ValgulNecron · Oct 5, 2026 · Sep 23, 2026 · Sep 23, 2026 · Sep 23, 2026 · Sep 23, 2026
diff --git a/.gitignore b/.gitignore
@@ -5,6 +5,10 @@
 *.out
 *.prof
 coverage.*
+# Audit component-review coverage table (spec 018 contracts/audit-records.md), not test coverage output
+!specs/*/audit/coverage.md
+# Spec 018 OD-019: unfixed security findings stay off GitHub until their fix merges
+specs/*/audit/held/
 coverage/
 vendor/
 operator/bin/
@@ -70,4 +74,6 @@ system.md
 design.pen.bak
 heroUI template.pen
 
-**/held
+**/held
+# 018 held audit records are published once every held fix has a pull request.
+!specs/018-v0-3-release-readiness/audit/held
diff --git a/specs/018-v0-3-release-readiness/OPEN-DECISIONS.md b/specs/018-v0-3-release-readiness/OPEN-DECISIONS.md
diff --git a/specs/018-v0-3-release-readiness/RESTART.md b/specs/018-v0-3-release-readiness/RESTART.md
diff --git a/specs/018-v0-3-release-readiness/audit/conventions.md b/specs/018-v0-3-release-readiness/audit/conventions.md
@@ -0,0 +1,95 @@
+# Conventions (shared by every procedures file)
+
+## Cluster
+
+Export the kubelab kubeconfig:
+```sh
+export KUBECONFIG=~/kubelab.yaml
+```
+
+The Gameplane release is in namespace `gameplane-system`, named `gameplane`. Game servers are in namespace `gameplane-games`.
+
+## Reaching the API
+
+Per OD-016, the ingress host `gameplane.local` is not used: it does not resolve from the audit devbox. Run:
+```sh
+kubectl port-forward -n gameplane-system svc/gameplane-web 18080:80
+```
+
+Use `GP=http://127.0.0.1:18080` for all API requests. The ingress sends `/` to `gameplane-web`, which serves the dashboard and proxies API paths to `gameplane-api`.
+
+## Sessions
+
+Create a session with a POST to `$GP/auth/login`:
+```sh
+curl -s -D headers.txt -H "Content-Type: application/json" \
+  -d '{"username":"audit018-admin","password":"<password>"}' \
+  $GP/auth/login
+```
+
+The response sets `gameplane_session` and `gameplane_csrf` cookies (both `HttpOnly` and `Secure`). Capture them:
+```sh
+grep -i "^set-cookie:" headers.txt | grep gameplane_session > ~/gameplane-audit-018/session-<role>.txt
+grep -i "^set-cookie:" headers.txt | grep gameplane_csrf >> ~/gameplane-audit-018/session-<role>.txt
+chmod 600 ~/gameplane-audit-018/session-<role>.txt
+rm headers.txt
+```
+
+Over plain HTTP, `curl` drops `Secure` cookies. Instead, extract and send them back:
+```sh
+SESS=$(grep gameplane_session ~/gameplane-audit-018/session-<role>.txt | cut -d'=' -f2 | cut -d';' -f1)
+CSRF=$(grep gameplane_csrf ~/gameplane-audit-018/session-<role>.txt | cut -d'=' -f2 | cut -d';' -f1)
+curl -H "Cookie: gameplane_session=$SESS; gameplane_csrf=$CSRF" \
+  -H "X-Gameplane-CSRF: $CSRF" \
+  $GP/api/path
+```
+
+Every mutating request also includes `-H "X-Gameplane-CSRF: <gameplane_csrf value>"`.
+
+## Accounts
+
+One session per role per round:
+- `audit018-admin`: full access
+- `audit018-operator`: operator access
+- `audit018-viewer`: read-only access
+- `audit018-collab`: collaborator access (when needed)
+
+Admin access follows OD-015: `audit018-admin` is created with `kubectl exec -n gameplane-system deploy/gameplane-api -- /api bootstrap-admin --username audit018-admin` (the image's entrypoint is `/api`, see `api/Dockerfile`), and its password is kept in `~/gameplane-audit-018/admin.env` (mode 600, off-git). The other role accounts are created through the API as that admin.
+
+## Login budget
+
+Rate limits per cluster:
+- IP burst 10 (5/min)
+- User burst 6 (3/min)
+
+Each procedure states its login cost. Procedures that spend the budget on purpose (brute force, throttling tests) are marked **deferred to T031** and run last.
+
+## Naming and isolation
+
+Every created object is named `audit018-<purpose>[-n]`, within Kubernetes' 63-character label limit.
