fix(audit): batch 1 — M-1 bare-except + M-3 timezone_offset + C-2 spec drift + typedb doc (#100)

* fix: audit batch 1 — M-1 bare-except + M-3 timezone_offset + C-2 spec drift + typedb doc

Closes 4 findings from tasks/compliance-audit-2026-04-25.md, all
small / mechanical / independent.

M-1 — memory_store.py:351 bare `except:` → `except Exception:`
Direct GOV-003 §"Error Handling" violation: bare except catches
KeyboardInterrupt/SystemExit. The re-raise on line 354 partially
compensated, but the pattern itself is what GOV-003 forbids and what
Ruff `E722` (already enabled) would flag the moment H-1 lands.
Comment added explaining the GOV-003 reference for future readers.

M-3 — OCSF events now emit `metadata.timezone_offset: 0`
GOV-012 §"Required OCSF Base Fields" lists timezone_offset as a
mandatory base attribute. Our events were correct on `time` (always
ISO8601 UTC) but missed the explicit offset, forcing OCSF-strict
downstream pipelines (Sentinel custom-log tables) to insert an
ingest-time transform. Constant `0` since we always emit UTC.

C-2 — `no_hardcoded_secrets` fabricated control claim removed
governance/controls.yaml:45-47 declared GovernanceValidator
.validate_operation as the runtime enforcement point for
no_hardcoded_secrets. Reading governance_validator.py:31-49 — the
method has zero secret-scanning logic. This is the highest-severity
audit-risk pattern: a control listed as 'enforced via runtime method
X' where X is a no-op. Removed the fabricated claim with an inline
comment documenting honest state (GitGuardian + Snyk in CI today;
ruff S rules pending H-1; runtime detector tracked as follow-up).
test_governance_spec_drift.py still passes — its "every runtime rule
references a method or test" check is satisfied by the remaining
input_validation rule.

typedb doc — `export TYPEDB_USERNAME=admin` → `<your-typedb-username>`
Carry-over from PR #82 (TypeDB auth hardening) that missed the
merge by 64s. The example block in configure-typedb.md was the last
place the old hardcoded `admin` default still appeared in user-facing
docs.

All four touch independent files. 18/18 governance + logging tests
pass locally. ruff check + ruff format --check clean.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* ci: enforce --cov-fail-under=67 (audit H-2)

GOV-007 §'Coverage Requirements' mandates ≥80% line / ≥70% branch
'enforced in CI'. Today's CI runs pytest --cov but does NOT pass
--cov-fail-under, so any coverage including 0% is silently accepted.
controls.yaml:35 already claims --cov-fail-under=67 as the enforced
value; this PR makes the claim true.

67% chosen as the starting ratchet because it matches the existing
governance/controls.yaml declaration and is verified to pass on
master today. Issue #51 tracks raising it toward 80% across v2.5.x.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: rolandpg

.github/workflows/ci.yml

@@ -59,7 +59,11 @@ jobs:
         ZETTELFORGE_BACKEND: sqlite
         ZETTELFORGE_EMBEDDING_PROVIDER: fastembed
       run: |
-        pytest tests/ -v --cov=zettelforge --cov-report=xml --cov-report=term-missing
+        # GOV-007 §"Coverage Requirements" mandates ≥80% line / ≥70% branch.
+        # We start the ratchet at 67 (matches governance/controls.yaml's
+        # current declaration) so today's pipeline does not break, and #51
+        # tracks raising it toward 80% across v2.5.x. Audit finding H-2.
+        pytest tests/ -v --cov=zettelforge --cov-report=xml --cov-report=term-missing --cov-fail-under=67
 
     - name: Upload coverage
       if: matrix.python-version == '3.12'

docs/how-to/configure-typedb.md

@@ -118,7 +118,7 @@ backend: typedb
 export TYPEDB_HOST=localhost
 export TYPEDB_PORT=1729
 export TYPEDB_DATABASE=zettelforge
-export TYPEDB_USERNAME=admin
+export TYPEDB_USERNAME=<your-typedb-username>
 export TYPEDB_PASSWORD=<your-password>
 export ZETTELFORGE_BACKEND=typedb
 ```

governance/controls.yaml

@@ -42,9 +42,15 @@ controls:
       - id: input_validation
         description: "Content must be str or have .content attribute"
         runtime_method: "GovernanceValidator.validate_operation"
-      - id: no_hardcoded_secrets
-        description: "Content must not contain API keys, tokens, or credentials"
-        runtime_method: "GovernanceValidator.validate_operation"
+      # The 2026-04-25 compliance audit (C-2) found that a previously-declared
+      # `no_hardcoded_secrets` rule pointed at GovernanceValidator.validate_operation
+      # as its runtime_method, but that method contains no secret-detection
+      # logic. Honest state: NOT IMPLEMENTED at runtime today. Static
+      # enforcement is provided by GitGuardian (CI) and (once GOV-003-mandated
+      # `S` rules are restored to ruff config — audit H-1) Bandit S105/S106/S108.
+      # Runtime detector (regex + entropy + detect-secrets) is tracked as
+      # follow-up work; the rule will be re-declared here when implemented.
+      # Removed rather than left fabricated — see tasks/compliance-audit-2026-04-25.md.
 
   GOV-012:
     name: Audit Logging

src/zettelforge/memory_store.py

@@ -348,7 +348,10 @@ def _rewrite_note(self, note: MemoryNote) -> None:
                     # Update cache
                     if self._note_cache is not None:
                         self._note_cache[note.id] = note
-                except:
+                except Exception:
+                    # GOV-003: never bare-except. Catches all real write
+                    # failures while letting KeyboardInterrupt / SystemExit
+                    # propagate normally.
                     if os.path.exists(tmp_path):
                         os.unlink(tmp_path)
                     raise

src/zettelforge/ocsf.py

@@ -101,6 +101,11 @@ def _base_fields(
         "status_id": status_id,
         "status": "Success" if status_id == STATUS_SUCCESS else "Failure",
         "time": datetime.now(timezone.utc).isoformat(),
+        # GOV-012 §"Required OCSF Base Fields" lists timezone_offset alongside
+        # `time`. We always emit UTC, so this is constant; surfacing it lets
+        # OCSF-strict downstream validators (Sentinel custom-log tables) accept
+        # the events without an ingest-time transform.
+        "timezone_offset": 0,
         "metadata": {
             "version": "1.3.0",
             "product": {