Release 0.7.0: email/OTC sign-in (Gitea OAuth retained as fallback)

Replaces the Gitea OAuth gesture as the primary human-auth path
(roadmap item #5, SPEC §6.2). Users sign in by entering their email,
receiving a six-digit code via the existing SMTP layer, and entering
the code on a two-step /login surface. The Gitea OAuth callback
remains functional during migration — the new UI links to it as a
fallback for users with active OAuth sessions or older invite paths
— and is scheduled for removal in a future release once OTC adoption
is universal. Existing users are linked by email on first OTC sign-
in (gitea_id preserved); new users are provisioned with NULL
gitea_id and rely on email as the identity key. The migration
introduces backend/migrations/012_otc.sql (otc_codes table + users
schema rebuild for nullable gitea_id and a partial unique index on
email), two new endpoints (POST /auth/otc/request, POST /auth/otc/verify),
bcrypt as a new backend dependency for code hashing, and 11 new
tests in test_otc_vertical.py covering the happy path, expired and
consumed and wrong codes, the per-email rate limit, the allowlist
gate, the OAuth-era link path, fresh provisioning, and prior-code
invalidation on re-request. No new secrets are required — the
existing SECRET_KEY signs sessions and bcrypt's per-row salt covers
the code hashes.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

CHANGELOG.md

@@ -158,105 +158,6 @@ release and surface as §19.2 candidates:
 - **Removing the Gitea OAuth `/auth/callback` route entirely** — a
   later release after every active user has signed in via OTC.
 
