Resolved in spikersoft-backend PR #337 (merged to master, 97198fdc), now CI-proven on the merge commit:
- ArtPipeProcessor workflow: green on the merge push (build_and_publish + deploy…
No longer reproduces: SonarQube Scan has been green on every non-cancelled spikersoft-angular run since 2026-07-16 19:48 — 10+ consecutive successes spanning the deps-pass merges (batches…
Verified resolved on the live swarm (2026-07-17):
spikersoft-quiz-generationnow runs withStorage__UseS3=trueand a non-emptyStorage__SecretKey(48 chars, Bao-sourced via the deploy…
Complete and verified live (2026-07-17):
- Code: backend #261 (ObjectFileCache + embeddings direct + quiz ModelPathResolver) — merged earlier.
- Infra: #120 (embeddings sources the model from…
Updated diagnosis (2026-07-17, from #625 — closing that as a duplicate of this): the pull now runs with sudo in the deploy jobs, which fixed the root-owned-checkout permission error described…
Duplicate of #615 (same underlying problem: the deploy jobs' /mnt/infrastructure pull has never worked; the sudo added after #615 traded the permission error for a credentials error). Consolidated…
Done in the 2026-07-16 spikersoft-angular deps pass — PRs #204–#211, landing as batch 6 (PR #211): Angular 22.0.6, Nx 23, TypeScript 6, ESLint 10 (plus ng-packagr 22 and the batch 1–5…
Resolved in spikersoft-backend PR #326 (merged to master, 4d22c0bb — PR-0 of the reader plan): UserBookmark re-keyed to Keycloak username strings, all three bookmark endpoints no longer…
Code fix merged: spikersoft-angular PR #216 → master (051258e). Verified: unit tests (41 green), nx build clean, and the prod tokenless-401 repro.
Holding this open for one last check…
Timeline correction (verified via git blame): the [Authorize] on GET /api/book/{id}/file predates #618 — it dates to commit 3a2314d (2026-04-09, "breaking files out"), when file serving…
Timeline validated against the full Unit Tests task history: last green run was 9e9a137c (2026-07-16 22:30); the Batch S PR run itself failed (c3dd9a1d, 22:10) and every run since — including…
Both vectors are now closed and deployed:
Part 1 — authenticated API leak:
- spikersoft-backend #331 (merged):
BookAccess.CanRead/ReadableByguard on every read endpoint (404-no-oracle),…
Verified against the live swarm: the service is absent (99 services running, none matching lesson/video) — lesson-video transcoding has never been deployed via CI. Fix PR: spikersoft-infrastru…