Intent: same-origin checks on every mutation are proven, not assumed.
Done looks like:
[ ] A test enumerates the registered POST/PUT/PATCH/DELETE routes from the router, sends each with a foreign Origin and a session cookie, and expects a 403 (or 401 for token-only API doors, named in an allowlist with the reason).
[ ] A new mutating route absent from the allowlist and lacking the check fails the test.
[ ] Any route found open is fixed in the same pull with its own test.
[ ] The test runs under the per-file budget (one forge, routes built once).
Files I expect to change: test/origin-all-routes.test.ts (new); src/http/* only for a route the test finds open (avoid editing scripts/gate.ts: the gate finds tests itself)
Risks: a route needing fixtures to reach its check; use the 403 before body parsing as the assertion.
Suggested brief: sentinel (a person assigns). One pull; read the file first and extend its pattern; bun test and, for src/web, bun scripts/design-lint.ts pass before the push. Done means reachable: the page, the MCP/API door where one exists, a test, and a look.
Intent: same-origin checks on every mutation are proven, not assumed.
Done looks like:
Files I expect to change: test/origin-all-routes.test.ts (new); src/http/* only for a route the test finds open (avoid editing scripts/gate.ts: the gate finds tests itself)
Risks: a route needing fixtures to reach its check; use the 403 before body parsing as the assertion.
Suggested brief: sentinel (a person assigns). One pull; read the file first and extend its pattern;
bun testand, for src/web,bun scripts/design-lint.tspass before the push. Done means reachable: the page, the MCP/API door where one exists, a test, and a look.