jposluns · Oct 19, 2026 · Oct 19, 2026 · Oct 19, 2026 · Oct 19, 2026 · Oct 19, 2026
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -12,6 +12,7 @@ service can change a gate's answer, and a pull request number is only knowable f
 
 ## 2026-10-19
 
+- Component names no longer repeat the version their header entry or summary line appends, in `deployment-lifecycle.md`, `gitops-controllers.md`, `host.md`, `mfa.md` and `self-signed.md`: headers now read, for example, "DNF 4.14.0", "Dex source v2.45.1" and "MySQL multifactor authentication 8.0 and 8.4", with each version stated once; no version, source, claim or guide body changes (#702)
 - `authentication.md`, the last guide, moves to the two-section layout (maintainer request, 2026-10-18), with its own topics named first in its header; all 100 guides now use the layout; no guide body or digest changes (#700)
 - Nineteen more guides move to the two-section layout (maintainer request, 2026-10-18), with each guide's own tool named first in its header; `mfa.md`, already in the layout, now lists authentik, Keycloak and oauth2-proxy in its header (Authelia has no recorded release version, so it stays in the folded count); no guide body or digest changes. Guides: `dotnet.md`, `php.md`, `ruby.md`, `nextjs.md`, `frontend-frameworks.md`, `web-exposure.md`, `admin-uis.md`, `bi-dashboards.md`, `devops-uis.md`, `server-admin-panels.md`, `low-code-builders.md`, `python.md`, `deployment-lifecycle.md`, `gpu-clouds.md`, `mlflow.md`, `paas.md`, `sqlite.md`, `sqlite-http-frontends.md`, `transactional-email-posture.md` (#699)
 - `authentication.md`: the secret-scan Verify step now cites Gitleaks v8.30.1's staged and pre-commit flags (which switch it to scanning `git diff`) and its `--log-opts` option over `git log -p` history, so the instruction to verify staged, all-ref and merge-commit coverage with the chosen scanner and configuration rests on cited behaviour; the claim keeps the limits of the supplementary `git log` search; rule 15 now says the cited protocol sources do not establish that an HTML login protects those endpoints; TODO row 1.295 moves to DONE (#698)

diff --git a/VERSION b/VERSION
@@ -1 +1 @@
-1.0.700
+1.0.702
diff --git a/deployment-lifecycle.md b/deployment-lifecycle.md
@@ -197,7 +197,7 @@ Components (recorded basis):
 - nist: NIST digital identity guidelines (SP 800-63B-4)
 - ubuntu-nc: Ubuntu noble netcat-openbsd source (c047f1a4572e796c8643fb7e5a719a9d960a677b)
 - c9s-nmap: CentOS Stream 9 nmap packaging (17c2b7795d821cd7fbe311cf3f885be3ea1f122f)
-- busybox: BusyBox 1.36.1 (1_36_1)
+- busybox: BusyBox (1_36_1)
 - docker-notes: Docker Engine release notes (4e9a5751518ed8223a8dcde53693badddd72604f)
 - webui: Open WebUI (0a7c15832fb30b1903753e83f81dc7d27e5b0944)
 - certbot-v230: Certbot user guide and source (v2.3.0)
@@ -394,7 +394,7 @@ Claims (full source mapping in the JSON block below):
       }
     },
     "busybox": {
-      "name": "BusyBox 1.36.1",
+      "name": "BusyBox",
       "basis": "1_36_1",
       "sources": {
         "s34bdee292f79": "https://github.com/mirror/busybox/blob/1_36_1/networking/nc_bloaty.c#L61-L93",

diff --git a/gitops-controllers.md b/gitops-controllers.md
@@ -1,6 +1,6 @@
 # GitOps controllers: Argo CD and Flux
 
-Written against Argo CD v3.5.3 source (pinned to a commit), Flux OIDC introduction v2.9, Dex v2.45.1 source v2.45.1, Redis 8.2.3 source 8.2.3, and curl curl-8_14_1; 1 further source is pinned to a commit and 3 carry no recorded version. Metadata reviewed 2026-10-19; documentation checked September 2026. The guide records 50 claims, all reasoned from cited sources.
+Written against Argo CD v3.5.3 source (pinned to a commit), Flux OIDC introduction v2.9, Dex source v2.45.1, Redis source 8.2.3, and curl curl-8_14_1; 1 further source is pinned to a commit and 3 carry no recorded version. Metadata reviewed 2026-10-19; documentation checked September 2026. The guide records 50 claims, all reasoned from cited sources.
 
