fix: code review — audit API contract, error handling, safety guards

.env.example

@@ -135,6 +135,7 @@ LANGFUSE_SECRET_KEY=
 # When unset, "chain_valid": null — use the CLI to verify:
 #   python -m molecule_audit.verify --agent-id <id>
 # Must match AUDIT_LEDGER_SALT set in each workspace container.
+# REQUIRED when audit module is active. Used for HMAC chain verification.
 # AUDIT_LEDGER_SALT=                # 32+ random bytes (base64 or arbitrary string)
 
 # ---- Operator identity (for org-templates/reno-stars/, see OPERATOR_NOTES.md) ----

.github/workflows/ci.yml

@@ -6,13 +6,21 @@ on:
   pull_request:
     branches: [main, staging]
 
+# Cancel in-progress CI runs when a new commit arrives on the same ref.
+# This prevents multiple stale runs from queuing behind each other and
+# monopolising the self-hosted macOS arm64 runner.
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   # Detect which paths changed so downstream jobs can skip when only
-  # docs/markdown files were modified. Uses git diff (no Docker — works
-  # on macOS self-hosted runners unlike dorny/paths-filter).
+  # docs/markdown files were modified. Uses plain `git diff` — no macOS
+  # dependency, so this runs on ubuntu-latest to free the self-hosted
+  # macOS arm64 runner for jobs that genuinely need it.
   changes:
     name: Detect changes
-    runs-on: [self-hosted, macos, arm64]
+    runs-on: ubuntu-latest
     outputs:
       platform: ${{ steps.check.outputs.platform }}
       canvas: ${{ steps.check.outputs.canvas }}

.github/workflows/codeql.yml

@@ -23,6 +23,13 @@ on:
     # Weekly run picks up findings in code that hasn't been touched.
     - cron: '30 1 * * 0'
 
+# Workflow-level concurrency: only one CodeQL run per branch/PR at a time.
+# `cancel-in-progress: false` queues new runs — the 45-min analysis is the
+# longest CI occupant and fights the single mac mini runner the hardest.
+concurrency:
+  group: codeql-${{ github.ref }}
+  cancel-in-progress: false
+
 permissions:
   actions: read
   contents: read

canvas/Dockerfile

@@ -20,4 +20,7 @@ COPY --from=builder /app/public ./public
 EXPOSE 3000
 ENV PORT=3000
 ENV HOSTNAME="0.0.0.0"
+# Non-root runtime — node image defaults to root, explicitly drop.
+RUN addgroup -g 1000 canvas && adduser -u 1000 -G canvas -s /bin/sh -D canvas
+USER canvas
 CMD ["node", "server.js"]