v1.7.4 — the backlog reaches the registry

The 2026-08-30 security remediation reaches the registry. Every finding in the seven-session
security review — the F, V and S series, including two independent falsification passes, one over
the findings and one over the fixes — plus three oxaudit.md tooling items (OX-L8, L17, L18) and
a restructured README.

If you are on 1.7.2, this delivers v1.7.3 as well. v1.7.3 was tagged 2026-09-01 and never
published. DriftCoverage.symbolBearingItems changes meaning there, on 254 of 580 corpus
rows — read the v1.7.3 changelog section if anything you own parses the trace.

What changes behaviour

• The Gateway refuses an upstream redirect (S-04), returning a 502 naming the status where
  it previously followed one. Demonstrated end to end delivering x-api-key to a stand-in
  metadata listener; authorization was stripped only by undici implementing the Fetch spec's
  cross-origin rule, and x-api-key is a vendor header on no such list. Neither api.openai.com
  nor api.anthropic.com redirects an API POST, so nothing anyone does today changes — but an
  endpoint that does redirect now needs its destination configured as the upstream URL.
• An unknown Gateway route no longer mints a session (S-01). 20 unauthenticated POSTs to an
  unknown endpoint previously produced 20 sessions, and 120 GETs naming chosen ids produced 100 —
  the store's entire cap. Reachable from a web page, because a no-cors GET sends no Origin
  header at all, so the origin gate never saw it.
• GatewaySessionStore.getContent refuses a ref shorter than 12 characters (F-02). The prefix
  scan previously returned stored plaintext for any unique prefix, and ref= (empty) matched
  every hash. No shipping caller is narrowed — the only producer emits a 12-character prefix.
• --diff-html writes its report 0600 (F-04), where it landed at 644. The report embeds
  every item's full before and after content.

Also fixed

Trace messages no longer quote the payload back at you: a JSON syntax error built its message
from V8's string, which embeds the input (S-03), and a dropped constraint directive was quoted
verbatim (F-05). Both are now built from a fixed vocabulary. A newline in a filename can no longer
forge an envelope header on either renderer (F-06, S-02). A signal no longer truncates the MCP
output stream (OX-L8). optimize <dir> warns when it ingests files git is ignoring (F-03).

Architecture import rules are now policed by the linter rather than only described, with no new
dependency, and npm run coverage exists — reporting only, deliberately not a build gate.

Full per-finding detail, with the measurements, is in CHANGELOG.md.

On the version number

This is a patch number over moved output, and that was an explicit call at ship time rather
than the rule changing. Four changes clear this project's usual threshold for a minor — the
same command over the same input emits different bytes: S-02 and F-06 escape envelope labels,
S-03 and F-05 rebuild trace messages, and OX-L8 stops a signal truncating the MCP stream.

The patch digit was chosen so that a ~1.7.2 range picks up a security release without
intervention. v1.6.1 is the precedent, and this is the second time. Do not read the digit as
evidence that nothing moved — the changelog, CLAUDE.md and the status doc all say so.

Verification

All three version reporters agree on 1.7.4 — the built dist/src/version.js, package.json,
and the MCP serverInfo.version (there is no --version flag; it prints usage). Suite 936
passing / 2 skipped across 99 files; typecheck, lint and build clean. npm pack --dry-run was
read before publishing: 223 files, 1.9 MB unpacked.

No corpus run, deliberately: this release adds no code, and a byte-identical result would have
been vacuous rather than reassuring.