fix(audit): batch 1 — M-1 bare-except + M-3 timezone_offset + C-2 spec drift + typedb doc

[rolandpg]

Summary

Closes 4 findings from `tasks/compliance-audit-2026-04-25.md`. All small, mechanical, independent. Does not depend on PR #99 (master CI fix) but rebases cleanly on top.

Finding	File	Change
M-1 GOV-003 §Error Handling	`memory_store.py:351`	bare `except:` → `except Exception:`
M-3 GOV-012 §Required OCSF Base Fields	`ocsf.py` `_base_fields()`	add `metadata.timezone_offset: 0`
C-2 GOV-011 + GOV-014 + CA-2 (spec drift / fabricated evidence)	`controls.yaml`	remove fabricated `no_hardcoded_secrets` rule; replace with honest comment block
Carry-over	`docs/how-to/configure-typedb.md:121`	`s/admin//` (PR #82 carry-over)

Why C-2 is the most consequential here

`controls.yaml:45-47` declared `GovernanceValidator.validate_operation` as the runtime enforcement point for `no_hardcoded_secrets`. Reading `governance_validator.py:31-49`, that method contains literally zero secret-scanning logic. A string with a live AWS access key would pass validation silently.

This was the audit's CRITICAL-tier example of the worst auditor-finding pattern: a control listed as "enforced via runtime method X" where X is a no-op creates false assurance throughout any SSP or SOC 2 narrative derived from the manifest.

Removed the fabricated claim with an inline comment documenting honest state:

• Static enforcement: GitGuardian + Snyk in CI today, plus ruff `S` rules once H-1 ships.
• Runtime detection: tracked as follow-up work; will be re-declared here when implemented (regex + entropy + detect-secrets).

`test_governance_spec_drift.py`'s "every runtime rule references a method or test" check still passes because the remaining `input_validation` rule satisfies it.

Verification

• `ruff check` + `ruff format --check` on all touched files: clean
• `pytest tests/test_governance_spec_drift.py tests/test_logging_compliance.py -p no:qmd_contract`: 18/18 pass

Not addressed in this batch

• C-1 branch protection — needs GitHub admin action via `gh api -X PUT`. Separate PR with the script.
• H-1 ruff rule set — adding `S, B, UP, SIM, RUF, ANN, T20` will surface 50-200 findings; needs a triage pass, not appropriate here.
• H-2 coverage threshold — adding `--cov-fail-under=67` to CI is small but warrants its own PR for visibility.
• H-3 mypy strict — needs a triage sweep similar to H-1.
• H-4 CODEOWNERS / GOV-006 amendment — policy decision required, not code.
• H-5 pip-audit + Snyk fail-mode — separate CI config PR.
• All MEDIUM / LOW findings beyond M-1 + M-3 — batch 2.

Test plan

• Lint clean
• 18 governance + logging tests pass locally
• CI green
• Merge

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Addresses several compliance-audit findings by tightening error handling, aligning emitted audit-log fields with required OCSF base fields, removing an overstated governance control claim, and correcting TypeDB configuration docs.

Changes:

• Replace a bare except: with except Exception: during atomic note rewrite cleanup.
• Add timezone_offset to OCSF base fields emitted for audit logging.
• Remove the fabricated no_hardcoded_secrets runtime rule from controls.yaml and document the current honest enforcement state.
• Update TypeDB docs to avoid suggesting admin as the username.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 3 comments.

File	Description
src/zettelforge/ocsf.py	Adds timezone_offset to _base_fields() for OCSF event emission.
src/zettelforge/memory_store.py	Replaces bare-except in note rewrite path with except Exception: and keeps cleanup behavior.
governance/controls.yaml	Removes the no_hardcoded_secrets rule and adds an explanatory comment block.
docs/how-to/configure-typedb.md	Replaces admin username example with a user-provided placeholder.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Shell snippet uses angle brackets in export TYPEDB_USERNAME=<your-typedb-username>, which is not copy/paste-safe in bash/zsh (< is input redirection). Use a placeholder that won’t be parsed by the shell (e.g., TYPEDB_USERNAME=your_typedb_username or quote the placeholder).

Suggested change

	export TYPEDB_USERNAME=<your-typedb-username>
	export TYPEDB_PASSWORD=<your-password>
	export TYPEDB_USERNAME=your_typedb_username
	export TYPEDB_PASSWORD=your_typedb_password

[Copilot]

PR description says to add metadata.timezone_offset, but _base_fields() currently adds timezone_offset at the top level (sibling of time/metadata). Please either update the PR description or move the field into metadata so the implementation matches the stated intent/spec reference used by downstream validators.

[Copilot]

This comment block says ruff S rules are “GOV-003-mandated”, but in this same manifest GOV-003 only declares naming and format rules (no security/static-analysis requirement). Consider rewording to avoid tying Bandit/ruff S enforcement to GOV-003 unless the control is updated accordingly.

Suggested change

	# enforcement is provided by GitGuardian (CI) and (once GOV-003-mandated
	# `S` rules are restored to ruff config — audit H-1) Bandit S105/S106/S108.
	# Runtime detector (regex + entropy + detect-secrets) is tracked as
	# follow-up work; the rule will be re-declared here when implemented.
	# Removed rather than left fabricated — see tasks/compliance-audit-2026-04-25.md.
	# enforcement is provided by GitGuardian (CI) and, if `S` rules are
	# restored in the lint/static-analysis configuration (audit H-1),
	# Bandit S105/S106/S108. Runtime detector (regex + entropy +
	# detect-secrets) is tracked as follow-up work; the rule will be
	# re-declared here when implemented. Removed rather than left
	# fabricated — see tasks/compliance-audit-2026-04-25.md.