11 Commits

Include renames

Author	SHA1	Message	Date
JesseMarkowitzandClaude Opus 5	7f082b61d8	M3: complete non-destructive history and active-head export ... The head-cursor model landed in 903fa7a and stopped there: the backend moved the head instead of deleting turns, but a bundle still reopened at its newest row, the browser had no way forward, and five inherited tests still asserted the contract Undo had just stopped honouring. This is the rest of the milestone, plus the one unsafe operation the review found. Export now writes headDepth, and it belongs on the other side of the rule app/bundle.py states about itself. The head depth used to be derived — the tip of the head branch, a fact about the nodes that arrived with it — and that was true while Undo deleted, because the newest row was the only place a story could be read. It is a decision now: the same tree exports identically whether the user undid three turns or none, so the file has to say. An import that ignored it would silently Redo the story to its newest retained turn, which is the Phase 0B export finding this milestone exists to close. A file with no headDepth is opened at the tip, which is not a fallback but the position such a file recorded; a file naming a depth its own rows do not reach is refused in plan(), before a row is written, for the reason that module gives about half-written trees. Which branches the story has left goes into the file for the same reason. Every row of an abandoned line arrives on an import either way, so the disposition is the only thing telling it apart from an active one, and a restored backup that had lost it would have nothing for the later cleanup and recovery screens to select on. Both keys or neither: a time with no depth cannot say what was displaced. The browser gets a Redo button beside Undo, on Ctrl+Shift+Z, and both are enabled from can_undo/can_redo rather than from the transcript. Neither is derivable on the client — Undo stops at the campaign opening, which may be off the top of the loaded window, and Redo depends on the retained future, which the client is never sent — so the flags now ride on every window the server hands back, including a scrolled-up page and the response to an import. Moving the head also refreshes the state panels, which undo never did: it has rolled the world state back since long before M3 and the drawer kept showing the old numbers. An in-place edit is now refused when story descends from the turn and is not on screen. Editing rewrites one row and re-evaluates nothing, which is what makes it a correction rather than a continuation, and that is harmless while everything below the turn is visible — the reader can see what their change has to agree with. It stops being harmless when the continuation is undone, or was left behind by a divergence, because the edit then silently changes the words an invisible stretch of story was written from. That was the one way M3's retained history could be made to contradict itself. Refusing is deliberately the whole of the fix: making such an edit fork is STORY-BRANCH-SEMANTICS.md §14-15, and §15 wants the state the edited prose implies re-evaluated, which is M5's extraction pass. The requirement is not weakened, only deferred, and §14A now says so. The predicate asks one question rather than two. A descendant is invisible either because it is past the head on this lineage or because it is past a fork on a branch the story left, and both are "a live node, deeper than this one, descending from it, off the path being read". A first attempt scoped the search to branches other than the active one and failed the divergence case, correctly: the departed branch is usually an ancestor of the branch now being read. Only the deepest live node on each descending branch is examined, because visibility is monotone in depth. Five inherited tests are rewritten rather than deleted, because what they were protecting is still worth protecting and only the mechanism changed. The undo-state pair keeps its state assertions and swaps "the rows are gone" for "the rows are all here and the story is read from earlier". The memory test stops asserting that undo prunes memories and starts asserting the property that replaced it: a memory past the head is unreachable, still on disk, and retrievable again after Redo, with no re-embedding. The attempt-group test still proves the group moves as one, out of the story rather than out of the database. And the fork test reverses: Undo used to refuse at a fork point because it deleted rows the parent branch was also reading, and with nothing deleted there is nothing to protect the parent from, so it now walks into the story the branch inherits and stops at the campaign opening instead. tests/test_head_cursor.py is the milestone's acceptance contract, named by the items it discharges: D01-D10, E01-E04, I01-I03, I07, L01-L02, and the invariant they all rest on — Undo deletes zero accepted turns, asserted on row ids over the whole retained tree. E02 has both controls, because a negative control alone would pass if memory retrieval were simply broken. L01 records what it does not claim: the head does move by one on a failed turn, onto the player's retained input, which is A05 rather than a gap. Two of the edit-guard tests exist to prove the guard stays out of the way — a correction at the tip and a correction mid-story with everything visible must both still work. 638 backend tests pass. Frontend lint is unchanged at seven pre-existing warnings, none in the files touched; the bundle builds at 395.85 kB; the production image builds. Verified at runtime against the trusted-LAN Ollama over HTTPS: three turns, two Undos, a Redo, a Retry, an Undo, a divergent continuation, Redo correctly refused with 400, Undo back to the opening, export, a process restart that reopened the campaign still undone, and an import that opened at the same position with its retained future intact. The browser click-through of that sequence has not been run — no session in this milestone had a browser to drive — so the Redo control itself is verified by its endpoint and its lint and build, not by a click. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01QF5TcoB86QADgjHz1GZe8u	2026-09-03 13:54:43 -04:00
