- docs/10: HTTP source + Basic Auth; manifest url/sha256/size; download zip + verify SHA-256 + extract; HTTP security model; stage notes marked pending - docs/02/05: add update_user/update_pass; update_source is now an HTTP(S) URL - tasks 17.18: HTTP pivot task (docs done; code TODO) Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>