Weekly scan: 2026-W17

[dstolts]

Weekly scan completed 2026-04-26 by repo-jitneuro agent.

PR #46 filed for all auto-fixable items.

Fixed this week (PR #46)

• CLAUDE.md passport has stale component counts (hooks: 4 vs 10 actual) #37 CLAUDE.md stale hook/command counts -- FIXED
• Docs gap: /help and /verify missing from commands-reference.md #43 /help and /verify missing from commands-reference.md -- FIXED
• [Security P1][jitneuro] Path traversal in dashboard session file read (.. in session name) #32 P1 path traversal in dashboard getSessionContent -- FIXED
• [Security P2][jitneuro] Dashboard binds 0.0.0.0, CORS *, no authentication #33 P2 CORS wildcard + 0.0.0.0 bind in dashboard -- FIXED
• [Security P3][jitneuro] Unauthenticated POST /api/settings overwrites jitneuro-settings.json #34 P3 unauthenticated POST /api/settings -- FIXED
• [Security P4][jitneuro] child_process.exec used to open browser (shell) #35 P4 exec shell string in openBrowser -- FIXED

Still open -- needs Owner decision

• Engram templates gap: 17 live engrams, 0 templates in jitneuro #38 Engram templates gap: 17 live engrams, 0 templates (Option A = document spec in example.md, Option B = create base templates)
• Template v0.4.0 vs workspace v1.0.0 version divergence undocumented #39 Template v0.4.0 vs workspace v1.0.0 version divergence undocumented; legacy autosave/hub-sync agents are enabled in workspace but marked LEGACY in template
• Rule template drift: approval-workflow.md and 20 workspace-only rules #40 Rule template drift: 20 workspace-only rules; 3 flagged as generic enough to upstream (root-cause-analysis, process-safety, memory-architecture)
• Command template drift: 4 commands >50 lines behind workspace #42 Command template drift: 4 commands materially behind workspace (onboard +173 lines, learn +90, session +83, sessions -93 lines)

Scans passing

• Owner/Dan reference scrub: PASS (no violations in templates/, docs/, community/)
• Workspace repo version consistency: PASS (20/20 repos uniform v1.0.0)
• Open PRs: PASS (0 open before this scan)
• git status: PASS (branch clean, up to date with origin/uat)
• Engram line counts: PASS (no engram at CRITICAL 280-line threshold)
• Rule conflict scan: PASS (no conflicting rules in templates/rules/)

No new findings vs W16

All findings this week were already tracked from W15/W16 scans.

Issue triage (recommend Owner action)

• Weekly scan: 2026-W15 #41 W15 scan tracking issue -- no sub-issues filed from it; recommend close as not_planned or confirm action
• Weekly scan: 2026-W16 #44 W16 scan report -- superseded by this report; recommend close as completed
• OWNER ACTION: 3 decisions blocking launch + sprint (2026-04-22) #45 Owner action blockers (Vercel token, launch date, drain approval) -- content is about jitai-www and CoWork, NOT jitneuro. Appears misrouted by sys-orchestrator. Recommend close/move to appropriate repo.
• [Security P5][jitneuro] GitHub Actions use secrets.* context appropriately #36 P5 informational security finding (positive) -- no action needed; recommend close as completed

Next scan

Expected 2026-05-03 (weekly cadence).

[dstolts]

Superseded by #50 (W19 umbrella). The W17 umbrella's principal open item #37 is now fully resolved on the default branch (PR #46 + commit 509413a).