fix(release): harden API errors and rollback cleanup

.github/workflows/ci.yml

@@ -62,3 +62,57 @@ jobs:
           }
       - name: Validate SPK13 icon integration safeguards
         run: php tests/WindowsSpk13IconIntegrationTest.php
+
+  windows-smoke:
+    runs-on: windows-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Setup PHP
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: '8.2'
+          extensions: sodium,zip,pdo_mysql,mbstring,intl,dom,xml
+          coverage: none
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: '24'
+      - name: Validate and install locked Composer dependencies
+        shell: pwsh
+        run: |
+          composer validate --strict --no-check-publish
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+          composer install --no-interaction --prefer-dist
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+          composer audit --no-interaction
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+      - name: PHP syntax check
+        shell: pwsh
+        run: |
+          Get-ChildItem app,bin,public,tests -Recurse -File -Filter *.php | ForEach-Object {
+            php -l $_.FullName
+            if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+          }
+      - name: Runtime self-check and source audit
+        shell: pwsh
+        run: |
+          php bin/self-check.php
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+          php bin/source-audit.php
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+      - name: V14 package round-trip and restore safety
+        shell: pwsh
+        run: |
+          php tests/V14PackageRoundTripTest.php
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+          php tests/V14RestoreSafetyTest.php
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+          php tests/V14PackageArchiveTest.php
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+      - name: Browser V13 automated round-trip
+        shell: pwsh
+        run: node tests/BrowserV13RoundTripTest.mjs
+      - name: Release signer external trust-root test
+        shell: pwsh
+        run: php tests/ReleaseSignerExternalTrustTest.php

.github/workflows/refresh-composer-lock.yml

@@ -32,6 +32,12 @@ jobs:
         continue-on-error: true
         run: composer audit --no-interaction
 
+      - name: Fail the workflow when dependency audit fails
+        if: steps.audit.outcome == 'failure'
+        run: |
+          echo "::error::composer audit failed. Review and resolve or document dependency findings before merging."
+          exit 1
+
       - name: Open a pull request with the generated lockfile
         uses: peter-evans/create-pull-request@v7
         with:
@@ -45,7 +51,7 @@ jobs:
             ## Summary
             - Generate `composer.lock` using Composer in a clean GitHub Actions runner.
             - Validate the manifest and lockfile with `composer validate --strict --no-check-publish`.
-            - Run `composer audit --no-interaction`; inspect the workflow result before merging.
+            - Run `composer audit --no-interaction`; this workflow fails before opening a PR if the audit step fails (including an audit command marked continue-on-error for outcome reporting).
 
             ## Review checklist
             - [ ] Confirm the lockfile was generated by Composer (not hand-written).

.github/workflows/security.yml

@@ -25,6 +25,14 @@ jobs:
         run: |
           find app bin public tests -type f -name '*.php' -print0 | xargs -0 -n1 php -l
 
+      - name: Require Composer lockfile for release-readiness branches
+        if: github.head_ref == 'release/v1.0.0-readiness' || github.base_ref == 'release/v1.0.0-readiness' || startsWith(github.head_ref, 'work/v1.0.0-reconciliation-') || startsWith(github.ref_name, 'work/v1.0.0-reconciliation-')
+        run: |
+          if [ ! -f composer.lock ]; then
+            echo "::error::A Composer-generated composer.lock is required for release-readiness changes."
+            exit 1
+          fi
+
       - name: Composer manifest validation
         run: composer validate --no-check-publish
 
@@ -92,5 +100,8 @@ jobs:
       - name: Source security audit
         run: php bin/source-audit.php
 
+      - name: Full regression and security suite
+        run: php bin/security-test.php --full
+
       - name: Legacy browser V13 round-trip
         run: node tests/BrowserV13RoundTripTest.mjs