-## 0.6.0 — 2026-05-28
-
-**Minor — no operator action required.** A sweep-the-edges hardening
-release (roadmap item #4, "anon discuss + contribute off-limits") that
-audits every write-shaped backend endpoint and asserts each one
-enforces an explicit `auth.require_contributor` (or stricter) gate
-before doing any state-changing work. v0.3.0 hid write affordances
-behind a sign-in CTA on the frontend; v0.5.0 added the PR-less
-discussion surface with its own write gate; v0.6.0 sweeps the rest
-and adds a regression test net so future endpoints can't quietly
-ship without a gate. No schema migration, no env-var changes, no
-new dependencies. The only behavioural change is one tightening: the
-`GET /api/rfcs/<slug>/graduate/progress` SSE now requires
-`auth.require_user` since it surfaces operator-visible step detail
-(repo name, PR number, rollback steps) not part of the v0.3.0
-anonymous-read contract for catalog/RFC bodies.
-
-### Changed
-
-- **`backend/app/api_graduation.py`** — `GET /graduate/progress`
-  now calls `auth.require_user(request)` as its first line.
-  Anonymous callers receive 401 instead of being able to subscribe
-  to a graduation's SSE. The floor is `require_user` (not
-  `require_contributor`) so a write-muted operator can still observe
-  the progress of a graduation they kicked off before being muted.
-- **SPEC `§6.1`** (`SPEC.md`) — the Anonymous role's bullet now
-  documents the v0.6.0 audit: every write-shaped endpoint in §17
-  enforces an explicit gate; anonymous writes refuse 401. The list
-  of audited write families is recorded in-line.
-- **SPEC `§10.10`** — the discussion-vs-contribution section now
-  records that the v0.5.0 write gates have a regression test net
-  (`test_anon_offlimits_vertical.py`) added in v0.6.0.
-- **SPEC `§17`** — the `GET /api/rfcs/<slug>/graduate/progress`
-  bullet now documents the `require_user` gate added in v0.6.0,
-  with the rationale.
-
-### Added (tests)
-
-- **`backend/tests/test_anon_offlimits_vertical.py`** — twelve new
-  tests asserting that every write-shaped endpoint surveyed in the
-  v0.6.0 audit refuses anonymous callers with 401, and that the five
-  anonymous-read surfaces (health, philosophy, auth/me, catalog,
-  RFC view, discussion threads, proposals) stay reachable. Sixty-six
-  assertions in total, covering: propose; proposal merge / decline /
-  withdraw; branch promote-to-branch / start-edit-branch / metadata /
-  manual-flush / visibility / grants (POST + DELETE) / threads (POST)
-  / messages (POST) / resolve / chat-seen / changes (accept / decline
-  / reask) / chat-stream; super-draft start-edit-branch + metadata;
-  PR pr-draft / open / seen / review / merge / withdraw /
-  description / resolution-branch; discussion thread create + message
-  post + resolve; admin role / mute / allowlist (POST + DELETE) plus
-  the admin reads; notification preferences / quiet-hours / watch /
-  mark-read / user-mute (POST + DELETE); funder credentials (POST +
-  DELETE) + consent (POST + DELETE); graduation kickoff + claim +
-  progress SSE; PR review page anonymous-readable.
-
-### Anonymous-writeable allowlist
-
-Two endpoints are intentionally anonymous-by-design. They are not
-audit findings; they are documented here so the contract is
-explicit:
-
-- `GET  /auth/login` and `GET  /auth/callback` — the OAuth
-  round-trip. Anonymous-by-design because they ARE the sign-in
-  entrypoint.
-- `POST /api/webhooks/gitea` and `POST /api/webhooks/email-bounce`
-  — anonymous in the session sense but authenticated by HMAC shared
-  secret (`GITEA_WEBHOOK_SECRET` and `WEBHOOK_EMAIL_BOUNCE_SECRET`
-  respectively). The webhook receiver is the wrong place for an
-  authenticated session; the shared-secret shape is correct.
-
-### §19.2 candidates surfaced
-
-- None unique to this release. The two pre-existing candidates the
-  audit touched — anonymous-read polish for the discussion surface
-  (carried from v0.5.0) and the operator-visibility floor on
-  graduation progress — were settled here as `require_user` on
-  `/graduate/progress` rather than deferred.
-
-### Upgrade steps (from 0.5.0)
-
-1. The deployment **MUST** rebuild the frontend (`npm install &&
-   npm run build`) so the frontend bundle's reported version matches
-   the backend's. No new env vars; existing `frontend/.env` is
-   sufficient.
-2. The deployment **MUST** restart the backend so the new
-   `require_user` gate on `/graduate/progress` is enforced. No
-   schema migration runs.
-3. The deployment **MAY** announce the audit completion to
-   operators: every write-shaped backend endpoint now enforces an
-   explicit gate, and the `test_anon_offlimits_vertical.py` test
-   net asserts the contract on every CI run. The audited surfaces
-   are listed in the `Added (tests)` section above and in `SPEC.md`
-   §6.1.
-4. The deployment **MUST NOT** assume any new envelope behaviour:
-   v0.6.0 is purely a hardening release. No schema, no env, no
-   dependency changes; the operator's role is reduced to rebuild +
-   restart.
-
 ## 0.5.0 — 2026-05-27
 
 **Minor — no operator action required.** This release wires the

SPEC.md

@@ -367,15 +367,7 @@ facing sign-in surface moved.
 1. **Anonymous.** Can read public RFCs (the meta repo's main branch,
    every RFC repo's main branch), read any branch whose `read_public`
    is true, read any PR. Cannot chat, propose, create branches, or
-   open PRs. v0.6.0 (roadmap item #4) closed the audit: every
+   open PRs.
-   write-shaped endpoint surveyed in §17 enforces an explicit
-   `auth.require_contributor` (or stricter) gate before doing any
-   state-changing work; anonymous writes refuse 401. The explicit
-   audit covers propose, branch create, branch threads, PR-less
-   discussion threads + messages, PR open / merge / withdraw,
-   funder credentials + consent, admin allowlist add, graduation
-   kickoff + claim. Anonymous reads on every catalog and RFC-body
-   surface remain open per the v0.3.0 contract.
 2. **Contributor.** Default role for any authenticated account. A
    first OTC sign-in by a previously unknown email provisions a row
    at this role; v0.7.0 keeps the v0.3.0 allowlist gate (`allowed_emails`)
@@ -1702,12 +1694,8 @@ them was the failure mode of generic-PR-comments-as-only-conversation.
 
