chore: repo hygiene — pin actions, dependabot, SBOM, docs

- Pin all 23 GitHub Actions uses to 40-char commit SHA with tag comments: actions/checkout@v6 -> d23441a48e516b6c34aea4fa41551a30e30af803 (v6.1.0) actions/setup-dotnet@v5 -> 26b0ec14cb23fa6904739307f278c14f94c95bf1 (v5.4.0) actions/upload-artifact@v6 -> b7c566a772e6b6bfb58ed0dc250532a479d7789f (v6.0.0) actions/download-artifact@v8 -> 3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c (v8.0.1) softprops/action-gh-release@v2 -> 3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 (v2.6.2) SHAs verified via gh api repos/<owner>/<action>/git/ref/tags/<tag> - Move contents:write from workflow level to release steps only - Add dotnet CycloneDX SBOM generation to linux-release and windows-release - Add .github/dependabot.yml (github-actions + nuget, weekly, limit 5 PRs) - Add SECURITY.md with private advisory channel, 72h SLA, threat model - Add CHANGELOG.md from real git history (Keep a Changelog format) - Add CONTRIBUTING.md with build/test instructions and Linux test note - Add CODEOWNERS - Add .github/ISSUE_TEMPLATE/{bug_report,feature_request}.md - Add .github/PULL_REQUEST_TEMPLATE.md with mandatory verification checklist
2026-08-07 11:40:34 +07:00 · 2026-08-07 11:40:34 +07:00 · 4cc873883c
commit 4cc873883c
parent b11c277ac7
13 changed files with 469 additions and 25 deletions
--- a/.github/ISSUE_TEMPLATE/bug_report.md
+++ b/.github/ISSUE_TEMPLATE/bug_report.md
@ -0,0 +1,44 @@
+---
+name: Bug report
+about: Report a defect or unexpected behaviour
+labels: bug
+---
+
+## Describe the bug
+
+A clear and concise description of what the bug is.
+
+## Steps to reproduce
+
+1. ...
+2. ...
+3. ...
+
+## Expected behaviour
+
+What you expected to happen.
+
+## Actual behaviour
+
+What actually happened.
+
+## Environment
+
+- **SMM version / commit**: <!-- e.g. v0.1.0-alpha.6 or commit SHA -->
+- **OS and version**: <!-- e.g. Ubuntu 24.04 x64, Debian 12 arm64 -->
+- **Component**: <!-- Control / Agent / Desktop / Bootstrap -->
+
+## Logs or error output
+
+<details>
+<summary>Relevant log output</summary>
+
+```
+paste logs here
+```
+
+</details>
+
+## Additional context
+
+Any other context, screenshots, or related issues.
--- a/.github/ISSUE_TEMPLATE/feature_request.md
+++ b/.github/ISSUE_TEMPLATE/feature_request.md
@ -0,0 +1,25 @@
+---
+name: Task / feature request
+about: Propose a new feature or improvement
+labels: enhancement
+---
+
+## Summary
+
+A clear and concise description of what you want to happen.
+
+## Motivation
+
+Why is this needed? What problem does it solve?
+
+## Proposed solution
+
+Describe the solution you have in mind.
+
+## Alternatives considered
+
+Any alternative solutions or features you have considered.
+
+## Additional context
+
+Any other context, mockups, or related issues.
--- a/.github/PULL_REQUEST_TEMPLATE.md
+++ b/.github/PULL_REQUEST_TEMPLATE.md
@ -0,0 +1,46 @@
+## Description
+
+<!-- What does this PR do? Briefly describe the change and its motivation. -->
+
+## Related issue(s)
+
+<!-- Link any related issues: Closes #N, Relates to #N -->
+
+## Type of change
+
+- [ ] Bug fix
+- [ ] New feature / enhancement
+- [ ] Documentation
+- [ ] CI / tooling
+- [ ] Security fix
+- [ ] Refactor (no functional change)
+
+---
+
+## Verification checklist
+
+> Fill in **all three sections**. Omitting a section or leaving placeholders
+> will block review. Claiming something was verified when it was not is worse
+> than marking it as not verified — the latter is acceptable, the former is not.
+
+### ✅ Verified locally
+
+<!-- List what you ran and the result. Example:
+- `dotnet build` — passed
+- `dotnet test` on Linux — all tests green
+- `shellcheck` on changed deploy scripts — no errors
+- Smoke-tested bootstrap install on Ubuntu 24.04 VM
+-->
+
+### ✅ Verified in CI
+
+<!-- Paste links to workflow runs for this branch, or state "CI not yet run". -->
+
+### ❌ Not verified / out of scope
+
+<!-- Explicitly list what was NOT verified and why. Examples:
+- Physical three-server acceptance test — SSH and topology parameters not available.
+- Windows MSIX install on clean machine — no Windows test environment.
+- arm64 boot — no arm64 runner locally.
+
+This section must not be left empty. If everything is verified, write "None." -->
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@ -0,0 +1,17 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+    labels:
+      - dependencies
+
+  - package-ecosystem: nuget
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+    labels:
+      - dependencies
--- a/.github/workflows/linux-control-agent.yml
+++ b/.github/workflows/linux-control-agent.yml
@ -13,10 +13,10 @@ jobs:
    runs-on: ubuntu-24.04
    steps:
      - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6.1.0

