John SmithandClaude 7271475539 fix(engine+client): fifth-audit remediation across six findings (iteration 78) ...

- F1 MED: Help promise burned by LOS/cover-refused attacks —
  consumption moved after all fallible gates; refused attacks leave it
  standing (red-first socket test).
- F2 MED: explicit under-level cast requests now 422 INVALID_SLOT_LEVEL
  instead of silent .max() upgrade (gateway default aligned to 0 =
  unspecified); absurd damage formulas (>2x caps) hard-rejected without
  spending slots, moderate overshoot still gently clamped — validation
  hoisted before expenditure.
- F3 MED: monster spawns require a GM seat (403 MONSTER_SPAWN_
  FORBIDDEN for non-GM unowned NPC spawns; owned-player deploys via the
  service principal unaffected); encounter-builder copy matches reality.
- F4/F5/F6 LOW: viewport fog-parity claim corrected to the actual union
  semantics; ability-score defaulting warns instead of silently
  defaulting; .expect() calls in core replaced with error propagation;
  offhand index 0 refused as matching the main hand.

All gates green: workspace tests, clippy -D warnings, pytest 496, tsc.

Co-Authored-By: Claude <[email protected]>

2026-08-24 13:46:36 -04:00

..

tests

feat(compendium): conservative spell-damage extraction pipeline (iteration 77)

2026-08-24 12:58:51 -04:00

vtt_orchestrator

fix(engine+client): fifth-audit remediation across six findings (iteration 78)

2026-08-24 13:46:36 -04:00

pyproject.toml

test(llm): opt-in live-LLM suite that never runs in CI (iteration 55)

2026-08-24 06:24:12 -04:00