John SmithandClaude 4e8477d08b feat(gateway): admin bootstrap allowlist, fail-closed secret, lobby membership gate (iteration 12) ...

Signup accepts only player/spectator — staff roles come from the
VTT_ADMIN_EMAILS allowlist (rotatable without restart). Gateway aborts
startup without AUTH_SECRET/VTT_ENGINE_SECRET, mirroring engine semantics.
GET /lobbies/{id} member-or-staff only with no existence oracle; invite
codes stay visible to members. 20 tests red-first; pytest 672 passed.

Co-Authored-By: Claude <[email protected]>

2026-08-24 21:14:10 -04:00

..

tests

feat(gateway): admin bootstrap allowlist, fail-closed secret, lobby membership gate (iteration 12)

2026-08-24 21:14:10 -04:00

vtt_orchestrator

feat(gateway): admin bootstrap allowlist, fail-closed secret, lobby membership gate (iteration 12)

2026-08-24 21:14:10 -04:00

pyproject.toml

test(llm): opt-in live-LLM suite that never runs in CI (iteration 55)

2026-08-24 06:24:12 -04:00