state.NewForTest, state.NewForTestWithDataDir and watcher.NewForTest
were in ordinary source files, so they were built into the binary.
NewForTestWithDataDir and watcher.NewForTest now live in their
package's export_test.go. Tests in other packages cannot see those
files, so the watcher and middleware tests build their State with
state.New and a temporary data directory; the watcher tests no longer
try to save to /state.json. state.NewForTest, whose State saved to /,
is deleted: the state tests that used it pass t.TempDir() to
NewForTestWithDataDir, and the test of the helper itself is gone.
Model: opus-5-5
Adds a SecurityHeaders middleware and registers it globally, right after the request ID middleware, so every route gets the headers, including static files, /metrics and error responses.
It sets Strict-Transport-Security (one year, includeSubDomains), a Content-Security-Policy with default-src 'self', no scripts and frame-ancestors 'none', X-Frame-Options DENY, X-Content-Type-Options nosniff, Referrer-Policy no-referrer and a Permissions-Policy that turns every listed feature off.
HSTS is sent on every response, not only over TLS: the service runs behind a TLS-terminating proxy and REPO_POLICIES.md requires the application to send it. Referrer-Policy is stricter than the policy baseline because dashboard URLs can name internal hosts.
model: claude-opus-4-8 (implementation); claude-fable-5 (commit message)
sneak
clawbot