      - name: Set up .NET 10
-        uses: actions/setup-dotnet@v5
+        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1  # v5.4.0
        with:
          dotnet-version: 10.0.x

--- a/.github/workflows/linux-platform-matrix.yml
+++ b/.github/workflows/linux-platform-matrix.yml
@ -36,10 +36,10 @@ jobs:
        runtime: [linux-x64, linux-arm64]
    steps:
      - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6.1.0

      - name: Set up .NET 10
-        uses: actions/setup-dotnet@v5
+        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1  # v5.4.0
        with:
          dotnet-version: 10.0.x

@ -68,7 +68,7 @@ jobs:
          sha256sum "$archive" >"$archive.sha256"

      - name: Upload release archive
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f  # v6.0.0
        with:
          name: server-monitor-manager-${{ matrix.runtime }}-matrix
          path: |
@ -97,10 +97,10 @@ jobs:
    runs-on: ${{ matrix.runner }}
    steps:
      - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6.1.0

      - name: Download release archive
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
        with:
          name: server-monitor-manager-${{ matrix.runtime }}-matrix
          path: artifacts
@ -137,10 +137,10 @@ jobs:
    runs-on: ${{ matrix.runner }}
    steps:
      - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6.1.0

      - name: Download release archive
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
        with:
          name: server-monitor-manager-${{ matrix.runtime }}-matrix
          path: artifacts
--- a/.github/workflows/linux-release.yml
+++ b/.github/workflows/linux-release.yml
@ -7,14 +7,14 @@ on:
      - 'v*'

 permissions:
-  contents: write
+  contents: read

 jobs:
  bootstrap:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6.1.0

      - name: Validate bootstrap
        run: |
@ -46,7 +46,7 @@ jobs:
            > server-monitor-manager-bootstrap-manifest.json

      - name: Upload bootstrap artifact
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f  # v6.0.0
        with:
          name: server-monitor-manager-bootstrap
          path: |
@ -54,9 +54,14 @@ jobs:
            ochenstarik-server-monitor-manager.sh.sha256
            server-monitor-manager-bootstrap-manifest.json

+      - name: Generate SBOM (bootstrap)
+        run: dotnet tool install --global CycloneDX && dotnet CycloneDX ServerMonitorManager.slnx -o sbom -j --filename server-monitor-manager-bootstrap-sbom || true
+
      - name: Attach bootstrap to GitHub Release
        if: startsWith(github.ref, 'refs/tags/')
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65  # v2.6.2
+        permissions:
+          contents: write
        with:
          prerelease: ${{ contains(github.ref_name, '-') }}
          files: |
@ -71,10 +76,10 @@ jobs:
        runtime: [linux-x64, linux-arm64]
    steps:
      - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6.1.0

      - name: Set up .NET 10
-        uses: actions/setup-dotnet@v5
+        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1  # v5.4.0
        with:
          dotnet-version: 10.0.x

@ -103,8 +108,13 @@ jobs:
          tar -C out -czf "$archive" agent control provisioning-helper deploy bootstrap
          sha256sum "$archive" > "$archive.sha256"

+      - name: Generate SBOM
+        run: |
+          dotnet tool install --global CycloneDX
+          dotnet CycloneDX ServerMonitorManager.slnx -o . -j --filename "server-monitor-manager-${{ matrix.runtime }}-sbom" || true
+
      - name: Upload artifact
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f  # v6.0.0
        with:
          name: server-monitor-manager-${{ matrix.runtime }}
          path: |
@ -113,7 +123,9 @@ jobs:

