Harden node boundary, wallet key storage, and CI

.github/dependabot.yml

@@ -0,0 +1,13 @@
+version: 2
+updates:
+  - package-ecosystem: gomod
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+
+  - package-ecosystem: npm
+    directory: /apps/wallet
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5

.github/workflows/ci.yml

@@ -0,0 +1,88 @@
+name: CI
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  go:
+    name: Go checks
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+
+      - name: Set up Go
+        uses: actions/setup-go@v7
+        with:
+          go-version-file: go.mod
+          cache: false
+
+      - name: Check formatting of changed Go files
+        shell: bash
+        run: |
+          if [ "${{ github.event_name }}" = "pull_request" ]; then
+            base="${{ github.event.pull_request.base.sha }}"
+          else
+            base="${{ github.event.before }}"
+          fi
+
+          if [ -z "$base" ] || [[ "$base" =~ ^0+$ ]]; then
+            base="$(git rev-list --max-parents=0 HEAD)"
+          fi
+
+          mapfile -t files < <(git diff --name-only --diff-filter=ACMRT "$base" HEAD -- '*.go')
+          if [ "${#files[@]}" -eq 0 ]; then
+            echo "No changed Go files to format-check."
+            exit 0
+          fi
+
+          unformatted="$(gofmt -l "${files[@]}")"
+          if [ -n "$unformatted" ]; then
+            echo "The following changed Go files need gofmt:"
+            echo "$unformatted"
+            exit 1
+          fi
+
+      - name: Vet
+        run: go vet ./...
+
+      - name: Test
+        run: go test ./...
+
+  wallet:
+    name: Wallet build
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: apps/wallet
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v7
+        with:
+          node-version: 24
+          cache: npm
+          cache-dependency-path: apps/wallet/package-lock.json
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Audit production and build dependencies
+        run: npm audit --audit-level=high
+
+      - name: Type-check and build
+        run: npm run build

README.md

@@ -11,7 +11,7 @@ Implemented today:
 - Go HTTP node entrypoint in `cmd/node`
 - DPoS election primitives and tests in `internal/dpos`
 - transaction envelope validation in `internal/tx`
-- durable accounts, mempool, committed blocks, restart-safe state, and snapshot restore in `internal/ledger`
+- durable accounts, mempool, committed blocks, atomic restart-safe state persistence, and snapshot restore in `internal/ledger`
 - durable validator-set snapshots with versioning, proposer scheduling, and quorum summaries in `internal/ledger`
 - durable consensus round state with restart-safe height, round, and round-start tracking in `internal/ledger`
 - durable signed consensus proposals, validator votes, and quorum certificates in `internal/ledger`
@@ -28,7 +28,7 @@ Implemented today:
 - consensus visibility endpoints for status, validator snapshots, active round inspection, proposer schedule inspection, latest consensus artifacts, and next-block template preview
 - operator-facing observability endpoints for readiness, alerts, SLO summaries, alert-rule exports, recording-rule exports, dashboard bundles, Grafana dashboard export, JSON metrics, Prometheus metrics, and structured logs
 - Vue wallet in `apps/wallet`
-- wallet account generation, import/export, local signing, account inspection, faucet funding, and transaction broadcast
+- wallet account generation, encrypted import/export, passphrase-protected local key storage, local signing, account inspection, faucet funding, and transaction broadcast
 
 Implemented in this iteration:
 
@@ -97,21 +97,23 @@ PowerShell note: if your shell blocks `npm`, use `npm.cmd` instead.
 
 ### 1. Run one node
 
-From the repository root:
+From the repository root, enable development-only endpoints only when you need the local faucet or manual block tools:
 
 ```powershell
+$env:ZEPHYR_ENABLE_DEV_ENDPOINTS="true"
 go run ./cmd/node
 ```
 
-By default the node:
+For a normal node process, leave `ZEPHYR_ENABLE_DEV_ENDPOINTS` unset or set it to `false`. The node process:
 
-- listens on `:8080`
+- listens on `127.0.0.1:8080` by default; set `ZEPHYR_HTTP_ADDR` explicitly to bind another interface
 - stores durable state in `var/node`
 - produces blocks every `15s` when transactions are queued
 - runs the consensus automation ticker every `1s`, but automation stays off until `ZEPHYR_ENABLE_CONSENSUS_AUTOMATION=true`
 - uses a `5s` consensus round timeout once automation is enabled
 - runs peer sync only if `ZEPHYR_PEERS` is configured
 - exposes consensus status even before a validator set has been elected
+- keeps `/v1/dev/*` unavailable unless `ZEPHYR_ENABLE_DEV_ENDPOINTS=true` is explicitly configured
 
 Useful probes:
 
@@ -148,7 +150,7 @@ npm.cmd install
 npm.cmd run dev
 ```
 
-Vite serves the wallet on `http://localhost:5173` by default.
+Vite serves the wallet on `http://localhost:5173` by default and proxies `/health`, `/v1`, and `/metrics` to `http://127.0.0.1:8080`, so local development stays same-origin in the browser. Set `ZEPHYR_WALLET_DEV_NODE` to change the dev proxy target, or `VITE_ZEPHYR_API_BASE` when intentionally targeting a different API origin.
 
 ### 3. Run a two-node local devnet
 

SECURITY.md

@@ -0,0 +1,31 @@
+# Security Policy
+
+Zephyr Chain is pre-production software. Do not use the current node, wallet, dev faucet, or consensus implementation to custody assets of real-world value.
+
+## Current security posture
+
+- The process-facing node handler disables `/v1/dev/*` endpoints by default. Local development that needs the faucet, block-template, or manual block-production endpoints must opt in with `ZEPHYR_ENABLE_DEV_ENDPOINTS=true`.
+- Internal snapshot requests require a peer source header and follow the configured peer-identity policy. Validator deployments should configure `ZEPHYR_VALIDATOR_PRIVATE_KEY`, enable `ZEPHYR_REQUIRE_PEER_IDENTITY=true`, and pin peers with `ZEPHYR_PEER_VALIDATORS` where practical.
+- The node entrypoint restricts its data directory to owner access and keeps `state.json` owner-readable/writable only on operating systems that implement POSIX-style permission bits.
+- The browser wallet encrypts private-key material at rest with a passphrase-derived AES-256-GCM key. The passphrase is processed locally and is not sent to the node.
+- A browser wallet remains exposed to browser-origin threats while unlocked. XSS, malicious extensions, compromised dependencies, or a compromised browser profile can still access in-memory key material. Hardware-backed signing and stronger key isolation remain future production work.
+
+## Development endpoints
+
+The following routes are development-only and should stay disabled on public deployments:
+
+- `POST /v1/dev/faucet`
+- `GET /v1/dev/block-template`
+- `POST /v1/dev/produce-block`
+
+Enable them only for an isolated development environment:
+
+```text
+ZEPHYR_ENABLE_DEV_ENDPOINTS=true
+```
+
+## Reporting a vulnerability
+
+Please avoid publishing exploitable details in a public issue. Use the repository's private vulnerability-reporting or security-advisory flow when available. If no private reporting channel is enabled, open a minimal issue asking the maintainer for a private contact channel without including exploit details.
+
+When reporting, include the affected commit, reproduction conditions, expected impact, and whether the issue affects consensus safety, key custody, peer authentication, state integrity, or denial-of-service resistance.