GHSA-35fj-9w6f-7h62, the admission alternative not taken: memory ingest now admits https sources only, with no escape — the posture of abcd update and of invariant 12 in the brief. The advisory proposed an additive --allow-http flag instead (https by default, explicit opt-in for a consumer that needs a plaintext source such as an internal mirror or a local test server), wired on the CLI, commands/memory.md and the reference page. Left open as the fork: a consumer that needs plaintext has no route today; adding one is additive, and needs a decision on whether the flag also relaxes the per-hop scheme pin or only the admission.

GHSA-35fj-9w6f-7h62, the admission alternative not taken: memory ingest now admits https sources only, with no escape — the posture of abcd update and of invariant 12 in the brief. The advisory proposed an additive --allow-http flag instead (https by default, explicit opt-in for a consumer that needs a plaintext source such as an internal mirror or a local test server), wired on the CLI, commands/memory.md and the reference page. Left open as the fork: a consumer that needs plaintext has no route today; adding one is additive, and needs a decision on whether the flag also relaxes the per-hop scheme pin or only the admission.

Remedy grounds (2026-09-29)

• Why: CA2's three answers; it is unanswered and none is picked. The unmerged commit 300968594 on feat/ruled-security-forks is the starting point if the flag is ruled in.
• Sources (consulted 2026-09-29): curl restricts redirects to HTTP, HTTPS, FTP and FTPS by default since 7.65.2 and documents --proto-redir =https to forbid a downgrade (https://github.com/curl/curl/blob/master/docs/cmdline-opts/proto-redir.md); Go's http.Client exposes CheckRedirect for a per-hop policy (https://pkg.go.dev/net/http#Client); RFC 6797 (HSTS) treats a downgrade of a known-https host as an attack (https://www.rfc-editor.org/rfc/rfc6797). No answer relaxes the https-to-http refusal.
• Rejected: a flag that also relaxes the per-hop pin, which would let an https source be downgraded in transit.