fix: complete security, concurrency, architecture, and test hardening (rebased on flux) (#309)

* fix(security,concurrency,arch): complete the hardening pass

Security:
- validatePathAllowed now fails closed without a ToolContext; tests attach a
  permissive test context.
- Delete the dead, bypassable BoundaryChecker (no production callers).
- Wrap MCP/remote tool output as untrusted external content.
- Bound HTTP clients in stt/media; safewrite uses crypto/rand + O_EXCL;
  hooks URL validation now actually rejects loopback; plugin index reads are
  capped.

Concurrency:
- jobs: snapshot cancel status under lock; guard nil Done.
- git context, spec tools, watcher: bounded exec timeouts.
- planning prompt: context-aware prompt + ctx timeout.
- watcher: bounded fireChange workers.
- filewatcher/cron: idempotent Stop (no double-close panic).
- event bus RunWaterfall: snapshot handlers under lock.
- AutoCommit errors logged; AssertWritable returns an error; SessionPreparations
  load/wait honor a context.

Architecture:
- Move IsSensitivePath/ResolvePath into internal/pathsafe; drop config->tool.
- Consolidate byte-unsafe truncate copies onto textutil (rune-safe).
- Delete dead types.ChatClient and the dead markdown_renderer.

* test(ci): de-flake tests, raise spec coverage, and tighten gates

- Fix a real bug in spec extractDescription: the requirement body excludes
  the header, so descriptions were always empty and every ADDED/MODIFIED
  requirement failed SHALL/MUST validation.
- Add spec tests (parse/validate/apply/DAG/config) lifting coverage from
  2.4% to 24.3%, plus a fuzz target and benchmarks.
- Make ContextDecay clock injectable; rewrite the timing-flaky decay tests
  deterministically.
- Un-skip TestParallelExecution, TestIntegration_FullSessionFlow, and the two
  config-apply tests; remove the blanket CI -skip.
- Golden test restores rootCmd globals; add make update-golden.
- Add testutil.Eventually/Never.
- CI: per-package coverage floors, FuzzParseDeltaSpec target, version fixture
  aligned to 0.0.1.

* style: format with the CI-pinned gofumpt/goimports

* fix(spec): don't panic on invalid UTF-8 in requirement names

applyRename built a regexp with regexp.MustCompile from an unescaped
requirement name; a name containing invalid UTF-8 (or a bad pattern) panicked
the whole process. Use regexp.Compile and fall back to leaving the content
unchanged, and ReplaceAllLiteralString so $$ in the new name is not treated as
a group reference. Found by the new FuzzParseDeltaSpec target.

Author: Patel230

.github/workflows/ci.yml

@@ -135,7 +135,7 @@ jobs:
             echo "==> validating $dir"
             (cd "$dir" && GOWORK=off go mod tidy -diff)
             (cd "$dir" && GOWORK=off go mod verify)
-            (cd "$dir" && GOWORK=off go test ./... -count=1 -timeout=300s -skip='TestDefaultSkillDirsCrossAgent|TestCopySelectionE2E')
+            (cd "$dir" && GOWORK=off go test ./... -count=1 -timeout=300s)
           done < <(find . -name go.mod -not -path './.git/*' -print | sort)
 
   public-modules:
@@ -159,7 +159,7 @@ jobs:
           go mod download
           go mod verify
           go build -mod=readonly ./cmd/rho
-          go test ./... -count=1 -timeout=300s -skip='TestDefaultSkillDirsCrossAgent|TestCopySelectionE2E'
+          go test ./... -count=1 -timeout=300s
 
