From e39d1a446e750dabcb1ba46ccd2225c9bb8f4b2f Mon Sep 17 00:00:00 2001
From: Phillip Tarrant <ptarrant@gmail.com>
Date: Thu, 9 Jul 2026 12:54:01 -0500
Subject: [PATCH] fix(api): constrain disposition_overrides keys; close docker
 paper cuts

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 api/.dockerignore                    | 16 ----------------
 api/tests/test_content_resolution.py |  7 +++++++
 api/tests/test_origin_schema.py      |  6 ++++++
 docker-compose.yml                   |  3 ++-
 docs/schemas/origin.schema.json      |  1 +
 5 files changed, 16 insertions(+), 17 deletions(-)
 delete mode 100644 api/.dockerignore

diff --git a/api/.dockerignore b/api/.dockerignore
deleted file mode 100644
index 6dc1728..0000000
--- a/api/.dockerignore
+++ /dev/null
@@ -1,16 +0,0 @@
-# Keep the build context small and secrets out of the image.
-.env
-.env.*
-__pycache__/
-*.py[cod]
-.venv/
-venv/
-.pytest_cache/
-.mypy_cache/
-.ruff_cache/
-.coverage
-htmlcov/
-docs/
-README.md
-Dockerfile
-.dockerignore
diff --git a/api/tests/test_content_resolution.py b/api/tests/test_content_resolution.py
index 133499c..2f03655 100644
--- a/api/tests/test_content_resolution.py
+++ b/api/tests/test_content_resolution.py
@@ -38,3 +38,10 @@ def test_null_quest_ref_resolves():
     origin = copy.deepcopy(load_origin(DESERTER))
     origin["start_quest_id"] = None
     assert unresolved_refs(origin, world) == []
+
+
+def test_broken_disposition_npc_ref_is_detected():
+    world = load_world(CONTENT_ROOT)
+    origin = copy.deepcopy(load_origin(DESERTER))
+    origin["disposition_overrides"]["ghost_npc"] = 10
+    assert "npc:ghost_npc" in unresolved_refs(origin, world)
diff --git a/api/tests/test_origin_schema.py b/api/tests/test_origin_schema.py
index bdfe8ca..036b58e 100644
--- a/api/tests/test_origin_schema.py
+++ b/api/tests/test_origin_schema.py
@@ -46,3 +46,9 @@ def test_extra_field_is_rejected():
     doc = copy.deepcopy(VALID_ORIGIN)
     doc["surprise"] = True
     assert validate_origin(doc) != []
+
+
+def test_disposition_override_key_must_match_id_pattern():
+    doc = copy.deepcopy(VALID_ORIGIN)
+    doc["disposition_overrides"] = {"Brannoc Thane": 40}
+    assert validate_origin(doc) != []
diff --git a/docker-compose.yml b/docker-compose.yml
index cfba5e4..56d63d7 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -10,7 +10,8 @@ services:
     ports:
       - "8000:8000"
     env_file:
-      - ./api/.env
+      - path: ./api/.env
+        required: false
     environment:
       PORT: 8000
     # Mount source + schemas so edits are live without a rebuild.
diff --git a/docs/schemas/origin.schema.json b/docs/schemas/origin.schema.json
index c4f7734..0485da9 100644
--- a/docs/schemas/origin.schema.json
+++ b/docs/schemas/origin.schema.json
@@ -20,6 +20,7 @@
     "opening_facts": { "type": "array", "items": { "type": "string", "minLength": 1 } },
     "disposition_overrides": {
       "type": "object",
+      "propertyNames": { "pattern": "^[a-z0-9_]+$" },
       "additionalProperties": { "type": "integer", "minimum": -100, "maximum": 100 }
     },
     "inventory_grants": {