ℹ️ About Codex in GitHub

\n
\n\n[Your team has set up Codex to review pull requests in this repo](https://chatgpt.com/codex/cloud/settings/general). Reviews are triggered when you\n- Open a pull request for review\n- Mark a draft as ready\n- Comment \"@codex review\".\n\nIf Codex has suggestions, it will comment; otherwise it will react with 👍.\n\n\n\n\nCodex can also answer questions or update the PR. Try commenting \"@codex address that feedback\".\n \n

ℹ️ About Codex in GitHub

\n\n--- inline comments 0 ---\n\n--- reviews 0 ---\n\n--- PR ---\nhttps://github.com/Chris0Jeky/Taskdeck/pull/1493 b3838d0632d9465f4ec16216d13fca312d568d4d 61f718af941c56c31b8b7595333b9debd6e47da8 ## Summary\n\n- Append qualified resolution records for #1343, #1347, #1348, and #1490 while preserving all 19 original JSONL rows.\n- Suppress `class=seed` metadata from every rendered projection, including seed-only input, without hiding issue-less non-seed rows.\n- Regenerate the human-readable ledger and add deterministic projection/regression coverage.\n\nPart of #1291; #1291 remains open.\n\nCloses #1492\n\n## Implementation Notes\n\n- Projection identity remains `(surface, first tracking issue in future_fix)`; each resolution row keeps its target issue first.\n- #1343 records the core #1386 repair while retaining separate #1388/#1410 residual debt.\n- #1348 records both the #1361 SQLite root fix and #1362 unmocked Paper-browser completion.\n- The raw ledger diff is append-only: 4 additions, 0 deletions.\n\n## Verification\n\n- [ ] `dotnet test backend/Taskdeck.sln -c Release` (not run: no backend/product behavior changed)\n- [ ] `Push-Location frontend/taskdeck-web; npm run typecheck; if ($LASTEXITCODE -ne 0) { Pop-Location; exit $LASTEXITCODE }; npm run build; if ($LASTEXITCODE -ne 0) { Pop-Location; exit $LASTEXITCODE }; npx vitest --run; $code = $LASTEXITCODE; Pop-Location; if ($code -ne 0) { exit $code }` (not run: no frontend behavior changed)\n- [ ] Playwright smoke/E2E executed (not applicable: no UI or cross-surface behavior changed)\n- [x] `py -3 -m unittest test_render_failure_ledger.py` from `scripts/agent_hooks` — 5/5 passed\n- [x] Fresh renderer run is byte-identical — SHA-256 `52C4CBC17BC401AC41B3DA50A4CBA9A3AB95AA5AEA52A857DC492FD6EF8E4B7B`\n- [x] JSONL parsed with required fields — raw 23 (9 open/14 resolved), projected 15 (1 open/14 resolved)\n- [x] Sole open projection remains `invalid_signal / ci/e2e-smoke`; raw seed count 1, projected seed count 0\n- [x] `node scripts/check-docs-governance.mjs`\n- [x] `node scripts/check-golden-principles.mjs`\n- [x] `node scripts/check-github-ops-governance.mjs`\n- [x] `git diff --check 61f718af941c56c31b8b7595333b9debd6e47da8..HEAD`\n- [x] Exact four-file scope, clean worktree, and DCO 2/2\n\n## Documentation\n\n- [x] `docs/agentic/failure_ledger.jsonl` appended and `docs/agentic/FAILURE_LEDGER.md` regenerated\n- [x] `docs/STATUS.md` reviewed and unchanged; shipped product reality did not change\n- [x] `docs/IMPLEMENTATION_MASTERPLAN.md` reviewed and unchanged; roadmap sequencing did not change\n- [x] `docs/TESTING_GUIDE.md` / `docs/MANUAL_TEST_CHECKLIST.md` reviewed and unchanged; verification flow did not change\n\n## Tracking\n\n- [x] Linked issue included: `Closes #1492`\n- [x] Linked issue and PR project items verified as `Review / Priority II`\n\n## CI Workflow Validation\n\n- [x] CI Extended passes on the exact head — run `30189284513` (auto-triggered because `scripts/` changed)\n\n## Risk Notes\n\n- Security impact: none; no runtime enforcement or product code changes.\n- Behavior/regression risk: low; projection behavior is directly covered, raw history is append-only, and the generated Markdown is byte-stable.\n- Follow-up tasks: #1388/#1410 remain explicit residuals for #1343; data-policy-blocked draft PR #1488 must absorb this new main history before it can proceed.\n\n\n--- checks ---\nCodeQL completed success https://github.com/Chris0Jeky/Taskdeck/runs/89759441044\nPerformance Regression Gate completed skipped https://github.com/Chris0Jeky/Taskdeck/actions/runs/30189284513/job/89759395613\nVisual Regression completed skipped https://github.com/Chris0Jeky/Taskdeck/actions/runs/30189284513/job/89759395571\nLoad and Concurrency Harness completed skipped https://github.com/Chris0Jeky/Taskdeck/actions/runs/30189284513/job/89759395519\nE2E Smoke completed skipped https://github.com/Chris0Jeky/Taskdeck/actions/runs/30189284513/job/89759395492\nDependency Security Signals completed skipped https://github.com/Chris0Jeky/Taskdeck/actions/runs/30189284513/job/89759395472\nDemo Director Smoke completed skipped https://github.com/Chris0Jeky/Taskdeck/actions/runs/30189284513/job/89759395456\nE2E Cross-Browser Matrix completed skipped https://github.com/Chris0Jeky/Taskdeck/actions/runs/30189284513/job/89759395441\nDeveloper