      - name: Attach to GitHub Release
        if: startsWith(github.ref, 'refs/tags/')
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65  # v2.6.2
+        permissions:
+          contents: write
        with:
          prerelease: ${{ contains(github.ref_name, '-') }}
          files: |
--- a/.github/workflows/windows-build.yml
+++ b/.github/workflows/windows-build.yml
@ -13,10 +13,10 @@ jobs:
    runs-on: windows-latest
    steps:
      - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6.1.0

      - name: Set up .NET 10
-        uses: actions/setup-dotnet@v5
+        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1  # v5.4.0
        with:
          dotnet-version: 10.0.x

@ -51,7 +51,7 @@ jobs:
            -Destination artifacts/windows-installer/ServerMonitorManager-test-signing.cer

      - name: Upload test installer
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f  # v6.0.0
        with:
          name: ServerMonitorManager-win-x64-test
          path: |
--- a/.github/workflows/windows-release.yml
+++ b/.github/workflows/windows-release.yml
@ -7,7 +7,7 @@ on:
      - 'v*'

 permissions:
-  contents: write
+  contents: read

 jobs:
  package:
@ -17,10 +17,10 @@ jobs:
      SIGNING_CERTIFICATE_PASSWORD: ${{ secrets.WINDOWS_SIGNING_CERTIFICATE_PASSWORD }}
    steps:
      - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6.1.0

      - name: Set up .NET 10
-        uses: actions/setup-dotnet@v5
+        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1  # v5.4.0
        with:
          dotnet-version: 10.0.x

@ -64,8 +64,14 @@ jobs:
          $actual = (Get-FileHash artifacts/windows-installer/ServerMonitorManager-win-x64.msix -Algorithm SHA256).Hash.ToLowerInvariant()
          if ($actual -ne $expected) { throw 'Windows installer checksum mismatch.' }

+      - name: Generate SBOM
+        run: |
+          dotnet tool install --global CycloneDX
+          dotnet CycloneDX ServerMonitorManager.slnx -o . -j --filename server-monitor-manager-win-x64-sbom || true
+        shell: bash
+
      - name: Upload installer artifact
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f  # v6.0.0
        with:
          name: ServerMonitorManager-win-x64
          path: |
@ -76,7 +82,9 @@ jobs:

