rbrooks/Quest-Board
Watch
1
0
Fork
You've already forked Quest-Board
 0
Code Issues 58 Pull requests 7 Projects Releases 76 Packages Wiki Activity Actions

[Backend+Frontend] Campaign invites with expiry, usage limits and per-campaign join approval; fix the INVITE_CODE sign-up gate #643

New issue
Closed
opened 2026-09-14 03:25:40 +00:00 by claude-bot · 3 comments
claude-bot commented 2026-09-14 03:25:40 +00:00
Collaborator
Copy link

Phase 0 of #642. Carried over from the investigation on #534 (comment 39607), where the owner chose option D.

The problem

1. Campaign invites never expire and have no usage limit.
Each campaign has one campaigns.invite_code (secrets.token_urlsafe(8), campaign_service.py:104). Anyone can use it any number of times, forever. It stops working only when the GM regenerates it, or the campaign is archived or soft-deleted. A link pasted into a group chat once stays a way into that campaign's transcripts and summaries indefinitely.

2. With INVITE_CODE set, no new user can sign up through the UI.

  • bb77ceb removed the invite-code field from the login page, but kept the backend gate (routers/auth.py:204-211).
  • Nothing in the frontend sends invite_code any more, so the gate compares "" against the instance code and refuses everyone. This happens after the full identity-provider round trip, and throws away next_url.
  • A player following a campaign /join/<code> link is refused too: the campaign code reaches the callback only inside next_url.

Decisions already made (#642)

  • Invites get expiry and usage limits.
  • Join approval is a per-campaign GM setting.
  • Existing codes get a 7-day expiry at migration.
  • On a self-hosted instance with INVITE_CODE set, a valid, redeemable campaign invite satisfies the registration gate for that sign-up. D bounds the risk, since a leaked link expires and runs out.

Design

Data (one migration, raw SQL per the house rule)

  • campaign_invites:
    • id, campaign_id (FK, cascade)
    • code (text, unique)
    • label (nullable, e.g. "for Sam")
    • created_by (FK users, SET NULL), created_at
    • expires_at (nullable), max_uses (nullable), use_count (default 0)
    • revoked_at (nullable)
  • invite_redemptions: id, invite_id, user_id, campaign_id, redeemed_at, outcome (joined | requested). This is the audit trail: which link each member arrived through.
  • campaigns.join_requires_approval: boolean, default false.
  • Pending members live in a separate campaign_join_requests table, not as a status on campaign_members. Membership is checked in many places; a pending row in campaign_members would grant access anywhere a status filter was forgotten. A separate table fails closed.
  • Backfill: each non-null campaigns.invite_code becomes an invite row, with expires_at = now() + 7 days, max_uses NULL, and label "Original invite link". Then drop campaigns.invite_code.

Codes stay stored in plaintext, deliberately. A GM needs to copy an active link again, and a database leak already exposes everything an invite would open. With expiry, hashing costs usability and buys little. #642 floated hashing; this reverses it.

Redemption (one service function; every path uses it)

redeem_invite(db, code, user):

  1. Lock the invite row (SELECT … FOR UPDATE).
  2. Refuse if it is unknown, revoked, expired, or use_count >= max_uses.
  3. Refuse if the campaign is soft-deleted or archived.
  4. If the user is already a member, do nothing and consume no use.
  5. Otherwise increment use_count, record the redemption, then either join as player or create a join request, depending on join_requires_approval.

The dashboard Join box (POST /api/campaigns/join), the /join/<code> page, and the OIDC sign-up path all call it. Today there are two duplicated lookups (campaign_service.join_campaign, routers/invites.py:60-65); both go.

Refusals don't leak. The unauthenticated preview (GET /api/invites/{code}) returns the campaign name only for a redeemable invite. Expired, used-up and revoked invites all return one generic "this invite link is no longer valid, ask your GM for a new one", with no campaign details.

