[arko33]

Hotfix from a real live-recording session: the playground crashed the moment a recording had no anomaly yet (anomaly.kind on undefined in AutopsyPanel) — the panel hardcoded the demo verdict (t4 / invoices.ts / +38 MB).

• AutopsyPanel: verdict is now data-driven (blame turn index + actually-touched files from the autopsy/anomaly), renders a calm "no anomaly detected — samples stayed inside every threshold" block when the recording has no breach, heals only when the recording says so (demo keeps its activeTurn-based story), and guards the case of no turn at the active position.
• Dashboard: guards undefined turn / empty snapshot list for early live recordings (no threshold breach yet, no checkpoint yet — GhostCity receives a valid empty snapshot instead of undefined).

Typecheck green; the demo fixture still renders exactly as before (same shape from data: anomaly kind/severity/blamed turn).

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
ghostinthecodebase	Ready	Preview	Oct 21, 2026 6:46pm UTC

[testsprite]

Caution

Widespread failures — 23 failed

The backend run looks weak overall: 1 test passed, while 23 tests failed. No tests were marked Blocked, so the score is computed on the full executable subset. The single passing case suggests at least one invoice retrieval path works, but the broad failure pattern indicates the API is not reliably satisfying the contract for authentication, authorization, validation, and record isolation. Most of the suite is concentrated around invoice access and creation, so these failures likely translate directly into broken user-facing billing flows and inconsistent security behavior.

Results: 1 passed • 23 failed • 24 total  ·  View Full Report ↗

23 failed tests

List invoices does not leak other users' invoice records or fields

Screenshot	Error details
—	TestSprite hit an internal error while running this test; our team has been notified. (ref: c59d63ca-4b88-4a3c-9346-6d11961f20cb)

---

Create an invoice then read it back

Screenshot	Error details
—	TestSprite hit an internal error while running this test; our team has been notified. (ref: c59d63ca-4b88-4a3c-9346-6d11961f20cb)

---

Get own seeded invoice by id as Alice

Screenshot	Error details
—	TestSprite hit an internal error while running this test; our team has been notified. (ref: c59d63ca-4b88-4a3c-9346-6d11961f20cb)

---

Create invoice with non-numeric amount returns 422 and creates nothing

Screenshot	Error details
—	TestSprite hit an internal error while running this test; our team has been notified. (ref: c59d63ca-4b88-4a3c-9346-6d11961f20cb)

---

Reject invoice listing without authentication

Screenshot	Error details
—	TestSprite hit an internal error while running this test; our team has been notified. (ref: c59d63ca-4b88-4a3c-9346-6d11961f20cb)

---

Reject unauthenticated invoice read

Screenshot	Error details
—	TestSprite hit an internal error while running this test; our team has been notified. (ref: c59d63ca-4b88-4a3c-9346-6d11961f20cb)

---

Reject missing auth before invoice existence is evaluated

Screenshot	Error details
—	TestSprite hit an internal error while running this test; our team has been notified. (ref: c59d63ca-4b88-4a3c-9346-6d11961f20cb)

---

Create invoice with missing customer returns 422 and creates nothing

Screenshot	Error details
—	TestSprite hit an internal error while running this test; our team has been notified. (ref: c59d63ca-4b88-4a3c-9346-6d11961f20cb)

---

Deny access when Alice reads Bob's invoice

Screenshot	Error details
—	TestSprite hit an internal error while running this test; our team has been notified. (ref: c59d63ca-4b88-4a3c-9346-6d11961f20cb)

---

Unknown x-user-id value returns 401 on POST /api/invoices

Screenshot	Error details
—	TestSprite hit an internal error while running this test; our team has been notified. (ref: c59d63ca-4b88-4a3c-9346-6d11961f20cb)

---

List bob's own invoices

Screenshot	Error details
—	TestSprite hit an internal error while running this test; our team has been notified. (ref: c59d63ca-4b88-4a3c-9346-6d11961f20cb)

