PCI scope is a template every payment handler is generated from

The card-handling endpoints are the ones the assessor asks about: which handlers log request bodies, how long they keep logs, whether the authorization header ever lands on disk. On most stacks the answer is a spreadsheet someone maintains by hand.

In hoody-exec those answers are magic comments at the top of each script: @log-request-body off, @log-exclude-headers authorization cookie x-card-token, @log-retention-days 90, @token for the shared secret. Store that header in a custom template with POST /api/v1/exec/templates/create-custom, and every new handler is born from it: POST /api/v1/exec/templates/generate with saveFile: true writes the script with the header already in place. templates/preview shows what it will produce before anything is written.

The posture isn't reviewed into each handler after the fact. It's inherited at creation.

Scope stopped being a spreadsheet and became a template.