Sign-up gate

  • login: when next matches the existing /join/<code> allowlist (auth.py:61,70), store the code in the OIDC state payload in Redis DB 0 (store_pkce_state).
  • callback, new user:
    • Pass the gate if INVITE_CODE is unset, or the instance code matches, or the stored campaign code is redeemable right now.
    • Create the user and redeem in one transaction, so a refusal leaves no user row.
    • First-user-becomes-admin is unchanged.
  • Also fix:
    • Compare bytes in hmac.compare_digest; a non-ASCII str raises inside the try and surfaces as "A database error occurred".
    • Log the exception in the broad except at auth.py:254-258.
    • Change the refusal text so it no longer points at a step that doesn't exist.

GM-facing UI

  • InvitePanel becomes an invite list:
    • each row: label, link, "expires in 3 days", "2 of 5 used", Copy, Revoke
    • "New invite link" with expiry (1 day, 7 days (default), 30 days) and uses (1, 5, 10, unlimited)
    • "Regenerate" is replaced by revoke plus new
  • Campaign settings: "New members need my approval" toggle.
  • Member list: pending requests with Approve / Decline.

Docs

  • The GM guide (help/running-your-first-campaign.md:54-56) and help/joining-a-campaign.md.
  • .env.example (INVITE_CODE text).
  • docs/API.md:95,119: the gate returns a 302 to /auth-error, not the 403 it documents.
  • docs/ROADMAP-COMPLETED.md:16, which says the gate was removed.
  • ARCHITECTURE.md:152.
  • CHANGELOG, stating the behaviour change: every existing invite link stops working 7 days after upgrade.

Out of scope

  • Slots, entitlements and member caps (#642 phase 1).
  • Notifying the GM of a join request through Discord (a follow-up; the bot API is untouched here).
  • The bot never reads invite codes (checked: no occurrence under bot/), so no BOT_CONTRACT_VERSION bump.

Tests

The OIDC callback has no tests today (tests/test_auth_routes.py has two cookie tests). Seed state with store_pkce_state, and mock fetch_oidc_discovery, exchange_code_for_tokens and fetch_userinfo.

  • INVITE_CODE set, no code: refused, and no users row.
  • Instance code: user created.
  • Redeemable next=/join/<code>: user created and joined; use_count 1; redemption row written.
  • Same flow on an approval-required campaign: user created, join request created, not a member.
  • Expired, used-up, revoked, archived campaign, soft-deleted campaign: each refused with no user row.
  • Code revoked between login and callback: refused.
  • Campaign code inside a next that isn't allowlisted: ignored.
  • Existing user and first user: unchanged.
  • Race: two concurrent redemptions of a max_uses=1 invite; exactly one succeeds.
  • Already a member: no use consumed.
  • Preview does not reveal the campaign for a dead invite.
  • Migration: backfilled rows expire 7 days out; head pin moved.
  • A pending requester gets 403 on campaign, session, transcript and wiki reads.
  • Frontend: invite list (create, copy, revoke, expiry and use display), the approval toggle, and approve/decline.
  • Every guard mutation-checked: revert it and watch its test fail (#441).

Size

Large. One migration; auth, invites and campaigns routers and services; InvitePanel, CampaignDetail, JoinCampaign and the dashboard Join box; docs. One PR, because dropping campaigns.invite_code breaks the current UI in any intermediate state.

Phase 0 of #642. Carried over from the investigation on #534 (comment 39607), where the owner chose **option D**. ## The problem **1. Campaign invites never expire and have no usage limit.** Each campaign has one `campaigns.invite_code` (`secrets.token_urlsafe(8)`, `campaign_service.py:104`). Anyone can use it any number of times, forever. It stops working only when the GM regenerates it, or the campaign is archived or soft-deleted. A link pasted into a group chat once stays a way into that campaign's transcripts and summaries indefinitely. **2. With `INVITE_CODE` set, no new user can sign up through the UI.** - bb77ceb removed the invite-code field from the login page, but kept the backend gate (`routers/auth.py:204-211`). - Nothing in the frontend sends `invite_code` any more, so the gate compares `""` against the instance code and refuses everyone. This happens after the full identity-provider round trip, and throws away `next_url`. - A player following a campaign `/join/<code>` link is refused too: the campaign code reaches the callback only inside `next_url`. ## Decisions already made (#642) - Invites get **expiry and usage limits**. - **Join approval is a per-campaign GM setting.** - **Existing codes get a 7-day expiry** at migration. - On a self-hosted instance with `INVITE_CODE` set, a **valid, redeemable campaign invite satisfies the registration gate** for that sign-up. D bounds the risk, since a leaked link expires and runs out. ## Design ### Data (one migration, raw SQL per the house rule) - **`campaign_invites`:** - `id`, `campaign_id` (FK, cascade) - `code` (text, unique) - `label` (nullable, e.g. "for Sam") - `created_by` (FK users, `SET NULL`), `created_at` - `expires_at` (nullable), `max_uses` (nullable), `use_count` (default 0) - `revoked_at` (nullable) - **`invite_redemptions`:** `id`, `invite_id`, `user_id`, `campaign_id`, `redeemed_at`, `outcome` (`joined | requested`). This is the audit trail: which link each member arrived through. - **`campaigns.join_requires_approval`:** boolean, default `false`. - **Pending members live in a separate `campaign_join_requests` table**, not as a status on `campaign_members`. Membership is checked in many places; a pending row in `campaign_members` would grant access anywhere a status filter was forgotten. A separate table fails closed. - **Backfill:** each non-null `campaigns.invite_code` becomes an invite row, with `expires_at = now() + 7 days`, `max_uses` NULL, and `label` "Original invite link". Then drop `campaigns.invite_code`. **Codes stay stored in plaintext, deliberately.** A GM needs to copy an active link again, and a database leak already exposes everything an invite would open. With expiry, hashing costs usability and buys little. #642 floated hashing; this reverses it. ### Redemption (one service function; every path uses it) `redeem_invite(db, code, user)`: 1. Lock the invite row (`SELECT … FOR UPDATE`). 2. Refuse if it is unknown, revoked, expired, or `use_count >= max_uses`. 3. Refuse if the campaign is soft-deleted or archived. 4. If the user is already a member, do nothing and consume no use. 5. Otherwise increment `use_count`, record the redemption, then either join as `player` or create a join request, depending on `join_requires_approval`. The **dashboard Join box** (`POST /api/campaigns/join`), the **`/join/<code>` page**, and the **OIDC sign-up path** all call it. Today there are two duplicated lookups (`campaign_service.join_campaign`, `routers/invites.py:60-65`); both go. **Refusals don't leak.** The unauthenticated preview (`GET /api/invites/{code}`) returns the campaign name only for a redeemable invite. Expired, used-up and revoked invites all return one generic "this invite link is no longer valid, ask your GM for a new one", with no campaign details. ### Sign-up gate - **`login`:** when `next` matches the existing `/join/<code>` allowlist (`auth.py:61,70`), store the code in the OIDC state payload in Redis DB 0 (`store_pkce_state`). - **`callback`, new user:** - Pass the gate if `INVITE_CODE` is unset, or the instance code matches, or the stored campaign code is redeemable right now. - Create the user and redeem in **one transaction**, so a refusal leaves no user row. - First-user-becomes-admin is unchanged. - **Also fix:** - Compare bytes in `hmac.compare_digest`; a non-ASCII `str` raises inside the `try` and surfaces as "A database error occurred". - Log the exception in the broad `except` at `auth.py:254-258`. - Change the refusal text so it no longer points at a step that doesn't exist. ### GM-facing UI - **`InvitePanel` becomes an invite list:** - each row: label, link, "expires in 3 days", "2 of 5 used", Copy, Revoke - "New invite link" with expiry (1 day, **7 days (default)**, 30 days) and uses (1, 5, 10, unlimited) - "Regenerate" is replaced by revoke plus new - **Campaign settings:** "New members need my approval" toggle. - **Member list:** pending requests with Approve / Decline. ### Docs - The GM guide (`help/running-your-first-campaign.md:54-56`) and `help/joining-a-campaign.md`. - `.env.example` (`INVITE_CODE` text). - `docs/API.md:95,119`: the gate returns a 302 to `/auth-error`, not the 403 it documents. - `docs/ROADMAP-COMPLETED.md:16`, which says the gate was removed. - `ARCHITECTURE.md:152`. - CHANGELOG, stating the **behaviour change: every existing invite link stops working 7 days after upgrade**. ## Out of scope - Slots, entitlements and member caps (#642 phase 1). - Notifying the GM of a join request through Discord (a follow-up; the bot API is untouched here). - The bot never reads invite codes (checked: no occurrence under `bot/`), so **no `BOT_CONTRACT_VERSION` bump**. ## Tests The OIDC callback has no tests today (`tests/test_auth_routes.py` has two cookie tests). Seed state with `store_pkce_state`, and mock `fetch_oidc_discovery`, `exchange_code_for_tokens` and `fetch_userinfo`. - [ ] `INVITE_CODE` set, no code: refused, and no `users` row. - [ ] Instance code: user created. - [ ] Redeemable `next=/join/<code>`: user created and joined; `use_count` 1; redemption row written. - [ ] Same flow on an approval-required campaign: user created, join request created, **not** a member. - [ ] Expired, used-up, revoked, archived campaign, soft-deleted campaign: each refused with no user row. - [ ] Code revoked between login and callback: refused. - [ ] Campaign code inside a `next` that isn't allowlisted: ignored. - [ ] Existing user and first user: unchanged. - [ ] **Race:** two concurrent redemptions of a `max_uses=1` invite; exactly one succeeds. - [ ] Already a member: no use consumed. - [ ] Preview does not reveal the campaign for a dead invite. - [ ] Migration: backfilled rows expire 7 days out; head pin moved. - [ ] A pending requester gets 403 on campaign, session, transcript and wiki reads. - [ ] Frontend: invite list (create, copy, revoke, expiry and use display), the approval toggle, and approve/decline. - [ ] Every guard mutation-checked: revert it and watch its test fail (#441). ## Size Large. One migration; auth, invites and campaigns routers and services; `InvitePanel`, `CampaignDetail`, `JoinCampaign` and the dashboard Join box; docs. **One PR**, because dropping `campaigns.invite_code` breaks the current UI in any intermediate state.
claude-bot commented 2026-09-14 03:38:01 +00:00
Author
Collaborator
Copy link

Interaction with #644 (campaign ownership), which can land before or after this.

  • Approving join requests: GMs approve and decline. Once #644 lands, the owner can too, even if they're a player, because membership is part of what they're accountable for. If this lands first, build the check as "GM or owner" behind one helper, so #644 only has to fill in the owner half.
  • The "New members need my approval" toggle: GMs, and the owner once #644 lands.
  • A campaign with no GM (allowed by #644): existing invites keep working, and approval-required requests wait for the owner or a newly assigned GM.
  • Invites are created by GMs (and the owner). Redemption never makes anyone a GM or an owner; it only adds players.
Interaction with #644 (campaign ownership), which can land before or after this. - **Approving join requests:** GMs approve and decline. Once #644 lands, the **owner** can too, even if they're a player, because membership is part of what they're accountable for. If this lands first, build the check as "GM or owner" behind one helper, so #644 only has to fill in the owner half. - **The "New members need my approval" toggle:** GMs, and the owner once #644 lands. - **A campaign with no GM** (allowed by #644): existing invites keep working, and approval-required requests wait for the owner or a newly assigned GM. - **Invites are created by GMs** (and the owner). Redemption never makes anyone a GM or an owner; it only adds players.
claude-bot commented 2026-09-14 03:41:16 +00:00
Author
Collaborator
Copy link

Picking this up now (owner go-ahead 2026-09-13). Building on a branch off main d02a6d4, with migration d3e4f5a6b7c8 chained on c2d3e4f5a6b7. #644 follows once this merges, because the two rewrite the same campaign router, service, member list and migration chain.

