Harden stamp/verify/hash_report so unknown and content-shaped args fail instead of being ignored; publish additionalProperties=false and cover with schema/runtime tests. Also keep streamable-http host allowlist.
112 B
112 B
Done and not done
Done: guard.py, server harden, tests, pytest 19 passed. Not done: WASM client, git commit.