Harden per security re-scan + test-suite adequacy plans

[Schroedingberg]

Implements both plan documents (.claude/security-rescan-2026-07-11.md, .claude/test-suite-adequacy-2026-07-12.md): all Medium/Low security findings (M1–M4, L1–L6) and all test-gap items (P1–P7).

App layer (2424a54)

• /history chunking (M4/P4i): replies split at line boundaries <3500 chars; :reply may now be a string or seq of strings (CONTRACT.md amended minimally).
• Honest failure replies (L6/P4ii): "⚠ not recorded" only when append! actually failed; a confirmation-send failure after a successful commit logs instead of lying.
• Contained effects (L4/P5): all run-effects! branches wrapped; failures log to stderr, never escape into the polling loop, and the outermost handler never calls send!.
• Category sanitization (L1): Expense schema constrains category segments (12,30 x #Evil;Cat now rejected with ⚠).
• Closed Effect schema (P2): the next :replly-style typo throws instead of silently no-oping; injected-fns map asserted complete.
• clojure -M:bot check (P6): config + getMe health probe, exit 0/1 — verified against the live Telegram API (401 with a fake token → exit 1).
• Wire fixture (P7): real sanitized getUpdates JSON (message / edit / photo-caption) driven through handle-update.

CI (6d4c0b7)

• All actions pinned to commit SHAs (each resolved + cross-verified via the GitHub API, # vX.Y.Z comments kept).
• deploy.yml secrets moved from job-level to per-step env; PR runs are now fully secret-free (tofu fmt/validate only; plan/apply/destroy are dispatch-only).
• Image cosign-signed by digest (keyless, GitHub OIDC; cosign-installer v3.10.1 → cosign 2.6.1, deliberately, so the classic signature format stays verifiable server-side).
• New: clojure -M -e "(require 'ledger.main)" step (a typo'd require no longer sails into a production crash loop) and a native-arch image smoke test before the multi-arch push (gha layer cache makes the push build nearly free).
• Announce curl gets the token via step env + in-shell expansion.

Infra/deploy (27ae182)

• Metadata firewall (M1): new bbledger-firewall.service (idempotent iptables -I DOCKER-USER -d 169.254.169.254 -j DROP, reboot-persistent, bot ordered after it).
• Verified + health-gated autodeploy (M3/P6): pull → digest compare → cosign verify (repo-workflow identity, GitHub OIDC issuer) → one-shot clojure -M:bot check against the real /data:ro → only then restart. Any failure leaves the old bot running; the timer retries. cosign v3.1.1 installed via cloud-init with per-arch sha256 verification (checksums confirmed against real downloads).
• Non-root hardened container (L3): USER bbledger (fixed uid 1000), --cap-drop=ALL --security-opt=no-new-privileges on every docker-run site; cloud-init chowns /srv/bbledger/data to uid 1000 and the host push unit gets safe.directory. Verified empirically: image built and run hardened as uid 1000 with a host-owned mount — git commit and classpath both work.
• Pinned GitHub host keys (L2): ssh-keyscan TOFU replaced with the three keys from api.github.com/meta (fetched 2026-07-12).

Verification

• bb test and clojure -M:test over the combined diff: 60 tests, 204 assertions, 0 failures each (dual-runtime parity holds); lint clean; hledger conformance ran.
• cloud-init YAML parses raw AND after simulated templatefile()/indent() rendering; all units round-trip byte-identical (verbatim-injection invariant preserved). systemd-analyze verify clean. Autodeploy ExecStart de-escaped and passed sh -n.
• tofu validate could not run (tofu not installed locally); the main.tf change is one templatefile entry mirroring the existing seven — the deploy.yml PR check will validate it.

Notes for review

• Includes e1d9efc (the clojure.test/are refactor from test-are) — the new tests build on it.
• Accepted residuals are documented in CLAUDE.md's rewritten "Security posture" section; notable: the first boot of a fresh VM still pulls :latest unverified (the cosign gate covers autodeploy only), and cosign v2-signs / v3-verifies — believed compatible (classic format), but unprovable until the first real CI run signs an image.
• CLAUDE.md's Security TODO is replaced by a posture summary; the two plan documents in .claude/ are untracked and left that way.

🤖 Generated with Claude Code