+
+Objects created with `kubectl` also carry the label `gameplane.io/audit: "018"`. Put it in the manifest's `metadata.labels`, or add it right after creating the object (`-l` on `kubectl apply` is a selector filter: it adds no label):
+```sh
+kubectl apply -f <file> -n gameplane-games
+kubectl label -f <file> -n gameplane-games gameplane.io/audit=018
+```
+
+Pre-existing objects are **never** written to. This covers:
+- GameServers: `mc-fabric`, `soak-bogus-pool`, `soak-no-preference`, `soak-pool-west`, `squad`
+- ModuleSources: `default`, `uploads`
+
+A procedure that needs an existing object creates its own `audit018-` copy first.
+
+## Evidence
+
+Save all evidence under `audit/evidence/<INV-ID>/`, redacted:
+- Share tokens as `<token>` (not the actual token)
+- No cookies, CSRF values, passwords or secrets
+- Each file stays under 1 MB
+
+Evidence of a security boundary or control that does not hold is a security finding. It goes to `audit/held/evidence/<ID>/` (git-ignored) instead, until the fix merges (OD-019).
+
+## Automatable?
+
+Each procedure states `yes` or `no`. For `yes`, propose a bucket from `test/e2e/buckets.sh`:
+- `operator`, `api-auth`, `api-roles`, `api-rbac`, `api-agent`, `api-mods`, `ratelimit`, `bot-fast`, `bot-heavy`, `multicluster`, `upgrade`
diff --git a/specs/018-v0-3-release-readiness/audit/coverage.md b/specs/018-v0-3-release-readiness/audit/coverage.md
@@ -0,0 +1,33 @@
+# Component Review Coverage
+
+One row per component (FR-003, SC-002). Columns are fixed by [contracts/audit-records.md](../contracts/audit-records.md#coveragemd). Allowed `Status` values: `not-started`, `in-review`, `complete`.
+
+| Component | Scope reviewed | Method | Reviewer tier | Date | Status | Findings |
+|-----------|----------------|--------|---------------|------|--------|----------|
+| agent/ | All 33 agent files including cmd/main.go, internal/ handlers (actions, auth, caps, console, files, heartbeat, logs, mods, players, quiesce, rcon, status), openapi.yaml, specs.md | code-review | opus → opus (independent, OD-020) | 2026-09-24 | complete | F-102, F-103, F-104, F-105, F-106, F-107, F-108, F-109, F-110, F-111 |
+| api/ | cmd/main.go, cmd/bootstrap.go, internal/handlers/ (all non-test), internal/auth/, internal/rbac/, internal/db/ (full), internal/kube/, internal/audit/, internal/notify/ (partial), internal/ws/, internal/registry/, internal/telemetry/ | code-review | opus → opus (independent, OD-020) | 2026-09-24 | complete | F-074, F-075, F-076, F-077, F-081, F-082, F-083, F-085, F-086, F-087, F-088, F-089 |
+| audit-syslog-bridge/ | main.go, bridge_test.go, specs.md, README.md, Dockerfile, go.mod, .testcoverage.yml | code-review | opus → opus (independent, OD-020) | 2026-09-24 | complete | F-195, F-196, F-197, F-198 |
+| capture-sidecar/ | cmd/main.go, internal/auth/tls.go, internal/capture/ (afpacket.go, filter.go, writer.go), internal/httpserver/handlers.go, specs.md, Dockerfile, go.mod, .testcoverage.yml; operator sidecar client reviewed | code-review | opus → opus (independent, OD-020) | 2026-09-24 | complete | F-187, F-188, F-189, F-190, F-191, F-192, F-193 |
+| gameaction/ | action.go, action_test.go, specs.md, go.mod, .testcoverage.yml; api and agent importers reviewed | code-review | opus → opus (independent, OD-020) | 2026-09-24 | complete | F-149, F-150, F-151, F-152 |
+| gameproto/ | gameproto.go, classifier.go, registry.go, demo.go, minecraft.go, terraria.go, specs.md, go.mod, .testcoverage.yml, test files (partial), sentinel usage reviewed | code-review | opus → opus (independent, OD-020) | 2026-09-24 | complete | F-153, F-154, F-155, F-156, F-157, F-158 |
+| gp-module/ | All non-test source: cmd/gp-module/, internal/archetypes/, internal/common/, internal/packager/, internal/preview/, internal/scaffold/, internal/validator/, pkg/ subdirectories, specs.md, go.mod; test functions list; operator and API usage reviewed | code-review | opus → opus (independent, OD-020) | 2026-09-24 | complete | F-159, F-160, F-161, F-162, F-163, F-164, F-165, F-166, F-167, F-168 |
