fix: security audit F5–F7 + Pi CI races (bundle) #12

Merged

sirius merged 6 commits from feat/audit-fixes-bundle into main

2026-09-11 00:41:40 +00:00

Author	SHA1	Message	Date
Sirius DevOps	08ced86a34	Merge F5 wallet digest RPC onto audit bundle All checks were successful ci / test (pull_request) Successful in 3m33s Details Keep sha3 (F4 checksums) and md-5 (HTTP Digest). Threat model: digest login plus conjunctive verified receipts. Wallet tests: F1 matcher fixtures plus F5 digest/cap coverage.	2026-09-10 20:36:10 -04:00
Sirius DevOps	39e7b3bf16	Merge remote-tracking branch 'origin/wt/t_792593f3' into feat/audit-fixes-bundle	2026-09-10 20:33:50 -04:00
Sirius DevOps	424002c0f5	[verified] fix(hs): redact onion in publish logs; cache 0700 All checks were successful ci / test (pull_request) Successful in 3m0s Details wait_until_published now logs HsId via safelog, not the locator. Store and client_config mkdir Arti cache/state 0700. Arti dangerously_trust_everyone stays on storage only.	2026-09-10 20:30:18 -04:00
Sirius DevOps	45c105de8a	fix(store): drop payments on /wipe; document non-forensic All checks were successful ci / test (pull_request) Successful in 3m1s Details /wipe now deletes payments as well as chat, checkpoints WAL, and enables sqlite secure_delete (flash still not crypto-shred).	2026-09-10 20:22:31 -04:00
Sirius DevOps	125aafb816	[verified] feat(wallet): require RPC digest login and cap reads All checks were successful ci / test (pull_request) Successful in 3m8s Details Refuse unauthenticated ONIONWIRE_WALLET_RPC, speak HTTP Digest like monero-wallet-rpc --rpc-login, cap responses at 1 MiB, and reject .onion RPC URLs instead of half-dialing them over TCP.	2026-09-10 20:17:25 -04:00
Sirius DevOps	bfd28fce6b	fix(ci): serialize Pi jobs; valid XMR fixture after F4 All checks were successful ci / test (pull_request) Successful in 2m49s Details Overlapping Actions used a fixed docker name onionwire-ci (Conflict) and OOM-killed with 137. Unique run_id names + one-at-a-time concurrency. F1 ingest test still used 8+B*94 which F4 checksums reject.	2026-09-10 20:12:41 -04:00