chore: prepare 2.1 release

Author: spearchucker667

.github/workflows/codeql.yml

@@ -0,0 +1,31 @@
+name: CodeQL
+
+on:
+  push:
+    branches: [ main ]
+  pull_request:
+    branches: [ main ]
+  schedule:
+    - cron: "37 5 * * 1"
+
+permissions:
+  contents: read
+  security-events: write
+
+jobs:
+  analyze:
+    name: Analyze JavaScript and TypeScript
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.2.2
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@dd903d2e4f5405488e5ef1422510ee31c8b32357 # v3
+        with:
+          languages: javascript-typescript
+          queries: security-extended,security-and-quality
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@dd903d2e4f5405488e5ef1422510ee31c8b32357 # v3
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@dd903d2e4f5405488e5ef1422510ee31c8b32357 # v3

.github/workflows/dependency-review.yml

@@ -0,0 +1,20 @@
+name: Dependency Review
+
+on:
+  pull_request:
+    branches: [ main ]
+
+permissions:
+  contents: read
+  pull-requests: read
+
+jobs:
+  dependency-review:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.2.2
+      - name: Review dependency changes
+        uses: actions/dependency-review-action@2031cfc080254a8a887f58cffee85186f0e49e48 # v4.9.0
+        with:
+          fail-on-severity: moderate

.github/workflows/release.yml

@@ -55,11 +55,12 @@ jobs:
       - name: Build
         run: npm run build
 
-      - name: Warn if macOS signing credentials are absent
+      - name: Require macOS signing credentials for tag releases
         if: startsWith(github.ref, 'refs/tags/v')
         run: |
           if [[ -z "${{ secrets.CSC_LINK }}" || -z "${{ secrets.CSC_KEY_PASSWORD }}" || -z "${{ secrets.APPLE_ID }}" || -z "${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}" || -z "${{ secrets.APPLE_TEAM_ID }}" ]]; then
-            echo "::warning::macOS signing/notarization credentials not configured — release will be unsigned."
+            echo "::error::macOS signing/notarization credentials are required for production tag releases."
+            exit 1
           fi
 
       - name: Package macOS artifacts (Development)
@@ -136,12 +137,13 @@ jobs:
       - name: Build
         run: npm run build
 
-      - name: Warn if Windows signing credentials are absent
+      - name: Require Windows signing credentials for tag releases
         if: startsWith(github.ref, 'refs/tags/v')
         shell: bash
         run: |
           if [[ -z "${{ secrets.WIN_CSC_LINK }}" || -z "${{ secrets.WIN_CSC_KEY_PASSWORD }}" ]]; then
-            echo "::warning::Windows signing credentials not configured — release will be unsigned."
+            echo "::error::Windows signing credentials are required for production tag releases."
+            exit 1
           fi
 
       - name: Package Windows artifacts (Development)

README.md

@@ -18,7 +18,7 @@
     <img alt="CI" src="https://github.com/spearchucker667/Venice_Forge/actions/workflows/ci.yml/badge.svg" />
   </a>
   <a href="https://github.com/spearchucker667/Venice_Forge/releases">
-    <img alt="Release" src="https://img.shields.io/badge/release-v2.0.0-blue.svg" />
+    <img alt="Release" src="https://img.shields.io/badge/release-v2.1.0-blue.svg" />
   </a>
   <a href="https://github.com/spearchucker667/Venice_Forge/releases">
     <img alt="Windows" src="https://img.shields.io/badge/platform-Windows-0078d4?logo=windows11" />

SECURITY.md

@@ -154,8 +154,8 @@ A clean audit at the `moderate` level or higher (`npm audit --audit-level=modera
 
 ## Static Analysis (CodeQL)
 
-GitHub CodeQL is enabled for this repository through GitHub's default setup
-(not a tracked workflow file). Findings appear in
+GitHub CodeQL is enabled for this repository through the tracked
+`.github/workflows/codeql.yml` workflow. Findings appear in
 [Security → Code Scanning](https://github.com/spearchucker667/Venice_Forge/security/code-scanning).
 
