chore(train): vehicle 2f — remaining approved greens (#16738, #16734, #16725, #16719, #16471, #16730, #16454, #16732)

.github/workflows/ci.yml

@@ -651,7 +651,7 @@ jobs:
         cat DEPLOYMENT_SUMMARY.md
 
     - name: Upload deployment artifact
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@v7.0.1
       with:
         name: deployment-summary
         path: DEPLOYMENT_SUMMARY.md

.github/workflows/co-located-smoke.yml

@@ -233,7 +233,7 @@ jobs:
 
       - name: Upload failure logs
         if: failure()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v7.0.1
         with:
           name: colocated-smoke-logs
           path: colocated-failure-logs.txt

.github/workflows/coverage.yml

@@ -136,7 +136,7 @@ jobs:
       # covered the lines it executed, and this suite has standing failures.
       - name: Upload shard coverage data
         if: ${{ !cancelled() }}
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v7.0.1
         with:
           name: coverage-shard-${{ matrix.shard }}
           path: .coverage.shard-${{ matrix.shard }}

.github/workflows/docker-smoke-test.yml

@@ -214,7 +214,7 @@ jobs:
 
       - name: Upload failure logs
         if: failure()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v7.0.1
         with:
           name: docker-compose-logs
           path: failure-logs.txt

.github/workflows/frontend-test.yml

@@ -231,7 +231,7 @@ jobs:
           fail_ci_if_error: false
 
       - name: Upload test results
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v7.0.1
         if: always()
         with:
           name: test-results-unit
@@ -338,7 +338,7 @@ jobs:
           npx auditjs ossi || true
 
       - name: Upload security scan results
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v7.0.1
         if: always()
         with:
           name: security-scan-results

.github/workflows/hardened-smoke-test.yml

@@ -340,7 +340,7 @@ jobs:
 
       - name: Upload failure logs
         if: failure()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v7.0.1
         with:
           name: hardened-docker-compose-logs
           path: failure-logs.txt

.github/workflows/import-hermeticity-sweep.yml

@@ -187,7 +187,7 @@ jobs:
 
       - name: Keep the raw output
         if: always() && steps.mode.outputs.mode != 'none'
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4.6.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
         with:
           name: import-hermeticity-sweep
           path: sweep-output.txt

.github/workflows/marker-tests.yml

@@ -406,7 +406,7 @@ jobs:
 
       - name: Upload marker reports
         if: ${{ !cancelled() }}
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v7.0.1
         with:
           name: marker-suite-reports
           path: marker-report-*.xml

.github/workflows/phase_validation.yml

@@ -182,7 +182,7 @@ jobs:
         fi
 
     - name: Upload Validation Reports
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@v7.0.1
       if: always()
       with:
         name: phase-validation-reports

.github/workflows/security.yml

@@ -334,7 +334,7 @@ jobs:
         done < <(git ls-files -z '*package-lock.json' | grep -zv node_modules)
 
     - name: Upload Security Reports
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@v7.0.1
       if: always()
       with:
         name: dependency-security-reports
@@ -458,7 +458,7 @@ jobs:
     # directories, so the repository root was never read.
 
     - name: Upload SAST Reports
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@v7.0.1
       if: always()
       with:
         name: sast-security-reports
@@ -684,7 +684,7 @@ jobs:
         } >> security-summary.md
 
     - name: Upload Security Summary
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@v7.0.1
       with:
         name: security-summary
         path: security-summary.md

.github/workflows/test-durations.yml

@@ -129,7 +129,7 @@ jobs:
 
       - name: Upload durations
         if: ${{ !cancelled() }}
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v7.0.1
         with:
           name: test-durations
           # Both paths are dotfiles; upload-artifact excludes hidden files

.github/workflows/trajectory-eval.yml

@@ -97,7 +97,7 @@ jobs:
 
       - name: Upload eval report
         if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v7.0.1
         with:
           name: trajectory-eval-report
           path: |

.github/workflows/unwired-tracker-audit.yml

@@ -71,7 +71,7 @@ jobs:
 
       - name: Upload findings artifact
         if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v7.0.1
         with:
           name: unwired-tracker-findings
           path: findings.json

.github/workflows/visual-regression.yml

@@ -177,7 +177,7 @@ jobs:
         # upload the regenerated PNGs. Download this artifact, copy the
         # contents into tests/visual/__screenshots__/, and commit.
         if: steps.visual.outputs.first_run == 'regenerated'
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v7.0.1
         with:
           name: visual-regression-updated-baselines-${{ github.run_id }}
           path: autobot-frontend/tests/visual/__screenshots__/
@@ -191,7 +191,7 @@ jobs:
         # "Pull this branch + commit the generated baselines" is
         # unactionable since the screenshots never escape the CI runner.
         if: steps.visual.outputs.first_run == 'true'
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v7.0.1
         with:
           name: visual-regression-generated-baselines-${{ github.run_id }}
           path: autobot-frontend/tests/visual/__screenshots__/
@@ -203,7 +203,7 @@ jobs:
         # upload them so a maintainer can download and commit to enable
         # future diff enforcement for those stories.
         if: steps.visual.outputs.first_run == 'false' && success()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v7.0.1
         with:
           name: visual-regression-new-baselines-${{ github.run_id }}
           path: autobot-frontend/tests/visual/__screenshots__/
@@ -212,7 +212,7 @@ jobs:
 
       - name: Upload Playwright HTML report on failure
         if: failure() || steps.visual.outcome == 'failure'
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v7.0.1
         with:
           name: visual-regression-report-${{ github.run_id }}
           path: autobot-frontend/playwright-report/
@@ -221,7 +221,7 @@ jobs:
 
