ops(db): unused-index 7-day audit runbook (kickoff 2026-05-12)

.claude/commands/arch-review.md

@@ -0,0 +1,14 @@
+Analyze the architecture of $ARGUMENTS for violations of hexagonal architecture, SOLID principles, and clean architecture.
+
+Check for:
+- Domain layer importing infrastructure/adapter classes (DIP violation)
+- Controllers containing business logic (SRP violation)
+- God classes exceeding 500 lines
+- Services implementing too many interfaces (ISP violation)
+- Circular dependencies between modules
+- JPA entities leaking into domain layer
+- Missing port/adapter boundaries
+- Feature envy (classes using other classes' data more than their own)
+- Improper dependency injection patterns
+
+Report violations with file paths, line numbers, and suggested fixes.

.claude/commands/docker-review.md

@@ -0,0 +1,16 @@
+Review all Dockerfiles, docker-compose files, and Traefik configuration in $ARGUMENTS.
+
+Check for:
+- Base image pinning (use digest, not just tag)
+- Multi-stage builds to minimize image size
+- Running as non-root user
+- Health checks defined
+- Resource limits (memory, CPU) in compose
+- Secret exposure in build args or environment
+- Unnecessary port exposure
+- .dockerignore completeness
+- Layer ordering for cache efficiency
+- Unnecessary packages installed
+- PID limits configured
+
+Report each finding with file path, severity, and fix.

.claude/commands/perf-review.md

@@ -0,0 +1,15 @@
+Review $ARGUMENTS for performance issues.
+
+Check for:
+- N+1 query patterns in JPA/Hibernate (missing @EntityGraph, lazy loading in loops)
+- Missing database indexes on frequently queried columns
+- Unbounded queries (missing LIMIT/pagination)
+- Memory leaks (unclosed resources, growing collections)
+- Connection pool exhaustion risks
+- Blocking calls in async/reactive code
+- Oversized API payloads (missing field selection or pagination)
+- Missing caching where appropriate
+- Inefficient string concatenation in loops
+- Image/file processing without streaming
+
+Report each finding with file path, estimated impact, and fix.

.claude/commands/security-audit.md

@@ -0,0 +1,18 @@
+Review this project for security vulnerabilities following OWASP Top 10 2025.
+
+Check for:
+- Hardcoded secrets, API keys, tokens in code and config
+- SQL injection (especially custom JPQL/native queries)
+- XSS in frontend templates and API responses
+- Broken access control (missing RBAC checks on endpoints)
+- Security misconfiguration (CORS wildcards, debug mode, exposed Swagger)
+- Authentication flaws (JWT validation gaps, session handling)
+- Insecure deserialization
+- SSRF in any URL-fetching code
+- File upload validation (type, size, content sniffing)
+- Exception handling that fails open instead of closed
+- Biometric data handling (encryption at rest, secure transmission)
+
+Focus on $ARGUMENTS or the entire codebase if no argument given.
+
+Rate each finding as CRITICAL / HIGH / MEDIUM / LOW with file path and line number.

.claude/commands/test-gaps.md

@@ -0,0 +1,11 @@
+Analyze the test suite for $ARGUMENTS. Identify:
+
+- Untested critical paths (authentication, authorization, verification pipeline, biometric processing)
+- Missing edge cases (null inputs, boundary values, concurrent access)
+- Tests that don't actually assert anything meaningful
+- Flaky test patterns (timing dependencies, order dependencies, shared state)
+- Integration test gaps between services
+- Missing error path testing (what happens when external services fail)
+- API endpoints without corresponding controller tests
+
+Suggest the 10 most impactful tests to add, ordered by risk reduction.

