[vibesoftwarecoder]

Builds on the update-check core. This PR makes it run, exposes it, and documents it. Still off by default: with UpdateCheckEnabled false the service makes no network call.

What changes

• UpdateCheckService: its own hosted service. Off, it idles on an options-change token. On, it checks about every 12 h (clamped 1 to 168, ±10% jitter), first check 10 to 20 min after start, backoff 15 min / 1 h / 4 h, rate-limit resets honoured, one check at a time, never throws into the host.
• UpdateStatusProvider: holds the last result in memory and computes status and announce. It never calls GitHub. A failed check no longer switches an "update available" notice off: the last good result stays, the status is recomputed from the installed version (so it ends once you update), and the error is shown beside it. With no good result there is nothing to announce.
• GET /api/system/updates, POST /api/system/updates/check (202 / 429 / 409; the check runs inside the request, bounded to 30 s), POST /api/system/updates/settings ({ "enabled": bool }). All behind the API key when auth is on; none is public.
• The settings switch replaces appsettings.local.json with File.Replace: still one atomic swap, but the file keeps its existing permissions. The file can hold the API key and an administrator may have tightened its ACL, so a plain rename-over would have widened it. If something briefly holds the file open (the configuration reload, a scanner), the swap is retried a few times with a short, growing pause before it reports 500. A failed write changes nothing and the staging file is deleted. AtomicFile itself is unchanged.
• ApiServer: the auth middleware and JSON options are split out unchanged (so tests can use them); nothing else changes.
• Docs: security-posture.md "Outbound connections", README config rows and "Updating", CLAUDE.md, and the 0.6.20 release notes.

Safety: GitHub text (html_url, release notes) is never forwarded; links are built from the repo name and the parsed tag. The check never downloads, installs or runs anything.

Tests: service behaviour on a fake clock, status and announce rules, and the API contract over loopback HTTP through the real auth middleware and routes. Timing-dependent tests prove their overlap instead of hoping for it. Each group was mutation-checked. Full suite 1444 passed, 18 skipped; the Updates group passed 20 runs in a row.

Live-host checks still needed: TLS and proxy from SYSTEM, config reload in the running service, the ACL on update-check.json, and File.Replace onto the real appsettings.local.json.

🤖 Generated with Claude Code