handoff git:20260717.294d215C

Immutable. This exact content never changes and is served at /api/v1/blob/c918acee24b1ef41.

# handoff — ave

End: docs/agents/handoffs/YYYY-MM-DD-HHMM.md
Start: read most recent, run python scripts/validate_records.py.

## End format

# Handoff — date

## Completed
- records/AVE-2026-00049.json — header injection (BadHost) record added
- tests/fixtures/AVE-2026-00049_positive.md + _negative.md
- Coordinated detection-rule PR opened in bawbel/scanner, referencing AVE-2026-00049

## Status
python scripts/validate_records.py → all valid
pytest tests/ -q → N passed

## Next
AVE-2026-00050: database data-path exposure (Mads Hansen suggestion)
First: grill the behavioral_fingerprint.

Note: docs/agents/handoffs/ gitignored.