chore(maintenance): refresh dependencies and resolve security findings

.agents/skills/maintain/SKILL.md

@@ -0,0 +1,35 @@
+---
+name: maintain
+description: Analyze, fix, validate, and ship Bashkit maintenance through green CI and merge. Trigger on run maintenance, maintain, maintainace, or maintaiance; use analysis-only mode only when explicitly requested.
+metadata:
+  internal: true
+---
+
+# Bashkit maintenance
+
+A request to run maintenance authorizes the full outcome: analyze the repository,
+fix findings, validate, push, open a PR, resolve review/CI failures, and squash-merge
+when every required check is green. A local commit or a list of follow-up issues
+is not completion. Explicit analysis-only requests omit edits and shipping.
+
+Read `knowledge/operations/maintenance.md` in the Bashkit checkout and execute its
+checklist, then use the repository's `ship` skill. Sync from latest origin/main
+before editing. Use parallel agents for independent reviews and fixes when useful.
+
+Keep findings in the active pass and fix root causes. A large diff, missing audit,
+failed local check, or long build is work to complete, not a reason to defer.
+Use a suitable environment for platform-specific checks. Never weaken tests,
+security limits, or supply-chain criteria to ship an upgrade. If the newest
+upstream version cannot preserve a required security contract, establish the
+incompatibility, retain the newest safe version with a tested/documented pin,
+and complete the rest of the pass; do not replace security checks with weaker ones.
+
+Do not create deferral issues instead of completing maintenance unless the user
+explicitly requests a deferred scope or a genuine external blocker requires it.
+Only stop for an actual missing permission, unavailable dependency/service, or
+user decision that cannot be resolved within the authorized task. Report concrete
+evidence and continue independent work. CI failures require diagnosis and fixes;
+never merge red CI or claim success while a required check is unfinished.
+
+The final response identifies the merged PR, key fixes, verification, and any
+explicitly accepted upstream constraints. Keep the spec's pass record factual.

.agents/skills/ship/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: ship
-description: Run the full ship flow — verify quality, ensure test coverage, update artifacts, smoke test, push, create PR, and merge when CI is green. Trigger when user says "ship", "ship it", "fix and ship", or asks to push and merge a branch.
+description: Run the full ship flow — verify quality, ensure test coverage, update artifacts, smoke test, push, create PR, and merge when CI is green. Trigger when user says "ship", "ship it", "fix and ship", asks to push and merge a branch, or runs Bashkit maintenance.
 user_invocable: true
 metadata:
   internal: true
@@ -106,14 +106,13 @@ If smoke testing reveals issues, fix them and loop back to Phase 2 (tests must s
 git fetch origin main && git rebase origin/main
 ```
 
-- If rebase fails with conflicts, abort and tell the user to resolve manually
+- Resolve rebase conflicts and rerun affected checks. Ask only when an unresolved conflict requires a user decision.
 
 ```bash
 just pre-pr
 ```
 
-- If it fails, run `just fmt` to auto-fix, then retry once
-- If still failing, stop and report
+- Diagnose failing checks, fix their root causes, and rerun. Do not bypass hooks or weaken tests/audit policy.
 
 ### Phase 6: Push and PR
 
@@ -138,9 +137,9 @@ If a PR already exists, update it if needed and report its URL.
 
 ### Phase 7: Wait for CI and Merge
 
-- Check CI status with `gh pr checks` (poll every 30s, up to 15 minutes)
-- If CI is green, merge with `gh pr merge --squash --auto`
-- If CI fails, report the failing checks and stop
+- Check CI status with bounded waits. Continue until the checks finish; elapsed time alone is not a blocker.
+- If all required CI is green and review comments are resolved, squash-merge and verify the PR actually merged. Enabling auto-merge alone is not completion.
+- If CI fails, inspect logs, fix the root cause, push the fix, and wait for the new checks.
 - **NEVER** merge when CI is red
 
 ### Phase 8: Post-merge

.claude/commands/maintain.md

@@ -1,113 +1,12 @@
-Run the pre-release maintenance checklist from `knowledge/operations/maintenance.md`. Find and fix all issues before reporting.
-
-## Arguments
-
-- `$ARGUMENTS` - Optional: scope to a specific section (e.g. "dependencies", "docs", "simplification"). If omitted, run all sections.
-
-## Goals
-
-Each section below is an outcome to achieve, not a script to follow. Use whatever tools and approaches make sense to verify and fix.
