chore(specs): security scan findings

[fclairamb]

Specs for the open findings of the daily security scan. Specs only, no code change.

Specs

Spec	Severity	Finding	Summary
specs/todos/2026-10-19-01-a2a-response-size-cap.md	medium	J1 (2026-10-19)	The A2A client (Agent Card fetch, SendMessage, GetTask, through the a2a-go SDK) reads success response bodies with no size cap. Only the 30 s timeout bounds them. A member pointing an A2A integration at their own server can exhaust the server's memory. Fix: a capped reader in a2aStatusTransport.

Scan of 2026-10-19 covered:

• the new A2A notification channel (feat: A2A notification channel for AI agents #596), which held on egress, tenancy, secrets and comment rendering apart from J1;
• the docs redesign;
• the dash0 changes.

It also verified the plugin-schema $ref fix of #593 (I1). No other new finding.

🤖 Generated with Claude Code

[codecov]

Codecov Report

❌ Patch coverage is 93.75000% with 1 line in your changes missing coverage. Please review.
⚠️ Please upload report for BASE (main@3295a20). Learn more about missing BASE report.

Files with missing lines	Patch %	Lines
server/internal/notifications/a2a.go	93.75%	1 Missing ⚠️

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #608   +/-   ##
=======================================
  Coverage        ?   83.32%           
=======================================
  Files           ?     1238           
  Lines           ?   127041           
  Branches        ?        0           
=======================================
  Hits            ?   105860           
  Misses          ?    21172           
  Partials        ?        9           

Files with missing lines	Coverage Δ
server/internal/notifications/a2a.go	86.24% <93.75%> (ø)

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.