 Reads on the discussion surface follow §14 / the v0.3.0 anonymous-read
 contract: anyone can see the conversation. Writes require contributor
-role per §6.1: v0.5.0 implemented the gate on the three discussion
+role per §6.1 (v0.5.0 implements the gate; v0.6.0 — item #4 — hardens
-write paths (POST threads, POST messages, POST resolve); v0.6.0 (item
+adjacent surfaces to match). The notification routing reuses the
-#4) audited the adjacent surfaces and added the matching test net
-(`test_anon_offlimits_vertical.py`) so a regression on any write
-endpoint is caught immediately. The gates use `auth.require_contributor`
-as the canonical helper. The notification routing reuses the
 existing `chat_message_in_participated_thread` /
 `chat_reply_to_my_message` event kinds with `branch_name=null` on the
 fan-out row; the §15.7 reconciler and §15 inbox prose render
@@ -2607,13 +2595,7 @@ The follow-up session will refine this. A minimal starting set:
   trailing `rollback` step's events if any earlier step fails. The
   Graduate dialog opens this stream on confirm and renders the step
   stack from the events. The stream closes on success or on
-  rollback completion. Requires `auth.require_user` per v0.6.0
+  rollback completion.
-  (item #4): the step detail (repo name, PR number, rollback steps)
-  is operator-visible state and isn't part of the v0.3.0
-  anonymous-read contract for catalog and RFC bodies. The floor is
-  `require_user` (not `require_contributor`) so a write-muted
-  operator can still observe a graduation they kicked off before
-  being muted.
 - `GET  /api/rfcs/<slug>/blocking-prs` — list open meta-repo PRs
   against `rfcs/<slug>.md` per §13.2's precondition popover. Returns
   PR number, title, author, last-activity timestamp, and the

backend/app/api_graduation.py

@@ -520,16 +520,7 @@ def make_router(
 
     @router.get("/api/rfcs/{slug}/graduate/progress")
     async def graduate_progress(slug: str, request: Request):
-        # v0.6.0 (item #4): the progress SSE surfaces admin-internal step
+        del request
-        # detail (repo name, PR number, rollback steps) that isn't part of
-        # the v0.3.0 anonymous-read contract for catalog/RFC bodies. The
-        # corresponding POST /graduate is gated to RFC owners/arbiters and
-        # app admins/owners via `_can_graduate`; the read SSE shares that
-        # operator-visible surface, so it requires at least an
-        # authenticated viewer. We keep the floor at require_user (not
-        # require_contributor) so a write-muted operator can still observe
-        # the progress of a graduation they kicked off before being muted.
-        auth.require_user(request)
         state = _get_active(slug)
         if state is None:
             raise HTTPException(404, "No graduation in flight for this slug")

