- docs/AUDITORIA_BASE_2GT.md: full audit of upstream 1a4b635 (v0.24.5-beta)
- 0 critical, 1 high (SEC-002: no per-site RBAC), 4 medium, 5 low, 5 informational
- Verdict: APROVADO COM CORREÇÕES OBRIGATÓRIAS
- First read-only RB: authorized (SIM)
- test: add regression coverage proving SEC-001 (no JWT revocation) and
SEC-002 (site scoping has no per-user authorization component)
- docs/SISTEMA_ATUAL.md: record confirmed facts (RBAC scope, Change Guard
coverage, RouterOS TLS verification) surfaced by the audit
No production code changed — audit-only per mission scope.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
