Claus Lohmar 92344d9783 docs(spec): revise D-025 to a tunnel-only setup gate and add D-043 ... The app is deployed behind Zoraxy (myday.sechpoint.app) with TLS terminated at the proxy, so it must listen on 0.0.0.0:8080 over HTTP — a bind refusal is impossible. - SPEC-003 §4/§6/§7/§9: the bind refusal is gone; in setup mode the door serves only a request whose TCP peer is loopback AND which carries no X-Forwarded-For (the direct SSH tunnel), else 404 (AC-7/AC-10); the proxy's X-Forwarded-Proto drives Secure + __Host- cookies and HSTS (AC-13). - SPEC-005 §3/§5/§6: AC-2 becomes the per-request tunnel-only gate; any bind is allowed. - review-001: record the Architect's rulings and the adopted strict gate.		2026-10-15 05:40:30 +00:00
..
review-001-m0.md	docs(spec): revise D-025 to a tunnel-only setup gate and add D-043	2026-10-15 05:40:30 +00:00