backend/tests/test_anon_offlimits_vertical.py

@@ -1,476 +0,0 @@
-"""v0.6.0 (roadmap item #4) — "anon discuss + contribute off-limits"
-vertical.
-
-A sweep-the-edges hardening release. The v0.3.0 release hid the write
-affordances from anonymous viewers; v0.5.0 added the PR-less discussion
-surface with its own write gate. v0.6.0 audits both: every write-shaped
-endpoint refuses anonymous callers with 401 (or 403 when the role check
-runs after the auth check), and every anonymous-read surface stays
-reachable.
-
-This test is the regression net for the audit. It walks each module's
-representative write endpoint as an anonymous client and asserts the
-401/403, then walks the same surfaces' representative read endpoints
-as anonymous and asserts the 200. The intent is breadth over depth:
-one assertion per write endpoint family is enough to catch a
-regression where someone strips the `auth.require_contributor` line.
-
-Endpoints covered (one or two from each module):
-
-  - api.py:          propose, decline (admin), withdraw,
-                     funder credentials POST/DELETE, funder consent
-                     POST/DELETE
-  - api_branches.py: promote-to-branch, start-edit-branch, metadata,
-                     manual-flush, visibility, grants POST/DELETE,
-                     threads POST, thread messages POST, resolve,
-                     chat-seen, change accept/decline/reask
-  - api_prs.py:      pr-draft, open-pr, seen, review, merge, withdraw,
-                     description, resolution-branch
-  - api_discussion.py: thread create, message post, resolve
-  - api_admin.py:    role POST, mute POST, allowlist POST/DELETE
-  - api_notifications.py: prefs POST, watch POST, mark-read POST,
-                          quiet-hours POST, user-mute POST/DELETE
-  - api_graduation.py: graduate POST, claim POST, progress GET
-
-The §15.7 reads (`/api/notifications`, `/api/watches`,
-`/api/users/me/*`) are per-user surfaces — they require an
-authenticated viewer by definition; an anonymous 401 on those reads is
-shape-correct, not a regression. The test does not assert reads on
-those.
-"""
-from __future__ import annotations
-
-import pytest
-
-# Reuse the fixture / session / fake-Gitea harness from Slice 1.
-from test_propose_vertical import (  # noqa: F401 — fixtures land via import
-    FakeGitea,
-    app_with_fake_gitea,
-    provision_user_row,
-    sign_in_as,
-    tmp_env,
-)
-from test_rfc_view_vertical import SEED_BODY, seed_active_rfc
-
-
-# ---------------------------------------------------------------------------
-# Tests
-# ---------------------------------------------------------------------------
-
-
-def test_anonymous_can_read_every_public_surface(app_with_fake_gitea):
-    """Per §14 / the v0.3.0 anonymous-read contract: the catalog, the
-    RFC view, the PR-less discussion surface, the philosophy page, and
-    the health probe must remain reachable for unauthenticated viewers.
-    This is the read side of the item #4 contract — the read surfaces
-    must NOT regress to require auth as the write gates tighten.
-    """
-    from fastapi.testclient import TestClient
-
-    app, fake = app_with_fake_gitea
-    with TestClient(app) as client:
-        provision_user_row(user_id=1, login="alice", role="contributor")
-        seed_active_rfc(fake, slug="ohm", title="OHM", body=SEED_BODY)
-
-        # No session cookie — viewer is anonymous.
-        client.cookies.clear()
-
-        # The five read surfaces an anonymous viewer must reach.
-        assert client.get("/api/health").status_code == 200
-        assert client.get("/api/philosophy").status_code == 200
-        assert client.get("/api/auth/me").status_code == 200
-        assert client.get("/api/rfcs").status_code == 200
-        assert client.get("/api/rfcs/ohm").status_code == 200
-        assert client.get("/api/rfcs/ohm/main").status_code == 200
-        assert client.get("/api/rfcs/ohm/discussion/threads").status_code == 200
-        assert client.get("/api/proposals").status_code == 200
-
-
-def test_anonymous_propose_refused(app_with_fake_gitea):
-    from fastapi.testclient import TestClient
-
-    app, _fake = app_with_fake_gitea
-    with TestClient(app) as client:
-        client.cookies.clear()
-        r = client.post(
-            "/api/rfcs/propose",
-            json={"title": "X", "slug": "x", "pitch": "p", "tags": []},
-        )
-        assert r.status_code == 401
-
-
-def test_anonymous_proposal_admin_paths_refused(app_with_fake_gitea):
-    """The admin-gated proposal actions — merge, decline — must refuse
-    anonymous callers with 401 (the auth check runs before the role