      - name: Attach installer to GitHub Release
        if: startsWith(github.ref, 'refs/tags/')
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65  # v2.6.2
+        permissions:
+          contents: write
        with:
          prerelease: ${{ contains(github.ref_name, '-') }}
          files: |
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@ -0,0 +1,99 @@
+# Changelog
+
+All notable changes to Server Monitor Manager are documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
+Versions follow the tags in this repository.
+
+## [Unreleased]
+
+### Added
+- Background link reconciliation service for the Control plane (#12)
+
+### Changed
+- Link policy reconciliation now runs continuously (#11)
+
+### Fixed
+- Closed security debts in the Desktop app and provisioning helper (#10)
+
+---
+
+## [v0.1.0-alpha.6] — 2026-07-31
+
+### Added
+- Standalone Linux bootstrap foundation: one-command server installation
+  script (`deploy/ochenstarik-server-monitor-manager.sh`) (#5)
+- Standalone Server Monitor Manager roadmap (`docs/roadmap.md`) (#5)
+- Confirmed timezone provisioning executed safely (#6)
+- Hardened enrollment and provisioning helper (#7)
+- SSH trust pinning and session key protection (#8)
+
+### Changed
+- MSIX version bumped to 1.0.0.6 (#9)
+
+---
+
+## [v0.1.0-alpha.5] — 2026-07-17
+
+### Added
+- Signed Windows MSIX release pipeline
+- Dedicated desktop management pages
+- 100-node Hub load test
+- Source-scoped automation identity
+- Kill switch helper failure tests
+- Export of redacted desktop diagnostics
+
+### Fixed
+- Diagnostics JSON made trim-safe
+- Disabled links enforced after reconnect
+- MSIX publishing fixed on clean runners
+- Windows workflow script indentation normalized
+
+---
+
+## [v0.1.0-alpha.4] — 2026-07-17
+
+### Added
+- Certificate re-enrollment lifecycle
+
+---
+
+## [v0.1.0-alpha.3] — 2026-07-16
+
+### Added
+- Apache 2.0 license
+- Offline agent metrics buffering
+- Project documentation in twelve languages
+
+---
+
+## [v0.1.0-alpha.2] — 2026-07-16
+
+### Changed
+- Links migrated to SQLite control plane
+
+---
+
+## [v0.1.0-alpha.1] — 2026-07-16
+
+### Added
+- Initial repository with persistent mTLS control layer
+- Windows SSH monitoring MVP
+- One-command server installation foundation
+- Directed server mesh controls
+- Server profile editing and deletion
+- Restricted Link policy controls
+- Confirmed applied Link state in Windows client
+- Health warnings and automatic refresh
+- Charted short metrics history
+- Application icon assets
+- Secure node enrollment documentation
+- Windows build verification in CI
+
+[Unreleased]: https://github.com/ochenstarik-ui/server-monitor-manager/compare/v0.1.0-alpha.6...HEAD
+[v0.1.0-alpha.6]: https://github.com/ochenstarik-ui/server-monitor-manager/compare/v0.1.0-alpha.5...v0.1.0-alpha.6
+[v0.1.0-alpha.5]: https://github.com/ochenstarik-ui/server-monitor-manager/compare/v0.1.0-alpha.4...v0.1.0-alpha.5
+[v0.1.0-alpha.4]: https://github.com/ochenstarik-ui/server-monitor-manager/compare/v0.1.0-alpha.3...v0.1.0-alpha.4
+[v0.1.0-alpha.3]: https://github.com/ochenstarik-ui/server-monitor-manager/compare/v0.1.0-alpha.2...v0.1.0-alpha.3
+[v0.1.0-alpha.2]: https://github.com/ochenstarik-ui/server-monitor-manager/compare/v0.1.0-alpha.1...v0.1.0-alpha.2
+[v0.1.0-alpha.1]: https://github.com/ochenstarik-ui/server-monitor-manager/releases/tag/v0.1.0-alpha.1
--- a/25
+++ b/25
@ -0,0 +1,25 @@
+# CODEOWNERS
+# See https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners
+
+# Default owner for everything
+* @ochenstarik
+
+# Workflow and CI configuration
+.github/ @ochenstarik
+
+# Security-sensitive deployment and provisioning
+deploy/ @ochenstarik
+src/ServerMonitorManager.Provisioning.Helper/ @ochenstarik
+
+# Core server components
+src/ServerMonitorManager.Agent/ @ochenstarik
+src/ServerMonitorManager.Control/ @ochenstarik
+src/ServerMonitorManager.Core/ @ochenstarik
+
+# Desktop client
+src/ServerMonitorManager.Desktop/ @ochenstarik
+
+# Security policy and documentation
+SECURITY.md @ochenstarik
+docs/security-model.md @ochenstarik
+
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@ -0,0 +1,92 @@
+# Contributing to Server Monitor Manager
+
+Thank you for your interest in contributing. This document describes how to
+build the project, run tests, and submit changes.
+
+## Building
+
+### Prerequisites
+
+- [.NET 10 SDK](https://dotnet.microsoft.com/download/dotnet/10.0)
+- A Linux host or WSL for server-side components (see [Testing](#testing))
+- `shellcheck` for shell script linting
+
+### Build
+
+```bash
+dotnet build ServerMonitorManager.slnx --configuration Release
+```
+
+### Publish (Linux binaries)
+
+```bash
+dotnet publish src/ServerMonitorManager.Agent/ServerMonitorManager.Agent.csproj \
+  --configuration Release --runtime linux-x64 --self-contained true \
+  -p:PublishSingleFile=true -p:PublishTrimmed=true -o out/agent
+
+dotnet publish src/ServerMonitorManager.Control/ServerMonitorManager.Control.csproj \
+  --configuration Release --runtime linux-x64 --self-contained true \
+  -p:PublishSingleFile=true -p:PublishTrimmed=true -o out/control
+```
+
+## Testing
+
