Django Dispatch

A tiny Django app with one authz boundary. Your role is analyst, server-side, with no cookie to tamper, so there's nothing client-side to mess with. The clue points at /dispatch-fa3df6.

The whole challenge is a path-normalization mismatch between the auth gate and the URLconf:

GET /dispatch-fa3df6/   →  404 not_found
GET /dispatch-fa3df6    →  200  (protected effect fires!)

The no-slash form resolves straight to the privileged view, and the trust decision never stops it — classic APPEND_SLASH / proxy-vs-urlconf disagreement. Method doesn't matter (GET/POST/OPTIONS all work), and the proof is the response body:

{"ok": true, "effect": "framework_authorization_bypassed", "evidence": "proof_..."}

One request, no payload. Nice and clean.