Ben Stull
21743a08b1
Sweep-the-edges hardening release (roadmap item #4). Audits every write-shaped backend endpoint to confirm each one enforces an explicit auth.require_contributor (or stricter) gate before doing state-changing work; adds a regression test net (test_anon_offlimits_vertical.py, 12 tests, 66 assertions) so future endpoints can't quietly ship without a gate. The only behaviour change: GET /api/rfcs/<slug>/graduate/progress now requires auth.require_user since the step detail (repo name, PR number, rollback steps) isn't part of the v0.3.0 anonymous-read contract. No schema, no env, no dependency changes; operator action is rebuild + restart per CHANGELOG §0.6.0 upgrade steps. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2 lines
6 B
Plaintext
2 lines
6 B
Plaintext
0.6.0
|