-
-### 1. Dependencies are current and clean
-
-Ensure all direct dependencies are at their latest versions — including major/breaking upgrades. Don't just run `cargo update`; also check `cargo outdated` for major version bumps and update the version constraints in `Cargo.toml` accordingly.
-
-For each outdated dependency (including major bumps):
-1. Bump the version constraint in workspace `Cargo.toml` (or crate-level if not in workspace)
-2. Run `cargo build` — fix compilation errors from API changes
-3. Run `cargo test` — fix test failures
-4. If an upgrade requires non-trivial refactoring (>50 lines changed), defer it to a tracked GitHub issue
-
-After all bumps, run `cargo update` to lock latest patch versions.
-
-Ensure no CVEs exist and license/advisory/supply-chain checks pass.
-
-Key tools: `cargo update`, `cargo outdated`, `cargo audit`, `cargo deny check`, `just vet`
-
-### 2. Security posture is solid
-
-Ensure the threat model covers all features, security tests exist for all mitigated threats, and no OWASP-style issues exist in the codebase.
-
-Key references: `knowledge/security/threat-model.md`, `knowledge/security/security-testing.md`, `crates/bashkit/docs/threat-model.md`
-
-### 3. Tests are comprehensive and green
-
-All tests pass, no gaps for recent features, bash compatibility holds, coverage has no major holes.
-
-Key tools: `just test`, `just check-bash-compat`
-
-### 4. Documentation matches reality
-
-All docs (rustdoc, guides, public docs in `docs/`, Python, README, CONTRIBUTING, CHANGELOG) accurately reflect current code. Command counts, feature lists, CLI flags, security boundaries, API signatures, and examples are correct.
-
-Fix any drift — update the docs, not the code (unless the code is wrong).
-
-### 5. Examples work end-to-end
-
-All Rust examples compile and run. Feature-gated examples (python, git) work. Python agent examples run successfully.
-
-Key tools: `cargo run --example <name>`, feature-gated variants
-
-### 6. Specs reflect reality
-
-Every spec status is accurate. Implementation status tables match code. No orphaned TODOs. New features have spec entries.
-
-### 7. Code is clean
-
-Formatted, no clippy warnings, no stale TODOs, no dead code or unused deps.
-
-Key tools: `cargo fmt --check`, `cargo clippy --all-targets --all-features -- -D warnings`
-
-### 8. Code is as simple as possible
-
-Review the codebase (focus on recently changed areas) for simplification opportunities:
-
-- **Duplication** — repeated patterns that should share a helper
-- **Over-engineering** — abstractions, indirection, or configurability that doesn't serve current needs
-- **Complexity** — deeply nested logic, long match arms, convoluted control flow
-- **Dead code** — unused functions, unreachable branches, commented-out code
-- **Naming** — unclear or misleading names
-
-Make the simplifications. Run tests after each change. The goal is less code that does the same thing.
-
-### 9. Agent configuration is accurate
-
-`AGENTS.md` and `CLAUDE.md` reflect current specs, commands, tooling, and workflows.
-
-### 10. All CI is healthy (HARD GATE)
-
-**This section is a blocker.** The maintenance pass MUST NOT be marked complete
-while any of these checks are red.
-
-1. **CI on main is green** — check the latest CI run on the `main` branch. If
-   any job (Audit, Test, Lint, Examples, Fuzz Compile Check) fails, fix it
-   before proceeding. Common failures: `cargo vet` missing certifications,
-   dependency audit advisories, clippy warnings.
-2. **Nightly workflow green** for past 7 days.
-3. **Fuzz workflow green** for past 7 days. If a fuzz target crashes, open a
-   GitHub issue with the crash artifact, reproduction command, and base64 input.
-4. Fuzz targets compile. Git-sourced deps resolve.
-
-Key tools:
-- `gh run list --workflow=ci.yml --branch=main --limit 5` (CI on main)
-- `gh run list --workflow=nightly.yml --limit 7` (nightly)
-- `gh run list --workflow=fuzz.yml --limit 7` (fuzz)
-- `gh api repos/OWNER/REPO/actions/runs/RUN_ID/jobs` (inspect failed jobs)
-
-If failures persist >2 days, escalate per `knowledge/operations/maintenance.md`.
-If the agent cannot fix a failure, it MUST open a GitHub issue and report the
-pass as blocked — never silently skip.