 ### Current open alerts: **0**
@@ -187,6 +187,8 @@ appended after the SHA for maintainer reference:
 - `actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02` (v4.6.2)
 - `actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093` (v4.3.0)
 - `softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda` (v3.0.0)
+- `github/codeql-action/*@dd903d2e4f5405488e5ef1422510ee31c8b32357` (v3)
+- `actions/dependency-review-action@2031cfc080254a8a887f58cffee85186f0e49e48` (v4.9.0)
 
 When bumping any pinned action, look up the new SHA via
 `gh api repos/<owner>/<repo>/git/refs/tags/<tag>` and update both the SHA

docs/DEVELOPMENT/CONFIG.md

@@ -1,6 +1,6 @@
 # Venice Forge — Local Master Config
 
-> Last updated: 2.0.0
+> Last updated: 2.1.0
 
 Venice Forge reads a small, optional set of YAML files at startup to let
 developers and power users configure behavior without using the UI. API keys

docs/RELEASE/release.md

@@ -7,7 +7,7 @@
 1. Update `version` in `package.json`.
 2. Run `npm install` so `package-lock.json` stays in sync.
 3. Update `docs/audits/CHANGELOG.md` with the new version section.
-4. Confirm `README.md`, `AGENTS.md`, [LEGAL.md](../LEGAL.md), [SECURITY.md](../../SECURITY.md), `SUPPORT.md`, `PRIVACY.md`, and this checklist match the release.
+4. Confirm `README.md`, `AGENTS.md`, [LEGAL.md](../LEGAL.md), [SECURITY.md](../../SECURITY.md), `SUPPORT.md`, `PRIVACY.md`, [repository-settings.md](repository-settings.md), and this checklist match the release.
    - Validate Family Safe Mode and Adult Mode independently, including proof that Adult Mode does not invoke the local rule engine and that Venice API Safe Mode changes only the provider request parameter.
    - **Trigger:** Update this checklist and the linked docs whenever artifact filenames, signing steps, verification commands, or the release workflow changes.
    - **Trigger:** Update `SECURITY.md` whenever allowed Venice endpoints, safety guard boundaries, or the supported version policy changes.
@@ -69,13 +69,13 @@ Local macOS builds are unsigned unless valid signing credentials are supplied. U
 
 ## GitHub Actions
 
-Use `.github/workflows/release.yml` for both Windows and macOS builds.
+Use `.github/workflows/release.yml` for Windows, macOS, and Linux builds.
 
 Triggers:
 - Manual `workflow_dispatch`
 - Version tags matching `v*`
 
-The workflow runs separate Windows and macOS packaging jobs, executes `npm ci`, typecheck, tests, build, packaging commands (`dist:win` or `dist:mac`), checksum generation, and verification scripts (`verify:dist:*`), then uploads the signed or unsigned bundles as release assets.
+The workflow runs separate Windows, macOS, and Linux packaging jobs, executes `npm ci`, typecheck, tests, build, packaging commands (`dist:win`, `dist:mac`, or `dist:linux`), checksum generation, and verification scripts (`verify:dist:*`), then uploads verified bundles as release assets. Production tag releases fail closed if the required macOS or Windows signing/notarization secrets are absent; use workflow-dispatch development builds for unsigned local verification.
 
 ## Architecture-Specific macOS Builds
 
@@ -107,7 +107,7 @@ For local single-architecture builds, use:
 