Portal completed skipped https://github.com/Chris0Jeky/Taskdeck/actions/runs/30189284513/job/89759395408\nContainer Integration (Testcontainers) completed skipped https://github.com/Chris0Jeky/Taskdeck/actions/runs/30189284513/job/89759395372\nBackend Solution Regression completed skipped https://github.com/Chris0Jeky/Taskdeck/actions/runs/30189284513/job/89759395357\nSAST Scanning (Semgrep) completed skipped https://github.com/Chris0Jeky/Taskdeck/actions/runs/30189284513/job/89759395341\nSecrets Detection (Gitleaks) / Gitleaks Scan completed success https://github.com/Chris0Jeky/Taskdeck/actions/runs/30189284513/job/89759395255\nWorkflow Lint completed success https://github.com/Chris0Jeky/Taskdeck/actions/runs/30189284513/job/89759395219\nOpenAPI Guardrail / OpenAPI Guardrail completed success https://github.com/Chris0Jeky/Taskdeck/actions/runs/30189284513/job/89759395215\nAnalyze (actions) completed success https://github.com/Chris0Jeky/Taskdeck/actions/runs/30189284246/job/89759395206\nAnalyze (python) completed success https://github.com/Chris0Jeky/Taskdeck/actions/runs/30189284246/job/89759395205\nAnalyze (csharp) completed success https://github.com/Chris0Jeky/Taskdeck/actions/runs/30189284246/job/89759395192\nDependency Review completed success https://github.com/Chris0Jeky/Taskdeck/actions/runs/30189284513/job/89759395183\nAnalyze (javascript-typescript) completed success https://github.com/Chris0Jeky/Taskdeck/actions/runs/30189284246/job/89759395171\nBackend Unit / Backend Unit (ubuntu-latest) completed success https://github.com/Chris0Jeky/Taskdeck/actions/runs/30189284450/job/89759395069\nFrontend Unit / Frontend Unit (ubuntu-latest) completed success https://github.com/Chris0Jeky/Taskdeck/actions/runs/30189284450/job/89759395015\nBackend Unit / Backend Unit (windows-latest) completed success https://github.com/Chris0Jeky/Taskdeck/actions/runs/30189284450/job/89759395010\nSecret Scan / Gitleaks Scan completed success https://github.com/Chris0Jeky/Taskdeck/actions/runs/30189284450/job/89759394999\nContainer Images / Container Images completed success https://github.com/Chris0Jeky/Taskdeck/actions/runs/30189284450/job/89759394995\nBackend Architecture / Backend Architecture completed success https://github.com/Chris0Jeky/Taskdeck/actions/runs/30189284450/job/89759394990\nAPI Integration / API Integration (ubuntu-latest) completed success https://github.com/Chris0Jeky/Taskdeck/actions/runs/30189284450/job/89759394984\nAPI Integration / API Integration (windows-latest) in_progress None https://github.com/Chris0Jeky/Taskdeck/actions/runs/30189284450/job/89759394982\nDocs Governance / Docs Governance completed success https://github.com/Chris0Jeky/Taskdeck/actions/runs/30189284450/job/89759394971\nPaper Color Audit / Paper Color Audit completed success https://github.com/Chris0Jeky/Taskdeck/actions/runs/30189284450/job/89759394967\n\n--- diff ---\ndiff --git a/docs/agentic/FAILURE_LEDGER.md b/docs/agentic/FAILURE_LEDGER.md\nindex 83a1234..8b9346f 100644\n--- a/docs/agentic/FAILURE_LEDGER.md\n+++ b/docs/agentic/FAILURE_LEDGER.md\n@@ -1,38 +1,37 @@\n # Agent Failure Ledger\n \n This is the human-readable view of recurring agent, tool, test, CI, and workflow failures.\n Machine-appended raw entries live in `docs/agentic/failure_ledger.jsonl`.\n Rows sharing a surface and first tracking issue in `future_fix` show only their latest state here; the JSONL retains append-only history.\n \n ## Entries\n \n | Date | Class | Surface | Failure | Workaround | Future fix | Status |\n | --- | --- | --- | --- | --- | --- | --- |\n-| 2026-05-11 | seed | agentic-pack | Ledger created | n/a | Start recording recurring failures and promote confirmed lessons | open |\n | 2026-05-29 | blocker | dependabot/nuget | dotnet-minor-patch repeatedly proposed EF Core 9.x while Sqlite/Design remained 8.x, causing ambiguous ExecuteDeleteAsync errors on #1102/#1106 | Pin EF Core back to 8.0.27 per PR | Resolved by #1112 ignore rule and the EF runtime 8.x pins in #760/#767 | resolved |\n | 2026-05-29 | blocker | dependabot/nuget | After FluentAssertions moved to free 7.x in #1088, Dependabot immediately proposed paid v8 in #1117 | Close the v8 PR | Resolved by the FluentAssertions major ignore rule in #1118/ADR-0034 | resolved |\n | 2026-05-29 | invalid_signal | ci/e2e-smoke | E2E Smoke intermittently times out at multi-board.spec.ts:197 restoredBoard visibility with a transient DB connection error unrelated to the PR diff | Investigate against the diff; rerun only the failed job when unrelated | Stabilize the archive-to-restore seed or adjust the visibility wait after root-cause proof | open |\n | 2026-05-29 | non_blocking_risk | git/worktree | gh pr merge --delete-branch on a stacked base auto-closed dependent PR #1096; it could not reopen after the base disappeared | Recover the dependent on a new main-based branch/PR (#1104) | Retarget dependent PRs before deleting any stacked base branch | resolved |\n | 2026-07-13 | pre_existing_noise | test/sqlite-concurrency | Required Windows/full-suite runs on #1328, #1298, and #1334 produced HTTP 500s in concurrent capture/card tests while exact repetitions passed | Keep the full run non-green; run exact tests for diagnosis and move unrelated work on without merging | Resolved by #1373 (closes #1282): a shared UseTaskdeckSqlite helper backs both production DI and the API test factory so WAL/busy-timeout can no longer drift; f... | resolved |\n | 2026-07-13 | pre_existing_noise | test/redis-lifecycle | #1298's second full backend run failed RedisCacheServiceTests.Dispose_IsNotSerialized_BehindAnInFlightConnect; the exact test passed 5/5 | Park #1298 without a PR instead of treating a narrow rerun as a green full gate | Resolved by #1392 (closes #1332) on 2026-07-17: a dedicated named background Thread replaces Task.Run so the dispose-vs-connect seam is reached deterministicall... | resolved |\n | 2026-07-13 | pre_existing_noise | test/background-workers | #1334's full suite let a hosted LLM worker pre-claim a test row and a delayed presence join arrive after events were cleared | Keep the full run non-green and link exact evidence from the PR | Resolved 2026-07-17: workers half by #1394 (closes #1335) + #1391 (closes #1383); presence half by #1366 (snapshot ordering) + #1371 (phase drains). A shared Ho... | resolved |\n | 2026-07-17 | non_blocking_risk | github/project-sync | Resolution record for the 2026-07-13 project-sync scope row: the gh token lacked read:project scope so Priority fields were unaudited | No workaround needed any longer | Resolved 2026-07-17 (#1327 scope item): maintainer ran gh auth refresh -s project; Sync-TaskdeckProjectPriority.ps1 audit scanned 1000 items with 0 needing sync | resolved |\n-| 2026-07-13 | pre_existing_noise | frontend/workspace-mode-ordering | #1334 required E2E observed a late workspace summary restore guided after the user selected workbench during a failed preference save; exact local Playwright th... | Treat the CI failure as real, track the asynchronous ordering seam separately from the auth PR, and rerun only after focused investigation | #1343: version summary mode application against newer explicit preference actions and prove it with deterministic store tests plus repeated E2E | open |\n-| 2026-07-13 | blocker | frontend/paper-review-contract | Real Paper Review proposals deserialize numeric ConflictTone values into a frontend string-only contract, causing tone.toLowerCase to throw and the ErrorBoundar... | Park #1274 after preserving a clean local branch; do not treat passing API-level apply assertions as valid Paper UI proof | #1347: align deep-review enum wire contracts and add serialized API plus Paper browser regressions | open |\n-| 2026-07-13 | blocker | backend/similar-past | GET /api/automation/proposals/{id}/similar-past returned HTTP 500 for at least four distinct real SQLite-backed capture proposals during #1274 Paper runs | Keep the failure visible despite Promise.allSettled fallback and frontend retries; park the coverage PR rather than certifying a noisy review path | #1348: capture the server exception in a SQLite API test and repair the bounded board-scoped query path | open |\n | 2026-07-14 | blocker | ci/extended-workflow | Resolution record for the earlier #1330 open row: CI Extended reusable Gitleaks permission startup failures are repaired and the tracking issue is closed | No workaround remains; use exact-head Extended runs as the verification signal | Resolved by 66382e6c (Fix CI Extended Gitleaks permissions); #1330 closed 2026-07-13 | resolved |\n | 2026-07-14 | blocker | ci/nightly-k6 | CI Nightly run 29229402012 and prior runs lost both k6 summary JSON files to bind-mount permission denial while the tagged SQLite board-write p95 gate failed at... | Do not treat the always-red lane as trustworthy regression evidence until summary ownership and the measured capacity contract are repaired | #1358: map both k6 containers to the host UID/GID, warn at the measured 2000ms capacity, gate at 2200ms, and prove exact-head CI. Resolved: First post-#1359 nig... | resolved |\n | 2026-07-25 | non_blocking_risk | dependency/sqlite-native | Resolution record: the inherited HIGH SQLite native advisory is removed from Taskdeck's resolved dependency graph | No workaround remains; keep the runtime security-floor regression and dependency audit green | #1345 resolved by centrally pinning the matched SQLitePCLRaw bundle/core/provider/native family at 2.1.12; SQLite 3.53.3 loads, the >= 3.50.2 floor test passes,... | resolved |\n-| 2026-07-26 | non_blocking_risk | agent/tool-command-composition | Repeated PowerShell/native composition mistakes caused parser failures, GitHub body argument splitting, jq quote loss, and optional rg exits hiding independent ... | Collect statement-form foreach output before piping; handle optional rg exit 1 explicitly; use typed GitHub connectors for multiline bodies; prefer gh --json pl... | #1490: add copyable PowerShell/native composition forms to the MCP tooling guide, verify the failure-ledger renderer and docs gates, then append a resolution re... | open |\n+| 2026-07-26 | pre_existing_noise | frontend/workspace-mode-ordering | Resolution record for the #1343 preference-vs-summary ordering defect; the original observed failure remains in append-only history | No workaround remains for the core stale-summary overwrite; retain separate residual debt instead of overstating closure | #1343 core resolved by PR #1386 merge dba47320e348b80ecb678c41a51b686c954527ee; separate server-order/cross-device and client-state residuals remain #1388/#1410... | resolved |\n+| 2026-07-26 | blocker | frontend/paper-review-contract | Resolution record for the #1347 numeric deep-review enum wire-contract crash; the original observed failure remains in append-only history | No workaround remains; valid numeric payloads render directly and unexpected values fail closed to visible warning states | #1347 resolved by PR #1360 merge ed2538ffb0388523882238653b34fcc6f431a512: API numeric-enum serialization, frontend mapping, conservative malformed-value handli... | resolved |\n+| 2026-07-26 | blocker | backend/similar-past | Resolution record for the #1348 SQLite-backed similar-past HTTP 500; the original observed failure remains in append-only history | No workaround remains; keep the bounded board/user scope and real SQLite/browser coverage as regression evidence | #1348 resolved by PR #1361 merge ccd7bf93721c07171099383c77bfb508c23fbf48; Paper-browser completion by PR #1362 merge 40b7bb2f3819dcc7d0bd6349a8f516fd3169190f. ... | resolved |\n+| 2026-07-26 | non_blocking_risk | agent/tool-command-composi…1504 tokens truncated…Priority fields\",\"status\":\"open\"}\n {\"ts\":\"2026-07-17T16:20:00Z\",\"class\":\"non_blocking_risk\",\"surface\":\"github/project-sync\",\"failure\":\"Resolution record for the 2026-07-13 project-sync scope row: the gh token lacked read:project scope so Priority fields were unaudited\",\"workaround\":\"No workaround needed any longer\",\"future_fix\":\"Resolved 2026-07-17 (#1327 scope item): maintainer ran gh auth refresh -s project; Sync-TaskdeckProjectPriority.ps1 audit scanned 1000 items with 0 needing sync\",\"status\":\"resolved\"}\n {\"ts\":\"2026-07-13T05:04:00Z\",\"class\":\"pre_existing_noise\",\"surface\":\"frontend/workspace-mode-ordering\",\"failure\":\"#1334 required E2E observed a late workspace summary restore guided after the user selected workbench during a failed preference save; exact local Playwright then passed 6/6\",\"workaround\":\"Treat the CI failure as real, track the asynchronous ordering seam separately from the auth PR, and rerun only after focused investigation\",\"future_fix\":\"#1343: version summary mode application against newer explicit preference actions and prove it with deterministic store tests plus repeated E2E\",\"status\":\"open\"}\n {\"ts\":\"2026-07-13T06:22:00Z\",\"class\":\"non_blocking_risk\",\"surface\":\"dependency/sqlite-native\",\"failure\":\"#1316 package verification found pre-existing HIGH advisory GHSA-2m69-gcr7-jv3q in transitive SQLitePCLRaw.lib.e_sqlite3 2.1.6; the official advisory currently lists all published versions through 2.1.11 as affected\",\"workaround\":\"Track the inherited advisory without blaming PdfPig or claiming an unavailable patched upgrade\",\"future_fix\":\"#1345: adopt a patched upstream release when available or prove a safe provider/mitigation change\",\"status\":\"open\"}\n {\"ts\":\"2026-07-13T06:25:00Z\",\"class\":\"blocker\",\"surface\":\"frontend/paper-review-contract\",\"failure\":\"Real Paper Review proposals deserialize numeric ConflictTone values into a frontend string-only contract, causing tone.toLowerCase to throw and the ErrorBoundary to replace the review surface\",\"workaround\":\"Park #1274 after preserving a clean local branch; do not treat passing API-level apply assertions as valid Paper UI proof\",\"future_fix\":\"#1347: align deep-review enum wire contracts and add serialized API plus Paper browser regressions\",\"status\":\"open\"}\n {\"ts\":\"2026-07-13T06:25:00Z\",\"class\":\"blocker\",\"surface\":\"backend/similar-past\",\"failure\":\"GET /api/automation/proposals/{id}/similar-past returned HTTP 500 for at least four distinct real SQLite-backed capture proposals during #1274 Paper runs\",\"workaround\":\"Keep the failure visible