grim7/11/2026, 7:38:40 PM

- stream requires a session (auth.api.getSession); webhooks stay HMAC-public,
  healthz open; dev open posture keeps the stream usable; production posture
  guard reinstated on api boot
- api builds a session-read auth instance (github: null) from @tripwire/auth
- web start.ts proxies /api/events/stream to the api with the session cookie
  (same-origin EventSource; the /api/auth precedent)
- integration: 401/200/dev-open/webhook-untouched; live cookieless curl 401

Parentf2f0d56