested (Vitest) and CI-gated.
+  Automated deploy and live VeriSimDB backing are the remaining external steps.
 
-=== v0.1.0 - Foundation
-* [ ] Core functionality
-* [ ] Basic documentation
-* [ ] CI/CD pipeline
+== Phases
 
-=== v1.0.0 - Stable Release
-* [ ] Full feature set
-* [ ] Comprehensive tests
-* [ ] Production ready
+[cols="1,4,2"]
+|===
+| Phase | Deliverable | Status
 
-== Future Directions
+| 0 | Clade taxonomy, repo seed, VCL schema, named queries | *Complete*
+| 1 | Deploy CLADE.a2ml to all ~200 repos | Pending
+| 2 | VeriSimDB instance on VPS + ingest | Pending (external infra)
+| 3 | Cloudflare Worker API (hardened, tested, deployed) | In progress (~60%)
+| 4 | ReScript/typed-WASM portal on github.io | Pending
+| 5 | LLM query endpoint (API-key tier) | Pending
+| 6 | Bot write endpoints (signed JWT) + TODO octads | Pending
+| 7 | Contributor OAuth + scoped access | Pending
+| 8 | Repo lockdown (visibility management) | Pending
+|===
 
-_To be determined based on community feedback._
+== Cross-cutting workstreams
+
+* *Engineering hygiene* — toolchain, tests, linting, docs/reality alignment.
+* *Worker hardening* — input validation, security headers, rate limiting, structured logs, readiness.
+* *Observability & ops* — logging, metrics, backups, drift detection, runbook.
+* *Security* — tiered auth (public / LLM key / bot JWT / contributor OAuth), secrets, supply chain.
+* *CI/CD* — test-gated CI + automated Cloudflare deploy (staging → production).
+
+== External prerequisites (owner-provided)
+
+* `CLOUDFLARE_API_TOKEN` secret — enables automated Worker deploys (Phase 3).
+* VeriSimDB instance on a VPS — the declared source of truth (Phase 2).
+* GitHub OAuth app + JWT signing key — Phases 6–7.
+
+See `.machine_readable/6a2/STATE.a2ml` for live status and blockers.

TEST-NEEDS.md

@@ -1,26 +1,37 @@
 # TEST-NEEDS.md — gv-clade-index
 
-## CRG Grade: C — ACHIEVED 2026-04-04
+## Current test state
 
-## Current Test State
+The deliverable is the Cloudflare Worker registry API (`worker/`). Tests run on
+Vitest (Node) and are gated in CI by `.github/workflows/worker-ci.yml`.
 
-| Category | Count | Notes |
-|----------|-------|-------|
-| Test files | 1 | Current state |
+| Suite | Location | Count | Covers |
+|-------|----------|-------|--------|
+| Worker integration | `worker/test/worker.test.js` | 30 | Routing, input validation, security headers, CORS, pagination, search/LLM, 405/404/429/500/503 paths, KV-fallback queries, fuzz (no uncontrolled 5xx) |
+| Data contract | `worker/test/data.test.js` | 3 | 12-clade invariant + snapshot count/membership consistency |
 
-## What's Covered
+Run:
 
-- [x] 1 existing test file(s)
-- [x] Zig FFI integration tests
+```bash
+cd worker && npm install && npm test
+```
 
-## Still Missing (for CRG B+)
+## Covered
 
-- [ ] CI/CD test automation
-- [ ] Property-based tests
-- [ ] Edge case coverage
+- [x] Unit + integration tests for all 9 API endpoints
+- [x] Input validation and error-path tests (400/404/405/429/500/503)
+- [x] Fuzz sweep (random paths/params → no uncontrolled 5xx)
+- [x] Data contract test (clade invariant, count consistency)
+- [x] CI automation (lint + format + test + bundle dry-run on every PR)
 
-## Run Tests
+## Still missing
 
-```bash
-cd src/interface/ffi/test && cargo test
-```
+- [ ] Integration tests against a live VeriSimDB (blocked on Phase 2)
+- [ ] End-to-end smoke tests against a deployed staging Worker
+- [ ] Tests for the future auth tiers (LLM key, bot JWT, contributor OAuth)
+
+## Notes
+
+This project has **no native/FFI surface**. The former Zig FFI template stubs
+under `src/interface/ffi/` were removed — they were non-compiling `{{project}}`
+template placeholders, not real tests.

src/interface/ffi/README.adoc

@@ -1 +1,14 @@
-= ffi Logic
+// SPDX-License-Identifier: MPL-2.0
+= FFI surface
+
+gv-clade-index has *no native/FFI surface*. It is a data + edge project: the runtime
+artifact is a Cloudflare Worker (JavaScript, see `worker/`) backed by VeriSimDB; there
+is no compiled library exposing a C ABI.
+
+The `src/interface/{abi,ffi,generated}` directories are retained only to satisfy the RSR
+repository structure (`just validate-rsr`). Their previous contents were non-compiling
+`{{project}}` Zig/Idris template stubs and have been removed to avoid implying a
+verification or FFI surface that does not exist (cf. `PROOF-NEEDS.md`).
+
+If a native surface is ever introduced, restore `build.zig`, `src/main.zig` and
+`test/integration_test.zig` from the RSR template and wire them into CI.