Review SCM files and security updates

.github/workflows/ada.yml

@@ -13,7 +13,7 @@ jobs:
 
     steps:
     - name: Checkout
-      uses: actions/checkout@v6
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
     - name: Set up GNAT toolchain
       run: >

.github/workflows/codeql.yml

@@ -55,7 +55,7 @@ jobs:
         # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v6
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
     # Add any setup steps before running the `github/codeql-action/init` action.
     # This includes steps like installing compilers or runtimes (`actions/setup-node`
@@ -65,7 +65,7 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v4
+      uses: github/codeql-action/init@4f3212b61783c3c68e8309a0f18a699764811cda # v3.27.1
       with:
         languages: ${{ matrix.language }}
         build-mode: ${{ matrix.build-mode }}
@@ -94,6 +94,6 @@ jobs:
         exit 1
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v4
+      uses: github/codeql-action/analyze@4f3212b61783c3c68e8309a0f18a699764811cda # v3.27.1
       with:
         category: "/language:${{matrix.language}}"

.github/workflows/elixir.yml

@@ -21,14 +21,14 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
     - name: Set up Elixir
       uses: erlef/setup-beam@e6d7c94229049569db56a7ad5a540c051a010af9 # v1.20.4
       with:
         elixir-version: '1.15.2' # [Required] Define the Elixir version
         otp-version: '26.0'      # [Required] Define the Erlang/OTP version
     - name: Restore dependencies cache
-      uses: actions/cache@v5
+      uses: actions/cache@6849a6489940f00c2f30c0fb92c6274307ccb58a # v4.1.2
       with:
         path: deps
         key: ${{ runner.os }}-mix-${{ hashFiles('**/mix.lock') }}

.github/workflows/generator-generic-ossf-slsa3-publish.yml

@@ -23,7 +23,7 @@ jobs:
       digests: ${{ steps.hash.outputs.digests }}
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       # ========================================================
       #
@@ -60,7 +60,7 @@ jobs:
       actions: read   # To read the workflow path.
       id-token: write # To sign the provenance.
       contents: write # To add assets to a release.
-    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.1.0
+    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.0.0
     with:
       base64-subjects: "${{ needs.build.outputs.digests }}"
       upload-assets: true # Optional: Upload to a new release

.github/workflows/guix-nix-policy.yml

@@ -4,7 +4,7 @@ jobs:
   check:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - name: Enforce Guix primary / Nix fallback
         run: |
           # Check for package manager files

.github/workflows/jekyll-gh-pages.yml

@@ -27,16 +27,16 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - name: Setup Pages
-        uses: actions/configure-pages@v5
+        uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5.0.0
       - name: Build with Jekyll
-        uses: actions/jekyll-build-pages@v1
+        uses: actions/jekyll-build-pages@44a6e6beabd48582f863aeeb6cb2151cc1716f3b # v1.0.13
         with:
           source: ./
           destination: ./_site
       - name: Upload artifact
-        uses: actions/upload-pages-artifact@v4
+        uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3.0.1
 
   # Deployment job
   deploy:
@@ -48,4 +48,4 @@ jobs:
     steps:
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4.0.5

.github/workflows/npm-bun-blocker.yml

@@ -4,7 +4,7 @@ jobs:
   check:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - name: Block npm/bun
         run: |
           if [ -f "package-lock.json" ] || [ -f "bun.lockb" ] || [ -f ".npmrc" ]; then

.github/workflows/quality.yml

@@ -5,14 +5,14 @@ jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
-      
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
       - name: Check file permissions
         run: |
           find . -type f -perm /111 -name "*.sh" | head -10 || true
 
       - name: Check for secrets
-        uses: trufflesecurity/trufflehog@main
+        uses: trufflesecurity/trufflehog@63e6dcaa4f6b7bbdd96ce0db5b7fbc8c839e7746 # v3.82.8
         with:
           path: ./
           base: ${{ github.event.pull_request.base.sha || github.event.before }}
@@ -29,13 +29,13 @@ jobs:
           find . -type f -size +1M -not -path "./.git/*" | head -10 || echo "No large files"
 
