mirror of
https://github.com/MBombeck/HealthLog.git
synced 2026-11-08 20:42:43 +00:00
Marc-André Bombeck
576be8b746
Three things the write surface claimed but did not hold. Scope: the run bodies never re-checked ctx.canWrite. Enforcement was real but lived entirely in the registration decision, and the test asserted registration only — so a refactor that registered the write tools unconditionally and meant to refuse at call time would open the surface with the suite still green. Wrap every run body in a scope guard at the registry level, so a new write tool inherits it, and drive the run bodies directly from a read-only context in the test. Free text: medication names, doses, treatment classes and lab analyte names were interpolated into tool prose with no delimiter. A lab analyte name is transcribed out of an uploaded document, so a hostile document chooses it, and the write tools ride the same wire. Fence the assembled prose with the shared data-fence markers and scrub short result titles, which would leak markers into a host's result list. Confirm: the header called the confirm flag a PROTOCOL-LEVEL CONFIRM GATE. It is a client-asserted boolean with nothing binding it to a prior preview. Binding it to a server-issued preview token would prove only that a preview call happened, which any client can do, so it buys no human-in-the-loop for a round trip and server state the stateless transport does not want. Describe it as the convention it is and name what actually bounds the blast radius.