Move the review pass and Amazon Bedrock support from [Unreleased] to
0.2.0 in the changelog, retitle the release notes and the README status
paragraph. Version strings come from git describe, so no code changes.
README status, release notes and predictions/personality docs no longer
describe 0.2 work as future or 0.1 as current; predictions.md states
which processes create predictions and which do not; ENVIRONMENT.md
records that the host cluster now has pgvector.
- TOTP second factor (RFC 6238, secret encrypted under the master key),
ten hashed single-use recovery codes, two-step login with a pending token
bound to the client address, account enrolment/disable, admin reset
- tests/security: prompt-injection corpus never acts or creates evidence-free
beliefs; roles and CSRF on form and API paths; cross-mind isolation
(demo scenario 5); stored-XSS escaping and CSP across pages; secrets never
echoed (API, pages, database, archives); hostile archive import; session
lifecycle and security headers
- OpenAPI 3.1 document generated from the route table, served at
/api/v1/openapi.json and kept complete by a test
- gosec clean (justified #nosec annotations, cookie/redirect hardening,
bounded multipart parsing, UUID packing without narrowing conversions);
govulncheck clean with toolchain pinned to go1.26.8
- THREAT_MODEL verification pointers, SECURITY.md testing section, README,
CHANGELOG 0.1.0, docs/RELEASE_NOTES.md, PLAN status
Andy Dixon