fix: unified remediation of consolidated audit findings (Phases 1-7)

[cryptoxdog]

Note: recreated from PR #2, which GitHub auto-closed and locked after a temporary force-push during remediation-pack application. Branch content restored to the original head (175d713) plus an empty resync commit.

Summary

Merges and remediates the overlapping findings from two independently-produced audit documents (consolidated-findings-plan.md: PRD-*/ICA-*, and consolidated-findings-remediation-plan.md: AUD-*/SEC-*/RAA-*/DWA-*), both audited against base_ref 87075d82. Cross-referencing them surfaced 25 raw finding IDs collapsing to 18 distinct defects, one confirmed false positive (AUD-003), and one critical release-blocking bug (ICA-002/ICA-003) that only one of the two documents caught.

• Phase 1 — CI/test safety net (TEST-CI-GAP): add eslint.config.js + a real Vitest suite; wire npm test/npm run lint into ci.yml/publish.yml
• Phase 2 — Critical bug fix (ICA-002/ICA-003): getDowngradedModel() now branches on provider/model-family; removes the unchecked as any cast that could send a GeneralModel string to the Perplexity API on any hard-throttled search task
• Phase 3 — Pricing consolidation (PRICING-DRIFT): single canonical src/pricing.ts consumed by both openrouter.ts and general-matrix.ts
• Phase 4 — Dead-wiring activation: disableSearch branch fixed, checkSurge()/resetGlobalMonthly() wrappers added, real CircuitBreaker implemented and wired into execute(), unused RoutingResult removed, swallowed fallback errors now accumulated (AUD-005)
• Phase 5 — Security hardening: vision-URL SSRF allowlist (SEC-001), Zod runtime validation of TaskDescriptor/RouterConfig (SEC-002), error toJSON() redaction (SEC-003), npm audit --omit=dev CI gate (SEC-004)
• Phase 6 — Contract docs (RAA-003): ARCHITECTURE.md + no-restricted-imports ESLint rule enforcing router-only-egress
• Phase 7 — Re-baseline: ledger/baseline handoff doc closing out all 18 findings (WIP planning docs, not tracked in git)

Full defect-by-defect disposition lives in src/docs/WIP/LLM-Router audits/unified-remediation-ledger.md (gitignored WIP doc, not part of this diff).

Note: this branch intentionally excludes a set of unrelated untracked repo-scaffold files present in the working tree (CODEOWNERS, ISSUE_TEMPLATE/, dependabot.yml, several l9-*.yml workflows, CODE_OF_CONDUCT.md, CONTRIBUTING.md, SECURITY.md, SUPPORT.md) — those were not produced by this remediation session and are out of scope for this PR.

Test plan

• npm run build — clean
• npm run verify:types — clean
• npm run lint — 0 errors (2 pre-existing, out-of-scope any warnings in vision/general-config branches)
• npm test — 82/82 passing across 10 test files
• npm audit --audit-level=high --omit=dev — 0 vulnerabilities
• CI green on this PR (ci.yml now runs audit/build/typecheck/lint/test)

Made with Cursor

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[sonarqubecloud]

Quality Gate failed

Failed conditions
C Security Rating on New Code (required ≥ A)
C Reliability Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

💡 Need a hand with PR review? Try Gitar by Sonar!