Phase 0: Security foundations — CI hardening, guardrails module, test scaffolds#25

Open

richard-devbot wants to merge 12 commits into

CursorTouch:mainfrom

richard-devbot:richardson/security-hardening

Commits on Apr 19, 2026

Add security hardening design doc and roadmap

authored and
Richardson Gunde
committed
Replace os.system() with subprocess.run() for safe process spawning

authored and
Richardson Gunde
committed
Add bandit, gitleaks, pip-audit, coverage to CI pipeline

authored and
Richardson Gunde
committed
Add AI_PRINCIPLES.md and operator_use/guardrails/ module

authored and
Richardson Gunde
committed
Add security and e2e test suite scaffolds

authored and
Richardson Gunde
committed
Update uv.lock for new dev dependencies (bandit, pip-audit, pytest-cov)

authored and
Richardson Gunde
committed
Fix Qodo review findings: browser classification, path containment, CI cache

authored and
Richardson Gunde
committed
Fix CI failures: bandit, gitleaks org license, pip-audit CVEs

authored and
Richardson Gunde
committed
ci: fix ruff lint errors and upgrade aiohttp to 3.13.5

Richardson Gunde
authored and
Richardson Gunde
committed
test: update plugin tests to match refactored hook architecture

Richardson Gunde
authored and
Richardson Gunde
committed
fix: restore correct import path in mcp/tool.py after rebase (operator_use.agent.tools.service)

Richardson Gunde
authored and
Richardson Gunde
committed
fix: update test imports for refactored tools paths; bump CVE deps; remove unused json import

Richardson Gunde
authored and
Richardson Gunde
committed