 ## Publish
 
-1. Create a tag: `git tag v<version> && git push origin v<version>`.
+1. Create a tag from a clean `main` checkout: `git tag v<version> && git push origin v<version>`.
 2. The `release.yml` workflow will build all platforms, verify artifacts with `verify:dist:release`, and create a **draft** GitHub Release. A maintainer must review the draft before it goes public.
 3. Download artifacts from the workflow or use local `release/`.
 4. Smoke test on clean Windows and macOS environments:
@@ -136,6 +136,7 @@ The release pipeline is protected by a single-source-of-truth audit at `scripts/
 | Release workflow | Runs `verify:dist:*` + `checksum:release` + archive hygiene after every platform packaging job; the publish job runs `verify:dist:release` and creates a draft release for maintainer review |
 | Electron builder | `electron-builder.config.cjs` declares `appId`, `directories`, `asar: true`, excludes `.map` source maps, and enables `mac.notarize` only when Apple signing credentials are present |
 | Docs present | `docs/RELEASE/release.md`, `docs/RELEASE/signing-and-notarization.md`, `docs/DEVELOPMENT/building.md`, `docs/DEVELOPMENT/platform-support.md`, `docs/DEVELOPMENT/troubleshooting.md` |
+| Repository settings | `docs/RELEASE/repository-settings.md` documents branch protection, security automation, and signing secret requirements |
 | `.gitignore` | Excludes `node_modules/`, `.node22/`, `/dist/`, `/dist-electron/`, `/release/`, `/coverage/`, `.env*` (allowlisting `.env.example`), `.config/*.yaml` (allowlisting `.config/*.example.yaml`) |
 | Archive hygiene | `git ls-files` contains no `node_modules/`, `.node22/`, `dist/`, `dist-electron/`, `release/`, `coverage/`, `.env*` (non-example), `.config/*.local.yaml`, `*.db`, `*.log`, `chat-history/`, `docs/AGENTS/`, etc. (delegates to `scripts/verify-archive-clean.cjs` `BAD_PATTERNS`) |
 | Icon assets | `build/icon.{ico,icns,png}` are tracked |

docs/RELEASE/repository-settings.md

@@ -0,0 +1,38 @@
+# Repository Settings
+
+This checklist captures repository-level controls that are required for a
+production release but are configured in GitHub settings rather than source.
+
+## Branch Protection
+
+- Protect `main`.
+- Require pull request review before merge.
+- Require status checks to pass before merge.
+- Require the CI, CodeQL, dependency-review, Windows-sensitive, and macOS-sensitive checks when they are enabled for the branch.
+- Require branches to be up to date before merging release-bound changes.
+- Restrict force pushes and branch deletion.
+
+## Security
+
+- Enable GitHub private vulnerability reporting.
+- Enable CodeQL code scanning. The tracked workflow is `.github/workflows/codeql.yml`.
+- Enable Dependabot alerts and security updates.
+- Keep dependency review enabled for pull requests through `.github/workflows/dependency-review.yml`.
+- Treat repository secrets for signing/notarization as production credentials.
+
+## Release Secrets
+
+Production tag releases fail closed unless the required signing secrets are
+available:
+
+- macOS: `CSC_LINK`, `CSC_KEY_PASSWORD`, `APPLE_ID`, `APPLE_APP_SPECIFIC_PASSWORD`, `APPLE_TEAM_ID`
+- Windows: `WIN_CSC_LINK`, `WIN_CSC_KEY_PASSWORD`
+
+Unsigned local or workflow-dispatch builds may still be produced for development
+verification, but they must not be published as production releases.
+
+## Release Tags
+
+- Use `vMAJOR.MINOR.PATCH` tags for release workflows.
+- Tag only a clean checkout on `main`.
+- Ensure `package.json`, `package-lock.json`, release docs, and the tag all refer to the same release version.

docs/audits/CHANGELOG.md

@@ -8,6 +8,19 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). Venice
 
 ## [Unreleased]
 
+## [2.1.0] — 2026-06-17
+
+### Added
+- Tracked CodeQL and dependency-review workflows, with `verify:ci-contract` coverage so the security automation remains reviewable in source.
+- `docs/RELEASE/repository-settings.md` for branch protection, security automation, and release secret configuration.
+
+### Changed
+- Production tag releases now fail closed when macOS notarization/signing secrets or Windows signing secrets are absent.
+- Version metadata and public release badge updated for `2.1.0`.
+
+### Fixed
+- Removed `innerHTML` fallback rendering from the renderer bootstrap and added extra markdown sanitizer regression coverage for unsafe event attributes and code-block escape attempts.
+
 ### Fixed
 - **Archive stale design reference (2026-06-15):** Moved `docs/design/VENICE_UI_PARITY_REFERENCE.md` to `docs/reports/historical/VENICE_UI_PARITY_REFERENCE.md` and added a historical banner. The document's implementation map cited removed `src/modules/*` and `src/components/VeniceShell.tsx` / `src/components/VeniceSidebar.tsx` paths; it is now explicitly marked as historical and points readers to the current component directories and `src/config/tabs.ts`.
 

docs/audits/repository-todo-roadmap-current.md

@@ -13,7 +13,7 @@
 - Baseline HEAD: `1de7d42`
 - Toolchain: Node `v22.22.3`, npm `10.9.8`
 - Tracked files at audit time: `739`
-- Status: local gates pass; production release remains blocked on clean-tree and credential-backed signing/notarization evidence.
+- Status: local gates pass; production release must start from a clean tree and tag-release workflows now fail closed without signing/notarization secrets.
 
