Backtalk6858 97a06261b6 note: next session — fix allowlist.json ownership + no-sync policy ...

allowlist.json must be root-owned so POST /allowlist is the only write
path; direct file edit bypasses audit log and danger veto. No cross-
bridge sync — allowlists grow organically per server.

2026-06-22 20:58:03 -05:00

..

.claude

note: next session — fix allowlist.json ownership + no-sync policy

2026-06-22 20:58:03 -05:00