-
server: replace global CSRF allowlist with per-route posture helpers
-
R27-UX-M3: AppError::Validation now carries per-field errors
-
Per-repo HMAC for build hooks, pinned SSH keys, archive scan opt
-
Audit Run 16: type safety, performance, dedup, testing (A- -> A)
-
Security hardening: code fuzz round 3 fixes
-
Restructure into monorepo