Bastien Chanot 66e4c4d0f9 docs(mcp): job8 B — document component_builder callback-injection risk ...

BDR-059 + LRN-110 + LRN-111. Confirmed A's ask-gate covers component_builder
(mcp__ scope) — no code fix possible or attempted, it's third-party package
code (dist/utils/callback-server.js:36). README MCP section now documents
the risk and why the mitigation is ask-gating, not patching.

2026-07-07 23:48:52 +02:00

..

blockers.md

job1: close BLK-009

2026-07-06 02:48:16 +02:00

decisions.md

docs(mcp): job8 B — document component_builder callback-injection risk

2026-07-07 23:48:52 +02:00

evals.md

job6: capitalize — BDR-056, LRN-107, EVAL-020, journal

2026-07-07 04:07:07 +02:00

journal.md

job7 capitalize: BDR-057, BDR-026 update, LRN-108, journal

2026-07-07 12:58:51 +02:00

learnings.md

docs(mcp): job8 B — document component_builder callback-injection risk

2026-07-07 23:48:52 +02:00