       - name: EditorConfig check
-        uses: editorconfig-checker/action-editorconfig-checker@main
+        uses: editorconfig-checker/action-editorconfig-checker@35f3c0fca2f5ee3e31fbcd40a5bbc58eb80db28d # v2.0.0
         continue-on-error: true
 
   docs:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - name: Check documentation
         run: |
           MISSING=""

.github/workflows/rsr-antipattern.yml

@@ -16,7 +16,7 @@ jobs:
   antipattern-check:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: Check for TypeScript
         run: |

.github/workflows/scorecard.yml

@@ -14,17 +14,17 @@ jobs:
       security-events: write
       id-token: write
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           persist-credentials: false
 
       - name: Run Scorecard
-        uses: ossf/scorecard-action@v2.4.3
+        uses: ossf/scorecard-action@62b2cac7ed8198b15735ed49ab1e5cf35480ba46 # v2.4.0
         with:
           results_file: results.sarif
           results_format: sarif
 
       - name: Upload results
-        uses: github/codeql-action/upload-sarif@v4
+        uses: github/codeql-action/upload-sarif@4f3212b61783c3c68e8309a0f18a699764811cda # v3.27.1
         with:
           sarif_file: results.sarif

.github/workflows/security-policy.yml

@@ -4,7 +4,7 @@ jobs:
   check:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - name: Security checks
         run: |
           FAILED=false

.github/workflows/wellknown-enforcement.yml

@@ -17,8 +17,8 @@ jobs:
   validate:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
-      
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
       - name: RFC 9116 security.txt validation
         run: |
           SECTXT=""

