Hard review: secure secrets, governance, scope, CI gates

[rokolslab]

Summary

This replacement PR contains the reviewed hard-audit package rebuilt cleanly from origin/main.

It replaces PR #1, which was accidentally based on a local main branch that was 5 commits ahead of origin/main and therefore included unrelated older local-main commits.

Changes included:

• Harden generated secrets handling and ignore local secret/runtime files.
• Add governance baseline docs, version policy, acceptance criteria, and AI Factory project rules.
• Clarify Ubuntu baseline: 24.04 LTS primary, 26.04 LTS validation target, 22.04 rejected as unsupported legacy.
• Clarify Supabase scope as PostgreSQL with selected Supabase-related components, not full Supabase.
• Remove unsafe public Compose override and replace direct public exposure guidance with localhost/SSH tunnel/reviewed Nginx reverse proxy guidance.
• Add a static GitHub Actions quality workflow.

Clean rebuild notes

This branch was rebuilt from origin/main and cherry-picked with only the intended review series.

The following older local-main scope is intentionally absent:

• .ai-factory/PLAN.md
• scripts/01-setup-ssh-keys.sh
• scripts/03-install-docker.sh
• scripts/lib/common.sh
• scripts/security/*.sh

Commit series

• 74eaeda fix: harden generated secrets handling
• 106de4a docs: add project governance baseline
• 4d4fd55 chore: add ai factory project rules
• 20849bd docs: clarify supabase-related scope
• 603ec57 docs: align ubuntu baseline policy
• 8808d07 fix: remove unsafe public compose override
• 80aec1d chore: ignore ai factory plan artifacts
• 14cc32b ci: add static quality workflow

Safety / scope controls

• No secrets committed.
• .ai-factory.json, .opencode/, and .ai-factory/plans/ are ignored/local.
• No container startup was required for review.
• No install scripts were run during review.
• Public admin surfaces remain localhost by default.
• Direct public Compose override was removed.

Validation performed

• git diff --check origin/main...review/hard-audit-ubuntu-bootstrap-clean
• Bash syntax checks
• ShellCheck locally
• docker compose --env-file env.example config
• docker compose --env-file env.example -f docker-compose.yml -f docker-compose.monitoring.yml config
• grep checks for removed public override references
• grep checks for Compose latest image tags
• tracked secret-file guard
• clean branch scope check against origin/main

Known follow-ups

• docker-compose.monitoring.yml still emits the known obsolete version: warning; separate Compose cleanup PR.
• GitHub Actions workflow may fail if ShellCheck is not available on the runner; tool installation strategy should be separate if needed.
• Clean Ubuntu 24.04 VM smoke-test evidence is still required before release-readiness claims.
• Changelog/release readiness remains a future phase.
• Full Supabase remains deferred/not current support.

Relation to PR #1

This PR supersedes PR #1. Do not merge PR #1.

[rokolslab]

Self-review summary

This is the active replacement draft PR for the hard repository review.

PR #1 was closed as superseded because it was based on a local main branch that was 5 commits ahead of origin/main and included unrelated older local-main commits.

This PR was rebuilt cleanly from origin/main and contains only the intended 8-review-commit series.

Verified

• CI Static quality checks passed.

• Branch is based on origin/main.

• Old local-main scope is absent:

  • .ai-factory/PLAN.md
  • scripts/01-setup-ssh-keys.sh
  • scripts/03-install-docker.sh
  • scripts/lib/common.sh
  • scripts/security/*.sh

• No tracked .env or secret-like local files.

• .ai-factory.json, .opencode/, and .ai-factory/plans/ are ignored/local.

• Unsafe public Compose override was removed.

• Public/admin access guidance is limited to localhost, SSH tunnel, or reviewed Nginx/reverse proxy.

• Supabase scope is documented as PostgreSQL with selected Supabase-related components, not full Supabase.

• Ubuntu baseline is documented as 24.04 LTS primary, 26.04 LTS validation target, and 22.04 unsupported legacy.

• Static GitHub Actions quality workflow was added.

Known follow-ups

• docker-compose.monitoring.yml still emits the known obsolete version: warning during static Compose validation.
• Clean Ubuntu 24.04 VM smoke-test evidence is still required before release-readiness claims.
• Changelog/release readiness remains a future phase.
• Full Supabase remains deferred/not current support.
• If GitHub runner ShellCheck availability changes, the CI tool installation strategy should be handled in a separate PR.

Review recommendation

Keep this PR as draft until human review is complete. Do not merge without explicit approval.