Denis Parfionovich e185af7116 fix(security): patent-leak + classical-safety audit fixes

PATENT-LEAK (HIGH):
- hooks/no-python-without-approval.sh: genesis-verify пример → my-project
- docs/encyclopedia/rust-crates-H-N.md: убран термин «Genesis IP, ITAR»
PATENT-LEAK (MEDIUM):
- CHANGELOG: project-vortex → reduced scope
- _blocks/registries (submodule bump): убраны имена приватных
  project-specialists из комментария agent-profiles.toml
- docs/encyclopedia/skills-and-agents.md: ML/RL/CfC → ML/RL

CLASSICAL-SAFETY (MEDIUM):
- install/lib-preflight.sh: eval "$version_cmd" → bash -c "..."
  (защита от инъекции если providers.toml расширят)
- _primitives/provision-{vultr,hetzner}.sh: /tmp/$$ → mktemp
  (устраняет symlink TOCTOU race)
- web-install.sh: chmod 600 + umask 077 на ~/.keisei-install.log
  (Forgejo admin creds + токены в логе)
- scripts/regen-counts.sh: eval "$1" → bash -c

NOT FIXED (требуют действий юзера):
- HIGH: @keisei scope не зарегистрирован на npmjs.org — typosquat
  возможен пока не задан NPM_TOKEN и не сделан publish
- HIGH: install.keisei.app DNS не настроен — DNS-hijack возможен
- LOW: parfionovich@keilab.io в SECURITY.md, plugin.json, ~40 Cargo
  файлах — intentional contact, оставлен

Локальный git author установлен на parfionovich@keilab.io вместо
parfionovichd@icloud.com (только для будущих коммитов в этом репо).

2026-05-18 12:05:25 +08:00

783 B

Raw Blame History

Changelog

All notable changes are tagged via git tag v*. This file tracks unreleased work + release pointers.

Unreleased

chore(docs): regenerate DNA-INDEX (reduced scope) (302ca661)
fix(kei-conflict-scan): close 3 backlog bugs + Phase C draft emission (f354aacc)
feat(kei-buddy): conversational LLM-driven flow + kei-sage retrieval graph-RAG (b61b17ea)
feat(contacts): glue sync + Google pagination + Apple discovery + folding (06bcce99)
fix(kei-conflict-scan): wikilink path-norm + drop handoff false-positives (6cd99982)
feat(kei-buddy fleet): 5 atomics — google/apple contacts + classifier + tick + slash-commands (450156a4)

Released

Release notes per tag are kept in the GitHub Releases UI. See git tag --sort=-creatordate.

783 B Raw Blame History

Changelog

Unreleased

Released

783 B

Raw Blame History