-    check; both refusals are correct, but 401 is the structural signal
-    "no session at all")."""
-    from fastapi.testclient import TestClient
-
-    app, _fake = app_with_fake_gitea
-    with TestClient(app) as client:
-        client.cookies.clear()
-        # PR number doesn't need to exist — the gate runs first.
-        assert client.post("/api/proposals/1/merge").status_code == 401
-        assert (
-            client.post("/api/proposals/1/decline", json={"comment": "no"}).status_code
-            == 401
-        )
-        assert client.post("/api/proposals/1/withdraw").status_code == 401
-
-
-def test_anonymous_branch_writes_refused_on_active_rfc(app_with_fake_gitea):
-    """Branch-scoped writes on an active RFC: promote-to-branch,
-    manual-flush, visibility, grants, threads create, message post,
-    resolve, chat-seen, change accept/decline/reask. All must 401 for
-    anonymous callers."""
-    from fastapi.testclient import TestClient
-
-    app, fake = app_with_fake_gitea
-    with TestClient(app) as client:
-        seed_active_rfc(fake, slug="ohm", title="OHM", body=SEED_BODY)
-        client.cookies.clear()
-
-        # Branch-scoped writes — slug + branch values are placeholders;
-        # the auth gate runs before any state lookup.
-        slug = "ohm"
-        branch = "feature-x"
-
-        assert (
-            client.post(
-                f"/api/rfcs/{slug}/branches/main/promote-to-branch",
-                json={},
-            ).status_code == 401
-        )
-        assert (
-            client.post(
-                f"/api/rfcs/{slug}/branches/{branch}/manual-flush",
-                json={"new_content": "hi", "paragraph_count": 1},
-            ).status_code == 401
-        )
-        assert (
-            client.post(
-                f"/api/rfcs/{slug}/branches/{branch}/visibility",
-                json={"read_public": False},
-            ).status_code == 401
-        )
-        assert (
-            client.post(
-                f"/api/rfcs/{slug}/branches/{branch}/grants",
-                json={"grantee_gitea_login": "alice"},
-            ).status_code == 401
-        )
-        assert (
-            client.delete(
-                f"/api/rfcs/{slug}/branches/{branch}/grants/alice",
-            ).status_code == 401
-        )
-        assert (
-            client.post(
-                f"/api/rfcs/{slug}/branches/{branch}/threads",
-                json={"thread_kind": "chat", "anchor_kind": "whole-doc"},
-            ).status_code == 401
-        )
-        assert (
-            client.post(
-                f"/api/rfcs/{slug}/branches/{branch}/threads/1/messages",
-                json={"text": "hi"},
-            ).status_code == 401
-        )
-        assert (
-            client.post(
-                f"/api/rfcs/{slug}/branches/{branch}/threads/1/resolve",
-            ).status_code == 401
-        )
-        assert (
-            client.post(
-                f"/api/rfcs/{slug}/branches/{branch}/chat-seen",
-                json={"last_seen_message_id": 1},
-            ).status_code == 401
-        )
-        assert (
-            client.post(
-                f"/api/rfcs/{slug}/branches/{branch}/changes/1/accept",
-                json={"proposed": "x"},
-            ).status_code == 401
-        )
-        assert (
-            client.post(
-                f"/api/rfcs/{slug}/branches/{branch}/changes/1/decline",
-            ).status_code == 401
-        )
-        assert (
-            client.post(
-                f"/api/rfcs/{slug}/branches/{branch}/changes/1/reask",
-            ).status_code == 401
-        )
-        # Chat stream — POST shaped, same auth gate.
-        assert (
-            client.post(
-                f"/api/rfcs/{slug}/branches/{branch}/threads/1/chat",
-                json={"text": "hi"},
-            ).status_code == 401
-        )
-
-
-def test_anonymous_super_draft_writes_refused(app_with_fake_gitea):
-    """Super-draft-scoped writes: start-edit-branch and metadata. The
-    PR open / merge paths share the gate via api_prs.py — see the
-    PR-flow test below for those."""
-    from fastapi.testclient import TestClient
-
-    app, _fake = app_with_fake_gitea
-    with TestClient(app) as client:
-        client.cookies.clear()
-        assert (
-            client.post(
-                "/api/rfcs/anything/start-edit-branch", json={}
-            ).status_code == 401
-        )
-        assert (
-            client.post(
-                "/api/rfcs/anything/metadata", json={"title": "x"}
-            ).status_code == 401
-        )
-
-
-def test_anonymous_pr_flow_writes_refused(app_with_fake_gitea):
