John SmithandClaude b7bb40b160 feat(gateway): durability-bridge auth + header-first tokens on legacy routes (iteration 8) ...

persist/hydrate require auth with x-card-style participation gating
(gm/admin any session, others via bound lobby roster, unbound fail closed).
All remaining token:Query routes migrated to _require_auth (Bearer preferred);
EnginePersistRequest.owner_user_id spoofing removed — ownership from verified
token. Sweep documented remaining unauthenticated LLM-spend/agent routes for a
coordinated follow-up. 11 new tests red-first; pytest 618 passed / 22 skipped.

Co-Authored-By: Claude <[email protected]>

2026-08-24 19:26:51 -04:00

..

tests

feat(gateway): durability-bridge auth + header-first tokens on legacy routes (iteration 8)

2026-08-24 19:26:51 -04:00

vtt_orchestrator

feat(gateway): durability-bridge auth + header-first tokens on legacy routes (iteration 8)

2026-08-24 19:26:51 -04:00

pyproject.toml

test(llm): opt-in live-LLM suite that never runs in CI (iteration 55)

2026-08-24 06:24:12 -04:00