4 Commits

Author	SHA1	Message	Date
Dobromir Popov	c967e5cfc4	test	2026-07-05 00:33:02 +02:00
Dobromir Popov	81719ed84b	feat(tracker): unified auth boundary — gossip HMAC + validator token + admin-gated reads (alpha 01/02/20, ADR-0017) ... Wire server.py handlers to the auth helper: forfeit requires validator service token or admin session (client API keys rejected); billing summary/ settlements/registry-wallets and benchmark endpoints require admin/service; the three gossip mutation endpoints require a fresh hive HMAC signature and outgoing gossip pushes are signed. Dashboard sends its session token on panel fetches. Existing tests updated for the new gates. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-05 00:08:25 +02:00
Dobromir Popov	69b0e726b8	tasks	2026-07-04 23:02:54 +02:00
D.Popov	68e057209c	Add alpha-hardening ADRs and issue plan from pre-release audit. ... Lock alpha scope, tracker auth, TOPLOC fraud verification, and deferred multi-tracker money-path work; supersede legacy fraud issues with ADR-0018. Co-authored-by: Cursor <cursoragent@cursor.com>	2026-07-04 23:12:09 +03:00