The prototype works. You can define a policy, evaluate intents against it, get decisions with explanations, and view receipts. That is the happy path. This week was about the unhappy paths.
Locked down convenience behaviors so they can not leak into real deployments. Debug endpoints, verbose error messages, default-open permissions. All the things that make development pleasant and make production dangerous. Every one of them now has an explicit environment gate.
Treated token leakage and receipt exposure as default threats, not edge cases. If a token ends up in a log line or a receipt gets returned to the wrong tenant, that is a vulnerability. We are treating it that way from the start rather than discovering it during a security review six months from now.
Added sandbox-only constraints for anything that increases exposure risk. If a feature is useful for testing but dangerous in production, it only exists in sandbox mode. No configuration option to "enable it anyway." The boundary is enforced, not suggested.
Security headers and leakage prevention mindset applied across the entire surface. Every response, every error message, every log line gets reviewed for information disclosure. The prototype works. The point now is reducing failure modes before real usage.