10 Commits

Include renames

Author	SHA1	Message	Date
JesseMarkowitzandClaude Opus 5	7f082b61d8	M3: complete non-destructive history and active-head export ... The head-cursor model landed in 903fa7a and stopped there: the backend moved the head instead of deleting turns, but a bundle still reopened at its newest row, the browser had no way forward, and five inherited tests still asserted the contract Undo had just stopped honouring. This is the rest of the milestone, plus the one unsafe operation the review found. Export now writes headDepth, and it belongs on the other side of the rule app/bundle.py states about itself. The head depth used to be derived — the tip of the head branch, a fact about the nodes that arrived with it — and that was true while Undo deleted, because the newest row was the only place a story could be read. It is a decision now: the same tree exports identically whether the user undid three turns or none, so the file has to say. An import that ignored it would silently Redo the story to its newest retained turn, which is the Phase 0B export finding this milestone exists to close. A file with no headDepth is opened at the tip, which is not a fallback but the position such a file recorded; a file naming a depth its own rows do not reach is refused in plan(), before a row is written, for the reason that module gives about half-written trees. Which branches the story has left goes into the file for the same reason. Every row of an abandoned line arrives on an import either way, so the disposition is the only thing telling it apart from an active one, and a restored backup that had lost it would have nothing for the later cleanup and recovery screens to select on. Both keys or neither: a time with no depth cannot say what was displaced. The browser gets a Redo button beside Undo, on Ctrl+Shift+Z, and both are enabled from can_undo/can_redo rather than from the transcript. Neither is derivable on the client — Undo stops at the campaign opening, which may be off the top of the loaded window, and Redo depends on the retained future, which the client is never sent — so the flags now ride on every window the server hands back, including a scrolled-up page and the response to an import. Moving the head also refreshes the state panels, which undo never did: it has rolled the world state back since long before M3 and the drawer kept showing the old numbers. An in-place edit is now refused when story descends from the turn and is not on screen. Editing rewrites one row and re-evaluates nothing, which is what makes it a correction rather than a continuation, and that is harmless while everything below the turn is visible — the reader can see what their change has to agree with. It stops being harmless when the continuation is undone, or was left behind by a divergence, because the edit then silently changes the words an invisible stretch of story was written from. That was the one way M3's retained history could be made to contradict itself. Refusing is deliberately the whole of the fix: making such an edit fork is STORY-BRANCH-SEMANTICS.md §14-15, and §15 wants the state the edited prose implies re-evaluated, which is M5's extraction pass. The requirement is not weakened, only deferred, and §14A now says so. The predicate asks one question rather than two. A descendant is invisible either because it is past the head on this lineage or because it is past a fork on a branch the story left, and both are "a live node, deeper than this one, descending from it, off the path being read". A first attempt scoped the search to branches other than the active one and failed the divergence case, correctly: the departed branch is usually an ancestor of the branch now being read. Only the deepest live node on each descending branch is examined, because visibility is monotone in depth. Five inherited tests are rewritten rather than deleted, because what they were protecting is still worth protecting and only the mechanism changed. The undo-state pair keeps its state assertions and swaps "the rows are gone" for "the rows are all here and the story is read from earlier". The memory test stops asserting that undo prunes memories and starts asserting the property that replaced it: a memory past the head is unreachable, still on disk, and retrievable again after Redo, with no re-embedding. The attempt-group test still proves the group moves as one, out of the story rather than out of the database. And the fork test reverses: Undo used to refuse at a fork point because it deleted rows the parent branch was also reading, and with nothing deleted there is nothing to protect the parent from, so it now walks into the story the branch inherits and stops at the campaign opening instead. tests/test_head_cursor.py is the milestone's acceptance contract, named by the items it discharges: D01-D10, E01-E04, I01-I03, I07, L01-L02, and the invariant they all rest on — Undo deletes zero accepted turns, asserted on row ids over the whole retained tree. E02 has both controls, because a negative control alone would pass if memory retrieval were simply broken. L01 records what it does not claim: the head does move by one on a failed turn, onto the player's retained input, which is A05 rather than a gap. Two of the edit-guard tests exist to prove the guard stays out of the way — a correction at the tip and a correction mid-story with everything visible must both still work. 638 backend tests pass. Frontend lint is unchanged at seven pre-existing warnings, none in the files touched; the bundle builds at 395.85 kB; the production image builds. Verified at runtime against the trusted-LAN Ollama over HTTPS: three turns, two Undos, a Redo, a Retry, an Undo, a divergent continuation, Redo correctly refused with 400, Undo back to the opening, export, a process restart that reopened the campaign still undone, and an import that opened at the same position with its retained future intact. The browser click-through of that sequence has not been run — no session in this milestone had a browser to drive — so the Redo control itself is verified by its endpoint and its lint and build, not by a click. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01QF5TcoB86QADgjHz1GZe8u	2026-09-03 13:54:43 -04:00