---

List alice's own invoices

Screenshot	Error details
—	TestSprite hit an internal error while running this test; our team has been notified. (ref: c59d63ca-4b88-4a3c-9346-6d11961f20cb)

---

Create invoice without x-user-id returns 401 and no invoice is created

Screenshot	Error details
—	TestSprite hit an internal error while running this test; our team has been notified. (ref: c59d63ca-4b88-4a3c-9346-6d11961f20cb)

---

Return 404 for an unknown invoice id

Screenshot	Error details
—	TestSprite hit an internal error while running this test; our team has been notified. (ref: c59d63ca-4b88-4a3c-9346-6d11961f20cb)

---

List invoices with a real user session returns only that user's seeded invoice

Screenshot	Error details
—	TestSprite hit an internal error while running this test; our team has been notified. (ref: c59d63ca-4b88-4a3c-9346-6d11961f20cb)

---

Create invoice with malformed JSON body returns 400 invalid_json

Screenshot	Error details
—	TestSprite hit an internal error while running this test; our team has been notified. (ref: c59d63ca-4b88-4a3c-9346-6d11961f20cb)

---

Unauthenticated request to invoices endpoint should not reveal data even if caller is otherwise valid

Screenshot	Error details
—	TestSprite hit an internal error while running this test; our team has been notified. (ref: c59d63ca-4b88-4a3c-9346-6d11961f20cb)

---

Create and read invoice as Alice, ensuring owner isolation fields

Screenshot	Error details
—	TestSprite hit an internal error while running this test; our team has been notified. (ref: c59d63ca-4b88-4a3c-9346-6d11961f20cb)

---

Get own seeded invoice by id as Bob

Screenshot	Error details
—	TestSprite hit an internal error while running this test; our team has been notified. (ref: c59d63ca-4b88-4a3c-9346-6d11961f20cb)

---

Read a created invoice using the id captured from create

Screenshot	Error details
—	TestSprite hit an internal error while running this test; our team has been notified. (ref: c59d63ca-4b88-4a3c-9346-6d11961f20cb)

---

Reject invoice listing with unknown user identity

Screenshot	Error details
—	TestSprite hit an internal error while running this test; our team has been notified. (ref: c59d63ca-4b88-4a3c-9346-6d11961f20cb)

---

Unknown invoice id returns not_found even for authenticated user

Screenshot	Error details
—	TestSprite hit an internal error while running this test; our team has been notified. (ref: c59d63ca-4b88-4a3c-9346-6d11961f20cb)

---

Invoice list response shape is stable for seeded invoices

Screenshot	Error details
—	TestSprite hit an internal error while running this test; our team has been notified. (ref: c59d63ca-4b88-4a3c-9346-6d11961f20cb)

1 passed test

Test Case	Status	Screenshot
Invoice visibility and retrieval flow	Passed	—

Evaluation details

What could be better: The failures cluster around the invoice API contract. High-priority checks for authenticated access, owner isolation, and create/read round-trips all failed, including Reject unauthenticated invoice read, Deny access when Alice reads Bob's invoice, Get own seeded invoice by id as Alice, and Create an invoice then read it back. Validation coverage is also red: Create invoice with malformed JSON body returns 400 invalid_json, Create invoice with missing customer returns 422 and creates nothing, and Unknown x-user-id value returns 401 on POST /api/invoices all failed. Because the test harness reported only an internal error, the exact response mismatch is unclear, but the suite suggests the backend is not consistently enforcing auth and schema rules.

Recommended next steps: First, reproduce the invoice endpoints locally with the same seeded Alice/Bob identities and verify the auth middleware runs before resource lookup. Then audit GET /api/invoices, GET /api/invoices/:id, and POST /api/invoices for three things: 401 on missing/unknown x-user-id, 403 or 404 for cross-user reads, and 400/422 for malformed or incomplete create payloads. Fix any schema/validation mismatch so create does not persist bad data. After each change, rerun the invoice tests in batches, starting with the high-priority auth and owner-isolation cases. Use the fixPrompt panel below as the copy-ready checklist for the coding agent.

---

_{Automated end-to-end testing powered by}