[arko33]

Author refactor, applied exactly as written:

• /city extracted out of ghost.mjs into packages/ghost/lib/{city.mjs, city-client.mjs, city.css} — recorder stays a thin server layer (-249 lines there).
• shadowgit: 'git add -A' now excludes .ghost/* (recorder bookkeeping must never be staged — it bloats every snapshot and could eventually blow the diff buffer, silently stopping city growth); diff maxBuffer raised 16MB → 64MB; changed-files listing narrowed.
• .gitignore: ignore .ghost/ state at the repo root.
  node --check green on ghost.mjs, city.mjs, city-client.mjs, shadowgit.mjs.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
ghostinthecodebase	Ready	Preview	Oct 21, 2026 7:59pm UTC

[testsprite]

Caution

Widespread failures — 23 failed

The executable portion of this backend suite shows 1 passed test and 24 failed tests, with no frontend coverage. Because every failure reported the same TestSprite internal error reference, the score is computed on the executable subset but the run is still heavily degraded by the failure pattern. The one passing integration test suggests at least one happy-path invoice flow is working, but the broader API surface around auth, listing, creation, and negative cases is not being validated successfully. The repeated failures indicate either a harness-wide issue or a backend problem severe enough to disrupt most invoice scenarios.

Results: 1 passed • 23 failed • 24 total  ·  View Full Report ↗

23 failed tests

Reject unauthenticated invoice read

Screenshot	Error details
—	TestSprite hit an internal error while running this test; our team has been notified. (ref: be81f98f-487f-4e34-b698-0f604a6ff742)

---

List invoices does not leak other users' invoice records or fields

Screenshot	Error details
—	TestSprite hit an internal error while running this test; our team has been notified. (ref: be81f98f-487f-4e34-b698-0f604a6ff742)

---

Create invoice with non-numeric amount returns 422 and creates nothing

Screenshot	Error details
—	TestSprite hit an internal error while running this test; our team has been notified. (ref: be81f98f-487f-4e34-b698-0f604a6ff742)

---

Reject invoice listing without authentication

Screenshot	Error details
—	TestSprite hit an internal error while running this test; our team has been notified. (ref: be81f98f-487f-4e34-b698-0f604a6ff742)

---

Reject missing auth before invoice existence is evaluated

Screenshot	Error details
—	TestSprite hit an internal error while running this test; our team has been notified. (ref: be81f98f-487f-4e34-b698-0f604a6ff742)

---

Return 404 for an unknown invoice id

Screenshot	Error details
—	TestSprite hit an internal error while running this test; our team has been notified. (ref: be81f98f-487f-4e34-b698-0f604a6ff742)

---

Get own seeded invoice by id as Alice

Screenshot	Error details
—	TestSprite hit an internal error while running this test; our team has been notified. (ref: be81f98f-487f-4e34-b698-0f604a6ff742)

---

Unknown x-user-id value returns 401 on POST /api/invoices

Screenshot	Error details
—	TestSprite hit an internal error while running this test; our team has been notified. (ref: be81f98f-487f-4e34-b698-0f604a6ff742)

---

Create invoice with malformed JSON body returns 400 invalid_json

Screenshot	Error details
—	TestSprite hit an internal error while running this test; our team has been notified. (ref: be81f98f-487f-4e34-b698-0f604a6ff742)

---

Deny access when Alice reads Bob's invoice

Screenshot	Error details
—	TestSprite hit an internal error while running this test; our team has been notified. (ref: be81f98f-487f-4e34-b698-0f604a6ff742)

---

List bob's own invoices

Screenshot	Error details
—	TestSprite hit an internal error while running this test; our team has been notified. (ref: be81f98f-487f-4e34-b698-0f604a6ff742)

---

Unknown invoice id returns not_found even for authenticated user

Screenshot	Error details
—	TestSprite hit an internal error while running this test; our team has been notified. (ref: be81f98f-487f-4e34-b698-0f604a6ff742)

---

Create an invoice then read it back

Screenshot	Error details
—	TestSprite hit an internal error while running this test; our team has been notified. (ref: be81f98f-487f-4e34-b698-0f604a6ff742)

---

List invoices with a real user session returns only that user's seeded invoice

Screenshot	Error details
—	TestSprite hit an internal error while running this test; our team has been notified. (ref: be81f98f-487f-4e34-b698-0f604a6ff742)

---

Create invoice without x-user-id returns 401 and no invoice is created

Screenshot	Error details
—	TestSprite hit an internal error while running this test; our team has been notified. (ref: be81f98f-487f-4e34-b698-0f604a6ff742)

---

List alice's own invoices

Screenshot	Error details
—	TestSprite hit an internal error while running this test; our team has been notified. (ref: be81f98f-487f-4e34-b698-0f604a6ff742)

---

Reject invoice listing with unknown user identity

Screenshot	Error details
—	TestSprite hit an internal error while running this test; our team has been notified. (ref: be81f98f-487f-4e34-b698-0f604a6ff742)

---

Create invoice with missing customer returns 422 and creates nothing

Screenshot	Error details
—	TestSprite hit an internal error while running this test; our team has been notified. (ref: be81f98f-487f-4e34-b698-0f604a6ff742)

---

Get own seeded invoice by id as Bob

Screenshot	Error details
—	TestSprite hit an internal error while running this test; our team has been notified. (ref: be81f98f-487f-4e34-b698-0f604a6ff742)

---

Create and read invoice as Alice, ensuring owner isolation fields

Screenshot	Error details
—	TestSprite hit an internal error while running this test; our team has been notified. (ref: be81f98f-487f-4e34-b698-0f604a6ff742)

---

Unauthenticated request to invoices endpoint should not reveal data even if caller is otherwise valid

Screenshot	Error details
—	TestSprite hit an internal error while running this test; our team has been notified. (ref: be81f98f-487f-4e34-b698-0f604a6ff742)

---

Read a created invoice using the id captured from create

Screenshot	Error details
—	TestSprite hit an internal error while running this test; our team has been notified. (ref: be81f98f-487f-4e34-b698-0f604a6ff742)

---

Invoice list response shape is stable for seeded invoices

Screenshot	Error details
—	TestSprite hit an internal error while running this test; our team has been notified. (ref: be81f98f-487f-4e34-b698-0f604a6ff742)

1 passed test

Test Case	Status	Screenshot
Invoice visibility and retrieval flow	Passed	—

Evaluation details

What could be better: The main problem is the repeated failure pattern across auth, retrieval, listing, and validation tests, all surfacing the same internal error reference be81f98f-487f-4e34-b698-0f604a6ff742. That makes it hard to distinguish a product bug from a test harness or environment failure, but it still means critical invoice coverage did not complete. The highest-priority scenarios affected include unauthenticated reads, unknown-user handling, POST /api/invoices validation, and access control for Alice/Bob invoice isolation. The suite currently provides little confidence in authorization correctness or request validation behavior because almost every case failed before yielding a product-specific assertion.

Recommended next steps: First, determine whether the shared TestSprite internal error is coming from the harness/environment or from a backend crash path, because the current failures are too uniform to isolate product defects confidently. Then re-run the invoice auth and validation subset focusing on the scenarios that should produce concrete HTTP outcomes: unauthenticated invoice read/list/create, unknown x-user-id, malformed JSON, non-numeric amount, missing customer, and cross-user invoice access. If the backend is healthy, fix any route or middleware issues that prevent these endpoints from returning the expected 401/404/422 responses. After each fix, re-run the matching tests and compare against the titled cases in the test list.

---

_{Automated end-to-end testing powered by}