-    """All §10 PR-flow writes — open, merge, withdraw, description,
-    review, seen, pr-draft, resolution-branch — must 401 for anonymous."""
-    from fastapi.testclient import TestClient
-
-    app, fake = app_with_fake_gitea
-    with TestClient(app) as client:
-        seed_active_rfc(fake, slug="ohm", title="OHM", body=SEED_BODY)
-        client.cookies.clear()
-        slug, branch, pr = "ohm", "feature-x", 1
-        assert (
-            client.post(
-                f"/api/rfcs/{slug}/branches/{branch}/pr-draft"
-            ).status_code == 401
-        )
-        assert (
-            client.post(
-                f"/api/rfcs/{slug}/branches/{branch}/open-pr",
-                json={"title": "t", "description": "d"},
-            ).status_code == 401
-        )
-        assert (
-            client.post(
-                f"/api/rfcs/{slug}/prs/{pr}/seen",
-                json={"last_seen_message_id": 1},
-            ).status_code == 401
-        )
-        assert (
-            client.post(
-                f"/api/rfcs/{slug}/prs/{pr}/review",
-                json={"text": "x", "anchor_payload": {}},
-            ).status_code == 401
-        )
-        assert (
-            client.post(
-                f"/api/rfcs/{slug}/prs/{pr}/merge"
-            ).status_code == 401
-        )
-        assert (
-            client.post(
-                f"/api/rfcs/{slug}/prs/{pr}/withdraw"
-            ).status_code == 401
-        )
-        assert (
-            client.post(
-                f"/api/rfcs/{slug}/prs/{pr}/description",
-                json={"title": "t", "description": "d"},
-            ).status_code == 401
-        )
-        assert (
-            client.post(
-                f"/api/rfcs/{slug}/prs/{pr}/resolution-branch"
-            ).status_code == 401
-        )
-
-
-def test_anonymous_discussion_writes_refused(app_with_fake_gitea):
-    """The v0.5.0 PR-less discussion surface — write gates must hold.
-    This duplicates the assertion in `test_discussion_vertical.py` and
-    keeps it here too as the canonical home for the item #4 audit."""
-    from fastapi.testclient import TestClient
-
-    app, fake = app_with_fake_gitea
-    with TestClient(app) as client:
-        seed_active_rfc(fake, slug="ohm", title="OHM", body=SEED_BODY)
-        client.cookies.clear()
-        assert (
-            client.post(
-                "/api/rfcs/ohm/discussion/threads",
-                json={"message": "drive-by"},
-            ).status_code == 401
-        )
-        assert (
-            client.post(
-                "/api/rfcs/ohm/discussion/threads/1/messages",
-                json={"text": "drive-by"},
-            ).status_code == 401
-        )
-        assert (
-            client.post(
-                "/api/rfcs/ohm/discussion/threads/1/resolve"
-            ).status_code == 401
-        )
-
-
-def test_anonymous_admin_writes_refused(app_with_fake_gitea):
-    """Admin surfaces — role, mute, allowlist — refuse anonymous.
-    The auth check runs before the require_admin role check, so the
-    response is 401."""
-    from fastapi.testclient import TestClient
-
-    app, _fake = app_with_fake_gitea
-    with TestClient(app) as client:
-        client.cookies.clear()
-        assert (
-            client.post(
-                "/api/admin/users/1/role", json={"role": "admin"}
-            ).status_code == 401
-        )
-        assert (
-            client.post(
-                "/api/admin/users/1/mute", json={"muted": True}
-            ).status_code == 401
-        )
-        assert (
-            client.post(
-                "/api/admin/allowlist", json={"email": "x@y.z"}
-            ).status_code == 401
-        )
-        assert (
-            client.delete("/api/admin/allowlist/x@y.z").status_code == 401
-        )
-        # Admin reads also gated.
-        assert client.get("/api/admin/users").status_code == 401
-        assert client.get("/api/admin/audit").status_code == 401
-        assert client.get("/api/admin/permission-events").status_code == 401
-        assert client.get("/api/admin/graduation-queue").status_code == 401
-        assert client.get("/api/admin/allowlist").status_code == 401
-
-
-def test_anonymous_notification_writes_refused(app_with_fake_gitea):
-    """Notification preference / watch / mark-read / user-mute writes —
-    all per-user surfaces, all require an authenticated viewer."""
-    from fastapi.testclient import TestClient
-
-    app, fake = app_with_fake_gitea
-    with TestClient(app) as client:
-        seed_active_rfc(fake, slug="ohm", title="OHM", body=SEED_BODY)
