mix 158b5323d3 docs: open-questions backlog for v1.0 (attention & discussion) ...

Capture conscious tradeoffs and hardening candidates that go beyond the
mandatory 7.6 requirements: reverse-proxy rate-limit keying, missing
security response headers, CSRF/SameSite stance, __Host- cookie prefix,
session/ops notes, and the gap that CI does not run go test. None are
compliance defects; each is a decide-later item.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-07-15 21:49:15 +03:00

..

implementation-plan.md

docs: open-questions backlog for v1.0 (attention & discussion)

2026-07-15 21:49:15 +03:00

progress.md

Phase 11: final security pass + acceptance (spec 7.6, 12.2-3)

2026-07-15 21:42:27 +03:00

specification.md

docs: specify CI image build and ghcr.io publishing

2026-07-11 21:45:04 +03:00