John SmithandClaude 9f31b5db26 feat(wave16): lobbies, character persistence, engine proxies, observability, rate limits ...

Closes the five product gaps surfaced by the campaign-harness exploration:
- Lobby REST API: create/join-by-invite-code/launch with dual-mode storage
  (Postgres lobbies+lobby_members / MemoryStore), host-only launch binding
  an engine session; LobbyView wired to real roster + invite code
- Character persistence: player_characters table + CRUD; deploy endpoint
  materializes a stat block as an RBAC-owned engine entity
  (owner_player_id = deploying user); CharacterBuilder persists on deploy
- Orchestrator proxy routes for spawn/cast-spell/move/turn-next/damage/
  reactions-arm (service-token authenticated, EngineRejectedError mapping)
- Observability: JSONL LLM call logger (tools + stream paths) and FastAPI
  request logging middleware; mitmproxy opt-in documented for MCP capture
- Rate limiting: in-memory sliding window (auth 30/min, agent 60/min,
  default 600/min) returning 429 + Retry-After
- Engine: orchestrator-service principal trusted to bind ownership on
  behalf of authenticated players during mediated spawns

Co-Authored-By: Claude <[email protected]>

2026-08-23 23:16:55 -04:00

..

tests

feat(wave16): lobbies, character persistence, engine proxies, observability, rate limits

2026-08-23 23:16:55 -04:00

vtt_orchestrator

feat(wave16): lobbies, character persistence, engine proxies, observability, rate limits

2026-08-23 23:16:55 -04:00

pyproject.toml

feat(wave13): UI/UX hardening — code splitting, dice history, a11y & honest ambience

2026-08-23 15:16:15 -04:00