JesseMarkowitz	8c65ae99de	M2: cut the hosted product away from the local one ... 94 files, +1,395 -6,578. Three files are new; twenty-four are gone. The milestone is subtraction, and what is left is the single-user local storyteller the specification describes. Removed in full: campaign scripting and its QuickJS sandbox; multi-user accounts, guest sessions, login, registration and the shared demo key; the visitor-analytics tables, dashboard and page beacon; the access log of sign-ins, addresses and devices; per-IP and per-user rate limiting and quotas; Render deployment config; Postgres and psycopg; cloud inference providers, the API-key field and the key encryption that existed to store it; session-cookie signing. None of it was hidden behind a flag — the routes are gone and answer 404. Two things were kept that the brief allowed keeping. The `users` table and its foreign keys stay as an internal ownership detail, because rewriting them out means a migration across most of the schema to delete a column that costs nothing; nothing creates a second user and no request carries an identity. Five inert tables and four inert columns stay for the same reason, so an M1 campaign database opens unchanged. The one addition is app/endpoints.py, which decides where a story may be sent. Loopback, RFC1918, link-local, unique-local and CGNAT — an explicit allowlist of networks, not a guess at what `ipaddress` means by "private", which calls the documentation ranges private and IPv6 loopback reserved. Every address a hostname resolves to must be in it, so a split answer does not squeak through, and the rule runs both when the endpoint is saved and before every outbound request, because a name that resolved to the LAN this morning can resolve elsewhere this afternoon. Known cloud hosts are named in the refusal so the error says why rather than looking like broken DNS. TLS is never traded against it: M1's shared trust context is intact on all four clients and there is no way to skip verification. The hardcoded 120-second model timeout is now a setting. That was not theoretical — on this GPU-less four-core host a cold load of qwen2.5:3b-instruct took 648.9 seconds to produce the first turn, while turns 2 to 5 of the same campaign took 3.6 to 13.1. Connect stays short at 10s so a wrong address still fails fast; the read timeout defaults to 300s and is bounded at 3600, because "wait longer" must stay a number. Two defects found while testing and fixed here. An unknown /api path fell through the SPA catch-all and came back as HTML with status 200, so a client asking for JSON parsed a web page instead of learning the route was gone. And AIDND_CORS_ORIGINS accepted "*", which on an unauthenticated loopback API would hand every page on the Internet a write handle on the campaign database; it now refuses to start. Verified rather than assumed. Offline, on a network with no route out and no DNS: five turns, retry with both takes retained, restart with an identical transcript digest, a failed model call leaving the accepted AI-turn count untouched, and a capture with zero non-loopback unicast packets. Against a real second machine on the LAN over HTTPS with a private CA: four turns, restart, and a capture showing 289 packets to the approved host, 344 loopback, zero anywhere else, zero DNS queries. Cloud and public endpoints refused with their reasons; no API key settable; every removed route 404. 604 backend tests pass, down from 648 by the fifteen retired with the subsystems they tested and up by the twenty-nine added for the endpoint policy and the removed surface. The scripting tests were not deleted: eight files used a JavaScript counter as instrumentation for the state snapshot and rollback machinery, which M2 does not touch, so the counter moved to the world-state engine and those tests still assert what they always did. Frontend lint and build are clean; the image builds, and its wheel-building stage is gone with quickjs. No M3 work. Undo is still destructive and there is still no Redo.	2026-09-02 11:27:14 -04:00
parththakkar106andClaude Opus 5	f1bebe18d0	Drop the eight legacy columns SP8 left behind ... Migrations 66 to 73 drop `actions.index`, `variants`, `variant_index`, `variant_count`, `state_before`, and `world_state_before`, plus `adventures.memory_cursor` and `summary_cursor`. `index` is a keyword in SQLite, so migration 71 quotes it. Nothing outside the migrations read these. `models.py`, `schemas.py`, and `ACTION_LIST_COLUMNS` lose the same eight fields, `Adventure.actions` orders by `id`, and `attempts.renumber`, `context.history.max_action_index`, and `nodes.next_index` are deleted. Two changes keep the migration replayable on a `create_all` database: - `_split_variants_into_siblings` wrote through the live ORM table, so it stopped compiling once migration 66 removed five of its columns. It now writes through `_ACTIONS_AT_60`, a frozen `Table` with its own `MetaData`. - Five data passes read columns these migrations drop. Each now calls `_has_columns` and returns early when the columns are absent. `bootstrap` takes a `through` version so a migration test can stop at the schema it asserts on. 555 tests pass, up from 549. Eight of the new cases assert each column is gone after a real schema-45 database migrates all the way. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0198qDK3gmgSo7EtQ4GTPqqK	2026-08-29 17:15:49 +05:30
