> ENFORCED PROTOCOLS

• Strict Allowlist Validation: Values that control behaviour are checked against exact allowlists - not stripped of markup - and every value is escaped where it is rendered.
• Symmetric Key Exchange: Exchanges and enforces secret tokens to prevent cross-domain 401 Spoofing.
• End-to-End Encryption: Zero-knowledge storage. Private keys never leave the browser.
• Rate Limiting: Protects endpoints against signal flooding (Max 5 req/min).
• Symmetrical Firewall: Only accepts signals from nodes listed in your Star Chart.
• Anti-Brute Force: Freezes console access for 15 minutes after 5 failed login attempts.
• Strict SSL Enforcement: Blocks unencrypted HTTP requests to prevent MitM attacks.
• CSRF-Protected Actions: Every state-changing action requires a POST with a per-session token. Destructive controls can no longer be fired by a stray link or an image tag on a third-party page.
• SSRF Containment: Outbound node requests must be HTTPS on a standard port and resolve only to publicly routable addresses. Loopback, private, link-local and cloud-metadata targets are refused, and the validated address is pinned so DNS cannot be re-pointed mid-request.
• Verified TLS Everywhere: Certificate and hostname verification is enforced on every outbound request, with redirects not followed.
• Hardened Sessions: Session identifiers are rotated on login, cookies are Secure, HttpOnly and SameSite=Strict, and both idle and absolute lifetimes apply.
• Core Memory Shielded: The SQLite core, its write-ahead logs, dotfiles and the deployment-local directory are all denied over HTTP.
• Spoof-Resistant Limits: Client identity comes from the TCP peer address, not from headers a caller can set - so the brute-force lockout and the rate limiters cannot be rotated around.
• Audited Media Pipeline: Uploads are size-capped and typed from their own contents, so the file written to disk never takes its type from the name the sender supplied.

> Auth Perimeter (single guard): ACTIVE
> CSRF Token Enforcement: ACTIVE
> POST-Only State Changes: ACTIVE
> SSRF Containment: ACTIVE
> TLS Certificate Verification: ACTIVE
> Session Rotation On Login: ACTIVE
> Secure / HttpOnly / SameSite Cookies: ACTIVE
> Core Memory HTTP Denial: ACTIVE
> Spoof-Resistant Client Identity: ACTIVE
> Rate Limiting (inbox / handshake): ACTIVE
> Media Type Sniffing: ACTIVE
> PDO Error Suppression: ACTIVE
> Zero Third-Party Requests: ACTIVE
> Symmetric Key Exchange: ACTIVE
> Tactical Signal Resonance: ACTIVE
> The Anti-Loop Shield: ACTIVE
> Cascading Chain-Purge Protocol: ACTIVE
> Local Memory Vault: ACTIVE
> Anti-Collision Engine: ACTIVE
> The Oracle Sentinel: ACTIVE
> The Nomadic Re-Sync Protocol: ACTIVE
> The Lighthouse Protocol: OPT-IN
> Anti-Brute Force Radar Lock: ACTIVE
> Strict SSL Enforcement: ACTIVE
> E2E Quantum Encryption: ACTIVE
> Private Bunker Node Mode: ACTIVE