Epic A — State Security & Integrity · Milestone: 0.6.0b · See claudedocs/dev_plan_production_grade_2026-06-24.md
The top credibility/security gap: server state round-trips to the client unsigned .
A1 Sign serialized state (HMAC) with configurable secret; verify inbound, reject tampered (CorruptStateError) — enabler — landed via feat(core): HMAC-sign client-carried state (A1, #21) #35 docs/STATE_SIGNING.mdA2 Key management + rotation; document STATE_SIGNING_KEY per adapter — landed alongside A1 in feat(core): HMAC-sign client-carried state (A1, #21) #35 docs/STATE_SIGNING.md ("Per-adapter setup", "Key rotation procedure")A3 Locked/immutable server-trusted fields — landed via feat(core): locked server-trusted state fields (A3, #21) #37 docs/LOCKED_FIELDS.mdA4 Audit CSRF coverage across FastAPI/Litestar/Flask HTTP paths; document; note WS CSRF limitation — landed via docs(security): CSRF/CSWSH coverage audit + per-adapter guidance (A4, #21) #36 docs/SECURITY_CSRF.md
Critical path: A1 is the security gate. Land early.
Status: complete. All four items shipped and documented; closing.
Epic A — State Security & Integrity · Milestone: 0.6.0b · See
claudedocs/dev_plan_production_grade_2026-06-24.mdThe top credibility/security gap: server state round-trips to the client unsigned.
CorruptStateError) — enabler — landed via feat(core): HMAC-sign client-carried state (A1, #21) #35, seedocs/STATE_SIGNING.mdSTATE_SIGNING_KEYper adapter — landed alongside A1 in feat(core): HMAC-sign client-carried state (A1, #21) #35, seedocs/STATE_SIGNING.md("Per-adapter setup", "Key rotation procedure")Locked/immutable server-trusted fields — landed via feat(core): locked server-trusted state fields (A3, #21) #37, seedocs/LOCKED_FIELDS.mddocs/SECURITY_CSRF.mdCritical path: A1 is the security gate. Land early.
Status: complete. All four items shipped and documented; closing.