+| mcp-server/ | main.go, tools.go, fixadvice.go, internal/kube/client.go and client_test.go, specs.md, README.md, Dockerfile, .testcoverage.yml; chart RBAC and CRD usage reviewed | code-review | opus → opus (independent, OD-020) | 2026-09-24 | complete | F-204, F-205, F-206, F-207, F-208, F-209, F-210 |
+| netguard/ | netguard.go, netguard_test.go, specs.md, go.mod, .testcoverage.yml; all call sites grepped; operator and agent usage reviewed | code-review | opus → opus (independent, OD-020) | 2026-09-24 | complete | none |
+| operator/ | cmd/main.go, internal/agent/client.go, sidecar_capture.go, internal/controller/ (all non-test files), internal/modsrc/, internal/oci/, internal/verify/, api/v1alpha1/, config/, specs.md, go.mod; test fixtures reviewed | code-review | opus → opus (independent, OD-020) | 2026-09-24 | complete | F-044, F-045, F-046, F-047, F-048, F-049, F-050, F-051, F-052, F-054, F-055, F-056, F-057, F-058, F-059, F-060, F-061, F-062, F-063 |
+| sentinel/ | main.go, specs.md, Dockerfile, .testcoverage.yml, go.mod, main_test.go (partial); operator wiring reviewed; gameproto contract reviewed | code-review | opus → opus (independent, OD-020) | 2026-09-24 | complete | F-179, F-180, F-181, F-182, F-183, F-184, F-185, F-186, F-254 |
+| svcutil/ | env.go, env_test.go, server.go, server_test.go, specs.md, go.mod, .testcoverage.yml; all importers grepped; consumer binaries reviewed | code-review | opus → opus (independent, OD-020) | 2026-09-24 | complete | F-170, F-171 |
+| telemetry-receiver/ | main.go, main_test.go, specs.md, README.md, Dockerfile, go.mod, .testcoverage.yml; API reporter reviewed; chart wiring checked | code-review | opus → opus (independent, OD-020) | 2026-09-24 | complete | F-200, F-201 |
+| test/e2e/ | `test/e2e/buckets.sh`, `test/e2e/specs.md`, `test/e2e/internal/specs.md`, CI wiring (`.github/workflows/ci.yaml`), env/gameprobe/gamebot helpers, test suites, JSON schema validation | code-review | sonnet → opus | 2026-09-23 | complete | F-040, F-041, F-042 |
+| tunnel/ | main.go, specs.md, Dockerfile.frp, Dockerfile.playit, Dockerfile.tailscale, go.mod, .testcoverage.yml, main_test.go (partial); operator wiring reviewed; docs/tunnels.md reviewed | code-review | opus → opus (independent, OD-020) | 2026-09-24 | complete | F-172, F-173, F-174, F-175, F-176 |
+| web/ | specs.md, index.html, package.json, eslint.config.js, tsconfig.json, src/main.tsx, src/router/tree.tsx, src/lib/ (all files), src/routes/ (most files and tabs), src/components/ (all directories); server-side endpoints reviewed | code-review | opus → opus (independent, OD-020) | 2026-09-24 | complete | F-115, F-116, F-117, F-118, F-119, F-120, F-121, F-122, F-123, F-124, F-125, F-126, F-127, F-128, F-129, F-130, F-131, F-132, F-133, F-134, F-135, F-136, F-137, F-138, F-139, F-140, F-141, F-251 |
+| charts/gameplane/ | Chart.yaml, values.yaml, all 18 templates, crds/*.yaml, docs/install.md, docs/networking.md, docs/security.md (chart sections); API flags, operator flags, CRD rendering, NetworkPolicy logic reviewed | code-review | opus → opus (independent, OD-020) | 2026-09-24 | complete | F-028, F-212, F-213, F-214, F-215, F-216, F-217, F-218, F-219, F-220, F-221, F-222, F-223, F-224, F-225, F-226, F-252 |
+| deploy/ | cluster.yaml, up.sh, down.sh, e2e.sh, upgrade.sh (all files); Makefile targets and script usage reviewed | code-review | opus → opus (independent, OD-020) | 2026-09-24 | complete | F-029, F-232, F-233, F-234, F-255 |
+| hack/ | check-doc-versions.sh, check-links.sh, check-specs.sh, gen-module-schema.py (all files); Makefile targets, CLAUDE.md commands, .testcoverage.yml thresholds reviewed | code-review | opus → opus (independent, OD-020) | 2026-09-24 | complete | F-026, F-236, F-237 |
+| .github/workflows/ | ci.yaml (all 1541 lines), release.yaml, publish-edge.yaml, images.yaml, republish-modules.yaml, screenshot-refresh.yaml, visual-diff.yaml, actions in .github/actions/, zizmor.yml, modules/build.sh, docs/contributing.md | code-review | opus → opus (independent, OD-020) | 2026-09-24 | complete | F-238, F-239, F-240, F-241, F-242, F-243, F-244, F-245 |
