[arko33]

The real-user gap that exposed it: ghost watch recorded to a file, but the playground only rendered the committed demo fixture. This PR closes it.

Ghost Studio — served by the recorder itself

• ghost watch now opens its own live page (http://127.0.0.1:5417, auto-opened in the browser): the session being recorded, in real time — repo, git head, turns (real prompts), checkpoints with per-file churn computed from the actual shadow-git patches, and runtime samples probed from the app.
• New loopback endpoints: GET /session (live JSON snapshot) and GET /diff/ (the stored patch). CORS-open but loopback-only, local by default.
• Recorder internals (.ghost/*) are filtered out of checkpoints so bookkeeping never becomes a city tower.

/playground?live=1 — the REAL 3D city from a REAL recording

• app/api/ghost/snapshot bridges the loopback recorder (same machine, npm run dev); /playground?live=1 polls it and renders the identical Dashboard/3D interface from the user's own recording — no fixture.
• src/ghost/adapter.ts adapts contract-v1 recordings into the dashboard Session: turns (real plugin ids + estimated fallback), cumulative snapshot towers where loc = churn ("height is churn" is now literally true), samples with MB normalization, then the autopsy engine runs on the real curves.
• engine.ts upgraded from the stub: first-breach detection per kind (mem/cpu/errors/latency), attribution grounded in the onset turn and the files it actually touched, honest wording ("recorded while in flight", not causal claims).
• city.ts generalizes: tower list derives from the recording, deterministic siting per path hash; the demo fixture city keeps its exact curated layout.

Docs: README CLI section documents Studio + ?live=1; landing quickstart step 03 updated.

Verified end-to-end on a scratch repo: OpenCode-style events + plain file edits → checkpoints attributed by turn, churn parsed per file, proxy green, studio 200, live page 200, diff endpoint serves the patch.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
ghostinthecodebase	Ready	Preview	Oct 21, 2026 6:39pm UTC

[testsprite]

Caution

Widespread failures — 23 failed

The backend run shows a mixed result set: 1 test passed and 22 failed, with no Blocked tests reported. Because the failures all share the same harness error reference, the executable subset effectively did not validate most API behavior, so the score is based on the observed executable subset only. The one passing invoice visibility/retrieval integration test suggests the core invoice flow may exist, but the suite is currently too noisy to confirm stability across auth, validation, ownership isolation, and 404 handling. Overall reliability appears low until the internal test-run failure is resolved and the failing paths can be exercised end to end.

Results: 1 passed • 23 failed • 24 total  ·  View Full Report ↗

23 failed tests

List invoices does not leak other users' invoice records or fields

Screenshot	Error details
—	TestSprite hit an internal error while running this test; our team has been notified. (ref: 5378bd71-606f-41be-abcd-66e42098ec8d)

---

Create an invoice then read it back

Screenshot	Error details
—	TestSprite hit an internal error while running this test; our team has been notified. (ref: 5378bd71-606f-41be-abcd-66e42098ec8d)

---

Reject invoice listing with unknown user identity

Screenshot	Error details
—	TestSprite hit an internal error while running this test; our team has been notified. (ref: 5378bd71-606f-41be-abcd-66e42098ec8d)

---

Create invoice with missing customer returns 422 and creates nothing

Screenshot	Error details
—	TestSprite hit an internal error while running this test; our team has been notified. (ref: 5378bd71-606f-41be-abcd-66e42098ec8d)

---

Get own seeded invoice by id as Bob

Screenshot	Error details
—	TestSprite hit an internal error while running this test; our team has been notified. (ref: 5378bd71-606f-41be-abcd-66e42098ec8d)

---

Create invoice with non-numeric amount returns 422 and creates nothing

Screenshot	Error details
—	TestSprite hit an internal error while running this test; our team has been notified. (ref: 5378bd71-606f-41be-abcd-66e42098ec8d)

---

Create and read invoice as Alice, ensuring owner isolation fields

Screenshot	Error details
—	TestSprite hit an internal error while running this test; our team has been notified. (ref: 5378bd71-606f-41be-abcd-66e42098ec8d)

---

List alice's own invoices

Screenshot	Error details
—	TestSprite hit an internal error while running this test; our team has been notified. (ref: 5378bd71-606f-41be-abcd-66e42098ec8d)

---

Unknown x-user-id value returns 401 on POST /api/invoices

Screenshot	Error details
—	TestSprite hit an internal error while running this test; our team has been notified. (ref: 5378bd71-606f-41be-abcd-66e42098ec8d)

