rbrooks/Quest-Board

Watch

Fork 0

An unidentified item's true name can reach players through title reads outside the wiki #877

New issue

Closed

opened 2026-09-27 03:49:37 +00:00 by claude-bot · 2 comments

claude-bot commented

2026-09-27 03:49:37 +00:00

Collaborator

Lane 8 PR 3 (#734) adds unidentified items (IS-122). A page carries player_title, and players see that title instead of the true one. The swap is done on every wiki read, in the AI and transcriber feeds and in export, and test_wiki_crawl covers all of those.

The gap: roughly 150 other LoreEntry.title reads in app/ weren't audited. Notifications (bell lines, emails and Discord posts that name a page), session and shelf text outside the card faces, search elsewhere, and similar paths could show a player an item's true name.

Fix: an AST allowlist, like test_body_readers.py, for reads of LoreEntry.title. Each read either goes through a title-for-reader helper or is allowlisted as GM-only or unseen, and any new read fails CI. Then convert or justify each existing read.

Lane 8 PR 3 (#734) adds unidentified items (IS-122). A page carries `player_title`, and players see that title instead of the true one. The swap is done on every wiki read, in the AI and transcriber feeds and in export, and `test_wiki_crawl` covers all of those. **The gap:** roughly 150 other `LoreEntry.title` reads in `app/` weren't audited. Notifications (bell lines, emails and Discord posts that name a page), session and shelf text outside the card faces, search elsewhere, and similar paths could show a player an item's true name. **Fix:** an AST allowlist, like `test_body_readers.py`, for reads of `LoreEntry.title`. Each read either goes through a title-for-reader helper or is allowlisted as GM-only or unseen, and any new read fails CI. Then convert or justify each existing read.

claude-bot referenced this issue

2026-09-27 03:50:00 +00:00

feat(webapp): the party, items, reputation and downtime (lane 8 PR 3) — stacked on #874 #878

claude-bot commented

2026-10-01 16:39:41 +00:00

Author

Collaborator

Picking this up (1 Oct), on fix/877-title-reads. Plan as the issue says: enumerate every read of a lore page's title under app/, classify each (through the title-for-reader helper; GM-only by construction; never shown; or a leak), fix each leak with a test that a player sees player_title, and add an AST allowlist test beside test_body_readers.py so a new unclassified read fails CI. Lane 11's sheet code (sheets named after their page) is in scope.

Picking this up (1 Oct), on `fix/877-title-reads`. Plan as the issue says: enumerate every read of a lore page's title under `app/`, classify each (through the title-for-reader helper; GM-only by construction; never shown; or a leak), fix each leak with a test that a player sees `player_title`, and add an AST allowlist test beside `test_body_readers.py` so a new unclassified read fails CI. Lane 11's sheet code (sheets named after their page) is in scope.

rbrooks referenced this issue from a commit

2026-10-01 17:07:56 +00:00

WIP: Unidentified items keep their player title outside the wiki: fixes and the title-readers allowlist (#877)

rbrooks referenced this issue from a commit

2026-10-01 17:07:56 +00:00

WIP: Unidentified items keep their player title outside the wiki: the tests that prove each leak closed (#877)

rbrooks referenced this issue from a commit

2026-10-01 17:07:56 +00:00

Unidentified items keep their player title outside the wiki: ruff, changelog fragment (#877)

claude-bot referenced this issue

2026-10-01 17:09:29 +00:00

Unidentified items: GM-reviewed model prompts still get the true name, and proposals about one don't match its page #993

claude-bot referenced this issue from a pull request that will close it,

2026-10-01 17:34:56 +00:00

An unidentified item keeps its party name outside the wiki (#877) #994

claude-bot closed this issue

2026-10-01 17:54:19 +00:00

claude-bot referenced this issue from a commit

2026-10-01 17:54:19 +00:00

Merge PR #994: an unidentified item keeps its party name outside the wiki (#877)

rbrooks referenced this issue from a commit

2026-10-01 18:01:33 +00:00

The title guard knows the export's two new reads: an arc's own title, and a reveal's, already the table's (#830, #877)

claude-bot commented

2026-10-01 18:01:37 +00:00

Author

Collaborator

Done in #994, merged 1 Oct (main 566185fe).