despite Promise.allSettled fallback and frontend retries; park the coverage PR rather than certifying a noisy review path\",\"future_fix\":\"#1348: capture the server exception in a SQLite API test and repair the bounded board-scoped query path\",\"status\":\"open\"}\n {\"ts\":\"2026-07-14T00:00:00Z\",\"class\":\"blocker\",\"surface\":\"ci/extended-workflow\",\"failure\":\"Resolution record for the earlier #1330 open row: CI Extended reusable Gitleaks permission startup failures are repaired and the tracking issue is closed\",\"workaround\":\"No workaround remains; use exact-head Extended runs as the verification signal\",\"future_fix\":\"Resolved by 66382e6c (Fix CI Extended Gitleaks permissions); #1330 closed 2026-07-13\",\"status\":\"resolved\"}\n {\"ts\":\"2026-07-14T00:00:00Z\",\"class\":\"blocker\",\"surface\":\"ci/nightly-k6\",\"failure\":\"CI Nightly run 29229402012 and prior runs lost both k6 summary JSON files to bind-mount permission denial while the tagged SQLite board-write p95 gate failed at its stale 1500ms target\",\"workaround\":\"Do not treat the always-red lane as trustworthy regression evidence until summary ownership and the measured capacity contract are repaired\",\"future_fix\":\"#1358: map both k6 containers to the host UID/GID, warn at the measured 2000ms capacity, gate at 2200ms, and prove exact-head CI. Resolved: First post-#1359 nightly green on 326b6b5b @ 2026-07-18T05:39:02Z (run 29632619187).\",\"status\":\"resolved\"}\n {\"ts\":\"2026-07-25T23:34:12Z\",\"class\":\"non_blocking_risk\",\"surface\":\"dependency/sqlite-native\",\"failure\":\"Resolution record: the inherited HIGH SQLite native advisory is removed from Taskdeck's resolved dependency graph\",\"workaround\":\"No workaround remains; keep the runtime security-floor regression and dependency audit green\",\"future_fix\":\"#1345 resolved by centrally pinning the matched SQLitePCLRaw bundle/core/provider/native family at 2.1.12; SQLite 3.53.3 loads, the >= 3.50.2 floor test passes, the solution vulnerability audit is clean, EF has no pending model changes, and the self-contained win-x64 API health smoke returns 200\",\"status\":\"resolved\"}\n {\"ts\":\"2026-07-26T03:59:00Z\",\"class\":\"non_blocking_risk\",\"surface\":\"agent/tool-command-composition\",\"failure\":\"Repeated PowerShell/native composition mistakes caused parser failures, GitHub body argument splitting, jq quote loss, and optional rg exits hiding independent evidence during Cycle 4\",\"workaround\":\"Collect statement-form foreach output before piping; handle optional rg exit 1 explicitly; use typed GitHub connectors for multiline bodies; prefer gh --json plus ConvertFrom-Json; avoid Markdown-bearing double-quoted wrappers\",\"future_fix\":\"#1490: add copyable PowerShell/native composition forms to the MCP tooling guide, verify the failure-ledger renderer and docs gates, then append a resolution record only after merge and issue closure\",\"status\":\"open\"}\n+{\"ts\":\"2026-07-26T05:11:40Z\",\"class\":\"pre_existing_noise\",\"surface\":\"frontend/workspace-mode-ordering\",\"failure\":\"Resolution record for the #1343 preference-vs-summary ordering defect; the original observed failure remains in append-only history\",\"workaround\":\"No workaround remains for the core stale-summary overwrite; retain separate residual debt instead of overstating closure\",\"future_fix\":\"#1343 core resolved by PR #1386 merge dba47320e348b80ecb678c41a51b686c954527ee; separate server-order/cross-device and client-state residuals remain #1388/#1410. The merged Home/Today guard has deterministic store and repeated E2E proof.\",\"status\":\"resolved\"}\n+{\"ts\":\"2026-07-26T05:11:40Z\",\"class\":\"blocker\",\"surface\":\"frontend/paper-review-contract\",\"failure\":\"Resolution record for the #1347 numeric deep-review enum wire-contract crash; the original observed failure remains in append-only history\",\"workaround\":\"No workaround remains; valid numeric payloads render directly and unexpected values fail closed to visible warning states\",\"future_fix\":\"#1347 resolved by PR #1360 merge ed2538ffb0388523882238653b34fcc6f431a512: API numeric-enum serialization, frontend mapping, conservative malformed-value handling, and Paper Chromium coverage prove the repaired wire contract.\",\"status\":\"resolved\"}\n+{\"ts\":\"2026-07-26T05:11:40Z\",\"class\":\"blocker\",\"surface\":\"backend/similar-past\",\"failure\":\"Resolution record for the #1348 SQLite-backed similar-past HTTP 500; the original observed failure remains in append-only history\",\"workaround\":\"No workaround remains; keep the bounded board/user scope and real SQLite/browser coverage as regression evidence\",\"future_fix\":\"#1348 resolved by PR #1361 merge ccd7bf93721c07171099383c77bfb508c23fbf48; Paper-browser completion by PR #1362 merge 40b7bb2f3819dcc7d0bd6349a8f516fd3169190f. The SQLite root cause and unmocked UI path are covered.