asepharyana
05a3bc7471
- ToHTML() now html.EscapeString on ticker, generated_at, section name/body, citations (stored/LLM content can't inject script into exported file) - Discord destination webhook_url restricted to discord.com/discordapp.com hosts (SSRF guard: server POSTs alert cards; no private IPs or arbitrary hosts) - Router middleware caps POST/PUT/PATCH bodies at 1 MiB (MaxBytesReader) - TestDestinations updated: non-discord host must 422, uses realistic discord.com webhook URL
docs index
Spec-driven source of truth. Code follows these docs; docs change before code.
| Doc | Contents |
|---|---|
| PLAN.md | Concept: Autopilot Routines, Verifiable AI, Accuracy Ledger; agents, features, architecture, data model, routes, pages, rules, timeline, verification, risks |
| API-REFERENCE.md | All 70 Sectors v2 paths with params, costs, FlowSight usage, per-cycle credit budget |
| TECH-STACK.md | Pinned versions, deps, why-chosen, declined alternatives, CI gates |
| ARCHITECTURE.md | Backend/frontend layout, scheduler, agent contracts, citation pipeline, SSE design |
| ROUTINES.md | 7 routine specs: schedule, inputs, detection logic, delivery format |
| AGENT-SPECS.md | 7 agent contracts: inputs, processing steps, outputs, verification fixtures |
| DATA-MODEL.md | Table schemas, indexes, retention, seed strategy |
| API.md | Backend route specs: request/response shapes, errors, auth |
| DEMO-DECK.md | Offline demo narrative: briefing → radar → report → interrogation |