Picking this up now (owner go-ahead 2026-09-13). Building on a branch off main d02a6d4, with migration `d3e4f5a6b7c8` chained on `c2d3e4f5a6b7`. #644 follows once this merges, because the two rewrite the same campaign router, service, member list and migration chain.
claude-bot commented 2026-09-14 05:09:59 +00:00
Author
Collaborator
Copy link

Done in #647. CI run 1096 passed. Before merging, the overlapping test files were rerun against main with #646 merged in: 246 passed.

What shipped (details in the PR):

  • Invites with expiry, usage limits and revoke; a per-campaign approval toggle; pending requests in a separate table.
  • A single redeem_invite path with a row lock. The two-connection race test is mutation-checked.
  • The sign-up gate works again with INVITE_CODE set: a redeemable campaign invite admits a new user, and the user and redemption are created in one savepoint.
  • Migration d3e4f5a6b7c8: existing codes expire 7 days after upgrade.
  • 46 guards mutation-checked; the OIDC callback now has tests.
  • can_manage_membership is the single hook where #644 adds the owner check.

Where the build interpreted the spec (all in the PR):

  • The join endpoint returns {outcome, campaign_id, campaign_name}, not a campaign.
  • The preview gives archived campaigns the same generic 404 as any dead invite.
  • New campaigns get no automatic invite.
  • The approval toggle has its own route, so a player-owner can use it.

Small follow-ups, not filed as issues yet:

