Ghost FTP 0.99.26 — whole-repository code and documentation review (Preview candidate)

Previous verified public release: v0.99.25.

Security and reliability changes

• Harden the localhost Agent Bridge HTTP parser: reject ambiguous Content-Length, unsupported Transfer-Encoding, truncated POST bodies, and browser Origin requests. Add an overall request timeout and remove permissive wildcard CORS. Retain bearer-token authentication, explicit per-session grants and interactive approvals.
• Extend repository-wide security-pattern detection to report every matching occurrence per source file and block embedded private keys, shell-piped curl fetches and permissive localhost CORS.
• Improve conservative Swift/Kotlin dead-module inventory to avoid flagging extension-only files with no class declaration. It remains advisory; compiler and runtime evidence are still required before deleting an API.

Documentation

• Consolidate the documentation entrypoint, repair broken retired Server/CLI/Demo links and stale publication status.
• Remove 11 superseded, unreferenced audit/phase snapshots from the active source tree. Historical git commits and all canonical release notes, legal terms, QA evidence and public release assets remain unchanged.
• Add a dated repository audit report with inventory, findings, corrections and outstanding production requirements.

Acceptance / limitations

Development Preview until the exact final commit passes all required Windows, Linux, Android, macOS, Rust, Go, TypeScript, release and protocol CI workflows. This is not a claim of full penetration testing, macOS FTPS/SFTP completion, universal pixel parity or production signing/notarization.