Wave 1 follow-up: CORS + npm-policy CI fixes, docs/reality alignment, FFI cleanup

[hyperpolymath]

Why

Follow-up to #19 (merged). Its CI surfaced issues that landed on main because the merge happened before the fixes; this PR resolves them and continues the in-repo Wave 1 hygiene that needs no external credentials.

CI fixes (the blockers on main)

🔴 Critical — wildcard CORS (CWE-942 / Hypatia js_wildcard_cors)

• Replaced the hardcoded Access-Control-Allow-Origin: * with an env-configurable allowlist (CORS_ALLOW_ORIGIN), defaulting to the portal origin. CORS is applied centrally in fetch(); the request Origin is echoed only when allowlisted; no wildcard in source. +3 CORS tests.

🟥 Governance — npm-avoidant policy (standards JS-RUNTIME-POLICY)

• A tracked package-lock.json is forbidden (devDependencies-only package.json is tolerated). Untracked the lockfile (gitignored), pinned devDependencies to exact versions, switched CI to npm install.

🟡 Workflow hygiene (Hypatia workflow_audit)

• Added timeout-minutes to worker-ci, worker-deploy, boj-build.

Docs / reality alignment & cleanup

• ROADMAP.adoc — replaced the generic template with the real 8-phase plan (mirrors STATE.a2ml).
• TEST-NEEDS.md — corrected false claims (Zig FFI tests / cargo test); documents the actual Vitest suite (33 tests) + CI gating.
• README.adoc — Phase 3 → In progress (~60%); Phase 4 → ReScript (per ADR-004).
• src/interface/ffi/ — removed non-compiling {{project}} Zig template stubs (no FFI surface in this JS/data project); kept the RSR dirs with an explanatory README.
• Filled load-bearing placeholders in .envrc and .well-known/security.txt.

Verified locally

33/33 tests pass · eslint + prettier --check clean · wrangler deploy --dry-run OK (top-level + staging) · no tracked package-lock.json.

Not in this PR (deferred, noted in the plan)

• Broad placeholder sweep across build/dev-env files — many remaining {{...}} tokens live in intentional templates (k9 template-*.k9.ncl, ADR 0000-template.adoc, issue templates), so a blanket sweep is unsafe; needs a careful per-file pass.
• Wiring Justfile recipes to the npm scripts (CI already calls npm directly; deferred since just isn't available here to verify).

Still needs you (external)

1. Add CLOUDFLARE_API_TOKEN → unlocks auto-deploy to staging.
2. Phase 2: stand up VeriSimDB on the VPS → live data backing.

🤖 Generated with Claude Code

https://claude.ai/code/session_01UCnxjXkN6uDj9YSANuGEgR

[github-actions]

🔍 Hypatia Security Scan

Findings: 71 issues detected

Severity	Count
🔴 Critical	1
🟠 High	11
🟡 Medium	59

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Issue in casket-pages.yml",
    "type": "missing_timeout_minutes",
    "file": "casket-pages.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in casket-pages.yml",
    "type": "missing_timeout_minutes",
    "file": "casket-pages.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in codeql.yml",
    "type": "missing_timeout_minutes",
    "file": "codeql.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in dependabot-automerge.yml",
    "type": "missing_timeout_minutes",
    "file": "dependabot-automerge.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in dogfood-gate.yml",
    "type": "missing_timeout_minutes",
    "file": "dogfood-gate.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in dogfood-gate.yml",
    "type": "missing_timeout_minutes",
    "file": "dogfood-gate.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in dogfood-gate.yml",
    "type": "missing_timeout_minutes",
    "file": "dogfood-gate.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in dogfood-gate.yml",
    "type": "missing_timeout_minutes",
    "file": "dogfood-gate.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in dogfood-gate.yml",
    "type": "missing_timeout_minutes",
    "file": "dogfood-gate.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in instant-sync.yml",
    "type": "missing_timeout_minutes",
    "file": "instant-sync.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence