Add operational runbook notes for DISPATCHAUTHMODE=disabled #320

Parent umbrella issue: #308
Source audit: Weekly tech debt audit: dispatch - 2026-06-03
Source audit date: 2026-06-03

Original recommendation

P3 — Add operational runbook notes for DISPATCH_AUTH_MODE=disabled: keep it explicitly local-only and add deployment checks if feasible.

Matched top finding

The pull-based PR follow-up sync endpoint is a mutating POST that does not use the shared authorizeRequest() helper. The webhook endpoint can intentionally skip signature verification when WEBHOOK_SECRET is unset, which may be acceptable behind a gateway but is risky as a default unless deployment docs and runtime checks make that explicit.

Evidence:

• Mutating routes without authorizeRequest scan returned: src/app/api/auth/logout/route.ts, src/app/api/pr-followup/sync/route.ts, src/app/api/pr-followup/webhook/route.ts.
• src/app/api/pr-followup/sync/route.ts:88 exports POST() and scans tracked repos using GITHUB_TOKEN without a route auth check.
• src/app/api/pr-followup/webhook/route.ts:186-196 verifies signatures only if WEBHOOK_SECRET is configured.
• src/app/api/pr-followup/webhook/route.ts:222 persists queue work through processPrFollowupEvents(...).