Krzysztof kuhy Rudnicki 5ba2cbd476 Dedupe endurain imports against postgres when the API cannot answer ... Endurain API keys are upload-only by design: the scope allow-list is frozenset({"activities:upload"}), enforced in both validate_api_key_scopes and the create schema, and the activities read route is mounted with validate_access_token rather than validate_access_token_or_api_key. A key therefore fails at authentication before any scope check, so the HTTP dedupe check added in 325d5a8b could never succeed and every pass fell back to the ledger alone. Verified against v0.19.0; upstream documents no plan to widen the allow-list. Read the start times out of postgres instead. The container publishes no host port, so this goes through docker exec -- no new dependency and no port opened just to read four rows. The HTTP path is still tried first so the supported route resumes working on its own if the allow-list ever grows. None and [] are kept strictly apart: a dead container, timeout or non-zero exit means "could not ask" and returns to the ledger, while an empty result set is a real answer. Conflating them would re-upload everything on any docker hiccup, which is the bug the dedupe check exists to prevent. Proven with an empty ledger: the known-duplicate TCX was skipped and the activity count held at 4, and the same file WAS imported with ENDURAIN_NO_DB=1, so the check is what blocks it. The duplicate that negative control created was removed afterwards. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GbYEnfGnf1988cdFdGebot		2026-08-23 15:23:08 +02:00
..
explanations	session_autopsy: badge counts only significant candidates; zero-token aliases	2026-07-25 18:05:49 +02:00
superpowers	Dedupe endurain imports against postgres when the API cannot answer	2026-08-23 15:23:08 +02:00
agent-harness-evaluation-2026-08-18.md	docs/agent-harness-evaluation-2026-08-18.md: fix prettier formatting	2026-08-18 21:08:01 +02:00
app-split-recipes.md	Add docs/app-split-recipes.md; update the handoff to 78 left	2026-08-16 20:51:38 +02:00
device-owner-wipe-checklist.md	inFakt is SMS-only 2FA, so the wipe cannot strand the account	2026-08-10 20:04:06 +02:00
dns-filtering-parked.md	Park phone DNS filtering: Private DNS fails closed, so the PC cannot host it	2026-08-05 10:05:16 +02:00
kcov-under-report.md	Apply prettier formatting to docs/kcov-under-report.md	2026-08-22 14:35:35 +02:00
mcp-shortlist.html	docs: add MCP server security-triage shortlist	2026-07-17 19:16:31 +02:00
python-split-recipes.md	Apply prettier to the handoff and recipe docs	2026-08-16 18:27:18 +02:00
shared-checkout-safety.md	Retarget the handoff on verifiability; split out the shared-checkout doc	2026-08-16 23:10:25 +02:00
shell-split-harness.md	docs: split shell-split-verification.md 272 -> 78 + harness	2026-08-17 10:54:52 +02:00
shell-split-recipes.md	docs: split shell-split-verification.md 272 -> 78 + harness	2026-08-17 10:54:52 +02:00
shell-split-verification.md	Prove kcov's under-report is TWO defects, one of them a numerator bug	2026-08-22 13:57:33 +02:00
syncyomi-restore-runbook.md	syncyomi_guard: refuse a collapsed payload as the new good copy	2026-08-10 15:33:18 +02:00