Grant Whitmer 85fa65a52b canary: continuously verify the forged-token bypass stays closed ...

Adds must_refuse checks: a 2xx is the alarm, a 401/403/503 is health. The
forged alg:none agent token is probed every 10 min; if it ever returns 2xx the
canary goes red and pages. Proven both ways — 503 reads ok, a 200 endpoint
alarms 'ACCEPTED — this MUST be refused'. The security property is now enforced
by a running check, not assumed.

Co-Authored-By: Claude (Fable 5) <noreply@anthropic.com>

2026-08-13 22:52:56 -04:00

..

backup.sh

G0.9: nightly backup — the prerequisite for becoming the daily driver

2026-08-12 21:47:46 -04:00

canary.py

canary: continuously verify the forged-token bypass stays closed

2026-08-13 22:52:56 -04:00

import_from_github.py

fix: the --all-as-mirrors flag itself was never added

2026-08-12 22:43:22 -04:00

sync_from_github.sh

URGENT FIX: reverse the sync — GitHub is the source of truth, not Windy Git

2026-08-12 22:11:34 -04:00

vocab_audit.py

G0: cell substrate — invariants made executable

2026-08-11 14:19:28 -04:00