.claude/settings.local.json

@@ -149,24 +149,18 @@
       "Bash(gcloud compute ssh:*)",
       "Bash(printf:*)",
       "Bash(base64:*)",
-      "Bash(TOKEN=\"eyJhbGciOiJIUzUxMiJ9.eyJzdWIiOiJ0ZXN0LnVzZXJAZXhhbXBsZS5jb20iLCJpYXQiOjE3NzAxNDM4ODEsImV4cCI6MTc3MDIzMDI4MX0.cR3TqZvLuxBIUSeWjcmMwzGXxcGUi7ZH79A4lXhhlVywqnxalIu_jFdnEbh8wo1Z10zBYqdlvtUVZtHdcdpvwg\")",
+      "Bash(TOKEN=:*)",
       "Bash(bash scripts/test/run-backend-tests.sh:*)",
       "Bash(bash:*)",
       "Bash(mvn clean package:*)",
       "Bash(mvn package:*)",
       "Bash(gcloud compute scp:*)",
       "Bash(gcloud compute firewall-rules list:*)",
       "Bash(gcloud compute firewall-rules create:*)",
-      "Bash(TOKEN=\"eyJhbGciOiJIUzUxMiJ9.eyJzdWIiOiJhZG1pbkBmaXZ1Y3Nhcy5sb2NhbCIsImlhdCI6MTc3MDY1Mzk2MSwiZXhwIjoxNzcwNzQwMzYxfQ.k1CqIub10inUUxYYGwL9KxfWcvWZnDy02DecYi48Q6AfY1T4yG83jGUv6HsksIwzygprW827YT8V0Xb45rlxPw\")",
       "Bash(Start-Sleep -Seconds 20)",
-      "WebFetch(domain:ica-fivucsas.rollingcatsoftware.com)",
+      "WebFetch(domain:app.fivucsas.com)",
       "WebFetch(domain:34.116.233.134)",
       "Bash(gcloud compute instances describe:*)",
-      "Bash(TOKEN=\"eyJhbGciOiJIUzUxMiJ9.eyJzdWIiOiJhZG1pbkBmaXZ1Y3Nhcy5sb2NhbCIsImlhdCI6MTc3MDcyMTM1OCwiZXhwIjoxNzcwODA3NzU4fQ.wx5G__I22TFxaBRCWfgjth3mpVB-FZKP5g0UyODEKgfSVx_8EH4RljDenN3O_bTB2K0c23_evV4si24h1Ti0Lw\")",
-      "Bash(TOKEN=\"eyJhbGciOiJIUzUxMiJ9.eyJzdWIiOiJhZG1pbkBmaXZ1Y3Nhcy5sb2NhbCIsImlhdCI6MTc3MDcyMjQyNiwiZXhwIjoxNzcwODA4ODI2fQ.uEB2Hiy7O93Fp_1FvYwoGjDZvDeP-3dCTK1SSwv0oARkkxYYgg8EHkjyqtTZ_jXW-dv5gMNUvzvaaKnq7KFuuA\")",
-      "Bash(TOKEN=\"eyJhbGciOiJIUzUxMiJ9.eyJzdWIiOiJhZG1pbkBmaXZ1Y3Nhcy5sb2NhbCIsImlhdCI6MTc3MDcyMjc3MSwiZXhwIjoxNzcwODA5MTcxfQ.JBVn3u2CjKEtCUxCCg5kgDhHhqnULnkHfHuF2sdKkTzehk3LMOH1kBx0OYyBIFwWS6KtVC13Kyq8TplC-x4m0w\")",
-      "Bash(TOKEN=\"eyJhbGciOiJIUzUxMiJ9.eyJzdWIiOiJhZG1pbkBmaXZ1Y3Nhcy5sb2NhbCIsImlhdCI6MTc3MDc1NjE0OSwiZXhwIjoxNzcwODQyNTQ5fQ.LBqLrvkOia9uyu-qmeOUyFE5k6kLbSBI_fGREjUKVSSBiq9Am4Gz2HhYOfEfI8NOrD-I22a3CZc41pmfcD0_1Q\")",
-      "Bash(TOKEN=\"eyJhbGciOiJIUzUxMiJ9.eyJzdWIiOiJhZG1pbkBmaXZ1Y3Nhcy5sb2NhbCIsImlhdCI6MTc3MDc1NzE4NywiZXhwIjoxNzcwODQzNTg3fQ.Zv6WCs_sxOgnHiTX7Hcz_0TwuoQvJLhBlztxRfrG5HYWV_2QSMWZkjkflR4LmVZVNrInq1dveXoXWq3fnqflJA\")",
       "Bash(git log:*)",
       "Bash(git -C .claude/worktrees/intelligent-swanson status)",
       "Bash(git -C .claude/worktrees/intelligent-swanson diff .claude/settings.local.json)",

.env.example

@@ -26,6 +26,13 @@ REDIS_PASSWORD=change_me_in_production
 JWT_SECRET=your-super-secret-256-bit-key-change-this-in-production
 JWT_ACCESS_TOKEN_EXPIRATION=3600000
 JWT_REFRESH_TOKEN_EXPIRATION=604800000
+# BE-H1: signing algorithm. Default RS256 (asymmetric, OIDC best practice).
+# HS512 is verify-only for legacy tokens minted before the 2026-04-20 flip.
+JWT_DEFAULT_ALGO=RS256
+JWT_RSA_KID=rs-2026-04
+# RSA key pair (PEM). REQUIRED in prod; auto-generated in dev profile if omitted.
+JWT_RSA_PRIVATE_KEY_PEM=
+JWT_RSA_PUBLIC_KEY_PEM=
 
