TASK22028: document signer allow-list follow-up

memory-bank/change-log.md

@@ -1018,3 +1018,30 @@ Validation:
 Follow-ups:
 
 - Continue incremental endpoint/file proxy consistency slices with same contract-preserving constraints.
+
+---
+
+### CL-028: Follow-up fix — signer allow-list expanded for deleteblobcase browser path
+
+date: 2026-03-13
+author: Cline
+scope: `pages/api/endpoint/gethash_api.js`, `tests/phase14/service-behaviour.test.cjs`
+type: change
+rationale: Resolve runtime failure where browser-side `deleteAwaitingSubmissionsFromBlob` hash signing requested a path not present in signer allow-list.
+impact: Restores browser-safe hash signing for delete-blob-case flow without weakening auth/session guard on signer endpoint.
+status: completed
+
+Summary:
+
+- Added `/api/file/deleteblobcase` to `gethash_api` allow-list.
+- Added focused test coverage in phase-14 suite for the new allow-listed path.
+
+Validation:
+
+- `node tests/phase14/service-behaviour.test.cjs` -> pass (6/6)
+- `node tests/phase7/service-behaviour.test.cjs` -> pass (10/10)
+- `npm run lint` -> warnings only (pre-existing)
+
+Follow-ups:
+
+- Keep signer allow-list additions minimal and path-specific.