+| .github/actions/ | `build-e2e-images/action.yml`, `dump-cluster-state/action.yml`, `e2e-images/action.yml`, `go-cache/action.yml`, and their callers in `.github/workflows/ci.yaml` | code-review | sonnet → opus | 2026-10-04 | complete | F-264, F-265, F-271, F-272 |
+| images/ | `README.md`, `common/steamcmd/Dockerfile`, `common/steamcmd/steam-install.sh`, `games/nuclear-option/Dockerfile`, `games/nuclear-option/entrypoint.sh`, and their build wiring in `.github/workflows/images.yaml` | code-review | sonnet → opus | 2026-10-04 | complete | F-266, F-267, F-268, F-269, F-270 |
+| docs/ | `docs/agent-architecture.md`, `docs/architecture.md`, `docs/comparison-sources.md`, `docs/contributing.md`, `docs/dependencies.md`, `docs/game-coverage.md`, `docs/install.md`, `docs/key-rotation.md`, `docs/module-authoring.md`, `docs/networking.md`, `docs/notifications.md`, `docs/oidc.md`, `docs/roadmap.md`, `docs/security.md`, `docs/tunnels.md` | code-review | sonnet → opus | 2026-09-23 | complete | F-027, F-031, F-032, F-033, F-034, F-035, F-036 |
+| root docs | `README.md`, `CHANGELOG.md`, `SECURITY_AUDIT.md`, `CLAUDE.md` | code-review | sonnet → opus | 2026-09-23 | complete | F-030, F-043, F-253 |
+| design-export/ | `design-export/json/*.json` (365 files): extracted `name`/`type` fields and diffed `Screen/*` list against `web/src/router/tree.tsx` | code-review | sonnet → opus | 2026-09-23 | complete | none |
+| modules/ | All 30 `modules/*/module.yaml` and `modules/*/template.yaml`; validated structurally against schemas; `modules/.schema/`, `modules/validate.py`, `docs/module-authoring.md` config-schema section; operator module-handling code | consistency-only | sonnet → opus | 2026-09-23 | complete | none |
+| website/ | `website/src/config.ts`, `website/src/pages/games.astro`, `website/src/pages/index.astro`, content pages and docs; game-count and version claims; grepped for stale patterns across `*.mdx` and `.astro` | consistency-only | sonnet → opus | 2026-09-23 | complete | F-037, F-038, F-039 |
diff --git a/specs/018-v0-3-release-readiness/audit/evidence/.gitkeep b/specs/018-v0-3-release-readiness/audit/evidence/.gitkeep
diff --git a/specs/018-v0-3-release-readiness/audit/evidence/baseline/crd-backups.json b/specs/018-v0-3-release-readiness/audit/evidence/baseline/crd-backups.json
@@ -0,0 +1 @@
+[]
diff --git a/specs/018-v0-3-release-readiness/audit/evidence/baseline/crd-backupschedules.json b/specs/018-v0-3-release-readiness/audit/evidence/baseline/crd-backupschedules.json
@@ -0,0 +1 @@
+[]
diff --git a/specs/018-v0-3-release-readiness/audit/evidence/baseline/crd-clusters.json b/specs/018-v0-3-release-readiness/audit/evidence/baseline/crd-clusters.json
@@ -0,0 +1 @@
+[]
diff --git a/specs/018-v0-3-release-readiness/audit/evidence/baseline/crd-gameservers.json b/specs/018-v0-3-release-readiness/audit/evidence/baseline/crd-gameservers.json
@@ -0,0 +1,42 @@
+[
+  {
+    "kind": "GameServer",
+    "name": "mc-fabric",
+    "namespace": "gameplane-games",
+    "uid": "2d67c5ad-ff8f-4e26-a188-be5ea9b6ad0b",
+    "generation": 4,
+    "phase": "Running"
+  },
+  {
+    "kind": "GameServer",
+    "name": "soak-bogus-pool",
+    "namespace": "gameplane-games",
+    "uid": "e12cb363-e632-4433-9bec-deae2e9d5a57",
+    "generation": 1,
+    "phase": "Running"
+  },
+  {
+    "kind": "GameServer",
+    "name": "soak-no-preference",
+    "namespace": "gameplane-games",
+    "uid": "62412014-b54a-4da4-b232-4e5543a80c90",
+    "generation": 1,
+    "phase": "Running"
+  },
+  {
+    "kind": "GameServer",
+    "name": "soak-pool-west",
+    "namespace": "gameplane-games",
+    "uid": "65e25ef6-3eda-4eb4-935a-1f2e45389a77",
+    "generation": 1,
+    "phase": "Running"
+  },
+  {
+    "kind": "GameServer",
+    "name": "squad",
+    "namespace": "gameplane-games",
+    "uid": "a86ae4e2-ef35-4463-8202-657daff52236",
+    "generation": 1,
+    "phase": "Failed"
+  }
+]