  • A user redeeming two different invites to the same campaign at the same instant gets a 500.
  • An unwrapped fetch_oidc_discovery() in the callback returns a 500 instead of the error page.
  • A test leaves committed users rows behind.
  • ARCHITECTURE.md still lists campaign_members.character_* columns.
Done in #647. CI run 1096 passed. Before merging, the overlapping test files were rerun against main with #646 merged in: 246 passed. **What shipped** (details in the PR): - Invites with expiry, usage limits and revoke; a per-campaign approval toggle; pending requests in a separate table. - A single `redeem_invite` path with a row lock. The two-connection race test is mutation-checked. - **The sign-up gate works again with `INVITE_CODE` set:** a redeemable campaign invite admits a new user, and the user and redemption are created in one savepoint. - Migration `d3e4f5a6b7c8`: existing codes expire 7 days after upgrade. - 46 guards mutation-checked; the OIDC callback now has tests. - `can_manage_membership` is the single hook where #644 adds the owner check. **Where the build interpreted the spec** (all in the PR): - The join endpoint returns `{outcome, campaign_id, campaign_name}`, not a campaign. - The preview gives archived campaigns the same generic 404 as any dead invite. - New campaigns get no automatic invite. - The approval toggle has its own route, so a player-owner can use it. **Small follow-ups, not filed as issues yet:** - A user redeeming two *different* invites to the same campaign at the same instant gets a 500. - An unwrapped `fetch_oidc_discovery()` in the callback returns a 500 instead of the error page. - A test leaves committed `users` rows behind. - `ARCHITECTURE.md` still lists `campaign_members.character_*` columns.
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
feat/1328-fill-it-in
feat/1328-fill-frontend
feat/1328-fill-backend
feat/9-foundry-push
fix/9-foundry-live
feat/9-foundry-push-frontend
renovate/celery-5.x
feat/5-foundry-connect
feat/9-foundry-push-backend
feat/9-foundry-push-module
feat/5-foundry-frontend
feat/5-foundry-backend
feat/5-foundry-module
release/v4.8.0-rc1
docs/d341-convert-draft
feat/958-update-to-version
feat/958-convert-sheet
feat/958-pathbuilder-import-frontend
fix/1360-heading-order
feat/958-pathbuilder-import-backend
feat/11-weekly-digest
feat/1341-auto-update
docs/d332-superseded
chore/1345-names-cleanup
feat/1342-mentioned-pages
feat/1328-recipes
fix/1346-pgdg-key
perf/1247-shared-recording-stream
chore/132-gitleaks-allowlist
release/v4.7.1
spike/foundry-module
release/v4.7.1-rc1
docs/decisions-d332-d337
fix/bot-certifi
chore/release-4.7.0
chore/release-4.7.0-rc4
chore/deps-4.7.0
chore/release-4.7.0-rc3
fix/1280-quote-must-say-it
fix/1257-names-row-squeeze
chore/release-4.7.0-rc2
fix/1245-pg-upgrade-count
chore/release-4.7.0-rc1
feat/1257-names-in-prep
feat/1257-be
feat/1257-fe
feat/1257-rating-fixes
design/1328-fill-it-in
feat/1257-name-splits
fix/1326-redis-503
feat/1280-fact-suggestions
feat/1280-be
feat/1280-fe
design/1280-fact-suggestions
feat/1279-infobox
feat/1279-be
feat/1279-fe
feat/1321-shelf-copies
design/1279-infobox
feat/1243-table-find
feat/1257-who-rated
feat/1243-prep-drawer
feat/1243-sheet-pickers
design/1243-browse-in-place
feat/1315-hotwords-default
feat/1242-system-filters
feat/1257-more-name-styles
feat/506-leg3-hotwords
design/1242-system-filters
fix/1302-packs-polish
feat/1241-rules-library
design/1241-rules-library
feat/1245-postgres-18
integ/4.6.2
fix/1263-map-ui-2
fix/1263-map-server
fix/1263-map-ui-1
fix/1261-editor-link-menu
fix/1229-axe-4.14-name-mismatch
