src/http/run_gate.ts allow-lists what a run token reaches; a route added tomorrow must stay closed. test/run-token.test.ts covers the repository and its parent; this pins the closed side as a table.
Done:
[ ] One table in test/run-gate-doors.test.ts (or extend run-token.test.ts): with a run token, /api/v1/user, the token and secret routes, /api/v1/admin/*, /mcp, a web page, the owner's other private repository and the crew member's own repository each answer 404 not_found, the same as an unseen repository.
[ ] A GET of the parent repository works; a POST, PATCH or DELETE under the parent is 404 and writes nothing.
[ ] here, search, explore and openapi.json answer, and search names nothing from outside the two repositories.
Files: a test only.
Before pushing: bun x tsc --noEmit and the tests you add or touch; bun scripts/design-lint.ts if src/web/ changes. Small and single-purpose; tests never read the wall clock — pass now in.
src/http/run_gate.ts allow-lists what a run token reaches; a route added tomorrow must stay closed. test/run-token.test.ts covers the repository and its parent; this pins the closed side as a table.
Done:
/api/v1/user, the token and secret routes,/api/v1/admin/*,/mcp, a web page, the owner's other private repository and the crew member's own repository each answer 404not_found, the same as an unseen repository.here,search,exploreandopenapi.jsonanswer, andsearchnames nothing from outside the two repositories.Files: a test only.
Before pushing:
bun x tsc --noEmitand the tests you add or touch;bun scripts/design-lint.tsif src/web/ changes. Small and single-purpose; tests never read the wall clock — passnowin.