[stanGSA]

Summary

Server deployments previously accepted placeholder credentials, password changes did not revoke existing JWTs, and expired task workers could overwrite replacement results. This change hardens authentication and request handling, prevalidates personal archives, and prevents cancelled review/profile work from committing stale results.

• Reject weak or placeholder bootstrap credentials; migrate existing user tables with token versions and revoke existing tokens on password changes.
• Read password hashes and token versions together, reject logins whose version changed during verification, and sign with the verified version so an in-flight old-password login cannot acquire a new-version token.
• Rate-limit failed logins by client address. Successful logins keep the IP failure budget until expiry, preventing own-account logins from resetting guesses against other accounts.
• Apply route-specific request body limits and validate personal archive profiles before importing database rows.
• Propagate cancellation and active lease checks through interview/recording profile extraction, embeddings, memory projection, consolidation, and final review/status/metadata writes. Recheck ownership before writes even when the heartbeat has not yet detected takeover.
• Keep the Compose API behind Nginx and document when forwarded client addresses may be trusted.

Validation

• 531 backend/contract/migration tests passed (0 failures), including 18 new regressions covering the review findings.
• Real SQLite repositories and two task queues cover stale resume/recording workers, profile-only retries, late results/errors, and takeover before the next heartbeat. Additional tests cover cancellation during embeddings and repository lock waits.
• Auth regressions cover successful own-account login bypass and password changes during verification or just before token signing.
• Both TypeScript checks, runtime boundary checks, API build, and frontend typecheck/lint/tests/build passed.
• Frontend lint: 0 errors, 41 existing warnings.
• Docker Compose runtime/config validation remains unverified because Docker is not installed locally.

[AnnaSuSu]

Three issues in the auth and task-lease hardening need to be addressed before merging. Each was independently reproduced against commit 52356cf; the inline comments describe the trigger and the observed result.

Validation: all 513 backend tests passed locally in an environment that permits the WebSocket tests to listen on loopback, and all three GitHub CI jobs passed. The additional reproductions confirm scenarios that the existing tests do not cover.

[AnnaSuSu]

All three previous findings are fixed in 2f064f2. I independently reran the original IP rate-limit bypass, old-password login race, and stale review/profile overwrite scenarios; all now preserve the intended security and task ownership boundaries.

Validation: 531 backend tests passed, all three independent regression scenarios passed, both TypeScript checks and runtime boundary checks passed, and all three GitHub CI jobs passed on this exact head.