 A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
 
@@ -498,9 +498,9 @@ Components (recorded basis):
 - flux-oidc: Flux OIDC introduction (v2.9)
 - argo-docs: Argo CD documentation (unknown)
 - flux: Flux documentation (unknown)
-- dex: Dex v2.45.1 source (v2.45.1)
+- dex: Dex source (v2.45.1)
 - redis-image: docker-library-redis v8.2.3 source (bcbc692165ce2241e194035041c5b5e01d2e1a5f)
-- redis-source: Redis 8.2.3 source (8.2.3)
+- redis-source: Redis source (8.2.3)
 - curl: curl (curl-8_14_1)
 - python: Python documentation (unknown)
 
@@ -655,7 +655,7 @@ Claims (full source mapping in the JSON block below):
       }
     },
     "dex": {
-      "name": "Dex v2.45.1 source",
+      "name": "Dex source",
       "basis": "v2.45.1",
       "sources": {
         "s3b9512b79dea": "https://github.com/dexidp/dex/blob/v2.45.1/cmd/dex/serve.go#L151-L199",
@@ -673,7 +673,7 @@ Claims (full source mapping in the JSON block below):
       }
     },
     "redis-source": {
-      "name": "Redis 8.2.3 source",
+      "name": "Redis source",
       "basis": "8.2.3",
       "sources": {
         "s667fc16bf18f": "https://github.com/redis/redis/blob/8.2.3/src/server.h#L142-L143",

diff --git a/host.md b/host.md
@@ -1,6 +1,6 @@
 # Host baseline: SSH, firewall, updates
 
-Written against OpenSSH documentation (no recorded version), OpenSSH 8.2 server manual V_8_2_P1, OpenSSH 8.1 server manual V_8_1_P1, OpenSSH 9.9 source V_9_9_P2, DNF 4.14.0 4.14.0, cloud-init 26.2 26.2, cloud-init 20.1 20.1, and iproute2 ss manual v6.12.0, plus 1 more recorded basis; 9 further sources are pinned to a commit and 9 carry no recorded version. Metadata reviewed 2026-10-18; documentation checked September 2026. The guide records 22 claims, all reasoned from cited sources.
+Written against OpenSSH documentation (no recorded version), OpenSSH 8.2 server manual V_8_2_P1, OpenSSH 8.1 server manual V_8_1_P1, OpenSSH 9.9 source V_9_9_P2, DNF 4.14.0, cloud-init 26.2 and 20.1, iproute2 ss manual v6.12.0, and BusyBox 1_36_1; 9 further sources are pinned to a commit and 9 carry no recorded version. Metadata reviewed 2026-10-18; documentation checked September 2026. The guide records 22 claims, all reasoned from cited sources.
 
