McRitchie Studio

← All Tasks

Sizing

Secure learning-loop grade endpoints

Archived

secure-learning-loop-grade-endpoints

Created

Jul 03, 05:13

Started

Jul 03, 05:14

Completed

Jul 03, 21:53

DevOps handoff

Type

Bug

Shape

backend

Worktree Slug

secure-learning-loop-grade-endpoints

Repositories

mcritchie-studio

Release Slug

—

Branch

feat/secure-learning-loop-grade-endpoints

Pull Request

https://github.com/amcritchie/mcritchie-studio/pull/337

Local URL

—

QA URL

—

Production URL

—

auth

Acceptance Criteria

Anonymous clients cannot POST grade or bank writes
Grade write actions require admin authentication
Insight Bank renders banked span grades without crashing

Expected Test Plan

[unit] ActionGrade provenance methods (insight_source/insight_label)
[integration] admin-gated grade writes + public reads + Insight Bank renders span grades

Checks Run

[unit] ActionGrade#insight_source/#insight_label provenance — action/span/orphaned/label-fallback (5 cases)
[integration] grade+grade_event writes admin-gated (anon rejected, no row); reads stay public; Insight Bank renders banked SPAN grade without crashing
[full-suite@0aa37405c21b042aab39cf55c6a429a11c83821a] bin/rails test green
[rubocop@0aa37405c21b042aab39cf55c6a429a11c83821a] bin/rubocop clean

Agent Context

Audit 2026-07-02 high findings #3+#5. (1) HeartbeatController skip_before_action :require_authentication is class-wide, so POST alex/heartbeat/actions/:id/grade and events/:id/grade are writable by anyone on prod with a client-supplied grader (mcr forgeable) — data-poisoning into the OPSD Insight Bank. Fix: mirror TasksController — skip auth only on read actions (show, all_spans, insights, feedback, feedback_event), require_admin on grade/grade_event. (2) app/views/heartbeat/_insight.html.erb derefs grade.atomic_action unconditionally; a banked SPAN grade (atomic_event target) has nil atomic_action so /alex/insights 500s — the Alex heartbeat SOP's normal output path. Fix: controller includes(:atomic_action, :atomic_event); view reads from whichever target is set. Regression-test-first (bug SOP): request spec anon grade POST rejected + GET insights with a banked span grade returns 200. Agent bearer CLI grade path is a SEPARATE follow-up (north-star lever 2).

Stage Timeline

Who handled each stage, the time it took (measured), and the model / tokens / cost reported (best-effort) — plus who's on it right now. — means the agent didn't report that metric.

Sizing Avi · PO SMALL Dev SMALL Actual XL ≠ forecast

Created → Designed

A
Arbok

Model

—

Duration

—

Tokens

—

Cost

—

Completed Jul 03, 05:13 · 5 days ago

api
Designed → Building

A
Arbok

Model

claude-opus-4-8

Duration

under a minute

Tokens

1,671,020

Cost

~$1.33

Started Jul 03, 05:13

Completed Jul 03, 05:14 · 5 days ago

cli
Building → Submitted

A
Arbok

Model

claude-opus-4-8

Duration

18 minutes

Tokens

28,164,682

Cost

~$17.19

Started Jul 03, 05:14

Completed Jul 03, 05:31 · 5 days ago

cli
Submitted → Reviewed Review Activity

C
Carl primary

S
Shannon light

Model

claude-opus-4-8

Duration

about 8 hours

Tokens

3,697,266

Cost

~$3.73

Started Jul 03, 05:31

Completed Jul 03, 13:55 · 5 days ago

cli
Reviewed → Assembled

S
Steffon

Model

claude-opus-4-8

Duration

14 minutes

Tokens

7,690,969

Cost

~$6.35

Started Jul 03, 13:55

Completed Jul 03, 14:09 · 5 days ago
Assembled → Shipped

A
Avi

Model

claude-opus-4-8

Duration

about 8 hours

Tokens

750,752,257

Cost

~$462.70

Started Jul 03, 14:09

Completed Jul 03, 21:53 · 5 days ago
Shipped → Archived

—

Model

—

Duration

about 10 hours

Tokens

—

Cost

—

Started Jul 03, 21:53

Completed Jul 04, 07:34 · 4 days ago