Indiana 605f32f20e fix: blank inbox previews, two unauthenticated 500s, and the missing social tests ...

- Every conversation row in the inbox rendered an empty preview: the
  frontend read `last_body`, which the API has never sent. It sends
  `excerpt` plus `truncated`.
- `GET /api/codex?limit=-1` passed a negative LIMIT to Postgres -> 500.
  Now bounded by Query(ge=1, le=200) -> 422.
- Registering with a >255 char email hit the VARCHAR(255) column and
  surfaced as a 500. PATCH /api/profile already validated this; only
  /auth/register was open.

The social layer had zero tests, despite routes/messages.py citing
"tests/test_messages.py's cross-user leak tests" and routes/profile.py
claiming "privacy rules that the tests pin". Neither file existed. Both now
do: auth required on every route, email only on /api/profile/me, no id or
password_hash on any public payload, third-party thread reads empty,
payload-supplied sender inert, veiled profiles 404 and stay off the roster.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

2026-08-01 01:45:04 +00:00

..

llm

fix: the test suite was destroying the production database

2026-07-30 01:44:01 +00:00

models

feat: hunter profiles, ranks, whispers, and the encounter record

2026-07-31 02:50:00 +00:00

routes

fix: blank inbox previews, two unauthenticated 500s, and the missing social tests

2026-08-01 01:45:04 +00:00

tts

feat: possession presentation layer — glitchy text + degraded audio

2026-07-23 05:48:02 +00:00

__init__.py

chore: scaffold backend venv, health check, systemd unit

2026-07-20 14:52:53 +00:00

celestial.py

feat: the room decides — physical entropy, real astronomy, unprompted speech

2026-07-28 05:38:59 +00:00

config.py

fix: the test suite was destroying the production database

2026-07-30 01:44:01 +00:00

db.py

fix: move NullPool test fix from db.py into a conftest-local test engine

2026-07-20 15:22:41 +00:00

deps.py

fix: claiming a name keeps your account instead of abandoning it

2026-07-29 23:39:53 +00:00

device_anomaly.py

feat: hardware sensor anomalies feed the summon pipeline (Workstream K)

2026-07-24 01:14:11 +00:00

entities.py

feat: the moon shapes who answers; wire magnetometer; drop dead CSS

2026-07-28 13:31:15 +00:00

entropy.py

feat: the room decides — physical entropy, real astronomy, unprompted speech

2026-07-28 05:38:59 +00:00

geomagnetic.py

feat: the moon shapes who answers; wire magnetometer; drop dead CSS

2026-07-28 13:31:15 +00:00

haunts.py

feat: haunted geography — real places near the seeker

2026-07-29 08:36:23 +00:00

inventory.py

feat: unlocks, inventory items, sigils, drops, and essence (Workstream C)

2026-07-24 03:02:20 +00:00

judgment.py

feat: ritual + judgment + favor + cross-over (Workstream B)

2026-07-24 21:27:30 +00:00

main.py

fix: verify all six unproven audit findings — four real, two not

2026-07-31 03:13:46 +00:00

passage.py

feat: the Passage — crossing over becomes a layered rite (Workstream L)

2026-07-31 14:19:55 +00:00

possession.py

feat: possession presentation layer — glitchy text + degraded audio

2026-07-23 05:48:02 +00:00

rank.py

feat: hunter profiles, ranks, whispers, and the encounter record

2026-07-31 02:50:00 +00:00

rate_limit.py

fix: verify all six unproven audit findings — four real, two not

2026-07-31 03:13:46 +00:00

schemas.py

fix: blank inbox previews, two unauthenticated 500s, and the missing social tests

2026-08-01 01:45:04 +00:00

security.py

fix: address final-review hygiene items (pydantic config, cookie alias, argon2 exception scope)

2026-07-20 16:00:35 +00:00

session_cleanup.py

feat: periodically sweep expired auth sessions

2026-07-21 03:43:34 +00:00

telemetry.py

feat: matrix/graph data views, wire-generated anomalies, http cookie fix

2026-07-21 00:02:41 +00:00

ws.py

fix: the Passage was an unbounded essence faucet

2026-08-01 01:44:47 +00:00