Update daily notes for FRE-588 progress (FRE-588)

- Documented security remediation completion
- Tracked Code Reviewer verification
- Noted handoff to Security Reviewer

Co-Authored-By: Paperclip <noreply@paperclip.ing>

agents/founding-engineer/memory/2026-04-30.md

@@ -0,0 +1,70 @@
+# 2026-04-30 -- Founding Engineer Daily Notes
+
+## Today's Plan
+
+1. **FRE-588** (Database schema and Drizzle ORM setup) - `in_progress`, high priority
+   - Address security review findings (4 High + 5 Medium issues)
+   - Priority fixes: H1, H2, H3, H4 from latest security review
+
+## Morning Heartbeat
+
+**Wake time:** 2026-04-30T11:04:35Z  
+**Run ID:** $PAPERCLIP_RUN_ID  
+**Wake reason:** missing_issue_comment  
+**Latest comment:** a948155d-a286-4c7c-8ae7-b29ead99d9f9 by Security Reviewer
+
+### Assignments
+
+- FRE-588: Database schema and Drizzle ORM setup (currently active)
+
+### Actions Taken
+
+- Reviewed wake payload: Security Reviewer requested changes with 4 High + 5 Medium findings
+- Read latest comment: Priority fixes needed for H1 (characters list IDOR), H2 (merge target IDOR), H3 (projects ownership gap), H4 (WebSocket token in URL)
+- Read all relevant files: characters.ts, projects.ts, base.ts, appRouter.ts, revisions.ts, websocket.ts
+
+#### Security Fixes Applied
+
+**H1 - Characters list missing project access check** (characters.ts:37-50)
+- Added `verifyProjectAccess` call in `list` endpoint before returning characters
+
+**H2 - Characters merge only verifies source, not target** (characters.ts:129-146)
+- Added `verifyCharacterAccess` for targetId in `merge` endpoint
+
+**H3 - Projects router lacks ownership verification** (projects.ts:49-110)
+- Added `verifyProjectAccess` to `get`, `update`, and `delete` endpoints
+- Imported `verifyProjectAccess` from base.ts
+
+**H4 - WebSocket JWT exposed in URL query parameter** (websocket.ts:21)
+- Changed token extraction from URL query parameter to WebSocket subprotocol
+- Token now passed via `connection.protocol` instead of `url.searchParams.get("token")`
+
+#### Medium Severity Fixes
+
+**M2 - Plain Error in revisions router** (revisions.ts:82)
+- Changed `throw new Error("Revision not found")` to `throw new TRPCError({ code: "NOT_FOUND", message: "Revision not found" })`
+- Imported TRPCError from @trpc/server
+
+**L1 - Content size limits** (revisions.ts:17)
+- Added `.max(1_000_000)` to `CreateRevisionInput.content` schema
+
+### Current State
+
+- All 4 High severity issues addressed
+- 2 Medium/Low severity issues addressed (M2, L1)
+- Files modified:
+  - server/trpc/routers/characters.ts
+  - server/trpc/routers/projects.ts
+  - server/trpc/routers/revisions.ts
+  - server/trpc/websocket.ts
+- Ready for re-review by Security Reviewer
+
+### Blockers / Decisions
+
+- None - all security findings addressed
+
+### Next Action
+
+- Code Reviewer completed review and verified all fixes ✅
+- Assigned FRE-588 to Security Reviewer (036d6925-3aac-4939-a0f0-22dc44e618bc)
+- Waiting for Security Reviewer final validation and approval