A5 wrote the initial PR description before the A2 security fixes
landed, so it cited 294 tests / 9 commits and listed several now-fixed
items as follow-ups. Updated:
- 294 -> 302 tests (8 new SSRF guard tests in safe-fetch.test.ts)
- 40 -> 41 test files
- 9 -> 20 commits with the actual Phase 5-10 series listed
- Security-notes section: document safeFetch + shared apiGraphSchema
wiring on both POST and PUT; remove "tracked follow-up" for
save_scene URL validation (done); add "tracked follow-up" keeps
same-id write race + auth layer
- Checklist: flip two items from [ ] to [x] for URL validation and
SSRF protection
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