 # ============================================================================
 # Service URLs

.github/workflows/ci.yml

@@ -28,10 +28,12 @@ jobs:
 
       - name: Validate Docker Compose configs
         run: |
-          docker compose -f docker-compose.yml config --quiet 2>&1 || true
-          docker compose -f docker-compose.dev.yml config --quiet 2>&1 || true
-          # prod compose depends on submodule build contexts, validate syntax only
-          docker compose -f docker-compose.prod.yml config 2>&1 | grep -v "has neither an image nor a build context" || true
+          docker compose -f docker-compose.yml config --quiet
+          docker compose -f docker-compose.dev.yml config --quiet
+          # prod compose references submodule build contexts not present in CI; suppress only that known warning
+          docker compose -f docker-compose.prod.yml config 2>&1 \
+            | grep -v "has neither an image nor a build context" \
+            | (grep -E "^(Error|error)" && exit 1 || exit 0)
 
       - name: Validate NGINX config syntax
         run: |

.github/workflows/deploy-landing.yml

@@ -1,19 +1,21 @@
 name: Deploy Landing to Hostinger
 
 on:
+  workflow_dispatch:
   push:
-    branches: [master]
+    branches: [main, master]
     paths:
       - 'landing-website/**'
       - '.github/workflows/deploy-landing.yml'
+  workflow_dispatch:
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
 jobs:
   deploy:
-    runs-on: [self-hosted, linux, x64]
+    runs-on: ubuntu-latest
     defaults:
       run:
         working-directory: landing-website
@@ -35,7 +37,7 @@ jobs:
         with:
           switches: -avz --delete
           path: landing-website/dist/
-          remote_path: ~/domains/fivucsas.rollingcatsoftware.com/public_html/
+          remote_path: ~/domains/fivucsas.com/public_html/
           remote_host: 46.202.158.52
           remote_port: 65002
           remote_user: u349700627

.gitignore

@@ -6,6 +6,8 @@
 .env
 .env.local
 .env.*.local
+.env.prod
+.env.gcp
 
 # IDE
 .idea/
@@ -38,9 +40,12 @@ nul
 *.zip
 
 # Archive and backup folders
-/archive/
 /_backup_before_submodules/
 
-# Claude Code
-.claude/settings.local.json
-.claude/worktrees/
+# Claude metadata
+.claude/
+
+# Generated verify-widget bundle artifacts (built via npm run build:widget)
+verify-widget/html/assets/*.js
+verify-widget/html/assets/*.js.map
+verify-widget/html/assets/*.css

.gitmodules

@@ -16,3 +16,6 @@
 [submodule "web-app"]
 	path = web-app
 	url = https://github.com/Rollingcat-Software/web-app.git
+[submodule "spoof-detector"]
+	path = spoof-detector
+	url = https://github.com/Rollingcat-Software/spoof-detector.git

.pre-commit-config.yaml

@@ -0,0 +1,9 @@
+# Parent-repo pre-commit hooks (IN-M1 — 2026-04-19).
+# Minimal set: gitleaks only. We deliberately skip detect-secrets to avoid
+# baselining maintenance overhead. Per-submodule configs may add more
+# (see biometric-processor/.pre-commit-config.yaml for the Python-heavy case).
+repos:
+  - repo: https://github.com/gitleaks/gitleaks
+    rev: v8.21.2
+    hooks:
+      - id: gitleaks

.pre-commit-install

@@ -0,0 +1,31 @@
+#!/usr/bin/env bash
+# Helper: install pre-commit hooks in the parent repo and every submodule that
+# has a .pre-commit-config.yaml (IN-M1 — 2026-04-19).
+#
+# Usage:  ./.pre-commit-install
+# Requires:  pip install pre-commit  (or `pipx install pre-commit`).
+set -euo pipefail
+
+if ! command -v pre-commit >/dev/null 2>&1; then
+    echo "pre-commit not found. Install it with:"
+    echo "  pipx install pre-commit   # recommended"
+    echo "  pip install --user pre-commit"
+    exit 1
+fi
+
+ROOT="$(cd "$(dirname "$0")" && pwd)"
+
+install_in() {
+    local dir="$1"
+    if [ -f "${dir}/.pre-commit-config.yaml" ]; then
+        echo "==> installing hooks in ${dir}"
+        (cd "${dir}" && pre-commit install)
+    fi
+}
+
+install_in "${ROOT}"
+for sub in identity-core-api biometric-processor web-app client-apps landing-website bys-demo verify-widget; do
+    install_in "${ROOT}/${sub}"
+done
+
+echo "Done. 'git commit' will now run gitleaks before accepting a commit."