John SmithandClaude c5d9cc6b37 fix(gateway): server-side auth for quest routes (iteration 94) ...

Closes the close-out audit's top known-limit: quest generation
replaces the shared active_campaign_quest global every player's
journal reads, yet took no token — any unauthenticated caller could
rewrite the table's quest. Generate now requires GM/admin (403
QUEST_GENERATION_GM_ONLY, reject before mutation); active-quest read
and Concordia negotiation require authentication with no role gate.
7 red-first tests; suite at 558.

Co-Authored-By: Claude <[email protected]>

2026-08-24 16:34:20 -04:00

..

tests

fix(gateway): server-side auth for quest routes (iteration 94)

2026-08-24 16:34:20 -04:00

vtt_orchestrator

fix(gateway): server-side auth for quest routes (iteration 94)

2026-08-24 16:34:20 -04:00

pyproject.toml

test(llm): opt-in live-LLM suite that never runs in CI (iteration 55)

2026-08-24 06:24:12 -04:00