ROADMAP.md

@@ -0,0 +1,173 @@
+# HINFO-LOC Fluctuator Roadmap
+
+**Last Updated**: 2025-12-17
+**Current Version**: 0.1.0 (development)
+**Overall Completion**: 40%
+
+## Current State Summary
+
+| Component | Status | Completion |
+|-----------|--------|------------|
+| RSR Compliance | Complete | 100% |
+| CI Security (SHA-pinned) | Complete | 100% |
+| Nix Fallback (flake.nix) | Complete | 100% |
+| Ada Implementation | In Progress | 60% |
+| Crypto Integration | Planned | 0% |
+| DNS Integration | Planned | 0% |
+
+## Phase 1: Foundation (Current)
+
+### Completed
+- [x] RSR (Rhodium Standard Repository) compliance
+- [x] SHA-pinned GitHub Actions (supply chain security)
+- [x] Guix package definition (guix.scm)
+- [x] Nix flake fallback (flake.nix)
+- [x] Core Ada type-safe DNS record structures
+- [x] Authentication module with session management
+- [x] Randomization engine framework
+- [x] Text-based user interface
+- [x] Zone file writer (BIND format)
+- [x] Thread-safe audit logging
+- [x] Scheduled fluctuation with Ada tasking
+- [x] DNS UPDATE framework (RFC 2136)
+- [x] Enterprise features (Firewall, SDP, Security Headers, Protocol Management)
+- [x] Comprehensive documentation
+
+### In Progress
+- [ ] Complete CSV parser in `randomizer.adb`
+- [ ] Verify Ada build in CI pipeline
+
+## Phase 2: Security Hardening (Q1 2026)
+
+**Priority**: CRITICAL
+
+### Crypto Integration
+- [ ] Integrate bcrypt/Argon2 password hashing library
+- [ ] Replace demo credentials in `secure_auth.adb`
+- [ ] Implement TSIG authentication (RFC 2845)
+- [ ] Add SPA packet encryption/decryption (AES-256-GCM, ChaCha20-Poly1305)
+
+### Testing
+- [ ] Unit test framework (target: 70%+ coverage)
+- [ ] Integration tests with mock DNS server
+- [ ] Security-focused test cases
+
+### CI/CD Improvements
+- [ ] Add Ada syntax/build verification to CI
+- [ ] Implement SPARK verification step (optional)
+
+## Phase 3: DNS Integration (Q2 2026)
+
+**Priority**: HIGH
+
+### Real Server Integration
+- [ ] Test with BIND 9
+- [ ] Test with PowerDNS
+- [ ] Test with NSD
+- [ ] Document server-specific configuration
+
+### DNS UPDATE Protocol
+- [ ] Complete RFC 2136 implementation
+- [ ] TSIG signature generation/verification
+- [ ] Zone transfer (AXFR) support
+- [ ] Incremental zone transfer (IXFR) support
+
+### Firewall Integration
+- [ ] Test actual firewall command execution
+- [ ] Add dry-run mode for safety
+- [ ] Support for firewalld, iptables, nftables, pf
+
+## Phase 4: Formal Verification (Q3 2026)
+
+**Priority**: MEDIUM
+
+### SPARK Verification
+- [ ] Add SPARK annotations to `secure_auth.ads/adb`
+- [ ] Add SPARK annotations to `sdp_controller.ads/adb`
+- [ ] Prove absence of runtime errors
+- [ ] Prove security properties
+
+### Certification
+- [ ] Document verification results
+- [ ] Achieve Platinum Tier RSR compliance (90%+)
+
+## Phase 5: Production Release (Q4 2026)
+
+**Priority**: MEDIUM
+
+### Release Preparation
+- [ ] Complete security audit
+- [ ] Performance optimization
+- [ ] Production deployment guide
+- [ ] Operational runbooks
+
+### Distribution
+- [ ] Submit to Guix channel
+- [ ] Nixpkgs submission
+- [ ] Container images (if requested)
+
+---
+
+## Known Security Issues
+
+### HIGH Priority
+
+1. **Demo Credentials** (`secure_auth.adb:17-38`)
+   - Current: Hardcoded SHA256 demo hashes
+   - Required: bcrypt/Argon2 integration
+   - Risk: Authentication bypass in production
+
+2. **Password Bypass** (`secure_auth.adb:126-131`)
+   - Current: Any non-empty password accepted in demo mode
+   - Required: Proper password verification
+   - Risk: Authentication bypass
+
+### MEDIUM Priority
+
+3. **No Real Cryptography**
+   - Affects: TSIG, SPA, password hashing
+   - Required: Integration with crypto library (libsodium, AWS-LC, or similar)
+
+4. **DNS Server Integration Untested**
+   - Affects: All DNS UPDATE operations
+   - Required: Integration testing with real DNS servers
+
+---
+
+## Architecture Notes
+
+### Design Principles
+1. **Memory Safety**: Ada's ownership model prevents entire classes of bugs
+2. **Type Safety**: Compile-time bounds checking on all coordinates/TTLs
+3. **Constant-Time Operations**: Authentication uses constant-time comparison
+4. **Defense in Depth**: Multiple layers of security checks
+
+### Key Files
+- `src/dns_records.ads` - Core type definitions
+- `src/secure_auth.adb` - Authentication (security-critical)
+- `src/sdp_controller.ads` - Zero-trust SDP
+- `src/firewall_manager.ads` - Firewall integration
+
+---
+
+## Contributing
+
+See [CONTRIBUTING.md](CONTRIBUTING.md) for guidelines.
+
+**Priority Areas for Contributors**:
+1. Crypto library integration (bcrypt/Argon2)
+2. Unit test coverage
+3. DNS server integration testing
+4. SPARK annotations
+
+---
+
+## References
+
+- [RFC 1034](https://tools.ietf.org/html/rfc1034): DNS Concepts
+- [RFC 1035](https://tools.ietf.org/html/rfc1035): DNS Implementation
+- [RFC 1876](https://tools.ietf.org/html/rfc1876): LOC Record Format
+- [RFC 2136](https://tools.ietf.org/html/rfc2136): DNS UPDATE
+- [RFC 2845](https://tools.ietf.org/html/rfc2845): TSIG Authentication
+- [RFC 8482](https://tools.ietf.org/html/rfc8482): HINFO/LOC Deprecation
+- [NIST SP 800-207](https://csrc.nist.gov/publications/detail/sp/800-207/final): Zero Trust Architecture