Motir

The story's motir-core suite gate — one repository, one suite, one PR. It runs after this story's four motir-core cards merge and measures their real, merged result. It is not a list of cases written in advance.

Three jobs, in the order they earn their keep:

1 · Coverage floor. Run coverage over this story's changed motir-core surface — the new public routes and anything under lib/api/public/ they touched — and wherever it is below the project's per-file floor (≥90% branch/fn/line, motir-core/CLAUDE.md § coverage), write the missing tests to reach it. Each card ships its own units; this tops up what falls between them. "Already covered by the per-subtask floor" is the expected normal, not a reason the card has nothing to do.

2 · The seams the units mock. Drive each new route's real response back through the shape the consumer reads — the contract document /api/openapi/public.json actually serves — so a key that drifts between the DTO, the operation and the emitted document fails here rather than on motir.co. This is the guard public-surface-hosts.md §3 insists belongs in the producing repository: "a contract test that lives only in the consumer reports that motir-core broke motir.co, after it has shipped."

3 · The guarantees coverage cannot see.

• The session cookie is host-only, asserted rather than assumed. This is the story's own acceptance criterion and §4's load-bearing condition. Read the shipped Better-Auth configuration and assert that no Domain attribute widening the session cookie to .motir.co is set, and that no code path sets one. Write it so it fails loudly if someone adds one later — this is the assertion the whole host split rests on.
• Totality, not a list. Every route under app/api/public/ has a declared operation, a cloud gate and an anonymous-posture entry — enumerated from the filesystem, so a route added later with none of them turns this suite red. The existing contract-coverage, cloud-gate-totality and anonymous-posture suites already do this; extend them to cover whatever the act path card decided about app/api/public-requests/*, which is today outside all three.
• The 404-not-403 posture on every new read: unknown, non-public and epic-privacy-hidden all answer the same 404, with no existence leak.

Real Postgres, not mocks, for anything that touches the service layer.

Acceptance criteria

• Coverage over this story's changed motir-core files meets the project floor, with the gaps filled by tests written in this card.
• A test asserts, against the shipped auth configuration, that the session cookie carries no Domain widening it beyond the application host — and the assertion is written so that adding one fails the suite.
• A contract-seam test drives each new route's real response against the served public OpenAPI document, so a shape drift fails in this repository.
• The route enumeration is derived from the filesystem: a new app/api/public/**/route.ts with no operation, no cloud gate or no posture entry turns the suite red without anyone editing a list.
• Whatever the act path card decided about app/api/public-requests/{id}/{upvote,comments} is asserted here — inside the contract and the gate, or outside them with the decision's reason cited in the test.
• The 404-not-403 posture is asserted per new read, including the epic-privacy case.
• The suite runs in motir-core's existing lanes with no new job, and adds no exemption to an existing guard.
• No file outside motir-core is touched.

Context refs

• motir-core/tests/api/public/ — contract-coverage, contract-drift, contract-document, cloud-gate, cloud-gate-totality, anonymous-posture
• motir-core/tests/api/public-project-subject-route.test.ts — the pattern MOTIR-3945 established
• MOTIR-3885 — this card's predecessor gate for MOTIR-3876; read it before writing, and do not re-derive what it already covers
• motir-core/lib/auth.ts — the cookie configuration under assertion
• motir-core/docs/decisions/public-surface-hosts.md §3 (the guard's home) and §4 (the condition)
• motir-core/CLAUDE.md § coverage