Repository files (latest commit first)

Filename	Latest commit message	Latest commit date
Heimdall c757acf525 Make every cookie host-only: __Host- names, Secure, Path=/, no Domain ... Session, OAuth correlation, antiforgery, voter and Heimdall attempt cookies all take the __Host- prefix. The prefix forbids a narrower Path, so the voter (was /mill) and attempt (was /auth/heimdall) cookies move to Path=/. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>		2026-11-07 18:42:43 +00:00
..
CastRequestGuard.cs	Vote page: explicit no-store (the antiforgery write no longer supplies it), handler must match the request, empty Origin counts as present	2026-10-11 00:15:13 +02:00
ConceptAppraisalService.cs	Concept subject registry and concepts plan|apply host command	2026-10-10 19:58:04 +02:00
ConceptCommand.cs	Registry: typed refusals for every input failure; strict manifest reader; retire rerun converges	2026-10-10 23:01:40 +02:00
ConceptKey.cs	Concept subject registry and concepts plan|apply host command	2026-10-10 19:58:04 +02:00
ConceptSubjectRegistry.cs	Registry: typed refusals for every input failure; strict manifest reader; retire rerun converges	2026-10-10 23:01:40 +02:00
ConceptTallyExport.cs	Tally export Vary: plain append, no dedupe	2026-10-10 22:19:52 +02:00
ConceptVoteRateLimits.cs	Vote budgets: at the cap a new key evicts the least recently used key with permits left	2026-10-11 19:16:30 +02:00
NetworkPrefix.cs	Startup validation: tag secret minimum length and prefix lengths inside the address family, naming keys not values	2026-10-10 09:56:34 +02:00
VoterIdentity.cs	VoterIdentity: anchor the device id grammar at \z so a trailing newline or control char is no second identity	2026-10-10 09:55:26 +02:00
VoterKeyResolver.cs	Make every cookie host-only: __Host- names, Secure, Path=/, no Domain	2026-11-07 18:42:43 +00:00