Client-side coupling verified (spikersoft-angular) — the fix is cross-repo, not a backend-only [Authorize].
DashboardHub← `projects/spikersoft/src/app/_services/signalr/dashboard-…
✅ Merged to master via spikersoft-backend#101. Artifact zip-bundle endpoint GET api/artstudio/{id}/bundle landed (streams GridFS artifacts as one archive; auth mirrors single-artifact…
✅ Merged to master via spikersoft-backend#101. Submit skip/method-selections wiring landed in SubmitArtAssetCommandHandler (staff-gated stage skipping, persisted StagePlan filter). Build 0…
✅ Merged to master via spikersoft-backend#101. Curation event publisher landed — RateGalleryAssetCommandHandler + ModerateGallerySubmissionCommandHandler publish art.asset.rated /…
✅ Merged to master via spikersoft-backend#101 (consolidated Art Studio backend slice). Metrics/activity read-model + SpikerSoft.EventHandlers.ArtStudioMetrics projector + `api/artstudio/metr…
Deeper verification — the root issue is broken object-level authorization (IDOR), not just a missing [Authorize]. This sharpens the fix.
CodeExecutionHub (CodeExecutionHub.cs:23-65)…
Follow-up on the route-coverage.spec.ts red seen in the pipeline (~2026-07-05): the reporter flagged /status as declared: public (routes.ts canActivate: []) vs manifest: auth. Root cause…
Layer-2 status: the shell-paint fix is already merged to master (PR #129 — keycloak-bounded-init, in origin/master HEAD 6374604). Independently re-verified the root cause + that the…
Correction after discovery — the gap was narrower than filed. Tracing ArtStudioController.Submit → SubmitArtAssetCommandHandler → RequestArtAssetStageCommand → ArtPipeProcessor showed…
Architecture decision — charting & 3D libs (verified against spikersoft-angular/package.json):
- Charting =
d3(already a dep,d3@^7.9.0). There is NO Chart.js / ngx-charts /…