MARS-118 Audit PTD render-GET tooling: enable exercising authed routes (dedicated test-user + stored session, OR a server-side render-self-check route) — Mars leg of the cross-project gap that let Pluto's /informes 500 ship unexercised (audit unauth render-GET -> 302/login, authed routes never actually rendered in PTD)

MARS-118 · mars

Audit PTD render-GET tooling: enable exercising authed routes (dedicated test-user + stored session, OR a server-side render-self-check route) — Mars leg of the cross-project gap that let Pluto's /informes 500 ship unexercised (audit unauth render-GET -> 302/login, authed routes never actually rendered in PTD)

No sub-items.

No questions.

2026-06-14T05:35:44.568Z · created · wi-cli-venus
2026-06-14T05:36:23.543Z · commented · wi-cli-venus

Design steer (3-PM + apiimages security caveat): PREFER an in-process server-side render-self-check route (credential-less) over a stored test-user session — a stored session is a standing credential/attack surface. Cross-project umbrella WI on venus side + nw-whey co-owns infra leg; sequenced after live incidents + Pluto P3 close.