The tests cover serving the app shell and assets with the SPA fallback, surviving malformed request paths, the cross-origin and rebound-Host rejections, the shared-token guard (401s everywhere without it, the cookie-setting redirect, timing-safe comparison, and its absence on a local bind), and the relay endpoints' authentication, event streaming, and never-relay-onward rule.

## Before writing SPEC.md files

Read https://raw.githubusercontent.com/brillout/sdd/refs/heads/main/sdd.md
