feat(security): ship pre-release security posture docs/tests/fuzz/CI#54

Merged

bb-connor merged 16 commits intomainfrom

audit-fix/2026-02-10-wave3-remediation

Feb 10, 2026

Commits on Feb 10, 2026

docs(audits): add 2026-02 rust security correctness audit
bb-connor
committed
fix(audit): remediate CS-AUDIT-001..006
bb-connor
committed
fix(hush-cli): harden CONNECT proxy policy/resource bounds
bb-connor
committed
fix(clawdstrike): fail closed on IRM path and URL spoof bypasses
bb-connor
committed
fix(remote-extends): validate git refs and block option injection
bb-connor
committed
fix(policy): bound extends recursion and async background inflight
bb-connor
committed
fix(audit): finalize remediation evidence and ipv6 parity
bb-connor
committed
fix(hush-cli): pin CONNECT hostname resolution to policy-checked IP
bb-connor
committed
fix(clawdstrike): fail closed when filesystem IRM path extraction is ambiguous
bb-connor
committed
chore(security): codify advisory exceptions and wave3 remediation proof
bb-connor
committed
feat(security): add pre-release posture docs, regressions, fuzz, and CI sensors
bb-connor
committed
fix(review): address CONNECT retry, SCP parsing, and session lock pruning
bb-connor
committed
fix(remote-extends): treat scheme remotes as URLs before scp parsing
bb-connor
committed
fix(hush-run): block full non-public ipv4 special-use ranges
bb-connor
committed
fix(irm): accept bare filenames in path extraction
bb-connor
committed
fix(hushd): use cached git policy before DNS host checks
bb-connor
committed