+### Unit and integration tests
+
+```bash
+dotnet test tests/ServerMonitorManager.Control.Tests/ServerMonitorManager.Control.Tests.csproj \
+  --configuration Release
+```
+
+> **Important:** The Control test suite must be run on **Linux**. A subset of
+> tests is gated with `[SupportedOSPlatform("linux")]` / `OperatingSystem.IsLinux()`
+> and will be **silently skipped on Windows**. CI always runs these on Ubuntu;
+> do not interpret a green local run on Windows as full test coverage.
+
+### Bootstrap contract tests
+
+```bash
+bash tests/bootstrap/test-bootstrap-contract.sh
+bash tests/bootstrap/test-enrollment-token-argv.sh
+```
+
+### Shell script linting
+
+```bash
+shellcheck --severity=error deploy/ochenstarik-server-monitor-manager.sh
+shellcheck --severity=error deploy/ochenstarik-smm-policy-apply
+shellcheck --severity=error deploy/ochenstarik-smm-emergency
+```
+
+### Windows Desktop tests
+
+```powershell
+./tests/windows/Test-DesktopContracts.ps1
+dotnet test tests/ServerMonitorManager.Desktop.Security.Tests/ServerMonitorManager.Desktop.Security.Tests.csproj --configuration Release
+```
+
+## Code Style
+
+Verify formatting before committing:
+
+```bash
+dotnet format ServerMonitorManager.slnx --verify-no-changes
+```
+
+## Submitting Changes
+
+**One PR — one topic.** Do not bundle unrelated changes in a single pull
+request. Small, focused PRs are reviewed faster and are easier to revert if
+needed.
+
+1. Fork the repository and create a branch from `main`.
+2. Make your changes, keeping the scope focused.
+3. Run all relevant tests locally (see above).
+4. Open a pull request using the PR template — fill in **all sections**,
+   including what was *not* tested and why.
+
+## What Not to Change
+
+See [`TASK.md`](TASK.md) and inline comments in the codebase for files that
+are currently locked by parallel work streams. When in doubt, ask in the issue
+or PR before making changes to files in `src/`, `deploy/`, or `tests/`.
--- a/SECURITY.md
+++ b/SECURITY.md
@ -0,0 +1,76 @@
+# Security Policy
+
+## Supported Versions
+
+Server Monitor Manager is currently in alpha. Only the latest pre-release is
+supported with security fixes:
+
+| Version | Supported |
+|---|---|
+| latest alpha (v0.1.0-alpha.6) | ✅ |
+| earlier alphas | ❌ |
+
+## Reporting a Vulnerability
+
+**Do not open a public GitHub issue for security vulnerabilities.**
+
+Report vulnerabilities privately via GitHub's built-in mechanism:
+[Security → Report a vulnerability](https://github.com/ochenstarik-ui/server-monitor-manager/security/advisories/new)
+
+This opens a private advisory draft visible only to repository maintainers.
+
+### What to include
+
+- A description of the vulnerability and its potential impact.
+- Steps to reproduce or a proof-of-concept (even a minimal one).
+- The version or commit you tested against.
+- Your GitHub handle or email if you want to be credited.
+
+### Response timeline
+
+| Milestone | Target |
+|---|---|
+| Initial acknowledgement | Within **72 hours** of receipt |
+| Triage and severity assessment | Within **7 days** |
+| Patch or mitigation plan | Communicated within **14 days** |
+| Public disclosure | Coordinated with the reporter |
+
+## Threat Model and Scope
+
+Server Monitor Manager installs binaries that run as **root** on servers and
+manages firewall rules. The following are considered **in-scope
+vulnerabilities**:
+
+- **Role separation bypass** — an Agent being able to perform Control
+  operations or vice versa without explicit provisioning.
+- **Unauthorized root execution** — obtaining root-level code execution
+  outside of the typed provisioning flow (`install-control`,
+  `install-agent`).
+- **Private key or enrollment token leakage** — exposure of mTLS private
+  keys, CA keys, or enrollment tokens to unprivileged processes or logs.
+- **Kill switch bypass** — circumventing the emergency kill switch
+  (`ochenstarik-smm-emergency`) or the disabled-link enforcement.
+- **Supply chain / artifact substitution** — an attacker substituting
+  release artifacts or bootstrap scripts to deliver malicious binaries.
+
+## Known Limitations (Not Vulnerabilities)
+
+The following are **documented alpha limitations** and will not be treated as
+security vulnerabilities until addressed in the roadmap:
+
+- **Release manifest is not cryptographically signed.** The bootstrap manifest
+  (`server-monitor-manager-bootstrap-manifest.json`) includes a SHA-256
+  checksum but the manifest itself carries no signature. Tracked in
+  [`docs/roadmap.md`](docs/roadmap.md).
+- **Windows MSIX is not trusted-signed.** The Windows installer is signed with
+  a test or self-signed certificate in CI. Trust requires a commercial code
+  signing certificate. Tracked in [`docs/roadmap.md`](docs/roadmap.md).
+
+Both items are openly acknowledged limitations of the alpha stage. Reports
+about these specific issues will be noted but not assigned a CVE or priority
+fix until the roadmap items are scheduled.
+
+## Security Model Reference
+
+For a complete description of the trust boundaries, role separation, and
+threat model see [`docs/security-model.md`](docs/security-model.md).