Resolved in spikersoft-backend PR #383 (merged to master). Made the Checkr/Sterling background-check base URLs and the MCPServer Keycloak base URL configurable (config-with-fallback to the…
Resolved in spikersoft-backend PR #382 (merged to master). Forwarded the request CancellationToken through all six MediatR pipeline behaviors (next(cancellationToken)), aligning them with the…
Resolved in spikersoft-backend PR #381 (merged to master). Removed the stale <IsAotCompatible>true> from SpikerSoft.API.csproj (leftover from the abandoned .NET 10-preview AOT trial), which…
Current-state audit (2026-07-17) — partial mitigation landed since filing; core gap stands
Re-verified the per-language safety boundary against master. Confirms this ticket's analysis and…
Resolved in spikersoft-backend PR #380 (merged to master). Hoisted CalendarTools' 4 per-call JsonSerializerOptions to one static readonly instance; no behavior change. Closing.
Resolved in spikersoft-backend PR #379 (merged to master). Hoisted KeycloakAdminService's 4 per-call JsonSerializerOptions to 2 static readonly instances; all 41 tests pass. Closing.
Resolved in spikersoft-backend PR #377 (merged to master). Removed dead SpaceZone CreateTestSpacecraft + GetDockedChainExcluding methods (~146 lines); no behavior change. Closing.
Resolved in spikersoft-backend PR #376 (merged to master). Consolidated the 27 duplicated token-user-id auth checks into a TryGetUserId helper; behavior identical, all 49 controller tests pass.…