jedarden 116464fe30 feat(security): tighten ingest trust boundary and add invariant tests ... - Remove CORS headers and OPTIONS preflight from daemon - CORS was enabling cross-origin browser POSTs to loopback endpoint - No legitimate consumer is a browser (emitter uses curl, TUI uses Go http) Add invariant test script test-invariants.sh: - Daemon listens on 127.0.0.1 only (loopback-only binding) - No synthesized input: verify no tmux send-keys in daemon sources - OPTIONS preflight is no longer honored (returns 404) Validates trust boundary specified in docs/plan/plan.md section 'Failure modes & invariants'. Co-Authored-By: Claude <noreply@anthropic.com>		2026-07-02 09:03:55 -04:00
..
claude-adapter.ts	feat(trail-boss): commit phase 3 daemon code (previously untracked)	2026-05-25 22:57:51 -04:00
db.ts	feat(reconcile): implement stuck-direction reconcile for dropped Stop events	2026-07-02 08:45:26 -04:00
index.ts	feat(security): tighten ingest trust boundary and add invariant tests	2026-07-02 09:03:55 -04:00
reconcile.ts	feat(reconcile): implement stuck-direction reconcile for dropped Stop events	2026-07-02 08:45:26 -04:00
schema.sql	feat(trail-boss): commit phase 3 daemon code (previously untracked)	2026-05-25 22:57:51 -04:00
types.ts	feat(trail-boss): commit phase 3 daemon code (previously untracked)	2026-05-25 22:57:51 -04:00