Task — engineering-spec@1

"Refuse dev CORS in production boot"

closedTASK-IMP-002
module improvement · class product · priority p0 · created 2026-07-08 · shipped null
depends on none · blocks none

TASK-IMP-002: Refuse dev CORS in production boot

1. Description

Author the normative clauses when this task is picked up; it was migrated as a draft stub.

Migrated 2026-07-08 from the deep-audit improvement backlog, folded into the task system as class: improvement. Source report refs: R23.

Acceptance criteria

Groom note (batch/12a, 2026-07-25)

Closed as platform / won't-do for CyberOS 1.x (batch-10e / #147 precedent).

CORS refuse-in-prod surface lives in services/* / *_DEV_CORS boot paths, not the payload. No payload-scoped surface to reframe onto.