Per CLAUDE.md "Review Discipline": post-/review fixes get their own
commits AND a CHANGELOG subsection so the audit trail of "what review
caught" is visible to future readers.

VERSION not bumped — this batch lands as part of the stacked sweep
(#226 → #232); a single VERSION bump will follow when the full chain
merges, to avoid CHANGELOG/VERSION conflicts on each cascade rebase.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Per CLAUDE.md "Review Discipline": post-/review fixes get their own
commits AND a CHANGELOG subsection so the audit trail of "what review
caught" is visible to future readers.

VERSION not bumped — this batch lands as part of the stacked sweep
(#226 → #232); a single VERSION bump will follow when the full chain
merges, to avoid CHANGELOG/VERSION conflicts on each cascade rebase.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

… epics (#226)

* fix(copilot-sweep batch 1): security + correctness across this week's epics

Audited Copilot review comments across PRs #198, #206-#215, #218, #219,
Themed follow-ups will land separately.

Security
- Shell injection in @skytwin/memory-gbrain searchSemantic (#215):
  switch from execSync with shell to execFileSync (no shell), so query
  metacharacters cannot inject. Added regression test.
- redactPII / redactPayload skipped arrays — PII in array-of-object
  payloads leaked to provenance and API responses (#209, #210, #211).
  Both helpers now recurse arrays. Tests updated (one previously asserted
  the bug as expected behavior).
- /api/capabilities/suggestions spread the row, leaking raw
  evidence_sources alongside the redacted preview (#211). Switched to
  explicit field projection.
- Email-redaction regex [A-Z|a-z] matched literal | as TLD char (#211).
  Fixed to [A-Za-z].

Correctness
- Credential vault never engaged: only the worker creates DbTokenStore
  but never called setKeyCache, so at-rest encryption + lazy migration
  were dead weight (#212). Worker now owns a KeyCache and wires it;
  cross-process unlock IPC is a #212 follow-up.
- DXT routes broken under real auth: getUserId read req.user?.id but
  production middleware sets req.authenticatedUserId (#219). Switched
  field; tests updated to mirror production middleware.
- Twin MCP provenance only fired on success (#209). Wrapped each tool
  handler in try/finally so audit fires for both success and failure;
  provenance failures never mask the underlying tool result.
- Migration 027 used inline INDEX (...) WHERE inside CREATE TABLE,
  which CockroachDB does not accept (#198). Pulled the partial indexes
  out as standalone CREATE INDEX IF NOT EXISTS — idempotent.
- Onboarding hard-coded first_run_choice='about-me' at three call
  sites (#208). Track _wizardState.firstRunChoice on welcome-screen
  selection, read everywhere downstream.
- Briefing generator capped at LIMIT 500 silently dropped users
  past the cap (#206). Switched to a 500-row paged scan.
- Zero-trust mode helpers exist but aren't wired into the decision
  pipeline (#222). Updated CHANGELOG and capability-detail copy to be
  honest; #222 follow-up tracks the wiring.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

* fix(copilot-sweep batch 1, post-/review): address Copilot inline comments on #226

Per the new merge gate (CLAUDE.md), every Copilot inline comment is
addressed before merge. Five comments on #226, all valid:

- Migration 027 idempotency: if the inline `INDEX (...) WHERE ...` form
  ever ran successfully (CRDB version-dependent), it would have created
  an auto-named partial index. Added defensive
  `DROP INDEX IF EXISTS <table>@<auto-name>` for both
  mcp_servers_last_active_at_idx and app_suggestions_user_id_idx so a
  re-run doesn't leave duplicate partial indexes covering the same
  predicate.
- briefing-generator: switched OFFSET pagination to keyset pagination
  (`AND user_id > $last`). OFFSET pagination on DISTINCT scales
  quadratically with user count — the briefing job's runtime would
  grow unboundedly. Keyset stays linear and the (user_id, status) index
  serves the range scan directly.
- DXT route docstring: removed the "other route modules use the same
  order" claim — it was misleading (other routes still vary in
  precedence). Now just notes a shared-helper #226 follow-up if the
  ordering proves load-bearing.
- gbrain-port test: renamed `mockExecSync` → `mockExecFileSync` so the
  variable name matches the API under test (execFileSync).

Tests: all 421 api + 48 worker + 20 memory-gbrain tests pass.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

* docs(CHANGELOG): add post-/review fixes subsection for #226

Per CLAUDE.md "Review Discipline": post-/review fixes get their own
commits AND a CHANGELOG subsection so the audit trail of "what review
caught" is visible to future readers.

VERSION not bumped — this batch lands as part of the stacked sweep
(#226 → #232); a single VERSION bump will follow when the full chain
merges, to avoid CHANGELOG/VERSION conflicts on each cascade rebase.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>