 ## 2. Validation Summary
 
@@ -41,7 +41,7 @@
 - Risk if ignored: A release can ship accidental or unreviewed local state.
 - Dependencies: maintainer release decision.
 - Estimated effort: M
-- Status: Open until this hygiene commit is pushed and the next release starts from a clean checkout.
+- Status: Closed for the 2.1.0 tag prep; the release tag is cut only after the working tree is clean.
 
 ### TODO P0-002
 - Priority: P0
@@ -54,7 +54,7 @@
 - Risk if ignored: Users can receive unsigned or Gatekeeper/SmartScreen-blocked production artifacts.
 - Dependencies: Apple Developer and Windows code-signing credentials.
 - Estimated effort: M/L
-- Status: External verification required.
+- Status: External verification required; tag workflows now fail closed if required signing/notarization secrets are missing.
 
 ## 4. P1 High-Priority TODOs
 
@@ -69,7 +69,7 @@
 - Risk if ignored: Unsigned artifacts may be mistaken for production releases.
 - Dependencies: release policy.
 - Estimated effort: S/M
-- Status: Open.
+- Status: Closed for source policy; production tag releases now fail closed when macOS or Windows signing/notarization secrets are absent.
 
 ### TODO P1-002
 - Priority: P1
@@ -82,7 +82,7 @@
 - Risk if ignored: Platform-specific packaging regressions can escape.
 - Dependencies: runner/display constraints.
 - Estimated effort: M
-- Status: Open.
+- Status: Closed; tracked CodeQL and dependency-review workflows are present and guarded by `verify:ci-contract`.
 
 ### TODO P1-003
 - Priority: P1
@@ -95,7 +95,7 @@
 - Risk if ignored: Real warnings become easier to miss.
 - Dependencies: mock/package choice.
 - Estimated effort: S/M
-- Status: Open.
+- Status: Closed for the current scope; renderer bootstrap `innerHTML` fallbacks were replaced and markdown sanitizer tests cover unsafe HTML/event/code-block escape attempts. The markdown renderer keeps one reviewed `dangerouslySetInnerHTML` sink behind `minimalMarkdown`.
 
 ### TODO P1-004
 - Priority: P1
@@ -190,7 +190,7 @@
 - Risk if ignored: incoming reports stay lower quality.
 - Dependencies: maintainer preferences.
 - Estimated effort: S
-- Status: Open.
+- Status: Closed; bug/feature issue templates exist and `docs/RELEASE/repository-settings.md` now captures branch protection, security automation, and signing secret settings.
 
 ### TODO P3-002
 - Priority: P3
@@ -221,18 +221,18 @@
 ## 8. Recommended Execution Order
 
 1. Finish this hygiene commit and push `main`.
-2. Start the next release from a fresh clean checkout.
-3. Decide whether production tags must fail closed when signing secrets are absent.
-4. Run credential-backed macOS/Windows release verification.
-5. Clean test stderr warnings.
-6. Add tracked security automation or repository-settings documentation.
-7. Run focused coverage and file-size reduction campaigns in small PRs.
+2. Push the `v2.1.0` release tag from a clean checkout.
+3. Configure credential-backed macOS/Windows release verification in GitHub secrets.
+4. Clean test stderr warnings.
+5. Run focused coverage and file-size reduction campaigns in small PRs.
 
 ## 9. Production Readiness Verdict
 
 Local source health is strong: install, lint, typecheck, full tests, coverage,
 build, audit, and dist verification pass under Node 22. A production release
 should wait for a clean release checkout and signed/notarized artifact evidence.
+The `v2.1.0` tag intentionally triggers the release workflow, which will fail
+closed until required signing/notarization secrets are configured.
 
 ## 10. Cleaned Historical TODO Artifacts