## FAIL

### Actionable findings

1. **Important — Origin validation is scheme-bound but not exact to a trusted public authority.**  
   `health_dashboard_server.py:61-72,545-574` compares `Origin` with the request-controlled `Host`; the allowlist checks only hostname and ignores the configured/listening port.  
   Synthetic probe showed:
   - configured `http://127.0.0.1:8014` → accepted
   - wrong scheme → rejected
   - **unconfigured `http://127.0.0.1:65535` with matching spoofed Host → accepted**
   
   **Fix:** configure one canonical public origin—scheme, canonical host, and effective port—validate it at startup, compare `Origin` directly against it, and independently constrain `Host` to the expected authority. Add wrong-host and wrong-port regressions, not only wrong-scheme coverage.

2. **Important — Path/URL/internal metadata sanitization is incomplete.**  
   `nutrition_mapping_review.py:163-167,425-460` sanitizes catalog fields, but publishes nutrition item `name`, `example_name`, and `examples` through `_display()` without metadata filtering. `contracts.py:290-338` also does not structurally validate or sanitize `examples`, `days`, `current_mapping`, or `recommendation`.  
   Synthetic review output preserved:
   - `/home/agent/private.db`
   - `https://internal.example/x`
   
   Additionally, worker-derived provenance at `health_dashboard_action_worker.py:984-989` checks catalog `source`/`updated_at` only for length and presence before persisting them; path/URL-like provenance is not rejected.
   
   **Fix:** apply one fail-closed sanitizer to every released free-text/nested mapping field and to server-derived provenance. Extend the bundle contract with exact nested schemas and bounded text/list validation. Cover embedded absolute paths, `file:`/HTTP URLs, traversal, Windows paths, `.hermes`, and internal identifiers.

### Verified successfully

- Every `assign` is transaction-time validated against the local catalog; alias assignments require an exact current alias.
- Method, confidence, and provenance are re-derived by the worker rather than trusted from the client.
- `BEGIN IMMEDIATE` encloses idempotency, preview re-resolution, mutation, recomputation, provenance, and action-log writes; rollback/race tests pass.
- Target revision includes current mapping rows and latest review action, closing stale review-state submissions.
- Review/support/catalog reads have explicit fetch caps and fail closed on overflow.
- Focused synthetic suite: **39 passed** with SciPy available.
- `git diff --check`: clean.
- No source files or tracked artifacts were modified by this review; no production PHI was accessed.