 A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
 
@@ -217,7 +217,7 @@ Components (recorded basis):
 - ubuntu-uu: Ubuntu noble unattended-upgrades source (0570be65234e2392d420308470d26920fa4cd21a)
 - ubuntu-apt: Ubuntu noble-updates apt source (835f914ef5657b923fbb8b357f134b00de24c6fd)
 - c9s-dnf: CentOS Stream 9 dnf packaging (3d5ca2af8635e0ef77219625f734d503b9900208)
-- dnf4: DNF 4.14.0 (4.14.0)
+- dnf4: DNF (4.14.0)
 - aws-ssm: AWS Session Manager (unknown)
 - gcp-iap: Google Cloud IAP (unknown)
 - azure-docs: Azure documentation snapshot (8ef1ae8a3759ddb2ed2e437bf38083aa2268c39f)
@@ -226,13 +226,13 @@ Components (recorded basis):
 - crowdsec: CrowdSec (unknown)
 - totp: google-authenticator-libpam (unknown)
 - duo: Duo Unix (unknown)
-- cloudinit26: cloud-init 26.2 (26.2)
-- cloudinit20: cloud-init 20.1 (20.1)
+- cloudinit26: cloud-init (26.2)
+- cloudinit20: cloud-init (20.1)
 - docker: Docker Engine networking (4e9a5751518ed8223a8dcde53693badddd72604f)
 - iproute2: iproute2 ss manual (v6.12.0)
 - ubuntu-nc: Ubuntu noble netcat-openbsd source (c047f1a4572e796c8643fb7e5a719a9d960a677b)
 - c9s-nmap: CentOS Stream 9 nmap packaging (17c2b7795d821cd7fbe311cf3f885be3ea1f122f)
-- busybox: BusyBox 1.36.1 (1_36_1)
+- busybox: BusyBox (1_36_1)
 
 Claims (full source mapping in the JSON block below):
 
@@ -359,7 +359,7 @@ Claims (full source mapping in the JSON block below):
       }
     },
     "dnf4": {
-      "name": "DNF 4.14.0",
+      "name": "DNF",
       "basis": "4.14.0",
       "sources": {
         "s97934a4740a2": "https://github.com/rpm-software-management/dnf/blob/4.14.0/etc/dnf/automatic.conf#L1-L22",
@@ -428,7 +428,7 @@ Claims (full source mapping in the JSON block below):
       }
     },
     "cloudinit26": {
-      "name": "cloud-init 26.2",
+      "name": "cloud-init",
       "basis": "26.2",
       "sources": {
         "sad4ec0d2acc5": "https://github.com/canonical/cloud-init/blob/26.2/cloudinit/ssh_util.py#L548-L586",
@@ -437,7 +437,7 @@ Claims (full source mapping in the JSON block below):
       }
     },
     "cloudinit20": {
-      "name": "cloud-init 20.1",
+      "name": "cloud-init",
       "basis": "20.1",
       "sources": {
         "s471abb6d2123": "https://github.com/canonical/cloud-init/blob/20.1/cloudinit/ssh_util.py#L338-L348",
@@ -485,7 +485,7 @@ Claims (full source mapping in the JSON block below):
       }
     },
     "busybox": {
-      "name": "BusyBox 1.36.1",
+      "name": "BusyBox",
       "basis": "1_36_1",
       "sources": {
         "s34bdee292f79": "https://github.com/mirror/busybox/blob/1_36_1/networking/nc_bloaty.c#L61-L93",

diff --git a/mfa.md b/mfa.md
@@ -1,6 +1,6 @@
 # Multi-factor authentication (MFA)
 
-Written against TOTP standard (no recorded version), authentik source version/2026.8.3, Keycloak documentation 26.7.4, oauth2-proxy documentation v7.15.4, Caddy forward_auth minimum 2.5.1, google-authenticator-libpam source 1.11, and MySQL 8.0 multifactor authentication 8.0, plus 10 more recorded bases; 14 further sources are pinned to a commit and 13 carry no recorded version. Metadata reviewed 2026-10-18; documentation checked September 2026. The guide records 35 claims: 2 demonstrated by a check that ran and 33 reasoned from cited sources.
+Written against TOTP standard (no recorded version), authentik source version/2026.8.3, Keycloak documentation 26.7.4, oauth2-proxy documentation v7.15.4, Caddy forward_auth minimum 2.5.1, google-authenticator-libpam source 1.11, and MySQL multifactor authentication 8.0 and 8.4, plus 9 more recorded bases; 14 further sources are pinned to a commit and 13 carry no recorded version. Metadata reviewed 2026-10-18; documentation checked September 2026. The guide records 35 claims: 2 demonstrated by a check that ran and 33 reasoned from cited sources.
 