   release-parity:
     name: workspace and module parity
@@ -249,7 +249,7 @@ jobs:
           go-version: ${{ env.GO_VERSION }}
           cache: true
       - name: Test with race detector
-        run: go test ./... -race -count=1 -shuffle=on -coverprofile=coverage.out -covermode=atomic -timeout=300s -skip='TestDefaultSkillDirsCrossAgent|TestCopySelectionE2E'
+        run: go test ./... -race -count=1 -shuffle=on -coverprofile=coverage.out -covermode=atomic -timeout=300s
       - name: Coverage summary
         run: |
           coverage=$(go tool cover -func=coverage.out | grep total | awk '{print $3}' | tr -d '%' | tail -1)
@@ -261,6 +261,23 @@ jobs:
             echo "::error::Coverage ${COVERAGE}% is below minimum 65%"
             exit 1
           fi
+      - name: Per-package coverage floors
+        run: |
+          set -euo pipefail
+          check() {
+            pkg="$1"; floor="$2"
+            cov=$(go test "$pkg" -count=1 -cover 2>/dev/null | grep -o 'coverage: [0-9.]*%' | grep -o '[0-9.]*' | tail -1)
+            echo "$pkg coverage: ${cov:-<none>}% (floor ${floor}%)"
+            if [ -z "$cov" ]; then echo "::error::no coverage reported for $pkg"; exit 1; fi
+            if (( $(echo "$cov < $floor" | bc -l) )); then
+              echo "::error::$pkg coverage ${cov}% is below floor ${floor}%"; exit 1
+            fi
+          }
+          check ./internal/spec 20
+          check ./internal/codegraph 20
+          check ./internal/provider/gateway 20
+          check ./internal/tool 50
+          check ./cmd 45
       - name: Upload coverage
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
@@ -540,6 +557,7 @@ jobs:
           go test -run='^$' -fuzz=FuzzIsSafeGitCommit    -fuzztime=60s ./internal/tool
           go test -run='^$' -fuzz=FuzzParseMessage       -fuzztime=60s ./internal/session
           go test -run='^$' -fuzz=FuzzParseSessionMeta   -fuzztime=60s ./internal/session
+          go test -run='^$' -fuzz=FuzzParseDeltaSpec    -fuzztime=60s ./internal/spec
 
   # -------------------------------------------------------------------------
   # 10. Smoke — build rho and verify ecosystem CLI wiring.

Makefile

@@ -100,6 +100,9 @@ api-validate: ## Validate the OpenAPI spec.
 bench: ## Run benchmarks.
 	go test ./... -bench=. -benchmem -count=3 -timeout=300s
 
+update-golden: ## Regenerate golden test fixtures.
+	go test ./cmd/ -run TestGoldenHelp -update-golden -count=1
+
 # ---------------------------------------------------------------------------
 # Quality gates.
 # ---------------------------------------------------------------------------

cmd/chat_config_save_flow_test.go

@@ -225,8 +225,6 @@ func TestHandleConfigApplyCredentialsMsg_CatalogFailureDoesNotBlameProvider(t *t
 
 // Skipped: integration test requiring specific flux model catalog state
 func TestHandleConfigApplyCredentialsMsg_ValidationFailureDoesNotBlameProvider(t *testing.T) {
-	// TODO: enable once flux catalog fixtures pin the claude-fable-5 model state.
-	t.Skip("requires specific flux model catalog state (claude-fable-5)")
 	rhoconfig.InvalidateConfigUICache()
 	store := &credentials.MapStore{}
 	credentials.SetDefaultStore(store)
@@ -254,8 +252,6 @@ func TestHandleConfigApplyCredentialsMsg_ValidationFailureDoesNotBlameProvider(t
 
 // Skipped: integration test requiring specific flux model catalog state
 func TestHandleConfigApplyCredentialsMsg_AuthenticationFailureBlamesKey(t *testing.T) {
-	// TODO: enable once flux catalog fixtures pin the auth-failure model state.
-	t.Skip("requires specific flux model catalog state")
 	rhoconfig.InvalidateConfigUICache()
 	store := &credentials.MapStore{}
 	credentials.SetDefaultStore(store)

cmd/golden_test.go

@@ -12,7 +12,7 @@ import (
 var updateGolden = flag.Bool("update-golden", false, "update golden files")
 
 func TestGoldenHelp(t *testing.T) {
-	SetVersion("0.1.0")
+	SetVersion("0.0.1")
 	SetBuildDate("test")
 
 	tests := []struct {
@@ -25,6 +25,13 @@ func TestGoldenHelp(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
+			// Restore the global rootCmd's output/args after this test so a
+			// later test is not affected by our mutation.
+			t.Cleanup(func() {
+				rootCmd.SetOut(os.Stdout)
+				rootCmd.SetErr(os.Stderr)
+				rootCmd.SetArgs(nil)
+			})
 			buf := new(bytes.Buffer)
 			groupRootCommands()
 			rootCmd.SetOut(buf)