JesseMarkowitz	8c65ae99de	M2: cut the hosted product away from the local one ... 94 files, +1,395 -6,578. Three files are new; twenty-four are gone. The milestone is subtraction, and what is left is the single-user local storyteller the specification describes. Removed in full: campaign scripting and its QuickJS sandbox; multi-user accounts, guest sessions, login, registration and the shared demo key; the visitor-analytics tables, dashboard and page beacon; the access log of sign-ins, addresses and devices; per-IP and per-user rate limiting and quotas; Render deployment config; Postgres and psycopg; cloud inference providers, the API-key field and the key encryption that existed to store it; session-cookie signing. None of it was hidden behind a flag — the routes are gone and answer 404. Two things were kept that the brief allowed keeping. The `users` table and its foreign keys stay as an internal ownership detail, because rewriting them out means a migration across most of the schema to delete a column that costs nothing; nothing creates a second user and no request carries an identity. Five inert tables and four inert columns stay for the same reason, so an M1 campaign database opens unchanged. The one addition is app/endpoints.py, which decides where a story may be sent. Loopback, RFC1918, link-local, unique-local and CGNAT — an explicit allowlist of networks, not a guess at what `ipaddress` means by "private", which calls the documentation ranges private and IPv6 loopback reserved. Every address a hostname resolves to must be in it, so a split answer does not squeak through, and the rule runs both when the endpoint is saved and before every outbound request, because a name that resolved to the LAN this morning can resolve elsewhere this afternoon. Known cloud hosts are named in the refusal so the error says why rather than looking like broken DNS. TLS is never traded against it: M1's shared trust context is intact on all four clients and there is no way to skip verification. The hardcoded 120-second model timeout is now a setting. That was not theoretical — on this GPU-less four-core host a cold load of qwen2.5:3b-instruct took 648.9 seconds to produce the first turn, while turns 2 to 5 of the same campaign took 3.6 to 13.1. Connect stays short at 10s so a wrong address still fails fast; the read timeout defaults to 300s and is bounded at 3600, because "wait longer" must stay a number. Two defects found while testing and fixed here. An unknown /api path fell through the SPA catch-all and came back as HTML with status 200, so a client asking for JSON parsed a web page instead of learning the route was gone. And AIDND_CORS_ORIGINS accepted "*", which on an unauthenticated loopback API would hand every page on the Internet a write handle on the campaign database; it now refuses to start. Verified rather than assumed. Offline, on a network with no route out and no DNS: five turns, retry with both takes retained, restart with an identical transcript digest, a failed model call leaving the accepted AI-turn count untouched, and a capture with zero non-loopback unicast packets. Against a real second machine on the LAN over HTTPS with a private CA: four turns, restart, and a capture showing 289 packets to the approved host, 344 loopback, zero anywhere else, zero DNS queries. Cloud and public endpoints refused with their reasons; no API key settable; every removed route 404. 604 backend tests pass, down from 648 by the fifteen retired with the subsystems they tested and up by the twenty-nine added for the endpoint policy and the removed surface. The scripting tests were not deleted: eight files used a JavaScript counter as instrumentation for the state snapshot and rollback machinery, which M2 does not touch, so the counter moved to the world-state engine and those tests still assert what they always did. Frontend lint and build are clean; the image builds, and its wheel-building stage is gone with quickjs. No M3 work. Undo is still destructive and there is still no Redo.	2026-09-02 11:27:14 -04:00
parththakkar106andClaude Opus 5	f1bebe18d0	Drop the eight legacy columns SP8 left behind ... Migrations 66 to 73 drop `actions.index`, `variants`, `variant_index`, `variant_count`, `state_before`, and `world_state_before`, plus `adventures.memory_cursor` and `summary_cursor`. `index` is a keyword in SQLite, so migration 71 quotes it. Nothing outside the migrations read these. `models.py`, `schemas.py`, and `ACTION_LIST_COLUMNS` lose the same eight fields, `Adventure.actions` orders by `id`, and `attempts.renumber`, `context.history.max_action_index`, and `nodes.next_index` are deleted. Two changes keep the migration replayable on a `create_all` database: - `_split_variants_into_siblings` wrote through the live ORM table, so it stopped compiling once migration 66 removed five of its columns. It now writes through `_ACTIONS_AT_60`, a frozen `Table` with its own `MetaData`. - Five data passes read columns these migrations drop. Each now calls `_has_columns` and returns early when the columns are absent. `bootstrap` takes a `through` version so a migration test can stop at the schema it asserts on. 555 tests pass, up from 549. Eight of the new cases assert each column is gone after a real schema-45 database migrates all the way. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0198qDK3gmgSo7EtQ4GTPqqK	2026-08-29 17:15:49 +05:30
