chore(tasks): mark fwd16, fwd13, cli01 completed

2026-08-31 00:23:46 +00:00
parent d5446c2780
commit a7f10ed04c
3 changed files with 18 additions and 6 deletions
@@ -1,7 +1,7 @@
 ---
 id: review-002-fwd16-missing-capability
 name: Loud error on missing capability instead of silent unauthenticated request (FWD-16)
-status: pending
+status: completed
 depends_on: []
 scope: narrow
 risk: low
@@ -67,4 +67,8 @@ succeed without the assembly layer changing. If a deployment legitimately
 runs authed-ops with *optionally*-present credentials (none known
 today), that would be a new config flag — do not preemptively add one;
 the invariant (ADR-014: credentials flow only via Capabilities) argues
-loud-and-closed.
+loud-and-closed.
+
+## Summary
+
+Silent missing-capability arm now fails with INTERNAL naming both key forms (api_key:/http_token:) and refusing the unauthenticated send; module doc loud-missing-matrix paragraph; 3 tests incl. a zero-upstream-requests wire test. Two pre-existing no-env-vars tests updated (they pinned the silent arm).