parththakkar106andClaude Opus 5	2c57b1ceab	Remove three kinds of duplication in the backend ... Stage 2, items 1, 4, and 5 of `plan/17-refactor.md`. **One path resolver in `worldstate`.** `apply_delta` and `apply_override` routed `flags.<name>`, `milestones.<id>`, `world.<stat>`, `player.<stat>`, and `npc.<id>.<stat>` with parallel code, about 100 lines each. `_resolve` now says what a path points at and returns either a target or the rejection to report. Each function keeps its own write rule, because the rules genuinely differ: an override sets a number rather than adding to it, ignores `cooldown`, `max_delta_per_turn`, and the rule that a counter only counts up, and can un-set a milestone. A differential check ran both implementations over 3960 payloads: twenty paths, fourteen values, three starting states, plus every three-path combination. The results are identical except that 674 rejections from `apply_override` now carry a `fix` string. `apply_delta` already worded those, and the world-state editor renders them, so an override that names an unknown flag now explains itself the way a delta does. **`sse`, `SSE_HEADERS`, and `turn_error` move to `app/sse.py`.** Two routers stream, and `chat.py` had to import from `routers.adventures` to reach them. **`get_adventure_or_404` becomes the `current_adventure` dependency.** All 32 handlers repeated the call as their first statement. The ownership check now reads in the signature and runs before the body. FastAPI caches a dependency for one request, so the handler's `db` is the session the adventure came from. The generated OpenAPI document is byte-identical except on `rename_branch`, where `branch_id` is now listed before `adventure_id`, because that handler no longer names `adventure_id` itself. Parameter order in the document is cosmetic. Six tests in `test_state_revert.py` call `undo_turn` and `retry_action` directly rather than over HTTP. They pass the adventure they already hold instead of an id. 549 tests pass. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014Dix4oGV3njgWRdu7P9t6r	2026-08-29 02:04:02 +05:30
parththakkar106andClaude Opus 5	2fa812c056	Split the adventures router into a package ... `backend/app/routers/adventures.py` held 2353 lines and 35 endpoints. It is now a package of 14 modules, the largest 443 lines. The split moves text rather than rewriting it. An AST comparison against the old file confirms all 86 definitions are identical, and the OpenAPI schema still lists the same 35 operations. Names a test replaces now live in `turns.py` only, and other modules reach them as `turns.<name>`. Rebinding a re-exported alias changes the alias and leaves every caller reading the original, so the package root does not re-export them. A patch aimed at the old target raises `AttributeError` instead of passing while doing nothing. Tests and the fixtures in `backend/tools/` say `adventures.turns.<name>`. The same rule keeps the turn lock working. One module owns `_active_turns`, so one lock guards one set. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014Dix4oGV3njgWRdu7P9t6r	2026-08-29 01:05:50 +05:30
parththakkar106andClaude Opus 5	32cd7c1077	Give the tests one setup instead of thirty-five ... Every test module carried the same eight-line prologue redirecting the database to a temp file. Only the first one to be imported ever took effect: `app.database` reads `AIDND_DB_PATH` at import and builds `engine` from it once, so by the time the second module ran the engine already existed. The other 34 copies created a temp file that nothing opened and nothing deleted, and leaked one per module per run. `conftest.py` now does it once, which is early enough because pytest imports conftest before any test module. It also deletes the file when the run ends. The tests still share one database, exactly as they already did: each `client` fixture calls `create_all` on setup and `drop_all` on teardown, so no test sees another test's rows. `tests/fakes.py` holds the one `ScriptedProvider`. Nine modules each had a copy, and the copies had drifted into four feature sets, so a test that needed to raise a provider error had to be written in one of the files whose copy supported that. The shared one is the superset. The two `FakeProvider` copies were the same class with a fixed reply, so they use it too. `test_chat.py` keeps its own, which implements `chat` rather than `generate` and records what it was constructed with. An autouse fixture resets the fake's class state between tests, so a stale reply list can no longer reach the next test. 435 lines out of the suite. 549 tests pass. Verified live by sabotage: breaking the shared fake fails 13 tests across four modules. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014Dix4oGV3njgWRdu7P9t6r	2026-08-29 00:47:46 +05:30
Parth	e7d75c3b05	Rewrite Python comments in Google developer documentation style (#12) ... * Rewrite comments in Google developer documentation style Rewrite the comments and docstrings across the backend core modules so they read plainly. The previous prose was accurate but dense and figurative, which made it slow to skim. Applies the Google developer documentation style guide: short sentences, active voice, present tense, American spelling, and no metaphors, idioms, or rhetorical asides. Replaces em-dash chains with separate sentences.	2026-08-26 15:37:25 +05:30
