fix(anon): owner key overflowed owner_user_id, 500ing anonymous writes

Live outage on both deployments since spec 0009 shipped on 2026-09-04:
POST /api/projects and POST /api/constructs returned 500 for anyone not
signed in, which is the entire anonymous try-it path.

ANON_PREFIX + secrets.token_hex(16) is 37 characters and both
owner_user_id columns are String(32). SQLite ignores VARCHAR limits so
all 162 tests passed locally; PostgreSQL enforces them, so every
anonymous insert was rejected. Signed-in users were unaffected because a
user id is exactly 32 characters, which is why nobody reported it - lab
members are signed in.

Shortened the session id to 13 bytes (104 bits of entropy, key length
31) rather than widening the column. A type change is not additive, so
auto_migrate_sqlite would not apply it and both deployed databases would
have needed hand-run DDL; this deploys as-is. No data is lost because no
anon: row was ever successfully written.

The regression test reads the column width from the model rather than
hardcoding it, and asserts against the keys the app actually mints, so it
fails if either the prefix, the id length, or the column changes. Added a
runtime assertion too, since this class of bug is invisible in dev by
construction: the database we test on does not enforce what the database
we deploy on does.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

CHANGELOG.md

@@ -66,6 +66,12 @@ Format: [Keep a Changelog](https://keepachangelog.com/). User-visible changes on
   texts, with the machine and date they were measured on.
 
 ### Fixed
+- Creating a project or a custom construct without signing in works again. Since
+  2026-09-04 both deployments returned a server error for anonymous visitors:
+  the new anonymous session owner key was 37 characters and the database column
+  holds 32. Signed-in users were unaffected, which is why it went unnoticed.
+  Local SQLite installs never hit it either, because SQLite ignores column
+  length limits and PostgreSQL enforces them.
 - Custom constructs are private to the person who created them. A construct
   anyone typed on the public site was listed to every other visitor, including
   under a heading that read "My custom constructs", because constructs had no

backend/app/auth.py

@@ -42,6 +42,9 @@ CONSTRUCTS_COOKIE_NAME = "ccr_constructs"
 # bare "" predate the anonymous session id and belong to nobody reachable; the
 # TTL sweep removes them.
 ANON_PREFIX = "anon:"
+# owner_user_id is String(32) on both Project and Construct; every owner key
+# (a user id, or ANON_PREFIX + session id) has to fit inside it.
+OWNER_KEY_MAX = 32
 _SECRET = (os.environ.get("CCR_SESSION_SECRET") or secrets.token_hex(32)).encode()
 
 # Headroom for 200 rows of long documents (200 x 8 KB transcripts ~ 1.6 MB sat
@@ -353,6 +356,14 @@ def ensure_anon_owner(request: Request, response) -> str:
     minting the session cookie on first write."""
     sid = anon_session_id(request)
     if not sid:
-        sid = secrets.token_hex(16)
+        # 13 bytes, not 16: the owner key is ANON_PREFIX + sid and it has to fit
+        # Project.owner_user_id / Construct.owner_user_id, which are String(32).
+        # SQLite ignores VARCHAR limits, Postgres does not - a 37-character key
+        # silently passed every local test and 500'd on both deployments.
+        sid = secrets.token_hex(13)
         set_anon_session_cookie(response, sid)
-    return ANON_PREFIX + sid
+    owner = ANON_PREFIX + sid
+    # Belt and braces: SQLite (dev, tests) ignores VARCHAR limits and Postgres
+    # (deployed) does not, so an overlong key is invisible until production.
+    assert len(owner) <= OWNER_KEY_MAX, f"owner key {len(owner)} > {OWNER_KEY_MAX}"
+    return owner

backend/tests/test_construct_ownership.py

@@ -242,3 +242,40 @@ def test_construct_used_by_a_run_is_hidden_not_deleted(client):
     # the run and its reproducibility record still resolve
     assert client.get(f"/api/jobs/{job_id}").status_code == 200
     assert client.get(f"/api/jobs/{job_id}/metadata").status_code == 200
+
+
+def test_owner_keys_fit_the_owner_column(client):
+    """Regression: an anonymous owner key overflowed owner_user_id.
+
+    ANON_PREFIX + a 16-byte session id is 37 characters and the column is
+    String(32). SQLite ignores VARCHAR limits so the whole suite passed, while
+    Postgres rejected every anonymous write and both deployments returned 500
+    on project and construct creation for three days.
+
+    Read the width from the model so this cannot drift, and check the real key
+    the app mints rather than a hand-written string.
+    """
+    from app import auth
+    from app.models import Construct, Project
+
+    for model in (Project, Construct):
+        width = model.__table__.c.owner_user_id.type.length
+        assert width == auth.OWNER_KEY_MAX, (
+            f"{model.__name__}.owner_user_id is String({width}) but auth assumes "
+            f"{auth.OWNER_KEY_MAX}"
+        )
+
+    # the key an anonymous visitor actually gets, via a real request
+    client.post("/api/auth/logout")
+    client.post("/api/projects", json={"name": "width check", "description": ""})
+    from app.db import SessionLocal
+
+    db = SessionLocal()
+    try:
+        keys = {p.owner_user_id for p in db.query(Project).all()}
+        keys |= {c.owner_user_id for c in db.query(Construct).all()}
+    finally:
+        db.close()
+    assert any(k.startswith(auth.ANON_PREFIX) for k in keys), "expected an anonymous owner"
+    for key in keys:
+        assert len(key) <= auth.OWNER_KEY_MAX, f"owner key {key!r} is {len(key)} chars"

docs/specs/0009-anonymous-session-scope.md

@@ -82,6 +82,20 @@ The cap is a signed cookie, so like the run counter it stops casual
 over-creation rather than a determined script. The TTL sweep is what actually
 bounds storage.
 
+## Post-release defect (2026-09-07)
+
+The owner key ANON_PREFIX + a 16-byte session id is 37 characters, and both
+owner_user_id columns are String(32). SQLite ignores VARCHAR limits so the full
+suite passed; PostgreSQL enforces them, so every anonymous project and construct
+creation returned 500 on both deployments for three days. Signed-in users were
+unaffected (a user id is exactly 32 characters), which hid it.
+
+Fixed by shortening the session id to 13 bytes (104 bits, key length 31) rather
+than widening the column: a type change is not additive, so auto_migrate_sqlite
+would not apply it and the deployed databases would need hand-run DDL. Guarded
+by a runtime assertion in ensure_anon_owner and a test that reads the column
+width from the model and checks the keys the app actually mints.
+
 ## Deviations (filled after implementation)
 
 Two existing tests changed because adoption is new behaviour, not because they