-
Exorcise sweep: strip AI tells from server copy, comments, and docs
-
server: adopt lint block, fix clippy, fmt
-
Format the tree with rustfmt and add the lint + supply-chain gates
-
Bump rand to 0.10 across MNW crates
-
cleanups: drop the last db .expect, fix csrf phantom race comment, instrument custom-page write (audit Run 20 Phase 5)
-
ux: seal cookie-auth mutations to the CsrfRouter, at-rule + XSS tests
-
security: seal git-push CSRF, close 7z/RAR polyglot evasion, exhaustive sanitizer allowlists
-
ux: field-error highlighting, csrf guards, dead-code + doc cleanup (ultra-fuzz Run 4, A+)
-
Close CHRONIC A': posture-independent CSRF origin gate + drop pre-auth skip
-
Add whole-router CSRF coverage manifest + tracker tests
-
server: close Ultra Fuzz Run #4 phases 1-5 + 41-test integration triage
-
server: replace global CSRF allowlist with per-route posture helpers
-
Run 27 carry-over: 6 SERIOUS + 6 MEDIUM remediated
-
Ultra Fuzz Run 27: 32 of 33 audit items remediated
-
Convert .map_err Internal(anyhow!) to ResultExt::context, fix variant misuse