docs(security): add the audit history, and close a test gap it found

[semics-tech]

Summary

This is the write-up requested for the full-repo security audit performed in this session: docs/security-audit.md, a running record of security audits — findings, the PR that fixed each one, and the specific regression test that stops it recurring.

• 2026-08-02 round (this session): five parallel reviews across server auth/CSRF, server domain/hub trust boundary, worker credentials/signing, dashboard client, and infra/supply-chain. Three real findings, fixed in fix(deploy): lock down the Windows install directory before writing to it #106, fix(dashboard): scope the write-without-where check to the outer statement #107, fix(server): require CSRF on logout too #108. Everything else those reviews specifically targeted was re-verified clean, having already been closed by the round below.
• 2026-07 round (prior deep-dive review): the durable record of what that round found and fixed, for anyone who wasn't in that session.
• A "what was checked and is not a finding" section, so a future audit doesn't re-litigate the same questions (estate-wide read access by design, maxCapability ceiling, no plaintext credential path, RFC1918 webhook targets, the known SBOM/scanning gap).

Every "regression test" citation was checked against the actual test file and, where possible, the actual test title — not asserted from memory. That process surfaced a real gap: the command-signing-key-pin tear-down in session.ts (fixed in #91, back in the 2026-07 round) had no dedicated test. Nothing would have caught a regression back to "log a warning and continue" on a fingerprint mismatch.

Fix

Added packages/worker/test/command-signing-key-pin.test.ts: asserts a HelloAck presenting a key that doesn't match a pinned commandSigningKeyFingerprint tears the session down (session.connected stays false, onDisconnect fires with the specific reason), and that a matching key connects normally.

Test plan

• pnpm lint && pnpm typecheck && pnpm test:unit — all green, 634 tests passing (2 new)

🤖 Generated with Claude Code

https://claude.ai/code/session_01AyYg2j8FVkLjiaVcj5HCkj