Resolved in spikersoft-angular PR #147 (merged to master). Widened the .nav-menu inter-item gap (0.5rem → 0.75rem) so longer translated (Spanish) labels no longer crowd/collide, and set…
P1+P2a merged ✅ — and a design-system fork for the Pipeline re-skin
Merged to master (e04fcea): #142 (P1 shell + theme + landing + System affordance + double-header fix) and #143 (P2a…
P2 progress + an architectural gate on the runner control bar
Shipped: P2a nav KPI chips — PR #143 (stacked on #142). Live Active/Running pills polled from the staff getActivity…
P2 build spec — Pipeline view fidelity (grounded in his actual markup at :5050)
Extracted his Pipeline view DOM so P2 mirrors it faithfully. Structure:
1. Runner control bar — buttons…
PR up: spikerj/spikersoft-backend#167 — full suite green (100 passed / 0 failed / 3 skipped, ~2m30s, self-contained Testcontainers).
Beyond the checklist above, the validation run surfaced and…
Verified finding — live secrets hardcoded in SpikerSoft.Api/appsettings.json (surfaced while adding webhook-signature validation)
Committed production credentials currently in source…
Audited the two remaining DOM sinks — severities differ from the ticket; scoping so the real one gets the effort
**Terminal innerHTML (terminal.component.ts:179-180) — downgrade to…
Item 1 (API → Docker 2375) — done, merged via PR #162 (0811a2f).
Resolved the way this ticket asks (remove, not re-point) after confirming the earlier "needs frontend-contract verification…
Item 3 (MCP auth) — scoped; blocked on one external-integration decision
Verified the shape so the decision is teed up:
SpikerSoft.AI.MCPServeris an HTTP-hosted MCP server —…
Item 2 (GameServer JWT forgery) — merged to master via PR #158 (commit f68ba51).
The game WebSocket now derives userId only from a token that cryptographically validates against the…
Item 2 (GameServer JWT) shipped — backend PR #158 (in review)
Server-side JWKS validation on the game WebSocket; forged/expired/wrong-issuer/wrong-audience/unsigned tokens now resolve to…
Resolved in backend PR #156 (merged to master). Implemented option 2: ScheduledTasksController.Create() now returns 403 when TaskType == "HttpCallback" and the caller is not admin (case-toler…