rcourtman ee67141fa2 Add MSP isolation E2E spec: token scoping, split-port ingest, signed webhook delivery ... Automates the docs/MSP.md validation checklist and the WEBHOOKS.md delivery contract against the real server, covering the cross-layer seams unit tests cannot see (today's two isolation bugs both lived there): - org-bound token allowed in its own org, denied 403 in sibling orgs AND the default org (leaked client-site token must not read the provider estate) - dedicated agent-ingest port serves only /api/agents/* (management paths 404, agent route auth-gated) - client-org webhook delivery through the instance-wide private-target allowlist saved in default-org context, with HMAC signature verified against the documented recipe, X-Pulse-Event-ID idempotency header, and tenant id/name stamped in the payload - restart inheritance: after docker restart the persisted allowlist still applies to lazily recreated tenant monitors (skips when the docker CLI cannot manage the container) Compose: pulse-test gains PULSE_AGENT_INGEST_PORT=7656 (+ port map) and a host-gateway extra_host so the spec's capture listener is reachable from the container.		2026-06-10 12:06:35 +01:00
..
integration	Add MSP isolation E2E spec: token scoping, split-port ingest, signed webhook delivery	2026-06-10 12:06:35 +01:00
migration	Clear all errcheck and gofmt violations so make lint gates on real findings	2026-06-09 21:42:21 +01:00