Ratifies the parent's recommendation (Option B — expanded sweep)
after a 10-file pattern-drift audit confirmed all 24 targets share
the identical scaffolded 3-line CORS block + OPTIONS-if. Records
5 architect-self-ratifiable decisions (D1 sweep-all, D2 delete-
OPTIONS-entirely, D3 verb-tightening-moot, D4 no-new-tests, D5
add forbidden-cors-headers CI job). Single mechanical brief
(~260 LOC; 240 deletions + ~20-line new CI job) under the
400-LOC per-brief budget. Awaiting human gate 1.
Co-authored-by: Cursor <cursoragent@cursor.com>
Scaffolds the cors-tighten convoy. Originally queued as a
one-file follow-up to fix-auth-bypass Brief 4 (only
pages/api/auth/verify.js), but a fresh repo-wide grep at
convoy creation found 24 files carrying the identical
scaffolded wildcard-CORS + redundant-OPTIONS pattern. The
documented narrow scope (verify.js only) materially
understates the actual exposure.
Two scope options spec'd in the convoy file for architect
ratification at gate 1:
Option A — narrow (verify.js only, ~10 LOC). Matches the
queued-convoy entry literally. Queues a separate
cors-sweep-all-routes for the remaining 23.
Option B — expanded (all 24 files, ~240 LOC). Single
mechanical sweep, same precedent as Brief 4 applied to
login + register, closes P0 #5 fully in one PR.
Parent recommends Option B. Architect verifies scope safety
(spot-check 5+ of 24 for pattern drift), confirms or splits,
adds optional CI regression lock if B wins.
Four decisions queued (scope option, OPTIONS-handler shape,
verify.js method-gate tightening, test coverage). No
operator action required — no env vars, no secrets, no infra.
Co-authored-by: Cursor <cursoragent@cursor.com>
