riotpiao.com/tasks/4.4-api-exec.md

# 4.4 — POST /api/exec (mock, GREEN)

Phase: 4 — Terminal (Surface C)
Stage: GREEN

- [x] `POST /api/exec` — input parses to a closed command enum, anything unmatched rejected before any lookup

Done — implemented in [app/api/exec/route.ts](../app/api/exec/route.ts). Command set, snapshot-membership validation, and rejection logging all present. Mock only: no session cookie, no 20/min/session rate limit. See [REQUIREMENTS.md](REQUIREMENTS.md).

## Verify

```bash
curl -X POST http://localhost:3000/api/exec -d '{"cmd":"get pods; rm -rf /"}'
```