Security: correct the CodeQL claim; document outbound device TLS
Security.md asserted there is no CodeQL workflow in the repository. CodeQL is
in fact active through GitHub default setup (security-and-quality suite over
Python, JS/TS and Actions), which is precisely why no codeql.yml exists — the
absent file had been read as an absent scanner. Add it to the scan table and
record the Dependabot-PR consequence.
Also document outbound TLS to managed firewalls, which the Transport security
section did not cover: the three per-device trust modes, the fingerprint pin as
the compensating control when verification is off, and the honest gap that an
already-onboarded device cannot have those settings changed from the console.
Troubleshooting now points at the actual field instead of naming the option.
Troubleshooting: revert now covers all live-applied kinds except ids_rulesets (v0.14.0)
docs: comprehensive OPNGMS wiki (install, architecture, config, editor, log lake, security, reporting, ops)
Add the full operator + contributor manual as 12 wiki pages, every claim
grounded in the repository:
- Home / _Sidebar — overview and persistent navigation
- Installation — prerequisites, four TLS models, pull & start, first run
- Architecture — component diagram, services, data flows, RLS multi-tenancy
- Configuration — complete environment-variable reference
- Upgrading — pull+up flow, version pinning, backups, MASTER_KEY rotation
- Configuration-Editor — the version-aware editor & catalog pipeline (3a/3b
built; 3c diff/config.xml-map fenced as planned/not-built)
- Log-Lake — the optional mTLS syslog to OpenSearch lake
- Reporting — SMTP delivery, per-tenant settings, schedules
- Security — RLS, encrypted-at-rest secrets, MFA, CI scans, hardening
- Troubleshooting — grouped symptom to cause to fix
- Development — local dev, tests, CI, contribution flow
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>