[acamarata]

Three rows fixed, two reported blocked.

D-0887 (fixed, partly)

• migrate.Status in the boot health helper now runs under context.WithTimeout(context.Background(), 5*time.Second). A hung database fails /health instead of hanging it. Changed in the codemod template (scripts/codemods/bootmig/run.go) and in the 36 generated boot_migrations.go copies (the 7 hand-written ones already passed a context).
• Test: scripts/codemods/bootmig/health_timeout_test.go fails on the template and on every generated copy that calls migrate.Status on an unbounded context. It failed before and passes now.
• Deviation: the row asks for the request context. bootMigrationsHealth(w) has no request parameter, and changing it means rewiring every plugin's health handler and the codemod's edit. The timeout alone removes the hang, so I did that.
• github-runner hooks: the cli (cli/internal/plugin, cmd) never discovers or runs install.sh, uninstall.sh or manifest postInstall/preUninstall; nothing reads them. D-0297 removes the scripts.

D-0617 (fixed)

• checkUploadOverlap in free/traefik/internal/render/upload.go refuses a named wildcard route that covers a host an unnamed route owns more specifically (exact name or longer wildcard). The refusal names the route and the host. Naming the overlapping route as well renders fine.
• Tests in upload_test.go (host-tier fixture): fail before, pass after. README and wiki Traefik page now say what happens.

D-0297 (fixed)

• Deleted the 82 per-plugin install.sh, uninstall.sh, actions/*.sh, webhooks/**/*.sh files and the 4 shared scripts (generate-plugin, plugin-utils, schema-sync, webhook-handler). Kept shared/validate-registry.sh.
• Checked first: no workflow, script, Dockerfile, compose file or Go code uses them; the cli does not run them.
• Also removed: free/github-runner/tests/github-runner.test.sh (it only tested the deleted scripts; the Go handlers keep their own tests), the redteam TestD24_InstallVerifiesRunnerDownload (its subject, install.sh, is gone), and 7 .github/file-size-budget.txt rows.
• Wiki pass: rewrote the script-based sections of Development.md; replaced ./install.sh steps with nself plugin install <name> in the wiki and the file-processing, idme, jobs, notifications READMEs and summaries; fixed Contributing.md, Plugin-System.md, the github-runner README and an idme schema comment.

D-0295 (blocked, no change)

Porting free/plugin-gauth (Rust, 771 lines, DB-backed with AES-GCM at rest, registry entry, signed artifacts) to Go and deciding whether to merge it with the Go CLI free/gauth is a product-scope decision. It must keep the stored-token format compatible, and it changes the registry language and release artifacts. Related D-0306.

D-1462 (blocked, no change)

There is no nself-audit plugin.json in this repo. The free audit plugin is free in both its manifest and registry.json. nself-audit exists only as a licensed catalog entry carried from the bundles repo (scripts/catalog/licensed-catalog-carry.json, owner ruling P7-PLUG-04). Picking its tier, porting it into audit-log (Part E), or tagging it needs an owner decision and a release.

Commands run

• cd scripts/codemods/bootmig && go test -mod=mod ./...: ok
• go vet -mod=vendor ./... in all 36 plugins touched by D-0887: clean
• go test -mod=vendor -count=1 ./... in the same plugins: all ok
• cd free/traefik && CGO_ENABLED=0 go test -mod=vendor -count=1 ./... && go vet -mod=vendor ./...: ok
• cd free/github-runner && go test -mod=vendor ./...: ok
• cd free/ci && go vet -mod=vendor -tags security ./test/security/redteam/: clean
• python3 scripts/ci/check-file-size.py: ok

[acamarata]

Fixed in 1f6a00f. The 10 remaining unbounded migrate.Status(context.Background(), …) calls (audit-analytics, hipaa, job-queue, nself-cloud, nself-eval-gate, nself-sync, nself-vault, plugin-pty, siem, tenant-controller) now use the same 5 s timeout. The alpha conformance golden is regenerated, and run.sh --fixtures --twice passes. beta and gamma were not affected. The guard test now walks every Go file under free/ and tests/conformance/expected/ instead of two globs. Against the base tree it reports 11 unbounded files, and it passes on the fix. Build, vet and tests pass for each touched plugin.

[acamarata]

Rebased onto origin/main. The only conflicts were six v1 shell files this PR deletes (file-processing/install.sh, github-runner install.sh, actions/start|status|trust.sh, tests/github-runner.test.sh) that main had patched; kept the deletion, since the Go github-runner plugin already carries the runner-group trust check. Also removed free/file-processing/tests/install-ts.test.sh (added on main, it sources the deleted install.sh). go test -mod=vendor passes in every touched module.