[csdev19]

Refs NIW2-313. Spec: design/core-hardening.md. ADRs: 0020 (cross-process file lock), 0021 (mock files are never read through symlinks).

Decisions

• The loader never follows symlinks inside the mocks area.
• Excerpts come only from regular files, are clipped, and files over 10 MB are refused.
• resolveSourcePath returns the real path. It denies dot-segments and node_modules.
• Source-read errors use fixed phrases and never quote JSON.parse.
• StateStore serves state from memory, revalidated by a stat fingerprint and written through.
• The O_EXCL lock gets a guarded reclaim and an async wait. No new dependency.
• Write failures surface: a 503 from the control plane, isError over MCP.
• Project does its state read-modify-write inside the lock.
• findKeyLine becomes a single pass over the file.

The spec also found that main does state read-modify-write outside the lock, and that the watcher ignores .laqi/, so the server does not see MCP's state writes.

Open questions

1. Are there user layouts that symlink individual mock files?
2. Should NIW2-315 narrow the default schemaSources.root, or is the deny list enough?
3. Keep one 5 s lock timeout for both surfaces, or use a shorter one for the control plane?
4. Should this ticket add a state-changed event, so the panel sees MCP's flips?
5. Is a small 'unavailable' change in NIW2-309's control-plane-app.ts acceptable here?

Status

This PR contains only the design spec and ADR drafts. It is opened as a draft so the design is not lost. The implementation will land on this same branch after the open questions are answered. Everything is "proposed, not implemented".

Part of the 2026-10-12 audit, umbrella NIW2-302. Specs were written by Fable agents against a read-only export of main at ee34302. The ADR numbers (0014–0026) are assigned across all eight audit PRs. decisions/index.md is not edited in these PRs, to avoid eight-way conflicts; add the index rows when each PR is promoted.

🤖 Generated with Claude Code