Sandbar sends Web Push (VAPID + aes128gcm, standard library only) to devices registered for a topic, serves the companion PWA at /app/, allows one CORS origin, and exposes a read-only Hammerhead edge view and POST .../escalate. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>