Edward Langley
95839fce43
CI / Build all bundles (push) Has been cancelled
CI / Test and lint (host) (push) Has been cancelled
CI / wasm32 check (browser bundle crates) (push) Has been cancelled
CI / Browser JS unit tests (node --test) (push) Has been cancelled
CI / Knowledge base consistency (push) Has been cancelled
CI / Lint the harness crate (push) Has been cancelled
CI / Browser harness (OPFS contract + shell) (push) Has been cancelled
CI / Deploy to GitHub Pages (push) Has been cancelled
Gotcha 49 records improvise-kc7n: a websocket handshake is exempt from the same-origin policy, so no network control can see cross-site hijacking — an IP allow-list, a private network and loopback binding all answer "may this client reach the endpoint" and the honest answer is yes. Loopback is the least protected case, not the safest. Records why all three arms are decided rather than defaulted, and that none of it is authentication. The File Inventory line counts were audited: 26 of 61 resolvable entries had drifted past 10%, several by a third. Refreshed, and relabelled as a dated snapshot with the method, because false precision in a carefully-checked document is worse than an obvious estimate. Two traps found while doing it, both recorded: a path-walking refresh resolves a bare name like lib.rs against the first matching crate and rewrites the wrong number, and the ws-server/ entries use a shorthand prefix no such walk resolves at all. The code-review skill's gate list now runs BOTH spellings of check-comment-runs.py. The flag selects rather than adds, so --check-evidence never runs the comment cap and does not say so; three separate agents hit it in one campaign (improvise-ijql). Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FC2jVn8Au7E9JPkw6bwXXH