mirror of
https://github.com/Such-Software/smirk-backend-core.git
synced 2026-10-17 07:21:32 +02:00
- Reject boot when POW_REQUIRED (or the per-pubkey PoW list) is set while FEATURE_POW is off: the gate would silently never apply and /capabilities would report pow_required:false — a signup endpoint the operator believes is protected but isn't. - Validate the premium PAYMENT_API_KEY through the same require_secret path the pay-to-register flow uses, so a placeholder key cannot reach production. - Advertise the premium-post write policy in MessagingCapability and regenerate openapi.json to match. - Give the premium integration fixtures unique per-run ids so the suite is re-runnable against a persistent local test database.