 A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
 
@@ -184,9 +184,9 @@ Components (recorded basis):
 - google-workspace-docs: Google Workspace 2SV documentation (unknown)
 - supabase: Supabase Auth MFA (citation gap) (unknown)
 - access: Cloudflare Access MFA (citation gap) (unknown)
-- mysql: MySQL 8.0 multifactor authentication (8.0)
-- mysql-8-4: MySQL 8.4 multifactor authentication (8.4)
-- mysql-webauthn: MySQL 8.4 WebAuthn authentication (8.4)
+- mysql: MySQL multifactor authentication (8.0)
+- mysql-8-4: MySQL multifactor authentication (8.4)
+- mysql-webauthn: MySQL WebAuthn authentication (8.4)
 - entra-docs: Microsoft Entra documentation (231747abc59ae3d50c74e215c1cdd592eb980723)
 - owasp-docs: OWASP cheat sheets (668ba7db3d0da5868b8a0305c259f7f6914a6ecd)
 - otp-source: pquerna/otp source (617f8d5f3f518bae0f5c3ec14a17ca19f2a6f870)
@@ -387,21 +387,21 @@ Claims (full source mapping in the JSON block below):
       }
     },
     "mysql": {
-      "name": "MySQL 8.0 multifactor authentication",
+      "name": "MySQL multifactor authentication",
       "basis": "8.0",
       "sources": {
         "sa937d1361fe1": "https://dev.mysql.com/doc/refman/8.0/en/multifactor-authentication.html"
       }
     },
     "mysql-8-4": {
-      "name": "MySQL 8.4 multifactor authentication",
+      "name": "MySQL multifactor authentication",
       "basis": "8.4",
       "sources": {
         "s56ada201b676": "https://dev.mysql.com/doc/refman/8.4/en/multifactor-authentication.html"
       }
     },
     "mysql-webauthn": {
-      "name": "MySQL 8.4 WebAuthn authentication",
+      "name": "MySQL WebAuthn authentication",
       "basis": "8.4",
       "sources": {
         "s807a77fa8872": "https://dev.mysql.com/doc/refman/8.4/en/webauthn-pluggable-authentication.html"

diff --git a/plugin/plugin.json b/plugin/plugin.json
@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "secureconfig",
-  "version": "1.0.700",
+  "version": "1.0.702",
   "description": "Deployment-exposure guides for services AI-assisted projects commonly run: TLS, authentication, MFA, secrets, and network exposure, each line traced to a vendor page.",
   "author": { "name": "Jeff Posluns", "url": "https://secureconfig.ai" },
   "homepage": "https://secureconfig.ai",

