[
  {
    "name": "M01-auth-before-proof",
    "path": "packages/webui/src/serve.mjs",
    "before": "    // The proof precedes every auth-header read, including the wrong-Host fence.",
    "after": "    if (named && req.headersDistinct[preview.header]?.[0] !== preview.user) return json(res, 401, { error: 'sign-in required' });\n    // The proof precedes every auth-header read, including the wrong-Host fence.",
    "test": "packages/webui/tests/proof.test.mjs",
    "pattern": "refuses missing wrong short",
    "check": "proof refusal precedes auth"
  },
  {
    "name": "M02-wrong-equal-length",
    "path": "packages/webui/src/serve.mjs",
    "before": " || !timingSafeEqual(value, proof.value)",
    "after": "",
    "test": "packages/webui/tests/proof.test.mjs",
    "pattern": "refuses missing wrong short",
    "check": "same-length incorrect proof refuses"
  },
  {
    "name": "M03-missing-proof",
    "path": "packages/webui/src/serve.mjs",
    "before": "if (!value || value.length !== proof.value.length || !timingSafeEqual(value, proof.value))",
    "after": "if (value && (value.length !== proof.value.length || !timingSafeEqual(value, proof.value)))",
    "test": "packages/webui/tests/proof.test.mjs",
    "pattern": "refuses missing wrong short",
    "check": "absent proof refuses"
  },
  {
    "name": "M04-loopback-proof",
    "path": "packages/webui/src/serve.mjs",
    "before": "if (!named && values) return json",
    "after": "if (false) return json",
    "test": "packages/webui/tests/proof.test.mjs",
    "pattern": "header is refused on other Hosts",
    "check": "proof on nonpublic Host refuses"
  },
  {
    "name": "M05-mode-0644",
    "path": "packages/webui/src/serve.mjs",
    "before": "[0o600, 0o400].includes(st.mode & 0o7777)",
    "after": "[0o600, 0o400, 0o644].includes(st.mode & 0o7777)",
    "test": "packages/webui/tests/proof-cli.test.mjs",
    "pattern": "startup refuses",
    "check": "0644 file refused"
  },
  {
    "name": "M06-log-refusal",
    "path": "packages/webui/src/serve.mjs",
    "before": "return json(res, 401, { error: 'proxy proof required' });",
    "after": "log(proof.value.toString('ascii')); return json(res, 401, { error: 'proxy proof required' });",
    "test": "packages/webui/tests/proof.test.mjs",
    "pattern": "refuses missing wrong short",
    "check": "refusal log never includes proof"
  },
  {
    "name": "M07-no-follow",
    "path": "packages/webui/src/serve.mjs",
    "before": " | constants.O_NOFOLLOW",
    "after": "",
    "test": "packages/webui/tests/proof-cli.test.mjs",
    "pattern": "startup refuses",
    "check": "fixture symlink refused"
  },
  {
    "name": "M08-owner",
    "path": "packages/webui/src/serve.mjs",
    "before": " || st.uid !== process.getuid()",
    "after": "",
    "test": "packages/webui/tests/proof-cli.test.mjs",
    "pattern": "startup refuses",
    "check": "another uid refused"
  },
  {
    "name": "M09-line-bytes",
    "path": "packages/webui/src/serve.mjs",
    "before": "line.length < 32 || /[^A-Za-z0-9_-]/.test(line)",
    "after": "false",
    "test": "packages/webui/tests/proof-cli.test.mjs",
    "pattern": "startup refuses",
    "check": "short/newline/bad-byte file refused"
  },
  {
    "name": "M10-duplicate-proof",
    "path": "packages/webui/src/serve.mjs",
    "before": "values?.length === 1 ? Buffer.from(values[0], 'utf8') : null",
    "after": "values?.length ? Buffer.from(values[0], 'utf8') : null",
    "test": "packages/webui/tests/proof.test.mjs",
    "pattern": "refuses missing wrong short",
    "check": "duplicate header refused"
  },
  {
    "name": "M11-tester-proof",
    "path": "packages/webui/src/serve.mjs",
    "before": "if (tester && testerProofHeader && Object.hasOwn(req.headers, testerProofHeader.toLowerCase()))",
    "after": "if (false)",
    "test": "packages/webui/tests/proof.test.mjs",
    "pattern": "header is refused on other Hosts",
    "check": "tester proof header refused"
  },
  {
    "name": "M12-main-wiring",
    "path": "packages/webui/src/cli.mjs",
    "before": "preview: options.preview, proof, send,",
    "after": "preview: options.preview, send,",
    "test": "packages/webui/tests/proof-cli.test.mjs",
    "pattern": "CLI applies proof",
    "check": "actual CLI main listener checks proof"
  },
  {
    "name": "M13-tester-wiring",
    "path": "packages/webui/src/cli.mjs",
    "before": "testerProofHeader: proof?.header ?? null,",
    "after": "",
    "test": "packages/webui/tests/proof-cli.test.mjs",
    "pattern": "CLI applies proof",
    "check": "actual CLI tester rejects proof header"
  },
  {
    "name": "M14-service-location",
    "path": "scripts/webui-service.sh",
    "before": "case \"$proof_path\" in \"$REPO\"|\"$REPO\"/*|\"$copies_path\"|\"$copies_path\"/*) die \"proxy proof file must be outside the repository and copies\" ;; esac",
    "after": ":",
    "test": "packages/webui/tests/service.test.mjs",
    "pattern": "proxy proof render refuses",
    "check": "render refuses repository/copy path"
  },
  {
    "name": "M15-service-propagation",
    "path": "scripts/webui-service.sh",
    "before": "flags=\"$flags --proof-header $PROOF_HEADER --proof-file $PROOF_FILE\"",
    "after": ":",
    "test": "packages/webui/tests/service.test.mjs",
    "pattern": "proxy proof render carries",
    "check": "render carries both flags"
  },
  {
    "name": "M16-release-preservation",
    "path": "scripts/stack-release.sh",
    "before": "    RUN_CONSOLE=(\"${P_CONSOLE[@]}\")",
    "after": "    RUN_CONSOLE=(\"${P_CONSOLE[@]:0:4}\")",
    "test": "packages/cli/tests/stack-release.test.mjs",
    "pattern": "T178 proxy proof header",
    "check": "pointer/unit preserve pair through re-pin and rollback"
  },
  {
    "name": "M17-render-no-open",
    "path": "scripts/webui-service.sh",
    "before": "        proof_mode=\"$(stat -c '%a' -- \"$PROOF_FILE\")\"",
    "after": "        cat -- \"$PROOF_FILE\" >/dev/null\n        proof_mode=\"$(stat -c '%a' -- \"$PROOF_FILE\")\"",
    "test": "render-no-open.py",
    "pattern": "",
    "check": "render never opens or reads the fixture",
    "command": [
      "python3",
      "/mnt/storage/src/mosaic-stack/agents/rocko/work/queue-178/render-no-open.py"
    ]
  },
  {
    "name": "M18-proof-send-status",
    "path": "scripts/webui-service.sh",
    "before": "( --proof-header [^ ]+ --proof-file /[^ ]+)?",
    "after": "",
    "test": "packages/webui/tests/service.test.mjs",
    "pattern": "proxy proof status",
    "check": "proof flags retain send-on status"
  }
]