fix: reconcile the four untracked findings in the security audit

[enricopiovesan]

Summary

Follow-up to #39, same day. All four rows previously marked "Not filed" are now either ticketed or explicitly resolved.

Every factual claim in the request that prompted this was independently verified against a fresh clone of traverse-framework/traverse at current main (9c2806c) before being written into a public audit page — none of it was taken on trust. Specifics below.

1. Bearer-token impersonation → redirected to #782 (Open)

Read http_api.rs's subject_from_request directly. Confirmed:

• The dev-mode arbitrary-bearer-as-subject_id path is exactly :1168-1211 as claimed, and is the same root cause as #782 (is_admin granted when the token equals the literal "system_admin").
• The original claim's other half is genuinely stale — the loopback + --allow-unauthenticated path at :1214-1219 returns a hardcoded, non-admin "local" identity, not attacker-controlled input.

2. Data-store durability → new ticket #788 (Open)

Confirmed MemoryDataStore sits inside #[cfg(test)] mod tests (verified the module boundary, not just a keyword match). Grepped every LocalFileDataStore reference in the workspace — all of them are its own definition or inside that same test module. Zero production call sites, zero integrity-hash code in the file.

3. Trace-store durability → new ticket #789 (Open)

Read trace/store.rs — TraceStore is exactly a HashMap<String, ...> at the claimed lines, structurally distinct from the event-broker fix already closed in #593.

4. Spec 022 governance drift → Resolved, no ticket

Read spec 022's own file: **Status**: Superseded (2026-07-18 — see decision-log.md Decision 25...), word-for-word matching the claim. Confirmed Decision 25 exists at that date, specs 057/058/059 are all Approved in approved-specs.json, their claimed implementation files exist (traverse-embedder, runtime/workflows.rs, cli/http_api.rs), and grepped every .github/workflows/*.yml for "mcp" — zero matches, confirming the old "CI-required" claim no longer holds.

Also

• "Not filed" count in the register: 4 → 0.
• Added a Resolved status (green, same visual treatment as Closed) alongside Open/Closed.
• Fixed the Ticket-cell fallback: a resolved row with no ticket now reads "No ticket needed" instead of the now-inaccurate "Not filed".
• Rewrote the section note above the table — it used to assert four findings were untracked, which is no longer true.
• Sanity-checked the six 2026-07-20 findings against live issue state: #781 already correctly showed Closed on this page (a follow-on fix, #787, merged after that original pass); #782–786 remain Open. No changes needed there.

Test plan

• npm run build clean
• Verified in browser: 21 total rows, 0 "Not filed", 1 "Resolved", #782 correctly linked from both its original row and the reconciled row, status pills render correctly in both themes
• No console errors
• Every code-level and governance-level claim checked against a fresh clone of the real repo before writing, not the relayed description alone

🤖 Generated with Claude Code