-
-## Execution
-
-- Run all sections (or scoped subset from `$ARGUMENTS`)
-- Fix issues as you find them — don't just report
-- Commit fixes incrementally with conventional commit messages
-- After all sections complete, report a summary of findings and fixes
-- If any section has unfixable issues, report them clearly with recommended next steps
-
-## Notes
-
-- This is a goal-based checklist. The spec (`knowledge/operations/maintenance.md`) defines *what* must be true. This skill defines *how* to verify and fix.
-- Use parallel agents for independent sections when possible.
-- For scoped runs, still verify that fixes don't break other areas (`just test` at minimum).
+Analyze, fix, and ship Bashkit maintenance. "Run maintenance" (including
+"maintainace" and "maintaiance") requests the complete shipped outcome.
+
+Read `.agents/skills/maintain/SKILL.md`, execute the checklist in
+`knowledge/operations/maintenance.md`, then run `.agents/skills/ship/SKILL.md`
+through green CI and squash-merge. `$ARGUMENTS` may scope the maintenance area;
+an explicit analysis-only request is the only default exception to fixing/shipping.
+
+Use parallel agents for independent sections when useful. Do not replace fixes,
+audits, or validation with deferral issues or stop at a local commit. Preserve
+security contracts, use an appropriate validation environment, fix CI failures,
+and never merge with red checks.

.deepsec/package.json

@@ -7,6 +7,6 @@
   "workspaces": [],
   "packageManager": "pnpm@9.15.4",
   "dependencies": {
-    "deepsec": "2.1.2"
+    "deepsec": "2.3.9"
   }
 }

.github/workflows/c-api-binaries.yml

@@ -1,3 +1,4 @@
+# THREAT[TM-INF-027]: build only the immutable SHA exported by tag validation.
 # Native C ABI archives, dispatched from the verified release workflow.
 # Windows must initialize the Visual Studio environment before using lib.exe/cl.exe.
 # Existing tags may be rebuilt only with the tagged or current main workflow definition.
@@ -20,6 +21,7 @@ jobs:
     runs-on: ubuntu-latest
     outputs:
       tag: ${{ steps.validate.outputs.tag }}
+      sha: ${{ steps.source.outputs.sha }}
     steps:
       - name: Validate workflow input
         id: validate
@@ -38,18 +40,21 @@ jobs:
           fetch-depth: 0
 
       - name: Verify tag source
+        id: source
         env:
           RELEASE_TAG: ${{ steps.validate.outputs.tag }}
         run: |
+          git fetch --force origin main:refs/remotes/origin/main \
+            "refs/tags/$RELEASE_TAG:refs/tags/$RELEASE_TAG"
+          TAG_SHA=$(git rev-list -n 1 "$RELEASE_TAG")
+          # Validate and build this exact commit even if the tag later moves.
+          git checkout --detach "$TAG_SHA"
           VERSION="${RELEASE_TAG#v}"
           CARGO_VERSION=$(grep '^version' Cargo.toml | head -1 | sed 's/.*"\(.*\)".*/\1/')
           if [ "$VERSION" != "$CARGO_VERSION" ]; then
             echo "Error: tag $RELEASE_TAG does not match Cargo.toml $CARGO_VERSION" >&2
             exit 1
           fi
-          git fetch --force origin main:refs/remotes/origin/main \
-            "refs/tags/$RELEASE_TAG:refs/tags/$RELEASE_TAG"
-          TAG_SHA=$(git rev-list -n 1 "$RELEASE_TAG")
           MAIN_SHA=$(git rev-parse origin/main)
           if [ "$GITHUB_SHA" != "$TAG_SHA" ] && [ "$GITHUB_SHA" != "$MAIN_SHA" ]; then
             echo "Error: workflow ref must be $RELEASE_TAG or current main" >&2
@@ -59,6 +64,7 @@ jobs:
             echo "Error: $RELEASE_TAG is not reachable from origin/main" >&2
             exit 1
           fi
+          echo "sha=$TAG_SHA" >> "$GITHUB_OUTPUT"
 
   build:
     name: Build C API (${{ matrix.target }})
@@ -94,7 +100,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
-          ref: ${{ needs.validate-tag.outputs.tag }}
+          ref: ${{ needs.validate-tag.outputs.sha }}
           persist-credentials: false
 
       - name: Install Rust toolchain