moradin-closelisted

# moradin:close Every item here traces to a documented disaster that hit builders exactly like this project's operator. The profile never shrinks this list — **scoping keys to release significance**: first public launch or personal data involved ⇒ Extended; otherwise Core. ## When invoked `/moradin:close` — after a milestone ships, before ending a project phase. Reads all of `.forge/`. ## Core (every ship, 30–60 min, agent-driven) 1. **Secrets** — scan the *entire git history*, not just HEAD. Any hit: **rotate the key**, never just delete the line (most keys leaked years ago are still live). Confirm nothing secret sits in client-delivered code. 2. **Logged-out probe** — from outside the app (curl/incognito, no session): attempt to read and write every endpoint, table, and storage bucket. Expect denial everywhere. This one check would have prevented the era's worst vibe-coded breaches. 3. **Database rules** — row-level security / access rules on every table, verified with the platform's own linter where one exists. 4. **A way back** — automatic backup on, and **one real restore performed** into a scratch location. An untested backup is a hope, not a backup. 5. **Spend caps** — billing alerts + hard caps on every metered API the project touches; note any service that *cannot* cap as a standing risk. 6. **Monitoring heartbeat** — error tracker receives a deliberate test error; uptime check answers. 7. **Production smoke test** — the golden path (arrive → core action → data