Skip to content

docs: final README pass #3

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
arko33 merged 1 commit into from
Oct 21, 2026
Merged

docs: final README pass #3

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
42 changes: 18 additions & 24 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -147,9 +147,10 @@ observation:

- `GET /api/invoices` — list invoices for the caller (`x-user-id` header).
- `POST /api/invoices` — create an invoice.
- `GET /api/invoices/:id` — **BOLA / IDOR** when `SECURE_MODE=off`: returns any
invoice regardless of owner. With `SECURE_MODE=on`, a cross-owner read returns
`403`.
- `GET /api/invoices/:id` — owner-scoped read. Cross-owner returns `403`, a
missing id returns `404`, no header returns `401`.
- `GET /api/health` — runtime probe: cpu, rss, heap, uptime.
- `GET /api/autopsy` — the autopsy engine over the recorded demo session.

Seed data is deterministic: users `alice` and `bob`, invoice `inv-1001` owned by
`alice`.
Expand Down Expand Up @@ -180,38 +181,31 @@ required check: a red suite blocks the merge.
| 13 | Create unauthenticated | `POST /api/invoices` | `401`, nothing created |

Run the same suite locally with `npx @testsprite/testsprite-cli ci run --project aa7e92b6-93ed-43a2-8cdf-9d4889269c86 --env default`.
That is the **catch** half of the demo; flipping the gate to `on` is the **green**
half. No verdict is ever fabricated in this repository — the suite is authored in
the portal against the deployed URL and executed by the GitHub App.
That is the **catch** half of the demo; enforcing ownership is the **green**
half. No verdict is ever fabricated in this repository: the suite lives in the
TestSprite 3.0 project and is executed against the deployed URL by the `TestSprite`
workflow.

---

## Wiring TestSprite (catch, then green)

| PR | Change | `SECURE_MODE` | Suite |
| --- | --- | --- | --- |
| #1 | Scaffold, dashboard, 3D city | `off` | red — BOLA is caught |
| #2 | Ownership check on `GET /api/invoices/:id` | `on` | green — same suite passes |
| #3 | Polish, health endpoint, legend | `on` | green — regression guard holds |
## Wiring TestSprite

Install the GitHub App from the TestSprite dashboard, enable **Run on Pull
Requests** and **Blocking PRs**, and every pull request gets a status check that
holds the merge.
| PR | Change | Suite |
| --- | --- | --- |
| [#1](https://github.com/arko33/ghostinthecodebase/pull/1) | Scaffold, dashboard, 3D city, capture path | shipped the hole |
| [#2](https://github.com/arko33/ghostinthecodebase/pull/2) | Ownership check on `GET /api/invoices/:id` | green, 13/13 |

---
The gate is [`.github/workflows/testsprite.yml`](.github/workflows/testsprite.yml):
it runs the suite with the official CLI on every pull request and holds the merge.

## Status

| Area | State |
| --- | --- |
| Landing, playground, 3D city | done |
| Live target API + BOLA demo | done |
| TestSprite suite + GitHub App | pending — authored in the 3.0 portal |
| Shadow-git collector, metrics runner, autopsy engine | done — see the capture path |
| Live target API + BOLA demo | done, `bob` gets 403 after #2 |
| TestSprite suite (13 cases) | done, green on every PR |
| Shadow-git collector, metrics runner, autopsy engine | done |
| MCP read-only surface (`get_autopsy`) | planned |

---

## Credits

Built for **TestSprite Season 4**. Stack: Next.js 14, React 18, three.js,
Expand Down
Loading