security: CMA HTTP surface is unauthenticated by default

[AsperforMias]

Problem

createCmaHttpHandler's authorize option is optional (src/surfaces/cma-http/contract.ts:36). When an embedder mounts the handler without it, every route proceeds unauthenticated (src/surfaces/cma-http/handler.ts:195-199), including:

• full session event streams — agent messages, tool-call arguments and raw tool outputs, which may contain echoed secrets (src/surfaces/cma-http/session-events.ts:50-81);
• session and agent creation;
• destructive operations such as DELETE /v1/environments/:id (handler.ts:94-99).

The only gate applied by default is a static, publicly known anthropic-beta header value (contract.ts:7-8), which is not authentication.

Verification

Mount createCmaHttpHandler without authorize, then:

curl http://<host>/v1/sessions/<id>/events

The full session event stream is returned with no credentials requested.

Impact

If deployed this way — which the type system and defaults actively permit — the surface allows unauthenticated read of all session content and destructive environment deletion.

Proposed direction

Fail closed: refuse to start (or deny all requests) when no authorizer is configured, with an explicit opt-out for trusted-loopback deployments, and document the requirement prominently in the public API docs.

Acceptance criteria

• A handler constructed without authorize cannot serve session data by default.
• The behavior is covered by contract tests for both the default and the explicit opt-out path.