CHANGELOG.md

@@ -1,6 +1,25 @@
 # Changelog
 
-## Unreleased — MVP readiness and repository maintenance
+## Unreleased — v1.0.0 readiness, API reliability, and storage hardening
+
+- Put API configuration loading and service initialization inside the generic error boundary; typed authentication failures now return HTTP 401, and missing resources are separated from storage/programming failures.
+- Added typed archive-step conflicts, rejected archive/package input, and storage faults so malformed input can return a documented 4xx while I/O failures remain generic 500 responses.
+- Hardened restore rollback, controller path cleanup, portable archive publication, and resumable-upload deletion with ownership checks, no-overwrite publication, post-cleanup verification, and surfaced cleanup errors.
+- Verified cleanup of incomplete V14 package builds and added a regression ensuring a failed build leaves no encrypted-package artifacts behind.
+- Made catalog listings fail closed on malformed JSON, invalid records, and symlinked records instead of silently presenting an incomplete inventory.
+- Ensured missing and unauthorized package lookups use the same privacy-preserving catalog response, and exposed the legacy server package format explicitly in runtime diagnostics.
+- Added regression coverage for runtime version metadata consistency and the diagnostics package-format contract.
+- Added HTTP regressions for configuration failure privacy, method Allow headers, authentication, missing job/package privacy, catalog failure, and restore storage failure.
+- Added regressions for corrupt ZIPs, archive traversal, existing-output preservation, catalog listing integrity, controller cleanup, and resumable-upload symlink safety.
+- Separated V14 authentication/stream rejection from storage errors while preserving atomic link-based no-replace publication; temporary file identities and restrictive modes are checked before publication.
+- Added the Composer-generated lockfile to the release-readiness work branch and made the manual lock refresh workflow fail before creating a PR when dependency audit fails.
+- Ported the Windows source-audit self-path normalization and strengthened release-signing input/write verification.
+- Reconciled the API error contract and reproducible QA matrix; manual Windows/XAMPP, real-browser, independently trusted signed-artifact, and independent security-review gates remain NOT RUN.
+- Kept the stable binary package format isolated in PR #38; it is not the default production writer and is not yet approved for v1.0.0.
+- Added a Windows CI smoke job for locked Composer install/audit, PHP syntax, self-check, source audit, V14 restore/archive safety, browser V13 compatibility, and external-trust-root signer verification.
+- Added a release-readiness lockfile gate and full regression/security suite to the Security and Release Integrity workflow.
+- Fixed a false-positive restore-safety test so an existing destination is accepted as rejected only when the expected typed storage exception is thrown, and verified its content remains unchanged.
+- Documented V14/stable-format metadata leakage, offline password-and-pattern guessing, sender-authenticity limits, and the explicit legacy-reader/migration policy.
 
 - Add an executable release-signing regression that verifies Ed25519 signatures against an independently pinned external trust root.
 - Fail closed when the audit hash-chain head is missing or corrupt, verify chain integrity before appending, and redact sensitive audit context keys by normalized fragments.

README.md

@@ -82,6 +82,16 @@ After a real root `composer.lock` has been generated with Composer and committed
 
 Before a release, work through the [reproducible release QA matrix](docs/RELEASE-QA.md). It separates CI evidence from manual Windows/XAMPP and real-browser checks; manual scenarios must remain NOT RUN until tested.
 
+## Security limitations and exposed metadata
+
+Encryption does not hide every property of a V14 package. The readable package header/completion records expose the format and generation identifiers, random package ID, creation time, cryptographic/KDF profile, whether a recovery slot exists, and integrity-binding values. ZIP entry structure and encrypted blob lengths can reveal the approximate number and sizes of files and the total package size. The encrypted manifest protects filenames and directory relationships; it does not make the entire package indistinguishable from random data of a fixed size.
+
+A copied package can be attacked offline: an attacker can test password-and-pattern guesses against the wrapped key slot without contacting the application. Argon2id raises the cost of each guess but cannot prevent offline guessing. Use a long, unique password and a separate, non-reused pattern. Web rate limits do not protect a package after an attacker obtains a copy. A lost password/pattern or lost recovery key cannot be recovered by the project.
+
+Package encryption also does not prove who sent a package. Use HTTPS, SFTP, or another trusted transfer channel; when sender identity or artifact substitution matters, verify a checksum or signature through an independently trusted channel. Do not rely on a public key embedded only inside the release artifact as the sole trust root.
+
+The version-independent single-file binary format is still a separately reviewed candidate. Until it is approved and integrated, V14 remains the active server writer and browser V13 remains a separate compatibility format. Do not assume that a legacy package has been converted merely because the application version changes.
+
 ## Security philosophy
 
 The application treats cryptography, parsing, filesystem handling, authentication, resource limits, and supply-chain integrity as one security boundary. A stronger cipher alone does not make the system secure; every step between untrusted input and plaintext restore must fail closed.