docs: establish green baseline for phase two routing

.github/audit-exceptions.yml

@@ -3,35 +3,35 @@ exceptions:
   - package: xlsx
     advisory: "GHSA-4r6h-8v6p-xvw6"
     severity: high
-    reason: "Admin export only; switched to dynamic import to reduce exposure (CVE-2023-30533)"
-    mitigation: "Load only on export; restrict export permissions and data scope"
-    expires_on: "2026-07-06"
-    owner: "security@your-domain"
+    reason: "Admin-only export path; replacement is tracked separately because the npm package has no patched registry release"
+    mitigation: "Dynamic import, admin authorization, bounded export scope, and no untrusted workbook formulas"
+    expires_on: "2026-08-10"
+    owner: "WilliamWang1721"
   - package: xlsx
     advisory: "GHSA-5pgg-2g8v-p4x9"
     severity: high
-    reason: "Admin export only; switched to dynamic import to reduce exposure (CVE-2024-22363)"
-    mitigation: "Load only on export; restrict export permissions and data scope"
-    expires_on: "2026-07-06"
-    owner: "security@your-domain"
+    reason: "Admin-only export path; replacement is tracked separately because the npm package has no patched registry release"
+    mitigation: "Dynamic import, admin authorization, bounded export scope, and no untrusted workbook parsing"
+    expires_on: "2026-08-10"
+    owner: "WilliamWang1721"
   - package: lodash
     advisory: "GHSA-r5fr-rjxr-66jc"
     severity: high
-    reason: "lodash _.template not used with untrusted input; only internal admin UI templates"
-    mitigation: "No user-controlled template strings; plan to migrate to lodash-es tree-shaken imports"
-    expires_on: "2026-07-02"
-    owner: "security@your-domain"
+    reason: "The vulnerable template API is not called with user-controlled templates"
+    mitigation: "No user-controlled template strings; migrate remaining dependency chain to patched/native alternatives"
+    expires_on: "2026-08-10"
+    owner: "WilliamWang1721"
   - package: lodash-es
     advisory: "GHSA-r5fr-rjxr-66jc"
     severity: high
-    reason: "lodash-es _.template not used with untrusted input; only internal admin UI templates"
-    mitigation: "No user-controlled template strings; plan to migrate to native JS alternatives"
-    expires_on: "2026-07-02"
-    owner: "security@your-domain"
+    reason: "The vulnerable template API is not called with user-controlled templates"
+    mitigation: "No user-controlled template strings; migrate remaining dependency chain to patched/native alternatives"
+    expires_on: "2026-08-10"
+    owner: "WilliamWang1721"
   - package: axios
     advisory: "GHSA-3p68-rc4w-qgx5"
     severity: critical
-    reason: "NO_PROXY bypass not exploitable; all API calls go to known endpoints via server-side proxy"
-    mitigation: "Proxy configuration not user-controlled; upgrade when axios releases fix"
-    expires_on: "2026-07-10"
-    owner: "security@your-domain"
+    reason: "Proxy targets are fixed by server configuration and are not supplied by end users"
+    mitigation: "NO_PROXY and proxy configuration remain administrator-controlled; upgrade immediately when a compatible patched release is available"
+    expires_on: "2026-08-10"
+    owner: "WilliamWang1721"

.github/workflows/backend-ci.yml

@@ -7,7 +7,41 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
 jobs:
+  go-module-consistency:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions/setup-go@v6
+        with:
+          go-version-file: backend/go.mod
+          check-latest: false
+          cache: true
+          cache-dependency-path: backend/go.sum
+      - name: Generate canonical module files
+        id: tidy
+        continue-on-error: true
+        working-directory: backend
+        run: |
+          go mod tidy
+          git diff --exit-code -- go.mod go.sum
+      - name: Upload canonical module files
+        if: steps.tidy.outcome == 'failure'
+        uses: actions/upload-artifact@v4
+        with:
+          name: go-module-candidates
+          path: |
+            backend/go.mod
+            backend/go.sum
+          retention-days: 7
+      - name: Enforce module consistency
+        if: steps.tidy.outcome == 'failure'
+        run: exit 1
+
   test:
     runs-on: ubuntu-latest
     steps:
@@ -20,13 +54,33 @@ jobs:
           cache-dependency-path: backend/go.sum
       - name: Verify Go version
         run: |
-          go version | grep -q 'go1.26.4'
+          go version | grep -q 'go1.26.5'
       - name: Unit tests
         working-directory: backend
-        run: make test-unit
+        run: |
+          set -o pipefail
+          make test-unit 2>&1 | tee unit-test.log
+      - name: Upload unit test diagnostics
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: backend-unit-test-diagnostics
+          path: backend/unit-test.log
+          if-no-files-found: ignore
+          retention-days: 7
       - name: Integration tests
         working-directory: backend
-        run: make test-integration
+        run: |
+          set -o pipefail
+          make test-integration 2>&1 | tee integration-test.log
+      - name: Upload integration test diagnostics
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: backend-integration-test-diagnostics
+          path: backend/integration-test.log
+          if-no-files-found: ignore
+          retention-days: 7
 
   frontend:
     runs-on: ubuntu-latest
@@ -60,10 +114,17 @@ jobs:
           cache-dependency-path: backend/go.sum
       - name: Verify Go version
         run: |
-          go version | grep -q 'go1.26.4'
+          go version | grep -q 'go1.26.5'
       - name: golangci-lint
-        uses: golangci/golangci-lint-action@v9
+        working-directory: backend
+        run: |
+          set -o pipefail
+          go run github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.9.0 run --timeout=30m 2>&1 | tee golangci-lint.log
+      - name: Upload lint diagnostics
+        if: failure()
+        uses: actions/upload-artifact@v4
         with:
-          version: v2.9
-          args: --timeout=30m
-          working-directory: backend
+          name: golangci-lint-diagnostics
+          path: backend/golangci-lint.log
+          if-no-files-found: ignore
+          retention-days: 7