- POST: WR-01 cap (MAX_GUIDANCE_BODY_CHARS 8192, pre/post-read double check),
hand-rolled snapshot validation (slug destinationId, bounded name, finite
metrics, integer startedAtSec, polyline6 geometry >= 2 points via
decodePolyline6) -> mintGuidanceSession with the CLAIM's chat_id — a body
chat_id is structurally ignored (T-06-02 injection probe GW4)
- GET/DELETE: resolve then OWN — envelope.chat_id === claim.chat_id else 404,
foreign and absent indistinguishable (T-06-02b); DELETE actively removes
the record (D-14's server half); non-POST/GET/DELETE -> 405
- category-only logging: [guidance] rejected: unauthorized|malformed —
literal strings, no interpolation of body/claim values (D-14)
- RP2 re-pin ships WITH the change (gate re-pin law): the total
@araharah/routing ban becomes an explicit allowlist — exactly the
polyline6 codec may enter the Worker (geometry validation); the routing
stack stays web-side; RP1 unchanged
- bot/package.json + lock: @araharah/routing workspace dep
- RP1: zero /api/route + registerRoute/routeProxy tokens in comment-stripped
bot/src — the Worker gains no route endpoint, even accidentally (T-05-16)
- RP2: zero @araharah/routing specifiers in bot/src — routing lives in the
webview bundle only; the Worker imports only @araharah/search
- scans grow with the bot/src tree automatically (the PG-gate pattern)
- TDD note: gates target an already-clean tree, so the RED run is a teeth
proof — a planted violating file fails both gates; removed, both pass
(74/0 bot suite green)
araharah-executor