security/fix: phase7 hardening — auth, authz, error kinds, file safety, frontend & quality#30

Merged

screenleon merged 6 commits into

mainfrom

review/phase7-hardening

Apr 28, 2026

Commits on Apr 28, 2026

security: harden auth layer — JSON injection fix, Strict cookie, security headers

screenleon
and
claude
committed
security: close authz gaps — project/task membership enforcement + repo path validation

screenleon
and
claude
committed
fix: accurate dispatch error kinds — FailDispatchTask errorKind param + constant usage

screenleon
and
claude
committed
fix(frontend): stale-flash fix, phase label fallback, remove dead badge component

screenleon
and
claude
committed
fix(backend): quality — flush timeout, reportPhase nil-safe helper, const dedup, doc fix

screenleon
and
claude
committed
fix(authz): allow nil-user requests; add pre-push CI gate

screenleon
and
claude
committed