docs(security): file idea.md findings from codebase security review

docs/00_overview/BACKLOG_DASHBOARD.md

@@ -2,7 +2,7 @@
 
 # RelyLoop BACKLOG Dashboard
 
-_Reflects feature-folder state as of **2026-06-06** (latest mtime of any planned/implemented feature `.md` file). Regenerated by `make dashboard` and the `mvp1-dashboard-regen` pre-commit hook. For the rich local view (filter chips, type colors), open [`backlog_dashboard.html`](backlog_dashboard.html) in a browser._
+_Reflects feature-folder state as of **2026-06-09** (latest mtime of any planned/implemented feature `.md` file). Regenerated by `make dashboard` and the `mvp1-dashboard-regen` pre-commit hook. For the rich local view (filter chips, type colors), open [`backlog_dashboard.html`](backlog_dashboard.html) in a browser._
 
 ## Next up
 

docs/00_overview/DASHBOARD.md

@@ -1,15 +1,15 @@
 # RelyLoop — Release Roadmap
 
-_Top-level index across MVP1 → GA v1+ as of **2026-06-06**. Click a release name to drill into the per-release dashboard. Theme labels sourced from [`docs/01_architecture/tech-stack.md` §"Canonical release matrix"](../01_architecture/tech-stack.md). For the rich local view, open [`dashboard.html`](dashboard.html) in a browser._
+_Top-level index across MVP1 → GA v1+ as of **2026-06-09**. Click a release name to drill into the per-release dashboard. Theme labels sourced from [`docs/01_architecture/tech-stack.md` §"Canonical release matrix"](../01_architecture/tech-stack.md). For the rich local view, open [`dashboard.html`](dashboard.html) in a browser._
 
 ## Releases
 
 | Release | Theme | Progress | Status |
 |---|---|---|---|
 | [MVP1 / v0.1](MVP1_DASHBOARD.md) | The Loop | 100 / 100 scoped done | **Complete** |
-| [MVP2 / v0.2](MVP2_DASHBOARD.md) | Three-Engine + Real Signals | 25 / 28 scoped done · 13 remaining | **In progress** |
+| [MVP2 / v0.2](MVP2_DASHBOARD.md) | Three-Engine + Real Signals | 25 / 28 scoped done · 17 remaining | **In progress** |
 | MVP3 / v0.3 | Observable | — | **Not yet scoped** |
-| GA v1 / v1.0 | Production-ready | — | **Not yet scoped** |
+| [GA v1 / v1.0](GA_DASHBOARD.md) | Production-ready | 1 item(s) queued | **Held / queued** |
 
 ---
 

docs/00_overview/GA_DASHBOARD.md

@@ -2,7 +2,7 @@
 
 # RelyLoop GA Dashboard
 
-_Reflects feature-folder state as of **2026-05-30** (latest mtime of any planned/implemented feature `.md` file). Regenerated by `make dashboard` and the `mvp1-dashboard-regen` pre-commit hook. For the rich local view (filter chips, type colors), open [`ga_dashboard.html`](ga_dashboard.html) in a browser._
+_Reflects feature-folder state as of **2026-06-09** (latest mtime of any planned/implemented feature `.md` file). Regenerated by `make dashboard` and the `mvp1-dashboard-regen` pre-commit hook. For the rich local view (filter chips, type colors), open [`ga_dashboard.html`](ga_dashboard.html) in a browser._
 
 ## Next up
 
@@ -14,12 +14,13 @@ Pull from the Idea backlog or capture a new feature spec.
 
 | Metric | Value |
 |---|---|
-| Scoped items done | **0 / 0** (0%) — feat_/infra_/chore_/epic_ past idea stage |
+| Filed under GA | **1** folders total (done + specced not-done + idea backlog + bugs) |
+| Specced features done | **0 / 0** (0%) — of features *past the idea stage* (those with a spec); the idea backlog below is NOT in this denominator, so 100% ≠ release complete |
 | Pending work | **1** items (every not-done feat/infra/chore/bug across all priorities) |
 | → P0 — do next | **0** unblocking / paying daily cost |
-| → P1 | **1** high-value, ready when P0 clears |
+| → P1 | **0** high-value, ready when P0 clears |
 | → P2 (default) | 0 important to file, not blocking |
-| → Backlog | 0 captured for record, not planned |
+| → Backlog | 1 captured for record, not planned |
 | Open bugs | 0 |
 | Legacy "Path to GA" | 1 items — scoped-not-done + bugs + chore-ideas only (excludes feat/infra ideas) |
 | Backlog ideas | 0 idea-only feat/infra (not yet scoped into GA) |
@@ -47,7 +48,7 @@ _None._
 
 | # | Priority | Feature | Type | One-liner | Depends on | Status |
 |---|---|---|---|---|---|---|
-| 1 | P1 | [chore_oss_public_launch_punchlist](planned_features/04_ga/chore_oss_public_launch_punchlist/idea.md) | Chore | The `chore_oss_launch_prep` PR adds the foundational governance / security / contributor files that prospective contributors and enterprise reviewers look for first. Three remaining items are gates on | — | Idea — captured during `chore_oss_launch_prep` (the PR that added SECURITY.md / GOVERNANCE.md / MAINTAINERS.md / CODEOWNERS / issue + PR templates and replaced the Code of Conduct) |
+| 1 | Backlog | [chore_cors_credentials_origin_hardening](planned_features/04_ga/chore_cors_credentials_origin_hardening/idea.md) | Chore | CORS is configured with `allow_credentials=True` and an operator-configurable origin list: | — | Idea — surfaced during a codebase-wide security review (branch `claude/codebase-security-review-6njwio`) |
 
 ## Dependency graph
 

docs/00_overview/MVP1_DASHBOARD.md

@@ -2,7 +2,7 @@
 
 # RelyLoop MVP1 Dashboard
 
-_Reflects feature-folder state as of **2026-06-06** (latest mtime of any planned/implemented feature `.md` file). Regenerated by `make dashboard` and the `mvp1-dashboard-regen` pre-commit hook. For the rich local view (filter chips, type colors), open [`mvp1_dashboard.html`](mvp1_dashboard.html) in a browser._
+_Reflects feature-folder state as of **2026-06-09** (latest mtime of any planned/implemented feature `.md` file). Regenerated by `make dashboard` and the `mvp1-dashboard-regen` pre-commit hook. For the rich local view (filter chips, type colors), open [`mvp1_dashboard.html`](mvp1_dashboard.html) in a browser._
 
 ## Next up