fix(security): enforce audited account, network and resource boundaries

Implement B01-B06 with regression coverage and retained validation evidence. Preserve the production ingress preflight; F04 runtime verification remains open.
2026-09-09 18:21:47 +02:00
parent 7d641edc7b
commit 0954876295
116 changed files with 10101 additions and 122 deletions
@@ -0,0 +1,9 @@
+{
+  "ticket": "B02",
+  "date": "2026-09-08",
+  "scenario": "Retain A profile request, logout, sign in as B, submit with B cookies/fresh CSRF and retained request context",
+  "before": { "status": 200, "a": "Private A", "b": "A draft must never enter B" },
+  "after": { "status": 409, "a": "Private A", "b": "Private B" },
+  "fixtures": "Permanent Playwright API tests against actual API, Identity/session checks and isolated SQLite; synthetic accounts only",
+  "historicalEvidenceUnchanged": ["probes.mjs", "evidence/observations.json"]
+}