Shankar 17ef377edb fix(bundle-5): CI green-up — drop unused sync.Once + document new env vars ...

Two CI gate failures from the Bundle 5 push:

1. golangci-lint (unused) — agent_bootstrap.go declared
   `var bootstrapWarnOnce sync.Once` but never called .Do(). The
   one-shot WARN actually lives in cmd/server/main.go (per-process at
   startup, not per-request) so the handler-side variable was dead code.
   Dropped the var + sync import; left a comment explaining where the
   WARN lives.

2. G-3 env-var docs guardrail — Bundle 5 added two new env vars
   (CERTCTL_AGENT_BOOTSTRAP_TOKEN, CERTCTL_AUDIT_FLUSH_TIMEOUT_SECONDS)
   but the G-3 closure CI step asserts every CERTCTL_* env defined in
   internal/config/config.go is mentioned in docs/features.md. Added
   three new sub-sections to docs/features.md after the Body Size
   Limits block:
     * Agent Bootstrap Token (H-007 contract + generation guidance)
     * Graceful Shutdown Audit Flush (M-011 timeout knob)
     * Liveness vs Readiness Probes (H-006 /health vs /ready table)

No production behaviour change; pure CI-gate fix.

Verification
- go vet ./internal/api/handler/...   → clean
- go test -count=1 -run 'TestVerifyBootstrapToken|TestRegisterAgent_BootstrapToken' ./internal/api/handler/...  → all pass
- grep CERTCTL_AGENT_BOOTSTRAP_TOKEN docs/features.md     → present
- grep CERTCTL_AUDIT_FLUSH_TIMEOUT_SECONDS docs/features.md → present

2026-04-26 00:03:03 +00:00

..

handler

fix(bundle-5): CI green-up — drop unused sync.Once + document new env vars

2026-04-26 00:03:03 +00:00

middleware

feat(security): bodyLimit on noAuth + security headers + encryption-key validation (H-1 master)

2026-04-25 16:40:21 +00:00

router

fix(bundle-5): Operational Liveness + Bootstrap — 4 audit findings closed

2026-04-25 23:54:18 +00:00