TRACK ENDPOINT NEGATIVE TESTS RECEIPT
Date: 2026-02-15
Owner: Hampus
Scope: Production endpoint validation for /api/track (non-client, non-outcome)

Target:
- POST https://revivalops.com/api/track

Observed statuses:
- Valid allowlisted event + allowed origin: HTTP 204
- Unknown event (not on allowlist): HTTP 400
- Bad origin (cross-site): HTTP 403

Request shape used:
- Content-Type: application/json
- Body fields: version, event, path, ts
- Origin header varied by test case

Interpretation:
- Endpoint accepts only expected telemetry events.
- Endpoint rejects unknown event drift.
- Endpoint enforces origin restrictions for browser-originated traffic.

Labeling rules:
- System test only.
- Not a client engagement receipt.
- Not an outcome claim.