Codeman maintainer 0a8ab84ea1 docs(local-model): name every covered launch path, both install executors, and the port without a login ...

The runner header says what each caller passes (the job: the compiled stock
command; the route: the merged entry, behind cliManagementEnabled).
docs/cli-registry.md names both executors in its trust boundary. The
security architecture gains a section on the pinned runtime and its hash,
the loopback port without a login and the digest check, and the install
path without cliManagementEnabled; SECURITY.md lists the port as a known
limitation. The guides and the rules name exactly the paths the launch
guard covers, the session that keeps calling a stopped runtime's port, the
claim before the connect writes, and the outcome kept in memory.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

2026-11-06 23:55:02 +01:00

..

workflows

ci(release): turn the GitHub release body into a readable page

2026-11-06 13:11:22 +01:00

CONTRIBUTING.md

test(guard): no legacy list left; flag raw listeners on a fixed port (#440)

2026-10-09 16:29:02 +02:00

SECURITY.md

docs(local-model): name every covered launch path, both install executors, and the port without a login

2026-11-06 23:55:02 +01:00