- H4: sliding-window rate limiter (10 attempts / 5min per IP+username)
on login and register; successful login resets the counter; pure
stdlib, no new dependency
- H8: docker-compose.test.yml DB/ADMIN passwords now :?required (align
with main); docker-compose.main.yml AUTH_REGISTRATION_ENABLED
defaults to false
- M8: fix FAV_PUBLISHER_ENABLE -> FAV_PUBLISHER_ENABLED typo so the
gate test actually guards the real flag
Co-authored-by: Cursor <cursoragent@cursor.com>
Also declare SEMANTIC_SUMMARY_SHADOW and PI_CHANGE_REPORT_NARRATIVE on
test/main, remove dead CURSOR_RUNNER_URL/cursor-agent, and set main
SEED_DEMO_USERS=false. Defaults stay legacy/false (no behavior change).
Co-authored-by: Cursor <cursoragent@cursor.com>
HTTP Runtime does not start the worker. Each compose environment gets its own events service, health port, and bounded pool.
Co-authored-by: Cursor <cursoragent@cursor.com>
Use pgvector image with extensions-only init, seed legacy users before project/chat fixtures, and align test compose with goose-only schema bootstrap.
Co-authored-by: Cursor <cursoragent@cursor.com>
Wire RUNNER_AUTH_TOKEN through dev/test/main Compose, validate uploads
with extension whitelist and content sniffing, add readiness soak script
and short PG loop test, and require runner token in prod when URL is set.
Co-authored-by: Cursor <cursoragent@cursor.com>