M41: harden trust boundaries and delivery

PROJECT_STATE.md

@@ -1,5 +1,39 @@
 # Project state
 
+## M41 — full review remediation and hardening (2026-08-21)
+
+- Closed all findings from the repository-wide review without expanding the locked PoC:
+  production now refuses placeholder MCP credentials, cleartext public URLs and insecure
+  session cookies; OIDC requires an explicit verified-email claim; nginx overwrites the
+  forwarded client address and the API uses the proxy-appended hop for rate limiting.
+- Added bounded per-IP/per-session knowledge requests and an explicit minimum RAGcore
+  retrieval score. Weak or concept-mismatched search fallback evidence is returned as
+  `insufficient`, never `grounded`. MCP audit attribution now authenticates the fixed Hub
+  service identity and stores the Hub-reported caller only as non-authoritative metadata.
+- Serialised data-quality scans with a PostgreSQL transaction advisory lock, added a
+  partial unique index for one open issue per condition, and locked issue rows for every
+  mutating resolution. Concurrent scan and concurrent-resolution regression tests pass.
+- Split the backend production/test image stages and locks: the runtime contains no test
+  suite, pytest, Ruff or mypy. All container bases and CI actions are digest/SHA pinned.
+  CI now builds and scans the real runtime image. The initial Debian 13 base exposed 36
+  fixable HIGH findings; switching to the pinned Python 3.12 Bookworm image reduced the
+  final Trivy result to **0 HIGH/CRITICAL** across OS and Python packages.
+- Moved every central n8n callback/source URL to the existing HTTPS endpoint
+  `fleetops.itworx.tech`, refreshed workflow checksums, corrected stale workflow status/
+  node-count documentation, fixed the return-odometer documentation and made the Unraid
+  bootstrap enforce HTTPS plus Secure cookies. Makefile lint now always builds the test
+  target and cannot silently inspect a stale runtime image.
+- Validation evidence: focused security/integration/data-quality suite **116 passed**;
+  final isolated PostgreSQL backend suite **270 passed**; Ruff and mypy clean; frontend
+  lint/build clean; npm audit **0 vulnerabilities**; production runtime contains no dev
+  dependencies/tests; Trivy runtime scan **0 HIGH/CRITICAL**; full Playwright acceptance
+  **153/153 passed in 5.1 minutes**; Compose test/Unraid configs and `git diff --check`
+  clean. Existing public TLS returns 200 with HSTS and HTTP redirects to HTTPS.
+- Exact next action: commit and push M41, take a verified production backup, update the
+  deployment's public URL/Secure-cookie settings, deploy the committed archive and
+  migration `4f2b9c8d7e61`, safely republish the four HTTPS n8n definitions, then repeat
+  live health, migration, security-header and browser acceptance checks.
+
 ## M40 — publish and redeploy M39 (2026-08-17)
 
 - Published three validated commits to Gitea `master`: the backend dependency and secret