       - name: Upload diff screenshots on failure
         if: failure() || steps.visual.outcome == 'failure'
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v7.0.1
         with:
           name: visual-regression-diffs-${{ github.run_id }}
           path: autobot-frontend/test-results/

README.md

@@ -31,6 +31,16 @@ Your data stays on your machines. Your AI stays yours.
 | Service lifecycle management (SLM) | Your infrastructure |
 | Module ecosystem | Your data |
 
+## Why, How, What
+
+- **Why.** Private AI you trust with your business knowledge shouldn't require handing that
+  knowledge — or control of the intelligence itself — to someone else's server.
+- **How.** A small, stable Core (RAG + knowledge-graph memory, a provider-agnostic LLM gateway
+  with fallback, governance) plus a management layer that absorbs deploy/operate/scale, plus
+  Modules that inherit all of it instead of rebuilding it.
+- **What.** A self-hosted AI platform — chat, a private knowledge base, a fleet-management
+  dashboard, and installable modules. Apache-2.0. No subscription.
+
 ## The Platform Model
 
 AutoBot is three layers, bottom to top:
@@ -95,6 +105,12 @@ control:
   agent-company), Codebase Analytics, the Transcriber, and more
 - **Complete Data Privacy** — full data control, no external dependencies, runs entirely
   on your hardware, no vendor lock-in
+- **Governance-Ready Architecture** — audit logging, MFA, a secrets vault, retention
+  policies, and RBAC built for GDPR/SOC2/ISO27001 today, on an architecture (self-hosted
+  data, a provider-agnostic LLM gateway, human-oversight-capable governance) that maps
+  cleanly onto EU AI Act, NIS2, and ISO/IEC 42001 (AI management systems) obligations. See
+  [EU AI Act, NIS2 & Governance Fit](docs/architecture/EU_AI_GOVERNANCE.md) for
+  what's covered and what's still a gap — no compliance certification is claimed.
 
 → Browse everything in the [Capability Catalog](docs/features/CATALOG.md).
 

autobot-backend/api/autobot_mcp_router.py

@@ -17,7 +17,7 @@
 
 from autobot_shared.logging_manager import get_logger
 from autobot_shared.proxy_utils import get_client_ip
-from mcp.autobot_server import AutoBotMCPServer
+from mcp_server.autobot_server import AutoBotMCPServer
 
 logger = get_logger(__name__)
 

autobot-backend/api/collaboration.py

@@ -12,6 +12,7 @@
 import uuid
 
 from fastapi import APIRouter, Depends, HTTPException, status
+from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from api.schemas_agent import (
@@ -28,6 +29,7 @@
 from autobot_shared.error_boundaries import ErrorCategory, with_error_handling
 from autobot_shared.logging_manager import get_logger
 from autobot_shared.time_utils import utc_timestamp
+from models.collaboration_event import CollaborationEvent
 from models.session_collaboration import PermissionLevel, SessionCollaboration
 from user_management.database import get_async_session
 
@@ -43,8 +45,6 @@
 
 async def _get_session_collab(session_id: str, db: AsyncSession) -> SessionCollaboration | None:
     """Get session collaboration record."""
-    from sqlalchemy import select
-
     stmt = select(SessionCollaboration).where(SessionCollaboration.session_id == session_id)
     result = await db.execute(stmt)
     return result.scalar_one_or_none()
@@ -94,8 +94,6 @@ async def _get_or_create_collab(session_id: str, owner_id: uuid.UUID, db: AsyncS
 
 async def _fetch_and_validate_secret(secret_id: uuid.UUID, user_id: uuid.UUID, db: AsyncSession):
     """Helper for share_secret_with_session. Ref: #1088."""
-    from sqlalchemy import select
-
     from models.secret import Secret
 
     stmt = select(Secret).where(Secret.id == secret_id)
@@ -134,6 +132,33 @@ def _resolve_share_recipients(
     return recipient_ids
 
 
+async def _record_event(
+    db: AsyncSession,
+    *,
+    session_id: str,
+    kind: str,
+    user_id: uuid.UUID | None,
+    username: str | None,
+    payload: dict,
+) -> None:
+    """Persist one collaboration event (#16460). Best-effort: a failure here
+    must never break the live broadcast or the REST call it rides alongside
+    -- see websocket/presence.py's own use of this for the same reasoning."""
+    try:
+        db.add(
+            CollaborationEvent(
+                session_id=session_id,
+                kind=kind,
+                user_id=user_id,
+                username=username,
+                payload=payload,
+            )
+        )
+        await db.flush()
+    except Exception as exc:  # noqa: BLE001 - persistence is best-effort, never breaks the caller
+        logger.warning("collaboration event persistence failed: %s", type(exc).__name__)
+
+
 # ====================================================================
 # API Endpoints
 # ====================================================================
@@ -355,6 +380,24 @@ async def share_secret_with_session(
             if recipient_id != user_id:  # Don't share with self
                 secret.share_with(recipient_id)
 
+        # #16460: persisted alongside the share, same transaction -- a client
+        # that reconnects later sees this in GET /{session_id}/events, not
+        # just whoever was connected to the live broadcast below.
+        await _record_event(
+            db,
+            session_id=session_id,
+            kind="secret_shared",
+            user_id=user_id,
+            username=current_user.get("username", ""),
+            payload={
+                "secret_id": str(secret_id),
+                "secret_name": secret.name,
+                "secret_type": secret.type,
+                "shared_by": str(user_id),
+                "shared_by_username": current_user.get("username", ""),
+            },
+        )
+
         await db.commit()
 
         logger.info(f"User shared secret with {len(recipient_ids)} participants in session {session_id}")