renovate/axllent-mailpit-1.x
renovate/eslint-monorepo
renovate/authlib-1.x
chore/release-4.6.0
chore/release-4.6.0-rc2
fix/460-rc2-screens
fix/460-rc2-server
fix/release-prerelease-exit
chore/release-4.6.0-rc1
feat/125-campaign-templates
feat/126-calendar
feat/1181-pictures-and-files
feat/1190-event-people
integ/4.6.0
feat/1191-line-of-the-night
feat/1200-starter-packs
chore/bot-multidict-and-playwright-group
fix/1202-this-week-answered-count
fix/122-124-leftovers
fix/1178-get-routes-that-write
fix/1203-journeys-check-names
design/125-campaign-templates
feat/126-calendar-engine
design/126-in-world-calendar
fix/1189-cited-stamp-in-range
fix/1189-v4-looser-check
fix/1189-richer-beats
fix/1113-export-bind-lists
fix/1154-release-notes-by-file
chore/release-4.5.0
chore/release-4.5.0-rc12
fix/1135-wiki-markup-as-text
fix/demo-usage-cost-in-window
chore/release-4.5.0-rc11
fix/1121-sheet-consistency
fix/1121-sheet-5e-terms-and-card-hp
copy/1122-busiest-pages
fix/1121-relevant-choices
fix/1121-wiki-create-npc-save-sheet-links
fix/1029-menu-stays-on-screen
docs/prototype-transcript-bin-wording
fix/1023-editor-save-row-back-scroll
fix/1020-search-exact-first
fix/1020-table-prep
fix/1020-shell-wordmark-footer-bell
fix/1020-wiki-article-party
fix/872-admin-kept-until-phone-tables
feat/l13-milestone-level-waiting
fix/1000-1001-bell-older-setup-context
fix/999-pronouns-in-prompts
fix/l19-other-class-feats
fix/1010-transcript-window-ordinary-confirm
docs/d254-d269-decisions
fix/702-member-search
fix/680-transcript-bin
fix/993-unidentified-prompts
fix/841-redis-timeouts
fix/990-binned-not-exported
fix/830-export-prep-shelf
fix/deps-audit-2026-10-01
fix/877-title-reads
fix/798-audio-received-at
build/lane11-17-j7
build/lane11-16-levelup
build/lane11-14-seams
build/lane11-14-seed
build/lane11-15-start
build/lane11-13-old-block-out
fix/980-review-r3
build/lane11-12-block
build/lane11-8-packs
fix/demo-seed-canonical-names
build/lane11-11-hot-half
docs/l11-decisions
build/lane11-7-convert
build/lane11-10-editing
fix/npm-audit-brace-expansion
build/lane11-9-sheet-page
fix/bot-pyjwt
build/lane11-6-content
fix/lane11-rank-names
build/lane11-2b-language
build/lane11-4-js-evaluator
build/lane11-3-server
build/lane11-5a-pf2e
build/lane11-5b-5e
feat/design-admin
build/lane11-2-evaluator
build/lane11-1-sheet-pieces
build/lane11-0-drawing
fix/943-quest-objectives-fk
fix/prepsheet-shelf-flake
fix/945-leftovers
build/demo-gm-copy
fix/901-email-landings
build/lane10-8-journeys
build/demo-seed-lanes-8-10
fix/887-gm-own-confirmation
build/lane9-5-j1-admin
fix/918-audience-click
fix/useasync-overtaken
ci/939-critical-path
test/937-backend-suite-speed
chore/claude-orchestration
fix/924-xp-gm-only
fix/session-stale-poll
docs/decisions-d239-d242
fix/930-pypdf
build/lane8-journeys
build/925-quest-editor
fix/894-private-page-pictures
build/lane8-p4-drafts
build/lane8-p7-map
build/lane8-p6-handouts-rules
fix/wiki-fixture-names
build/lane10-d227-test-usage
fix/rsvp-horizon-test-tuesday
fix/media-volume-owner
build/lane8-p3-editor
fix/912-unidentified-rename
build/lane8-p5-party-quests
build/lane8-handout-takeback
build/lane10-pickers
build/lane8-p2-article
build/lane8-6-map
build/lane10-7b-email-pages
build/lane8-5-handouts
build/lane10-7a-test-the-bot-pages
build/lane8-p1-pages
build/lane8-4-quests
build/lane8-2b-feeds
build/lane8-3-parties
build/lane8-2a-links
build/lane10-5-commands
build/lane9-6-seed
build/lane10-4b-reactions
build/lane9-4d-pages
build/lane9-4c-pages
build/lane10-4a-posts
build/lane10-3-email
fix/891-web-fonts
build/lane9-4b-pages
