-
Let a plain form log in
-
Exorcise sweep: strip AI tells from server copy, comments, and docs
-
server: adopt lint block, fix clippy, fmt
-
Format the tree with rustfmt and add the lint + supply-chain gates
-
Bump rand to 0.10 across MNW crates
-
cleanups: drop the last db .expect, fix csrf phantom race comment, instrument custom-page write (audit Run 20 Phase 5)
-
ux: seal cookie-auth mutations to the CsrfRouter, at-rule + XSS tests
-
security: seal git-push CSRF, close 7z/RAR polyglot evasion, exhaustive sanitizer allowlists
-
ux: field-error highlighting, csrf guards, dead-code + doc cleanup (ultra-fuzz Run 4, A+)
-
Close CHRONIC A': posture-independent CSRF origin gate + drop pre-auth skip
-
Add whole-router CSRF coverage manifest + tracker tests