chore(work): finish 08-app-wiring-web-next

docs/work/_system/_state.json

@@ -1,5 +1,5 @@
 {
-  "updated_at": "2026-05-20T09:58:23.827Z",
+  "updated_at": "2026-05-20T10:14:21.032Z",
   "epics": {
     "binder-wrap-helper": {
       "status": "done",
@@ -647,10 +647,10 @@
           ]
         },
         "08-app-wiring-web-next": {
-          "status": "todo",
+          "status": "done",
           "title": "App wiring: web-next",
           "ac_total": 1,
-          "ac_completed": 0,
+          "ac_completed": 1,
           "depends_on": [
             "07-security-header-adapters"
           ],
@@ -686,11 +686,6 @@
     }
   },
   "ready": [
-    {
-      "epic": "security-headers-rate-limit-sbom",
-      "story": "08-app-wiring-web-next",
-      "title": "App wiring: web-next"
-    },
     {
       "epic": "security-headers-rate-limit-sbom",
       "story": "09-app-wiring-web-tanstack-and-cms",

docs/work/epics/security-headers-rate-limit-sbom/08-app-wiring-web-next/_story.md

@@ -3,12 +3,12 @@ id: 08-app-wiring-web-next
 epic: security-headers-rate-limit-sbom
 title: "App wiring: web-next"
 type: technical-story
-status: todo
+status: done
 feature: web-next
 depends-on: [07-security-header-adapters]
 blocks: []
 created: 2026-05-20T00:00:00Z
-updated: 2026-05-20T08:14:55.907Z
+updated: 2026-05-20T10:14:20.860Z
 ---
 
 ## Goal
@@ -44,4 +44,4 @@ Wire the security headers middleware end-to-end in `apps/web-next` — middlewar
 
 ## Tasks
 
-- [ ] Wire `core-shared/security/next` middleware in `apps/web-next/middleware.ts` chained before existing auth checks; update `apps/web-next/instrumentation-client.ts` to read nonce via `getNonce()` and pass to `Sentry.init` replay + feedback integrations; thread nonce from `getNonce()` into `<Script nonce={nonce}>` in `apps/web-next/app/layout.tsx`; add middleware test asserting all six headers, prod/dev CSP shape, and `x-nonce` present in response; all gates pass.
+- [x] Wire `core-shared/security/next` middleware in `apps/web-next/middleware.ts` chained before existing auth checks; update `apps/web-next/instrumentation-client.ts` to read nonce via `getNonce()` and pass to `Sentry.init` replay + feedback integrations; thread nonce from `getNonce()` into `<Script nonce={nonce}>` in `apps/web-next/app/layout.tsx`; add middleware test asserting all six headers, prod/dev CSP shape, and `x-nonce` present in response; all gates pass.

docs/work/epics/security-headers-rate-limit-sbom/_epic.md

@@ -7,7 +7,7 @@ status: in-progress
 features:
   [core-shared, core-testing, core-eslint, auth, web-next, web-tanstack, cms]
 created: 2026-05-20T00:00:00Z
-updated: 2026-05-20T09:58:23.659Z
+updated: 2026-05-20T10:14:20.860Z
 ---
 
 ## Goal
@@ -27,7 +27,7 @@ Security scanners flag the absence of HSTS, X-Frame-Options, X-Content-Type-Opti
 - [x] [05 — auth.signIn rate-limit backfill](05-auth-signin-rate-limit-backfill/_story.md)
 - [x] [06 — Security headers core module](06-security-headers-core-module/_story.md)
 - [x] [07 — Per-framework security header adapters](07-security-header-adapters/_story.md)
-- [ ] [08 — App wiring: web-next](08-app-wiring-web-next/_story.md)
+- [x] [08 — App wiring: web-next](08-app-wiring-web-next/_story.md)
 - [ ] [09 — App wiring: web-tanstack and cms](09-app-wiring-web-tanstack-and-cms/_story.md)
 - [ ] [10 — SBOM CI workflow and ADR-023 amendment](10-sbom-ci-workflow/_story.md)
 - [ ] [11 — Documentation and conformance reference updates](11-documentation/_story.md)