diff --git a/plugin/skills/secure-deployment-config/references/MANIFEST.sha256 b/plugin/skills/secure-deployment-config/references/MANIFEST.sha256
@@ -1,12 +1,12 @@
 16d5e01fa7dc8355dd64b44f09923711070b47cd66686feef7e0bfe2adf63f2e  README.md
 0396b6b7ea6cd394bf147ada54efce3154d905ed8b40a36982eb5a1da0a98b2a  controls-reference.md
 63dbab66d2ee6a851368cc772aff88eed98760b747b3735c746d3a8a828263e5  free-certificates.md
-4e48558c75fe443cb3023ede38f621c4bfe5d966c6861ab57dd47ce89954a46f  self-signed.md
+3104f197772642c968114ce553c1a2770bba671bcf9ae51e5d4751ba0e3905cc  self-signed.md
 4a642d38e1d4628e996990eae651e8c8d7325369793e7f06b8b7fc7f059464ae  cloudflare.md
 b76f678010dfbb1eda11cb17174c28a07ac28cfbee453c9bf16c5e72ac2eb38b  tailscale.md
 267a1cfb8144a162281e7ccf80f3d25464cceeb1459d387ae165e7924a91b9ea  tunnels.md
 6ccf37d64405e9d145a949c4d13faa411c95e4b68238cb1ed7c4d1338649b98b  authentication.md
-d5417d828cff8a2fc0da5bde3850ef2eb0b2e86c77e43000612c434b4f86dbcc  mfa.md
+571c8cb1a6f81d2ede38db4275bff7cc763f718f8b5ee96cde2a515e9cb458d2  mfa.md
 998211fa469d26e685293914ab164b3be8ef7d0826ea5353903c5704899e36b7  secrets.md
 67ead6128e8115fe289b11db4010b4fc046b44fbf797bb7d3ac6c52f4e4d4959  vault.md
 d18b415d444bcccc6ffdf29affcf52a7ed8798acd780897473f7c5db8866d8b1  identity-providers.md
@@ -25,7 +25,7 @@ e294462aeb6ce1498c97d8198598f79b3b8d7c0930fad5538e687587cf76887b  lighttpd.md
 c609d3d870923e9276f8f4485957e8f689894290b324fad2637fb6fea8810bf0  python.md
 d03313bfa0afb1e9a960c070516b5f5f1d328d7b41aba215b52619f328395138  docker.md
 1b8445e0dc25fb843829d1b2fdc2c67ee64b1e63b4a89b8518f1a994e722143f  kubernetes.md
-7c35f943796e0cfcba3c327a1c7c6e3dba385de4d90000a64ceaf09da81e5746  gitops-controllers.md
+2942a7e7a6d41996126e943a4f4ac1c9e31e34c99b9b8eaa7f472b21bb65e9cf  gitops-controllers.md
 4d831688e4658d37dd10f2729397f3d225fdac03d8861f20a850a8ffc9962662  self-hosted-ci-runners.md
 8821c15b9a8007190be74118d90f349d2e87790908fa4bcbc2d4d6ed874dd1fa  frontend-frameworks.md
 3cc39b499774d04e366810d1aedd7e9c88dcf2534040d81c021d270bf37c2fb4  container-hardening.md
@@ -35,12 +35,12 @@ dff5cfe166a59c4d384dd977fab5426b0c7c8bfb5b6125765c80d7a7c7ef1b88  dotnet.md
 483c9fe8e28df277628817218e8b295403be9eeedf376adbe377cfc2abd6c118  java.md
 f1bd449090c1f3c159d7d3d6a0b44d49c742c42d41b9a08fbed94937b2220255  php.md
 ad47380702f2c803e066c7d89bd2e2d311693f22493875ee93f285ec96ca2e15  ruby.md
-a7f51f22878598d67c63943bba9957231f5d5c2d99324994fdd6366d06b9a86d  host.md
+b48a443b180b2ee6dad39ddedb3ff83f6bfe8ee6125bc3efb6bd2767246f7c8e  host.md
 499ddd36b87b44ed676ab6647a26e689c6c0efe8cf3794dab9131709edf02111  cloud-firewalls.md
 860e20169175feda8cbce73ffdf164d77ca625cbb681713971397ac263290346  paas.md
 17091cd4ef3b1c9b8ea0be22fa019f07cf02e581b76d7b8506eba1bd959a052b  egress-metadata.md
 2aaa5a1425d394ebd6464a40555dd89a22a91ecd3354b9141d60cc7fa0dc8b6d  gpu-clouds.md
-d393dc7e920ff1649154d05910dbf2fb0c577d198a854495ecb8d089492ac191  deployment-lifecycle.md
+e2fa042ae3a9fa55dc8c3521630b7bad5799522484e74b38ce16039c96d5c3dd  deployment-lifecycle.md
 607338a9c1aa23484131619211818491966e30a064f2b7b2fe9a343af31918bf  postgresql.md
 da990e0ca7e7b950deb35fdd859677ef247db8f2aa8ca34330a857708f8830ca  connection-poolers.md
 80360a609312bb18f0f7a2740de2b003d996061721f8a964a9502141506e1e27  mysql.md

