# Wizard Fortress re-audit checklist

An agent may read `checklist.json`. It must not auto-apply, commit, or write Track A.

1. Apex and www serve this project over HTTPS.
2. OpenAI TXT challenges match the UI that issued them.
3. `/api/health` says `proposal_only` / `execute=disabled`.
4. A normal proposal POST returns `AWAITING_HUMAN_APPROVAL` plus a SHA-256 digest.
5. `worker=openai` and `/api/v1/execute` are 403.
6. Schema and privacy URLs still work.
7. No new function was added that writes files or forwards to the tower.

Date every run. Failed checks block publication, not "we'll fix it later."