parththakkar106andClaude Opus 5	2fa812c056	Split the adventures router into a package ... `backend/app/routers/adventures.py` held 2353 lines and 35 endpoints. It is now a package of 14 modules, the largest 443 lines. The split moves text rather than rewriting it. An AST comparison against the old file confirms all 86 definitions are identical, and the OpenAPI schema still lists the same 35 operations. Names a test replaces now live in `turns.py` only, and other modules reach them as `turns.<name>`. Rebinding a re-exported alias changes the alias and leaves every caller reading the original, so the package root does not re-export them. A patch aimed at the old target raises `AttributeError` instead of passing while doing nothing. Tests and the fixtures in `backend/tools/` say `adventures.turns.<name>`. The same rule keeps the turn lock working. One module owns `_active_turns`, so one lock guards one set. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014Dix4oGV3njgWRdu7P9t6r	2026-08-29 01:05:50 +05:30
parththakkar106andClaude Opus 5	32cd7c1077	Give the tests one setup instead of thirty-five ... Every test module carried the same eight-line prologue redirecting the database to a temp file. Only the first one to be imported ever took effect: `app.database` reads `AIDND_DB_PATH` at import and builds `engine` from it once, so by the time the second module ran the engine already existed. The other 34 copies created a temp file that nothing opened and nothing deleted, and leaked one per module per run. `conftest.py` now does it once, which is early enough because pytest imports conftest before any test module. It also deletes the file when the run ends. The tests still share one database, exactly as they already did: each `client` fixture calls `create_all` on setup and `drop_all` on teardown, so no test sees another test's rows. `tests/fakes.py` holds the one `ScriptedProvider`. Nine modules each had a copy, and the copies had drifted into four feature sets, so a test that needed to raise a provider error had to be written in one of the files whose copy supported that. The shared one is the superset. The two `FakeProvider` copies were the same class with a fixed reply, so they use it too. `test_chat.py` keeps its own, which implements `chat` rather than `generate` and records what it was constructed with. An autouse fixture resets the fake's class state between tests, so a stale reply list can no longer reach the next test. 435 lines out of the suite. 549 tests pass. Verified live by sabotage: breaking the shared fake fails 13 tests across four modules. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014Dix4oGV3njgWRdu7P9t6r	2026-08-29 00:47:46 +05:30
Parth	e7d75c3b05	Rewrite Python comments in Google developer documentation style (#12) ... * Rewrite comments in Google developer documentation style Rewrite the comments and docstrings across the backend core modules so they read plainly. The previous prose was accurate but dense and figurative, which made it slow to skim. Applies the Google developer documentation style guide: short sentences, active voice, present tense, American spelling, and no metaphors, idioms, or rhetorical asides. Replaces em-dash chains with separate sentences.	2026-08-26 15:37:25 +05:30
parththakkar106andClaude Opus 5	a408c7b6f7	Lay the prompt out so the endpoint can cache most of it ... Prompt caching bills on a shared prefix: the endpoint reuses the request up to the first byte that differs from last time and no further. The live world-state block sat third from the top of the system message, so every turn re-priced the instructions, the plot essentials and the whole story history underneath it. The retrieved memories and the rewritten summary did it again. Everything fixed is emitted first now, and everything that moves goes after the history, ordered least-volatile first — which is also where recency serves it best, the reasoning that already put the emit reminder last. The three tail sections that are last for their own reasons stay last. The moved sections are still charged to the token budget; only their position changed. Two smaller halves of the same problem. OpenRouter serves a model from whichever upstream is free and each upstream holds its own cache, so a deepseek model now names deepseek as its preferred upstream — a preference, not a restriction, so a turn still runs if that upstream is down. And the endpoint's usage block is read back off the response and kept per attempt, so the hit rate shows up in Insights and the debug log instead of being assumed. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DfMCsN1KBLsTqMkj5hSgrY	2026-08-23 06:31:30 +05:30