\",\"status\":\"resolved\"}\n+{\"ts\":\"2026-07-26T05:11:40Z\",\"class\":\"non_blocking_risk\",\"surface\":\"agent/tool-command-composition\",\"failure\":\"Resolution record for the repeated #1490 PowerShell/native command-composition failures; the original recurrence remains in append-only history\",\"workaround\":\"No workaround remains; use the copyable safe forms and classify future failures through the ledger process\",\"future_fix\":\"#1490 resolved by PR #1491 merge 61f718af941c56c31b8b7595333b9debd6e47da8: the MCP tooling guide now covers collected foreach output, optional rg exits, safe multiline GitHub bodies, Markdown/backtick boundaries, and gh --json plus ConvertFrom-Json; #1490 closed 2026-07-26.\",\"status\":\"resolved\"}\ndiff --git a/scripts/agent_hooks/render_failure_ledger.py b/scripts/agent_hooks/render_failure_ledger.py\nindex 87cbe63..94634b6 100644\n--- a/scripts/agent_hooks/render_failure_ledger.py\n+++ b/scripts/agent_hooks/render_failure_ledger.py\n@@ -1,104 +1,107 @@\n #!/usr/bin/env python3\n \"\"\"Render docs/agentic/failure_ledger.jsonl into FAILURE_LEDGER.md table rows.\"\"\"\n from __future__ import annotations\n \n import json\n import re\n from pathlib import Path\n \n ROOT = Path(__file__).resolve().parents[2]\n JSONL = ROOT / \"docs\" / \"agentic\" / \"failure_ledger.jsonl\"\n MD = ROOT / \"docs\" / \"agentic\" / \"FAILURE_LEDGER.md\"\n \n HEADER = \"\"\"# Agent Failure Ledger\n \n This is the human-readable view of recurring agent, tool, test, CI, and workflow failures.\n Machine-appended raw entries live in `docs/agentic/failure_ledger.jsonl`.\n Rows sharing a surface and first tracking issue in `future_fix` show only their latest state here; the JSONL retains append-only history.\n \n ## Entries\n \n | Date | Class | Surface | Failure | Workaround | Future fix | Status |\n | --- | --- | --- | --- | --- | --- | --- |\n \"\"\"\n \n FOOTER = \"\"\"\n \n ## Classification\n \n - `blocker`: work cannot safely continue.\n - `non_blocking_risk`: work can continue, but verification confidence is reduced.\n - `pre_existing_noise`: unrelated existing failure that should still be visible.\n - `invalid_signal`: false alarm, stale check, or non-applicable warning.\n \n ## Promotion Rule\n \n A ledger entry should become a guide or skill update only when it is reproducible, project-specific, and likely to recur.\n Use `docs/agentic/GUIDE_UPDATE_PROTOCOL.md`; do not mutate root instructions after a single ambiguous failure.\n \"\"\"\n \n TRACKING_ISSUE = re.compile(r\"#\\d+\")\n \n \n def cell(value: object, limit: int = 160) -> str:\n text = str(value or \"\").replace(\"\\n\", \" \").replace(\"|\", \"\\\\|\")\n return text[:limit] + (\"...\" if len(text) > limit else \"\")\n \n \n def projection_key(entry: dict[str, object], index: int) -> tuple[str, ...]:\n tracking_issue = TRACKING_ISSUE.search(str(entry.get(\"future_fix\", \"\")))\n if tracking_issue is None:\n return (\"row\", str(index))\n \n return (\"tracked_failure\", str(entry.get(\"surface\", \"\")), tracking_issue.group(0))\n \n \n def project_latest_entries(entries: list[dict[str, object]]) -> list[dict[str, object]]:\n- \"\"\"Keep the latest file-order state for each tracked surface/issue pair.\"\"\"\n+ \"\"\"Hide seed metadata and keep the latest tracked surface/issue state.\"\"\"\n+ visible_entries = [entry for entry in entries if entry.get(\"class\") != \"seed\"]\n latest_indexes: dict[tuple[str, ...], int] = {}\n keys: list[tuple[str, ...]] = []\n \n- for index, entry in enumerate(entries):\n+ for index, entry in enumerate(visible_entries):\n key = projection_key(entry, index)\n keys.append(key)\n latest_indexes[key] = index\n \n return [\n entry\n- for index, (entry, key) in enumerate(zip(entries, keys, strict=True))\n+ for index, (entry, key) in enumerate(zip(visible_entries, keys, strict=True))\n if latest_indexes[key] == index\n ]\n \n \n-def main() -> int:\n+def render_markdown(entries: list[dict[str, object]]) -> str:\n+ \"\"\"Render projected ledger entries without inventing fallback history.