Hermes
56b807543c
1. audit-logger middleware computed action/resource from req.path INSIDE the res.json override — after the /api/v1 router rebased req.url to the router-relative path. resolveAction fell through ACTION_MAP for every HTTP request, producing 45,899 'unknown.get' entries since 2026-07-14. Fix: snapshot req.path/req.method at app-level (post-shim, pre-router). 2. DC-044 shim double-prefixed ALREADY-canonical /api/v1/auth/gate|x into /api/v1/v1/... → 401 for canonical-URI clients. Fix: rewrite only legacy /api/auth/* shapes; canonical pass through untouched. 3. event-store VALID_OUTCOMES lacked 'failure' → every failed API action's security event was rejected+dropped from security-events.jsonl. Fix: add 'failure' to the vocabulary set. 8 regression pins over a faithful shim→audit→router mount mirror. Suite: 124 suites / 2809 tests green. Judge: GLM-5.3 cold read round-1 A/ship, URN urn:ump:ywv6rpmx55tlxbgc7ciyxqfcmx2v6q756cjbmif2d66k4bwwn6ya