The ingress no longer reads labels from a Toybox-Labels header. A header
was no place for the webkey pattern: browsers can't set one on a
WebSocket, and the pattern puts the secret in-band anyway. A page keeps
it in its fragment, reaches the vat by public labels, and sends it in
the body of a call, which the vat checks like a swissnum.
A request still reaches a vat only by naming every label of its mount.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
dckcandClaude Opus 5.5
193a126d1c