PR #118 up — starts failure mode #2 (in-place element mutation) with a verified slice: a new JsonListValueComparer<T> (JSON deep-clone snapshot + structural JSON equality) applied to…
PRs #116 and #117 merged to master. CodeExecutionHub, ChatHub now class-level [Authorize]; PreRegistrationHub explicitly [AllowAnonymous]. Combined with DashboardHub/ClusterHub (item 1),…
PR #115 merged to master — all 19 count-only List<T> comparers now use SequenceEqual, closing the element-replacement data loss (failure mode #1), verified against the real built…
Triage — located each gate; one is a ready config flip, the others need pointers
1. ClamAV malware scan — CONFIRMED fail-open in prod, and it's a config decision (not a code bug). The…
Status — critical hubs now covered by two PRs
- PR #116 —
CodeExecutionHub→ class-level[Authorize](plain; students reach their own sessions). - PR #117 —
ChatHub→…
Already resolved on master (verified off origin/master @ 365320c) — no PR needed.
The recommended "best" option (3, inline ignore marker) is fully in place:
- The scanner supports it —…
PR #115 up — implements the primary fix from the spec above: all 19 count-only List<T> comparers → SequenceEqual (turns out there were 19, not 13 — the earlier count was head-truncat…
Update — getting TripoSG (modeling) actually running end-to-end on a cu128 host surfaced two more venv_setup bugs beyond the missing cloned-repo requirements.txt. Fixed in **spikersoft-artpi…
Resolved in spikersoft-backend PR #114 (merged to master). GetRoleMembersAsync now uses the injected HttpClient with a per-request Authorization header, matching every sibling method — no…
Resolved in spikersoft-backend PR #113 (merged to master). Registered IHttpClientFactory in the Scheduler host and switched HttpCallbackTaskRunner + GeoIpUpdateTaskRunner to `CreateClient()…
Precise diagnosis + implementation spec (after reading every comparer)
Exact inventory in SpikerSoft.Data/Contexts/SpikerDbContext.cs:
- Count-only
Equals(the bug) — 13 sites:…
Resolved in spikersoft-backend PR #112 (merged to master). MongoDB_HealthCheck now takes the DI-registered singleton IMongoClient and uses it for the ping/settings instead of `new MongoClient…
Progress: the MongoClient-per-message bomb is now merged (PR #111 → master, GamePersistenceService reuses the singleton IMongoClient). A related per-invocation MongoClient leak in…