build/lane10-6-test-the-bot
build/lane10-2-notify-out
build/lane8-1-wiki-text
build/lane9-4a-frame
design/lane10-drawings
fix/j6-budget
fix/j5-phone-flake
fix/869-test-leaks
fix/843-record-start-followups
build/lane7-all
build/lane6-all
build/lane9-b2-server
chore/changelog-fragments
docs/decisions-d218
build/lane9-a-owner-overview
fix/rule-card-level-label
fix/834-retention-semantics
fix/o3c-record-without-announcement
docs/decisions-d179
docs/decisions-d131-d170
fix/851-commit-before-response
build/lane6-j3-seed
build/lane9-b1-d67-identity
fix/841-blocking-loop
build/lane9-c-backups-audit
fix/vote-race-and-start-commit
fix/recording-announcement
fix/proposal-read-leak
fix/last-admin-guard
build/lane6-p4c-planning
build/lane6-p4b-margin
build/lane6-p4a-sheet
build/lane5-j4-seed
build/lane6-base
build/lane7-pages-talk
build/lane5-pages
build/lane7-pages-safety
build/lane7-p3-safety
build/lane7-p2-notify
build/lane6-p3-planning
build/lane6-p2-history
build/lane6-p1b-items
build/lane7-p1-threads
build/lane5-p6-faces
build/lane6-p1a-sheet
build/lane5-p5-find
build/lane5-p4a-board
build/lane5-p4b-scenes
build/lane5-p3-live
build/lane5-base
build/lane5-p2-cards
docs/lane5-decisions
build/review-r2-wide
fix/review-r1
build/lane5-p1-scenes
build/demo-seed
build/lane4-journeys-j5
build/lane4-page-review-b
build/lane4-page-review-a
build/lane4-page-read
build/lane4-journeys
build/lane4-page-sess2
build/lane4-page-sess1
build/lane4-notes
build/lane4-discord-on-approval
build/lane4-scheduling
build/lane4-versions
build/760-session-number
build/lane4-decisions
build/797-erase-no-regenerate
build/test-race-audit
build/lane3-completions
build/794-dark-only
build/796-titles-scroll
build/791-retention-anchor
build/a11y-sweep
build/shell-followups
build/retention-preview
build/753-backup-readback
docs/d91-d93
build/lane3-j1
build/ci-harness-paths-selftest
fix/useauth-test-race
build/ci-harness-paths
build/777-ai-settings-read
build/lane3-settings-c
build/lane3-settings-b
build/lane3-j6
build/lane3-sessionform
build/lane3-settings-a
build/lane3-members
build/lane3-thisweek
build/lane3-story
chore/87-align-python-3.12
v4.8.0-rc1
v4.7.1
v4.7.1-rc1
v4.7.0
v4.7.0-rc4
v4.7.0-rc3
v4.7.0-rc2
v4.7.0-rc1
v4.6.2
v4.6.2-rc4
v4.6.2-rc3
v4.6.2-rc2
v4.6.2-rc1
v4.6.1
v4.6.1-rc1
v4.6.0
v4.6.0-rc2
v4.6.0-rc1
v4.5.3
v4.5.3-rc1
v4.5.2
v4.5.2-rc1
v4.5.1
v4.5.1-rc2
v4.5.1-rc1
v4.5.0
v4.5.0-rc12
v4.5.0-rc11
v4.5.0-rc10
v4.5.0-rc9
v4.5.0-rc8
v4.5.0-rc7
v4.5.0-rc6
v4.5.0-rc5
v4.5.0-rc4
v4.5.0-rc3
v4.5.0-rc2
v4.5.0-rc1
v4.4.1
v4.4.0
v4.3.0
v4.2.3
v4.2.2
v4.2.1
v4.2.0
v4.1.2
v4.1.1
v4.1.0
v4.0.1
v4.0.0
v3.11.4
v3.11.3
v3.11.2
v3.11.1
v3.11.0
v3.10.0
v3.9.1
v3.9.0
v3.8.0
v3.7.0
v3.6.1
v3.6.0
v3.5.0
v3.4.1
v3.4.0
v3.3.0
v3.2.0
v3.1.0
v3.0.0
v2.1.0
v2.0.0
v1.1.0
v1.0.0
v0.12.0
v0.11.0
v0.10.0
v0.9.1
v0.3.3
v0.9.0
v0.8.0
v0.3.2
v0.3.1
v0.3.0
v0.7.0
v0.6.0
v0.5.0
v0.4.0
v0.2.1
v0.2.0
v0.1.1
v0.1.0
Labels
Clear labels   
backend
Issue related to the backend

  
bot
Issue related to the bot

  
bug
Something is not working

  
duplicate
This issue or pull request already exists

  
enhancement
New feature

  
frontend
Issue related to the frontend

  
help wanted
Need some help

  
invalid
Something is wrong

  
question
More information is needed

  
recording
Issue related to the recording system

  
security
Security hardening / vulnerability work

  
wontfix
This won't be fixed

No labels
backend
bot
bug
duplicate
enhancement
frontend
help wanted
invalid
question
recording
security
wontfix
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
rbrooks/Quest-Board#643
No description provided.