Found: PUT /lore/{id}/identity accepts any kind of page, so quests, characters and NPCs can be unidentified too, not only items. Of about 250 .title reads under app/, 103 were a page's title, and sixteen leaked the true name to someone who should read the party's:

History; a name-clash oracle on create and rename; the bell, email and Discord DM for a shown handout; the reveal's stored row; the Discord handout post; a session's cold open; the quest log; the pre-session reminder's open threads; the bot's /quests; a timeline row with no words of its own; "Add to a sheet"; a new sheet's starting name; a level-up's milestone; a rest's refusal; the proposal-merge prompt (its output is not GM-reviewed); and the wiki list's sort order.

Each is fixed with a test that fails on the old code (tests/wiki/test_unidentified_titles.py).

The guard: tests/wiki/test_title_readers.py lists every .title read by module, function and expression, with a count and a reason for each page title. A new read fails CI. It already caught two in #830's export module on the next merge, which were then classified. Its docstring lists what it cannot see (rows read by key, a title copied into another column, aliases, the bot and the frontend).

Decisions and follow-ups

Words written once for everyone (a reveal's row, the Discord handout post, a level-up milestone, a new sheet's name) use the party's name for GMs too: question W18 on the Questions page.
No data fix for rows written before this: unidentified items arrived in lane 8 and have never been released, so no production data holds a true name in a reveal row.
#993: GM-reviewed prompts still get the true name; a proposal about an unidentified item doesn't match its page.
The audit log's descriptions keep true titles; it is administrators-only.

Done in #994, merged 1 Oct (main 566185fe). **Found:** `PUT /lore/{id}/identity` accepts any kind of page, so quests, characters and NPCs can be unidentified too, not only items. Of about 250 `.title` reads under `app/`, 103 were a page's title, and **sixteen leaked** the true name to someone who should read the party's: History; a name-clash oracle on create and rename; the bell, email and Discord DM for a shown handout; the reveal's stored row; the Discord handout post; a session's cold open; the quest log; the pre-session reminder's open threads; the bot's `/quests`; a timeline row with no words of its own; "Add to a sheet"; a new sheet's starting name; a level-up's milestone; a rest's refusal; the proposal-merge prompt (its output is not GM-reviewed); and the wiki list's sort order. Each is fixed with a test that fails on the old code (`tests/wiki/test_unidentified_titles.py`). **The guard:** `tests/wiki/test_title_readers.py` lists every `.title` read by module, function and expression, with a count and a reason for each page title. A new read fails CI. It already caught two in #830's export module on the next merge, which were then classified. Its docstring lists what it cannot see (rows read by key, a title copied into another column, aliases, the bot and the frontend). **Decisions and follow-ups** - Words written once for everyone (a reveal's row, the Discord handout post, a level-up milestone, a new sheet's name) use the party's name for GMs too: question W18 on the Questions page. - No data fix for rows written before this: unidentified items arrived in lane 8 and have never been released, so no production data holds a true name in a reveal row. - #993: GM-reviewed prompts still get the true name; a proposal about an unidentified item doesn't match its page. - The audit log's descriptions keep true titles; it is administrators-only.

claude-bot referenced this issue

2026-10-01 18:54:23 +00:00

Campaign export carries prep, arcs and the shelf, and what is in the bin stays out (#830, #990) #998

claude-bot referenced this issue

2026-10-01 19:23:33 +00:00

A model is shown an unidentified item's party name, and a proposal about one finds its page (#993) #1003

claude-bot referenced this issue

2026-10-01 20:16:35 +00:00

Dev deploy, 1 Oct: lane 11, the R3 fixes and today's issue fixes #1004

claude-bot referenced this issue

2026-11-07 00:41:54 +00:00

[Foundry] Test (D337): a minimal Quest Board module pairs and round-trips in The Amberwake Accord #4