Merge remote-tracking branch 'gitea-ai/gsd/phase-13-aiui-functional-conversational-node-control-and-content-surf'

core/archipelago/src/api/rpc/middleware.rs

@@ -2,7 +2,13 @@ use crate::session::SessionStore;
 use std::net::IpAddr;
 
 /// Methods that do not require a valid session cookie.
-pub(super) const UNAUTHENTICATED_METHODS: &[&str] = &[
+///
+/// `pub(crate)` (not just `pub(super)`) so `crate::assistant`'s test suite
+/// can assert directly against the live list that the assistant RPC prefix
+/// is never added to it (Phase-10 hard constraint) — see the re-export in
+/// `api/rpc/mod.rs`. Read-visibility only; the list's contents and every
+/// other visibility in this module are unchanged.
+pub(crate) const UNAUTHENTICATED_METHODS: &[&str] = &[
     "auth.login",
     "auth.login.totp",
     "auth.login.backup",