diff --git a/plugin/skills/secure-deployment-config/references/deployment-lifecycle.md b/plugin/skills/secure-deployment-config/references/deployment-lifecycle.md
@@ -197,7 +197,7 @@ Components (recorded basis):
 - nist: NIST digital identity guidelines (SP 800-63B-4)
 - ubuntu-nc: Ubuntu noble netcat-openbsd source (c047f1a4572e796c8643fb7e5a719a9d960a677b)
 - c9s-nmap: CentOS Stream 9 nmap packaging (17c2b7795d821cd7fbe311cf3f885be3ea1f122f)
-- busybox: BusyBox 1.36.1 (1_36_1)
+- busybox: BusyBox (1_36_1)
 - docker-notes: Docker Engine release notes (4e9a5751518ed8223a8dcde53693badddd72604f)
 - webui: Open WebUI (0a7c15832fb30b1903753e83f81dc7d27e5b0944)
 - certbot-v230: Certbot user guide and source (v2.3.0)
@@ -394,7 +394,7 @@ Claims (full source mapping in the JSON block below):
       }
     },
     "busybox": {
-      "name": "BusyBox 1.36.1",
+      "name": "BusyBox",
       "basis": "1_36_1",
       "sources": {
         "s34bdee292f79": "https://github.com/mirror/busybox/blob/1_36_1/networking/nc_bloaty.c#L61-L93",

diff --git a/plugin/skills/secure-deployment-config/references/gitops-controllers.md b/plugin/skills/secure-deployment-config/references/gitops-controllers.md
@@ -1,6 +1,6 @@
 # GitOps controllers: Argo CD and Flux
 
-Written against Argo CD v3.5.3 source (pinned to a commit), Flux OIDC introduction v2.9, Dex v2.45.1 source v2.45.1, Redis 8.2.3 source 8.2.3, and curl curl-8_14_1; 1 further source is pinned to a commit and 3 carry no recorded version. Metadata reviewed 2026-10-19; documentation checked September 2026. The guide records 50 claims, all reasoned from cited sources.
+Written against Argo CD v3.5.3 source (pinned to a commit), Flux OIDC introduction v2.9, Dex source v2.45.1, Redis source 8.2.3, and curl curl-8_14_1; 1 further source is pinned to a commit and 3 carry no recorded version. Metadata reviewed 2026-10-19; documentation checked September 2026. The guide records 50 claims, all reasoned from cited sources.
 
 A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
 
@@ -498,9 +498,9 @@ Components (recorded basis):
 - flux-oidc: Flux OIDC introduction (v2.9)
 - argo-docs: Argo CD documentation (unknown)
 - flux: Flux documentation (unknown)
-- dex: Dex v2.45.1 source (v2.45.1)
+- dex: Dex source (v2.45.1)
 - redis-image: docker-library-redis v8.2.3 source (bcbc692165ce2241e194035041c5b5e01d2e1a5f)
-- redis-source: Redis 8.2.3 source (8.2.3)
+- redis-source: Redis source (8.2.3)
 - curl: curl (curl-8_14_1)
 - python: Python documentation (unknown)
 
@@ -655,7 +655,7 @@ Claims (full source mapping in the JSON block below):
       }
     },
     "dex": {
-      "name": "Dex v2.45.1 source",
+      "name": "Dex source",
       "basis": "v2.45.1",
       "sources": {
         "s3b9512b79dea": "https://github.com/dexidp/dex/blob/v2.45.1/cmd/dex/serve.go#L151-L199",
@@ -673,7 +673,7 @@ Claims (full source mapping in the JSON block below):
       }
     },
     "redis-source": {
-      "name": "Redis 8.2.3 source",
+      "name": "Redis source",
       "basis": "8.2.3",
       "sources": {
         "s667fc16bf18f": "https://github.com/redis/redis/blob/8.2.3/src/server.h#L142-L143",