parththakkar106andClaude Opus 5	4af6e17406	Answer the review, and keep the opening node's bank ... Nine findings from a review of the phase-14 stack. The one about a retry withdrawing a memory is not a bug — a memory anchored to a node describes that node, and it goes when the node goes. The root is the exception, and it is the only one: migration 62 parked every memory written before memories had coordinates on depth 0, so withdrawing the opening node would retire a whole bank nobody attached there. A memory with no source range covers no story and now stays; a summary that genuinely ends there is still withdrawn. The rest are repairs. * The adventure list quoted whichever attempt was written last rather than the one the story tells, so switching back left the index disagreeing with the page. * A v1 import gave a typed memory no depth, rebuilding the NULL the migration exists to remove — invisible until the imported adventure forked. * The action cap counted a v1 file's turns, and a turn expands into a row per saved attempt, so a file inside the cap could write a multiple of it. * Forking a live node on a borrowed ancestor promoted a sibling on a branch the caller never named. It is a branch switch, and now says so. * Switching attempts left the state, status and memory panels reading the previous take: the story does not change length, so nothing keyed on its length noticed. Same class as the branch-switch bug this phase already fixed. * A retry after switching back numbered the new attempt into the middle of the group instead of the end. * The cursor backfill numbered every action in the table once per adventure; correlated to the adventure being updated, it is an index lookup instead. * Renaming a branch answered own_actions=0. And one behaviour change recorded rather than repaired: script-visible history and actionCount no longer count blank-text rows. That is the right shape and there is no reading compatible with both, so plan/14 says so. 409 tests. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015H5qiyiR7gtFQaoDphHZ3g	2026-08-18 19:14:07 +05:30
parththakkar106andClaude Opus 5	a7bf47a35e	Let a backup carry a story that went two ways ... A bundle had one list and a forked adventure has two stories, so export was emitting every branch's turns interleaved by index — a mangled story rather than lost data, and unreachable only because forking has no UI yet. `ai-dnd-adventure-v2` carries the branches, the depth each one left its parent at, which attempt at every turn is the story, and what each node left behind. That last one is not decoration: the after-snapshots are what a branch switch puts back, and a bundle without them imports a tree nobody can switch inside. `app/bundle.py` owns both formats and nothing else knows either. The v1 reader stays — those files are already on people's disks — and it is now the only place a `variants` array exists anywhere. The rule the module is built on is that a bundle carries what was chosen and never what is derived. The head branch, the fork points, the live flags and the anchors are decisions somebody made. The lineage, the head depth, the legacy `index` and the variant ordinals are computed from those and are rebuilt on the way in, because a bundle is a text file anybody can edit and a derived field shipped beside its source is a chance for the file to disagree with itself where no read would report it. `index` is the one that stops being academic here. It agreed with `depth` until SP5, and this is the first writer that has to fill it for a forked story, where two branches both hold a node at depth 4. It is allocated one per turn instead: siblings share it, no two coordinates do. Everything a hand-edited file can get wrong about the shape of a tree is a 400 raised before the adventure row exists, because a half-applied import is exactly the failure this phase exists to end — a story that goes quiet. A file wrong about which attempt is live is corrected rather than refused; that is an invariant of the database, not of the format. Measured on the 600-action fixture: 587 kB to 911 kB, and all of the increase is the outcomes at 489 B a node — the coordinates themselves save 57.5 B a node against the old turn-and-variants shape. Twenty forks add 660 B. 4.3% of the import body cap. 381 tests green, 16 of them new in test_bundle_v2.py. No migration, no vacuum owed. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015H5qiyiR7gtFQaoDphHZ3g	2026-08-18 19:14:07 +05:30
parththakkar106andClaude Opus 5	0a12d9cd47	Make a retry a node, not a rewrite ... Every attempt at a turn is now its own row at the same (branch, depth), with `live` naming the one the story tells. The JSON repeating group on `actions.variants` is read one last time, by a migration that writes it out as the sibling rows it always described, and then goes unread. The snapshots turn around with it: an action carries the state it left behind rather than the state it started from, because attempts at one turn share a starting position and differ exactly in their outcome. Rolling back is "what the node in front left behind", one lookup on the path, and it is what undo and retry now both read. And the memory holdback goes. It existed because retry rewrote a row under a mark that had already moved past it; a retry writes a sibling now, and replacing what a coordinate says withdraws what was derived from it — the same repair undo and delete already made. The assembled prompt is still stored once per turn: it moves with the live flag, so a superseded attempt keeps only the few hundred bytes that were its own. Measured on the 600-action fixture: 700 rows for the same 600-turn story, prompt archive byte-identical at 0.50 MB, index 1.8 kB and page load 62.7 kB unmoved. 347 tests green. `tests/test_story_tree_baseline.py` and `tests/test_retry_variants.py` pass unmodified — SP4 was allowed to move the baseline for the variant-count semantics and did not need to. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017Dvvqn9ZDR4ixeFPHNbww7	2026-08-18 19:14:07 +05:30