dckcandClaude Opus 5.5
193a126d1c
The ingress no longer reads labels from a Toybox-Labels header. A header was no place for the webkey pattern: browsers can't set one on a WebSocket, and the pattern puts the secret in-band anyway. A page keeps it in its fragment, reaches the vat by public labels, and sends it in the body of a call, which the vat checks like a swissnum. A request still reaches a vat only by naming every label of its mount. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>