---

Reject invoice listing without authentication

Screenshot	Error details
—	TestSprite hit an internal error while running this test; our team has been notified. (ref: 5378bd71-606f-41be-abcd-66e42098ec8d)

---

Return 404 for an unknown invoice id

Screenshot	Error details
—	TestSprite hit an internal error while running this test; our team has been notified. (ref: 5378bd71-606f-41be-abcd-66e42098ec8d)

---

Create invoice without x-user-id returns 401 and no invoice is created

Screenshot	Error details
—	TestSprite hit an internal error while running this test; our team has been notified. (ref: 5378bd71-606f-41be-abcd-66e42098ec8d)

---

Unauthenticated request to invoices endpoint should not reveal data even if caller is otherwise valid

Screenshot	Error details
—	TestSprite hit an internal error while running this test; our team has been notified. (ref: 5378bd71-606f-41be-abcd-66e42098ec8d)

---

Get own seeded invoice by id as Alice

Screenshot	Error details
—	TestSprite hit an internal error while running this test; our team has been notified. (ref: 5378bd71-606f-41be-abcd-66e42098ec8d)

---

Invoice list response shape is stable for seeded invoices

Screenshot	Error details
—	TestSprite hit an internal error while running this test; our team has been notified. (ref: 5378bd71-606f-41be-abcd-66e42098ec8d)

---

Reject unauthenticated invoice read

Screenshot	Error details
—	TestSprite hit an internal error while running this test; our team has been notified. (ref: 5378bd71-606f-41be-abcd-66e42098ec8d)

---

Unknown invoice id returns not_found even for authenticated user

Screenshot	Error details
—	TestSprite hit an internal error while running this test; our team has been notified. (ref: 5378bd71-606f-41be-abcd-66e42098ec8d)

---

List bob's own invoices

Screenshot	Error details
—	TestSprite hit an internal error while running this test; our team has been notified. (ref: 5378bd71-606f-41be-abcd-66e42098ec8d)

---

Reject missing auth before invoice existence is evaluated

Screenshot	Error details
—	TestSprite hit an internal error while running this test; our team has been notified. (ref: 5378bd71-606f-41be-abcd-66e42098ec8d)

---

Deny access when Alice reads Bob's invoice

Screenshot	Error details
—	TestSprite hit an internal error while running this test; our team has been notified. (ref: 5378bd71-606f-41be-abcd-66e42098ec8d)

---

List invoices with a real user session returns only that user's seeded invoice

Screenshot	Error details
—	TestSprite hit an internal error while running this test; our team has been notified. (ref: 5378bd71-606f-41be-abcd-66e42098ec8d)

---

Read a created invoice using the id captured from create

Screenshot	Error details
—	TestSprite hit an internal error while running this test; our team has been notified. (ref: 5378bd71-606f-41be-abcd-66e42098ec8d)

---

Create invoice with malformed JSON body returns 400 invalid_json

Screenshot	Error details
—	TestSprite hit an internal error while running this test; our team has been notified. (ref: 5378bd71-606f-41be-abcd-66e42098ec8d)

1 passed test

Test Case	Status	Screenshot
Invoice visibility and retrieval flow	Passed	—

Evaluation details

What could be better: The main weakness is test execution integrity: nearly every invoice test failed with the same message, "TestSprite hit an internal error while running this test; our team has been notified. (ref: 5378bd71-606f-41be-abcd-66e42098ec8d)", which prevented meaningful verification of API correctness. That obscures whether the backend has actual defects in authentication, request validation, and authorization or whether the harness/environment is unstable. The suite targeted critical behaviors such as POST /api/invoices, GET /api/invoices, missing auth handling, unknown user identity, and unknown invoice IDs, but the results do not yet separate product bugs from test infrastructure failure.

Recommended next steps: First, resolve the test harness/internal execution issue behind ref 5378bd71-606f-41be-abcd-66e42098ec8d so the invoice suite can run to completion. Then re-run the invoice tests in smaller groups: authentication (Reject unauthenticated invoice read, Create invoice without x-user-id returns 401 and no invoice is created), validation (Create invoice with malformed JSON body returns 400 invalid_json, Create invoice with non-numeric amount returns 422 and creates nothing), and ownership/read-after-write (Create an invoice then read it back, Get own seeded invoice by id as Alice/Bob). Once the harness is stable, inspect any remaining status-code or schema mismatches and fix the backend route/validation logic accordingly. See the fixPrompt panel for a copy-ready checklist.

---

_{Automated end-to-end testing powered by}