Promote develop-auto security-review campaign + landing video → develop (#856)

[chronoai-shining]

Promote develop-auto → develop (security-review campaign + landing video)

Closes #856

Promotes the autonomous security-review campaign plus the landing hero video from develop-auto into develop, in preparation for the next release. develop-auto = v0.9.1 + 20 commits, 0 behind develop, 0 merge conflicts.

What's included (20 commits)

Security hardening

• BOLA: enforce private-skill visibility on playground skill-load ([Bug] Enforce private-skill visibility on playground skill-load (BOLA) #806) + actor-plumbing follow-up ([Misc] Harden playground actor plumbing (follow-up to #806) #826)
• Path-traversal: reject traversal skill names on skip-validation import ([Bug] Reject path-traversal skill names on the skip_validation import path #807); reject ./.. in GitHub owner/repo identifiers ([Bug] Reject traversal/dot segments in GitHub owner/repo identifiers (mirror + pull) #818)
• Quota integrity: atomic reservation to stop concurrent over-cap TOCTOU ([Bug] Atomically reserve quota to prevent concurrent over-cap (TOCTOU) #808) + reservation follow-ups ([Misc] Quota reservation follow-ups (follow-up to #808) #827)
• Rate limiting: per-user limit on POST /playground/chat ([Bug] Add a per-user rate limit to POST /playground/chat #809); key anon limits on a trusted client IP not raw XFF ([Bug] Key anonymous rate limits on a trusted client IP, not raw XFF #813); shared-store contract ([Misc] Back the rate limiter with a shared store (per-pod/restart-reset today) #814)
• DoS: bound pagination skip() ([Bug] Bound pagination page to stop unbounded MongoDB skip() #810)
• SSRF: re-resolve outbound hosts at fetch time for DNS-rebind parity ([Bug] Re-resolve outbound hosts at fetch time for SSRF (DNS-rebind) parity #811); re-validate each redirect hop + strip cross-host credentials ([Bug] Re-validate redirect hops in safeFetch to close the SSRF redirect bypass (follow-up to #811) #832)
• Idempotency: skip capture for SSE/streaming responses ([Bug] Skip idempotency capture for SSE/streaming responses #812)
• Org-share authz: enforce caller org membership when sharing into an org ([Bug] Enforce caller org membership when sharing a skill into an org #815); distinguish unresolved membership → retryable 503 org_membership_unavailable vs resolved-not-member → 403 not_org_member ([Bug] setSkillPermissions returns spurious 403 when org memberships are unresolved (follow-up to #815) #842)
• Secret hygiene: redact token/accessToken/userAccessToken/clientSecret/privateKey across all Pino roots ([Misc] Redact token/clientSecret/privateKey/accessToken in Pino logs #817)
• Config: ENCRYPTION_KEY doc correctness ([Docs] Correct the stale ENCRYPTION_KEY dev-sentinel claim in config doc #821); remove dead requireOwnerOrAdmin helper ([Misc] Remove the unused requireOwnerOrAdmin authz helper #820)
• Sandbox: clamp timeout_secs to advertised 1–600 ([Bug] Clamp playground sandbox timeout_secs to the advertised 1-600 range #819)

Feature

• Full-bleed autoplay hero video on the landing page ([Feature] SPA stale-bundle self-recovery — auto-reload when a new ornn-web is deployed #318)

Every commit carries a changeset (21 changesets present), so the develop → main release flow will version correctly (→ next minor/patch).

---

Validation — full A/B regression vs v0.9.1 on local k8s (ornn-cluster)

Built and deployed both versions to the live cluster (docker-desktop) and ran an identical suite against each.

In-repo suite on the integrated develop-auto HEAD (595b883) — all green:

Check	Result
ornn-api bun test	964 pass / 0 fail (2102 assertions, 87 files)
ornn-web vitest	153 pass / 0 fail (incl. HeroVideo.test.tsx)
TS SDK vitest	17 pass / 0 fail
typecheck · lint · build:web	clean

Live A/B (deployed v0.9.1 baseline vs deployed develop-auto):

• Core parity: 15/15 identical, zero regressions — /livez, /me, /me/orgs, /me/quota, /me/models, skill-search (empty + query), skill get + /json, skill-format/rules, manifest schema, users/search, admin/skills, 404 contract, unauth-gate.
• OpenAPI contract: identical (14 paths, no additions/removals, no breaking changes).
• Hardening deltas confirmed present in develop-auto:
  • Playground rate-limit ([Bug] Add a per-user rate limit to POST /playground/chat #809) — confirmed live: concurrent burst → 429s; ornn-api logs show rateLimit key=user:<id> label=playground-chat count=21..25 max=20 → 429 "Retry in 60s".
  • Org-membership gate ([Bug] Enforce caller org membership when sharing a skill into an org #815/[Bug] setSkillPermissions returns spurious 403 when org memberships are unresolved (follow-up to #815) #842) — present and keyed user:<id>; correctly admin-bypassed by design (service.ts:514 if (!actor.isPlatformAdmin)), so the live admin token returns 200; the gate for non-admins is proven by the 964-test suite.
  • Secret redaction ([Misc] Redact token/clientSecret/privateKey/accessToken in Pino logs #817) — confirmed: live request logs show user:<id> only, no bearer/secret in plaintext.
• Boot: develop-auto ornn-api boots clean (confirms [Docs] Correct the stale ENCRYPTION_KEY dev-sentinel claim in config doc #821 ENCRYPTION_KEY fail-fast does not crash with the deployed secret).

Web (landing hero video, #318): <video autoplay muted loop playsInline> with poster ornn-intro-poster.jpg + source ornn-intro.mp4, readyState 4, playing, 1920×1080, assets served (200), no console errors. Absent in v0.9.1.

---

Known deferred (not blocking this promotion)

• [Misc] Gate/scope user-directory enumeration on /users/search and /users/resolve #816 — user-directory enumeration gate on /users/search + /users/resolve did not land (PR [Misc] Gate/scope user-directory enumeration on /users/search and /users/resolve #845 is red on an env-at-import test flake; root cause diagnosed in follow-up(#816): /auto could not converge #846). It is not a regression — those endpoints behave exactly as in v0.9.1 (live parity confirmed). Decide whether to land follow-up(#816): /auto could not converge #846's fix before cutting develop → main.

Merge notes

• Mergeable: 0 conflicts, 0 behind develop. Merge with a merge commit (not squash) to preserve the per-issue history + changesets.
• After merge, the standard develop → main + changeset-release flow consumes the 21 changesets and bumps the version.