# SPEC: Harden Dashboard Security and Fix Scripts

## Goal
Close obvious security holes in the dashboard and fix script/documentation bugs identified in the audit.

## Requirements
1. Fix path-traversal guard in `automaton/dashboard/ui/app.py`:
   - Replace string-prefix check with `Path.relative_to` resolution.
2. Tighten task name validation in the review API.
3. Add uncommitted-changes warning to `scripts/update.sh` before running `git pull`.
4. Replace the placeholder repository URL in `README.md` and `scripts/install.sh` with `http://10.37.0.86:3003/hermes/automaton`.
5. Add guidance on atomic artifact writes to `references/stop-hook-pattern.md` or `.rules.md`.

## Acceptance Criteria
- [ ] Path-traversal check uses robust `Path` comparison.
- [ ] Tests include path-traversal attempts.
- [ ] `update.sh` aborts or warns when local uncommitted changes exist.
- [ ] `README.md` and `install.sh` contain the real Gitea URL.

## Non-Goals
- Adding authentication to the dashboard.
- Rewriting scripts in another language.

## Stop Condition
When all acceptance criteria are met, output "CONTRACT_MET".