-        client.cookies.clear()
-        assert (
-            client.post(
-                "/api/users/me/notification-preferences",
-                json={"email_personal_direct": False},
-            ).status_code == 401
-        )
-        assert (
-            client.post(
-                "/api/users/me/quiet-hours",
-                json={"start": None, "end": None, "timezone": None},
-            ).status_code == 401
-        )
-        assert (
-            client.post("/api/rfcs/ohm/watch", json={"state": "watching"}).status_code
-            == 401
-        )
-        assert client.post("/api/notifications/1/read").status_code == 401
-        assert (
-            client.post("/api/notifications/read", json={}).status_code == 401
-        )
-        assert client.post("/api/users/1/notification-mute").status_code == 401
-        assert client.delete("/api/users/1/notification-mute").status_code == 401
-
-
-def test_anonymous_funder_writes_refused(app_with_fake_gitea):
-    """§6.7 funder credential + consent writes — registering a key,
-    consenting to fund — all refuse anonymous callers."""
-    from fastapi.testclient import TestClient
-
-    app, fake = app_with_fake_gitea
-    with TestClient(app) as client:
-        seed_active_rfc(fake, slug="ohm", title="OHM", body=SEED_BODY)
-        client.cookies.clear()
-        assert (
-            client.post(
-                "/api/users/me/funder/credentials",
-                json={"provider": "anthropic", "api_key": "sk-test"},
-            ).status_code == 401
-        )
-        assert (
-            client.delete(
-                "/api/users/me/funder/credentials/anthropic"
-            ).status_code == 401
-        )
-        assert (
-            client.post("/api/rfcs/ohm/funder/consent").status_code == 401
-        )
-        assert (
-            client.delete("/api/rfcs/ohm/funder/consent").status_code == 401
-        )
-
-
-def test_anonymous_graduation_writes_refused(app_with_fake_gitea):
-    """§13 graduation: the POST kickoff and POST claim both refuse
-    anonymous. The progress SSE was gated to require_user in v0.6.0
-    (item #4) since it surfaces admin-internal step detail."""
-    from fastapi.testclient import TestClient
-
-    app, _fake = app_with_fake_gitea
-    with TestClient(app) as client:
-        client.cookies.clear()
-        assert (
-            client.post(
-                "/api/rfcs/anything/graduate",
-                json={
-                    "rfc_id": "RFC-0001",
-                    "repo_name": "rfc-0001-x",
-                    "owners": ["alice"],
-                },
-            ).status_code == 401
-        )
-        assert client.post("/api/rfcs/anything/claim").status_code == 401
-        # v0.6.0 tightening: progress SSE now requires require_user.
-        # No graduation is in flight, but the auth check runs first.
-        assert (
-            client.get("/api/rfcs/anything/graduate/progress").status_code == 401
-        )
-
-
-def test_anonymous_can_read_published_pr_view(app_with_fake_gitea):
-    """The PR review page is §11.3 universal-public — once a PR is
-    open, anonymous viewers can read it. This guards against a
-    regression where the read endpoint accidentally grows an auth
-    gate."""
-    from fastapi.testclient import TestClient
-    from app import db
-
-    app, fake = app_with_fake_gitea
-    with TestClient(app) as client:
-        seed_active_rfc(fake, slug="ohm", title="OHM", body=SEED_BODY)
-        # Seed an open PR row directly — the cache shape is enough for
-        # the read endpoint; the live Gitea fetch falls back gracefully.
-        db.conn().execute(
-            """
-            INSERT INTO cached_prs
-                (rfc_slug, pr_kind, repo, pr_number, title, description, state,
-                 opened_by, opened_at, head_branch, base_branch, head_sha)
-            VALUES ('ohm', 'rfc_branch', 'wiggleverse/rfc-0001-ohm', 7, 't', 'd',
-                    'open', 'alice', datetime('now'), 'feature-x', 'main', 'sha7')
-            """
-        )
-        client.cookies.clear()
-        # Anonymous read on an open PR: should be 200. The endpoint may
-        # surface a partial response (the FakeGitea won't have the head
-        # branch's RFC.md, so branch_body falls back to empty) but the
-        # auth gate must let the read through.
-        r = client.get("/api/rfcs/ohm/prs/7")
-        assert r.status_code == 200
-        body = r.json()
-        assert body["capabilities"]["is_anonymous"] is True
-        assert body["capabilities"]["can_merge"] is False
-        assert body["capabilities"]["can_post_review"] is False