One test walks every route the server registers and fails on any response without the security floor #10397

Adds test/security-sweep.test.ts: one test file that reads the route table from both routers (977 entries: 460 GET, 446 POST, 34 DELETE, 25 PUT, 12 PATCH) and runs three passes against one seeded server. The sweep found no response missing the floor, so src/http/respond.ts is unchanged.

• Anonymous, every registered (verb, route) once. It also asks /healthz, /readyz and an unknown studio path and API path. Every answer must carry Content-Security-Policy, X-Content-Type-Options and Referrer-Policy. The test asserts it actually met a 2xx, a 3xx, a 404, another 4xx and an event stream, so it can't pass on empty coverage. Mutations are sent from another origin carrying the seeded account's real username and password, and none may return a forge_session cookie, which catches login CSRF on any route. POST /signin and POST /api/v1/sessions already refuse this with a 403.
• A wrong verb on every API pattern. The answer must be a 405 with the floor, and its Allow header must equal apiRouter.allowed(path). A wrong verb on a studio path gets the not-found page; that is checked once, with PATCH /.
• Every mutating route, cross-origin, with a live session cookie. Each must answer 403 (the originGate refusal) and set no cookie, and afterwards the session must still be valid.

Every Set-Cookie seen in any pass must be HttpOnly. A real same-origin sign-in, through both the form and the API, must set forge_session HttpOnly.

Exception lists: each entry carries its reason, and the tests check the entries both ways.

• FLOOR_EXCEPTIONS is empty, because the probes and assets also leave through the one door (answered) that applies the floor.
• READABLE_COOKIES is empty.
• NO_405 names /api/v1, /api/v1/ and /metrics, which answer a wrong verb with 404 by design.

I checked that each guarantee is really tested: removing Referrer-Policy from securityFloor, short-circuiting originGate, and dropping HttpOnly from sessionCookie each turn tests red.

Timing — the "under 5 s" item is not enforced: the passes took about 3 s when the file ran alone, but about 5 s when run with the other fast-tier files. Most of that is the first render of each page module (cold 2.7 s, warm 1.1 s for the 460 GETs). Hard 5 s timeouts timed out in the batch run, so the timeouts are flake guards instead (6 s, 2 s, 2 s, 1 s), in line with the "count work, not a clock" principle. What keeps the cost in check is the shape: one request per (verb, route) per pass.

Not done: the anonymous pass fills only the owner, repository, username and issue number from the seed; other parameters get a placeholder, so those routes answer their miss. Deeper GET filling, signed in and out, stays in test/security-floor-routes.test.ts, which this doesn't replace. I couldn't call the keep_plan tool from this session, so the issue has no plan posted.

Try it: bun test test/security-sweep.test.ts. bun scripts/gate.ts, bun x tsc --noEmit and the 18 files scripts/fast.ts names (219 tests) pass.

🤖 Generated with Claude Code

Closes #10386

Adds test/security-sweep.test.ts: one test file that reads the route table from both routers (977 entries: 460 GET, 446 POST, 34 DELETE, 25 PUT, 12 PATCH) and runs three passes against one seeded server. The sweep found no response missing the floor, so src/http/respond.ts is unchanged.

• Anonymous, every registered (verb, route) once. It also asks /healthz, /readyz and an unknown studio path and API path. Every answer must carry Content-Security-Policy, X-Content-Type-Options and Referrer-Policy. The test asserts it actually met a 2xx, a 3xx, a 404, another 4xx and an event stream, so it can't pass on empty coverage. Mutations are sent from another origin carrying the seeded account's real username and password, and none may return a forge_session cookie, which catches login CSRF on any route. POST /signin and POST /api/v1/sessions already refuse this with a 403.
• A wrong verb on every API pattern. The answer must be a 405 with the floor, and its Allow header must equal apiRouter.allowed(path). A wrong verb on a studio path gets the not-found page; that is checked once, with PATCH /.
• Every mutating route, cross-origin, with a live session cookie. Each must answer 403 (the originGate refusal) and set no cookie, and afterwards the session must still be valid.

Every Set-Cookie seen in any pass must be HttpOnly. A real same-origin sign-in, through both the form and the API, must set forge_session HttpOnly.

Exception lists: each entry carries its reason, and the tests check the entries both ways.

• FLOOR_EXCEPTIONS is empty, because the probes and assets also leave through the one door (answered) that applies the floor.
• READABLE_COOKIES is empty.
• NO_405 names /api/v1, /api/v1/ and /metrics, which answer a wrong verb with 404 by design.

I checked that each guarantee is really tested: removing Referrer-Policy from securityFloor, short-circuiting originGate, and dropping HttpOnly from sessionCookie each turn tests red.

Timing — the "under 5 s" item is not enforced: the passes took about 3 s when the file ran alone, but about 5 s when run with the other fast-tier files. Most of that is the first render of each page module (cold 2.7 s, warm 1.1 s for the 460 GETs). Hard 5 s timeouts timed out in the batch run, so the timeouts are flake guards instead (6 s, 2 s, 2 s, 1 s), in line with the "count work, not a clock" principle. What keeps the cost in check is the shape: one request per (verb, route) per pass.

Not done: the anonymous pass fills only the owner, repository, username and issue number from the seed; other parameters get a placeholder, so those routes answer their miss. Deeper GET filling, signed in and out, stays in test/security-floor-routes.test.ts, which this doesn't replace. I couldn't call the keep_plan tool from this session, so the issue has no plan posted.

Try it: bun test test/security-sweep.test.ts. bun scripts/gate.ts, bun x tsc --noEmit and the 18 files scripts/fast.ts names (219 tests) pass.

🤖 Generated with Claude Code

Left #10386 open: 1 unticked item remain (The sweep runs under 5 s.).