Audit fixes: 13 of 14 findings

[timothyerwin]

Fixes for the repo audit. Seven commits, each one finding or one theme, so they can be taken or dropped independently.

Correctness

The permission mode never persisted. config.Mode documents itself as "persisted when the user cycles it", and cmd/interactive.go:33 has always read it at startup — but nothing ever wrote it back. Shift+Tab and /mode silently reset on every restart. The read side was fully built; this was unfinished wiring, not a design choice.

Both entry points now route through one setMode that changes the session and saves the config together, with a guard test that fails if a third call site skips the save (verified: it catches the regression when reintroduced).

A pin that cannot be recorded now says so. ResolvePin promised the seed was "persisted to BOTH stores before returning"; both writes discarded their errors and the user-store writer dropped four without returning anything.

Best-effort persistence is correct and stays — failing to remember a preference must never fail the operation. Silence was the bug: if neither store is writable, every run re-seeds from default_model, and because that value legitimately changes as models come and go, a user's model can drift between releases while everything believes the pin is stable.

Security

Both dependency advisories cleared — grpc v1.82.0 (GO-2026-6061), x/text v0.38.0 (GO-2026-5970).

Worth stating precisely: govulncheck reports 13, but 10 are stdlib from the local go1.26.3 toolchain. CI pins go-version: "1.26", which resolves to go1.26.8, so released binaries were never affected by those ten. Only these two shipped.

The webhook token verifier now has tests. webjwt is the single verifier for platform-signed inbound tokens (Bot Framework, Google Chat) and had none. "Fails closed" is worth proving on an authentication boundary, so this covers expired, unexpiring, wrong issuer, wrong audience, unknown signing key, unknown kid, alg:none, HMAC against an RSA key set, unconfigured verifier, and an unreachable JWKS — plus the stated flood defense (25 forged kids must not become 25 outbound fetches) and the metadata-discovery path. 87% coverage on a package that had zero.

Documentation

The weakest area, and the pattern was consistent: v0.29.0 removed automatic routing, the code recorded that carefully with a tombstone at every site, and the documents around it kept advertising the deleted system in the present tense.

• README no longer claims "it uses cheap models for routine work and strong models when the task is hard or risky." That was the only false claim a prospective user reads before installing. Also corrected /plan, which no longer gets a second model's review on its own.
• ROUTING.md rewritten. Every symbol it documented as current — decideLane, ResolveModel, SteerResolvedModel — has zero references in non-test code, and it carried its own warning that finding those names means something is stale. It now describes the pin chain, the two narrow exceptions, why capability gaps refuse rather than substitute, and which error classes may walk a fallback chain. Every claim was verified against the code before writing.
• COMPACTION.md claimed a ~45K default budget; it is window-relative (85% of learned capacity). An absolute default is exactly what the current design rejects, so the stale number misrepresented a deliberate position as a tunable.
• Two file headers contradicted correct comments lower in the same file (llm/lanes.go, llm/resolve.go).

Consolidation and cleanup

One Jaccard instead of three. Written three times in two map shapes, and already diverging — the lessons copy had dropped a guard the others kept. A metric deciding whether two things are "the same" should have one definition and one set of tests.

Ten unreachable functions removed. deadcode now reports nothing. The interesting group was three package-level wrappers in autonomy whose comment said "used by cmd" — cmd never used them. The methods they wrapped are live and stay.

Tests for explore (concurrency-cap resolution, finding indenter).

Landed separately in memcode.ai

The catalog drift guard had never run. TestEmbeddedCatalogMatchesRoot looked for gateway-cloud/models.json, which has never existed, so it hit its "outside the monorepo" skip on every run and reported success while checking nothing.

It had drifted, exactly as designed to prevent: 14 fallback chains differed from the public catalog, including gemini-flash → gemini-pro — the same-vendor hop behind the 12-minute review failure. All four copies are now byte-identical, and the repaired guard fails on injected drift rather than skipping. (d3d0fa3b)

Not fixed, deliberately

fileExists ×4, clip ×3, firstLine ×3, envOr ×3. Each is three lines with obvious semantics, and the copies have not diverged. Consolidating would couple four unrelated packages to a new utility package to save nine lines, and Go's own library omits these deliberately. My audit said these were worth a shared package only if the count grew; that reasoning still holds. Happy to do it if you disagree.

Verification

gofmt, go vet, go test -race ./..., staticcheck@2026.1, and deadcode all clean.

[memcode-ai]

Walkthrough

Resolves two indirect dependency advisories, persists TUI permission mode adjustments across restarts, warns if model seed persistence fails across both stores, consolidates duplicate Jaccard set-similarity implementations into a shared package, purges ten unreachable internal functions, adds unit tests for webjwt and explore helpers, and updates documentation to match the current pinned-model architecture.

• Permission mode cycling and the /mode command route through setMode to keep session state and on-disk config in sync, guarded by an AST test.
• setsim.Jaccard replaces three diverging implementations across mood tracking, lesson clustering, and preference grouping.
• webjwt gets test coverage verifying token validation edge cases, alg-none rejection, and JWKS fetch throttling.
• Documentation across README.md, ROUTING.md, and COMPACTION.md is brought into alignment with the v0.29.0 pin model.

The changes are clean, well-factored, and thoroughly covered by existing and added tests.

---

No findings.