parththakkar106andClaude Opus 5	0a12d9cd47	Make a retry a node, not a rewrite ... Every attempt at a turn is now its own row at the same (branch, depth), with `live` naming the one the story tells. The JSON repeating group on `actions.variants` is read one last time, by a migration that writes it out as the sibling rows it always described, and then goes unread. The snapshots turn around with it: an action carries the state it left behind rather than the state it started from, because attempts at one turn share a starting position and differ exactly in their outcome. Rolling back is "what the node in front left behind", one lookup on the path, and it is what undo and retry now both read. And the memory holdback goes. It existed because retry rewrote a row under a mark that had already moved past it; a retry writes a sibling now, and replacing what a coordinate says withdraws what was derived from it — the same repair undo and delete already made. The assembled prompt is still stored once per turn: it moves with the live flag, so a superseded attempt keeps only the few hundred bytes that were its own. Measured on the 600-action fixture: 700 rows for the same 600-turn story, prompt archive byte-identical at 0.50 MB, index 1.8 kB and page load 62.7 kB unmoved. 347 tests green. `tests/test_story_tree_baseline.py` and `tests/test_retry_variants.py` pass unmodified — SP4 was allowed to move the baseline for the variant-count semantics and did not need to. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017Dvvqn9ZDR4ixeFPHNbww7	2026-08-18 19:14:07 +05:30
parththakkar106andClaude Opus 5	c51531709d	Mark the story with a node, not with a count ... The memory bank and the story summary each kept a cursor: how many story actions they had already covered. A count is a position in a list, and this list moves — delete an action in front of the mark and every later one slides down a slot, so the mark now covers one it has never read. All the cursor bookkeeping existed to patch that up. Both marks are now (branch_id, depth): the node up to and including which the work is done. A depth is a coordinate along a path, not an offset into a list, so nothing in front of it can move it. That deletes rather than rewrites `position_of_index`, `note_action_removed`, `_rewind_cursors_to_index`, `prune_dangling_memories` and the every-pass clamp in `run_post_turn`. A memory hangs off the node its block ends on, so a fork inherits its ancestors' memories without copying any, and retrieval selects through the branch clause over the *whole* lineage — recall is long-range by definition and cannot be windowed. Measured: 1,807 B on a story forked twenty times against 1,823 B on a flat one of the same length. Migrations 53-56 translate the old counts into nodes. They rewrite `adventures` and not `actions`, so this one needs no VACUUM FULL. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017Dvvqn9ZDR4ixeFPHNbww7	2026-08-18 19:14:07 +05:30
parththakkar106andClaude Opus 5	906ba423d8	Keep every retried attempt instead of deleting it ... Retry used to delete the last AI action and generate a replacement, so the discarded narration was simply gone. The row survives now: each attempt is appended to actions.variants with variant_index naming the live one, and a ChatGPT-style pager under the message browses them. Action.text still mirrors the active variant, so the context builder, memory bank, summarizer and export needed no changes. A variant carries only what differs between attempts -- the text, the reasoning, and the state it produced -- never the assembled prompt, which is identical across attempts of one turn and is the bulk of context_snapshot. Only the last message can be switched, restoring the script/world state that attempt produced; earlier turns were written as a continuation of whatever is active there, so theirs are read-only previews. Three things that would otherwise bite: - generate_turn now wraps _generate_turn and watches for a save sentinel. If the generator ends without it (provider error, empty reply, script stop, client hangup) it re-applies the previous variant -- otherwise a failed retry leaves rolled-back stats under un-rolled-back text. - Retry reuses the turn's own index rather than next_index, or the clock the world-state cooldowns run on advances on a re-run of the same turn. - Editing a message rewrites the active variant too, or paging away and back silently reverts the edit. Migrations 34/35 verified as an upgrade against a populated database, not just a fresh schema. test_state_revert's retry test asserted the old delete behaviour and was rewritten. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UeQVy5bEjLhfgWNc27Efet	2026-08-02 20:44:06 +05:30
parththakkar106andClaude Opus 4.8	dab1807118	Roll back script_state on undo/retry; fix retry double-apply ... The shared per-adventure script_state ("scoreboard" scripts write to) was never reverted by undo, and retry re-ran the output hook on top of the already- mutated state, double-applying its changes (e.g. "+10 gold" became +20). Each action now snapshots script_state as it was immediately before its own hooks ran (new Action.state_before column, migration 25): - undo restores the turn's first-action snapshot, prunes memories that summarized the removed actions, and takes the turn lock against races. - retry restores the AI action's snapshot before regenerating. Story-card mutations are not reverted (documented limit). Adds the project's first test suite: unit + full HTTP integration through the real scripting engine (14 tests). See plan/11-state-revert-and-retry-fix.md. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-21 02:58:38 +05:30