\"\"\"\n rows: list[str] = []\n+ for entry in project_latest_entries(entries):\n+ date = str(entry.get(\"ts\", \"\"))[:10] or \"unknown\"\n+ rows.append(\n+ f\"| {cell(date, 20)} | {cell(entry.get('class'), 40)} | {cell(entry.get('surface'), 80)} | \"\n+ f\"{cell(entry.get('failure'))} | {cell(entry.get('workaround'))} | {cell(entry.get('future_fix'))} | {cell(entry.get('status'), 40)} |\"\n+ )\n+\n+ return HEADER + \"\\n\".join(rows) + FOOTER\n+\n+\n+def main() -> int:\n entries: list[dict[str, object]] = []\n if JSONL.exists():\n for line in JSONL.read_text(encoding=\"utf-8\").splitlines():\n if not line.strip():\n continue\n try:\n entry = json.loads(line)\n except json.JSONDecodeError:\n continue\n if not isinstance(entry, dict):\n continue\n entries.append(entry)\n \n- for entry in project_latest_entries(entries):\n- date = str(entry.get(\"ts\", \"\"))[:10] or \"unknown\"\n- rows.append(\n- f\"| {cell(date, 20)} | {cell(entry.get('class'), 40)} | {cell(entry.get('surface'), 80)} | \"\n- f\"{cell(entry.get('failure'))} | {cell(entry.get('workaround'))} | {cell(entry.get('future_fix'))} | {cell(entry.get('status'), 40)} |\"\n- )\n-\n- if not rows:\n- rows.append(\"| 2026-05-11 | seed | agentic-pack | Ledger created | n/a | Start recording recurring failures and promote confirmed lessons | open |\")\n-\n MD.parent.mkdir(parents=True, exist_ok=True)\n- MD.write_text(HEADER + \"\\n\".join(rows) + FOOTER, encoding=\"utf-8\")\n+ MD.write_text(render_markdown(entries), encoding=\"utf-8\")\n return 0\n \n \n if __name__ == \"__main__\":\n raise SystemExit(main())\ndiff --git a/scripts/agent_hooks/test_render_failure_ledger.py b/scripts/agent_hooks/test_render_failure_ledger.py\nindex a9c8286..4f69c5e 100644\n--- a/scripts/agent_hooks/test_render_failure_ledger.py\n+++ b/scripts/agent_hooks/test_render_failure_ledger.py\n@@ -1,55 +1,176 @@\n import unittest\n+from collections import Counter\n \n-from render_failure_ledger import project_latest_entries\n+from render_failure_ledger import project_latest_entries, render_markdown\n \n \n class FailureLedgerProjectionTests(unittest.TestCase):\n def test_latest_state_supersedes_same_surface_and_tracking_issue(self) -> None:\n entries = [\n {\n \"surface\": \"ci/extended-workflow\",\n \"future_fix\": \"#1330: repair workflow permissions\",\n \"status\": \"open\",\n },\n {\n \"surface\": \"ci/extended-workflow\",\n \"future_fix\": \"Resolved by 66382e6c; #1330 closed\",\n \"status\": \"resolved\",\n },\n ]\n \n projected = project_latest_entries(entries)\n \n self.assertEqual([entry[\"status\"] for entry in projected], [\"resolved\"])\n \n def test_same_surface_with_different_tracking_issues_remains_visible(self) -> None:\n entries = [\n {\n \"surface\": \"ci/extended-workflow\",\n \"future_fix\": \"#1330: repair workflow permissions\",\n \"status\": \"resolved\",\n },\n {\n \"surface\": \"ci/extended-workflow\",\n \"future_fix\": \"#1400: repair a separate workflow fault\",\n \"status\": \"open\",\n },\n ]\n \n projected = project_latest_entries(entries)\n \n self.assertEqual(projected, entries)\n \n def test_rows_without_tracking_issues_remain_unique(self) -> None:\n entries = [\n- {\"surface\": \"tooling\", \"future_fix\": \"Investigate\", \"status\": \"open\"},\n- {\"surface\": \"tooling\", \"future_fix\": \"Investigate\", \"status\": \"resolved\"},\n+ {\n+ \"class\": \"invalid_signal\",\n+ \"surface\": \"ci/e2e-smoke\",\n+ \"future_fix\": \"Stabilize the archive-to-restore seed\",\n+ \"status\": \"open\",\n+ },\n+ {\n+ \"class\": \"invalid_signal\",\n+ \"surface\": \"ci/e2e-smoke\",\n+ \"future_fix\": \"Stabilize the archive-to-restore seed\",\n+ \"status\": \"resolved\",\n+ },\n ]\n \n projected = project_latest_entries(entries)\n \n self.assertEqual(projected, entries)\n \n+ def test_seed_only_input_renders_no_failure_rows(self) -> None:\n+ entries = [\n+ {\n+ \"ts\": \"2026-05-11T00:00:00Z\",\n+ \"class\": \"seed\",\n+ \"surface\": \"agentic-pack\",\n+ \"failure\": \"Ledger created\",\n+ \"status\": \"open\",\n+ }\n+ ]\n+\n+ rendered = render_markdown(entries)\n+ data_rows = rendered.split(\"| --- | --- | --- | --- | --- | --- | --- |\", 1)[1]\n+\n+ self.assertNotIn(\"| seed |\", rendered)\n+ self.assertFalse(any(line.startswith(\"| \") for line in data_rows.splitlines()))\n+\n+ def test_reconciled_targets_project_exact_latest_state(self) -> None:\n+ entries = [\n+ {\n+ \"class\": \"seed\",\n+ \"surface\": \"agentic-pack\",\n+ \"future_fix\": \"Start recording recurring failures\",\n+ \"status\": \"open\",\n+ },\n+ {\n+ \"class\": \"invalid_signal\",\n+ \"surface\": \"ci/e2e-smoke\",\n+ \"future_fix\": \"Stabilize the archive-to-restore seed\",\n+ \"status\": \"open\",\n+ },\n+ {\n+ \"class\": \"pre_existing_noise\",\n+ \"surface\": \"frontend/workspace-mode-ordering\",\n+ \"future_fix\": \"#1343: guard summary mode application\",\n+ \"status\": \"open\",\n+ },\n+ {\n+ \"class\": \"blocker\",\n+ \"surface\": \"frontend/paper-review-contract\",\n+ \"future_fix\": \"#1347: align enum wire contracts\",\n+ \"status\": \"open\",\n+ },\n+ {\n+ \"class\": \"blocker\",\n+ \"surface\": \"backend/similar-past\",\n+ \"future_fix\": \"#1348: repair the SQLite query\",\n+ \"status\": \"open\",\n+ },\n+ {\n+ \"class\": \"non_blocking_risk\",\n+ \"surface\": \"agent/tool-command-composition\",\n+ \"future_fix\": \"#1490: document safe composition\",\n+ \"status\": \"open\",\n+ },\n+ {\n+ \"class\": \"pre_existing_noise\",\n+ \"surface\": \"frontend/workspace-mode-ordering\",\n+ \"future_fix\": \"#1343 resolved by PR #1386\",\n+ \"status\": \"resolved\",\n+ },\n+ {\n+ \"class\": \"blocker\",\n+ \"surface\": \"frontend/paper-review-contract\",\n+ \"future_fix\": \"#1347 resolved by PR #1360\",\n+ \"status\": \"resolved\",\n+ },\n+ {\n+ \"class\": \"blocker\",\n+ \"surface\": \"backend/similar-past\",\n+ \"future_fix\": \"#1348 resolved by PR #1361 and PR #1362\",\n+ \"status\": \"resolved\",\n+ },\n+ {\n+ \"class\": \"non_blocking_risk\",\n+ \"surface\": \"agent/tool-command-composition\",\n+ \"future_fix\": \"#1490 resolved by PR #1491\",\n+ \"status\": \"resolved\",\n+ },\n+ ]\n+\n+ projected = project_latest_entries(entries)\n+ target_surfaces = {\n+ \"#1343\": \"frontend/workspace-mode-ordering\",\n+ \"#1347\": \"frontend/paper-review-contract\",\n+ \"#1348\": \"backend/similar-past\",\n+ \"#1490\": \"agent/tool-command-composition\",\n+ }\n+\n+ self.assertEqual(len(entries), 10)\n+ self.assertEqual(len(projected), 5)\n+ self.assertEqual(Counter(entry[\"status\"] for entry in projected), {\"resolved\": 4, \"open\": 1})\n+ self.assertFalse(any(entry.get(\"class\") == \"seed\" for entry in projected))\n+\n+ for issue, surface in target_surfaces.items():\n+ matches = [\n+ entry\n+ for entry in projected\n+ if entry.get(\"surface\") == surface\n+ and str(entry.get(\"future_fix\", \"\")).startswith(issue)\n+ ]\n+ self.assertEqual(len(matches), 1, issue)\n+ self.assertEqual(matches[0][\"status\"], \"resolved\", issue)\n+\n+ open_entries = [entry for entry in projected if entry[\"status\"] == \"open\"]\n+ self.assertEqual(\n+ [(entry[\"class\"], entry[\"surface\"]) for entry in open_entries],\n+ [(\"invalid_signal\", \"ci/e2e-smoke\")],\n+ )\n+\n \n if __name__ == \"__main__\":\n unittest.main()\n","Script completed\nWall time 3.8 seconds\nOutput:\n",{"_536":770,"_515":516,"_538":522},{"_560":761,"_42":771,"_610":772,"_543":773,"_282":613,"_614":-5,"_529":113,"_92":615},"ctc_04df12867dccf958016a659b8dec7081979fc28f863c086ee9","const r = await tools.exec_command({cmd:\"for endpoint in 'issues/1493/comments' 'pulls/1493/comments' 'pulls/1493/reviews' 'pulls/1493' 'commits/b3838d0632d9465f4ec16216d13fca312d568d4d/check-runs'; do echo \\\"--- $endpoint ---\\\"; curl -fsSL -H 'Accept: application/vnd.github+json' \\\"https://api.github.com/repos/Chris0Jeky/Taskdeck/$endpoint\\\"; echo; done > /tmp/pr1493-api.txt; python3 - <<'PY'\\nimport json, urllib.request\\nbase='https://api.github.com/repos/Chris0Jeky/Taskdeck/'\\nfor label, ep in [('issue comments','issues/1493/comments'),('inline comments','pulls/1493/comments'),('reviews','pulls/1493/reviews')]:\\n with urllib.request.urlopen(base+ep) as r: x=json.load(r)\\n print('\\\\n---',label,len(x),'---')\\n for v in x: print(v.get('user',{}).get('login'), v.get('state',''), v.get('body',''))\\nwith urllib.request.urlopen(base+'pulls/1493') as r: p=json.load(r)\\nprint('\\\\n--- PR ---')\\nprint(p['html_url'],p['head']['sha'],p['base']['sha'],p['body'])\\nwith urllib.request.urlopen(base+'commits/b3838d0632d9465f4ec16216d13fca312d568d4d/check-runs') as r: c=json.load(r)\\nprint('\\\\n--- checks ---')\\nfor x in c['check_runs']: print(x['name'],x['status'],x['conclusion'],x['details_url'])\\nPY\\nprintf '\\\\n--- diff ---\\\\n'; git diff --no-ext-diff --unified=80 61f718af941c56c31b8b7595333b9debd6e47da8..b3838d0632d9465f4ec16216d13fca312d568d4d -- docs/agentic/failure_ledger.jsonl scripts/agent_hooks/render_failure_ledger.py scripts/agent_hooks/test_render_failure_ledger.py docs/agentic/FAILURE_LEDGER.md\",\"workdir\":\"/workspace/Taskdeck\",\"yield_time_ms\":10000,\"max_output_tokens\":40000}); text(r.output);",{"_548":522},{"_536":775,"_515":516,"_538":522},{"_539":-5,"_618":776,"_42":777,"_543":778,"_622":779,"_92":624},"gAAAAABqZZuNlDXe-z6biDyvuJ3mJMz9QCWQk9DmFSsN41Zoowi07aEODz1Sn_RpVVucnZp0Asut3tLVq1OPwWZyrSgX0UKlvKOx_MQz8zgLTE5x63St8qrcyvWd5a9eH-60FF02CVYUlqNKJM7dNm3zT09rdY0XIbqj_yHMfCKyHgyz-bpMP9lKc_IwzKHQMhlPWMStYjITT3r5OekZWAV4VwkZ5tD8GLR6bQ5pizfQeCpDUKkDIGSeNc5jIlFm8j_ya529aaFo85zSS7l4BJ-DlOjdwkwqFVRkydBizn5UBysnXYtM3muWh27PqNV6QLFT5Yhy27dwNH04E4xwK6JzAatNHkoJJ1S_nYGjB2ccjuACOf5j8OhnbHH5PABXGIo9TaWDt7E9QJiByY3MDc7iNjKTCsdF0y_W_MPkN_I_gVgBNlXvrDhPSlw7RBuwaLur7OGy8ljDG3KcaQ3_JIyOwVmHkRdbxJnHBGlzLgCmGRob3LfPD9uc5bN0Ohn7dlkZCtPHSiqzgzFAhLXrrGvvNYR6A7DQ7fwMjjBH_ffQoZ3DYLnkjBbX0S97pJWd5UCoybjPKeoS-eASZiwqkCubuacG1wqgQMqDPkIuXFQxR5b3Sm2QUuq-rRl8PENL8Qwtd3XyniUHAS6nu6-8BNaUg6AhzWSNn8sl4bzGKwe4akHoVS7z_el0wnEEmkzjFIinoQURyscDpbJCkVRYJBsoXB9KBvTzp8PrHW2cuo4fbRYKEo6m4Q35ZcfsSRKqlUR4LA8W877enQIa_Lw2QVrt_p1Z4ZyT3ZUczZTq9HzqdRXtVxdf7WJIDasDH0R8C64Niqzn4xSk5_oZdpABew-Ymk7gudnqH_12H6QoKY09wtJO_pxzWaP_UGqNb1e4pP9DPegJcXBON3AnltYGpR7LhG0u7n9nLyfgezGT8u9juBECwOr7nMAtJ1Y1uHoV4xoW29Hdfm6w0S2c9Cq0ppBGh_8u98IwGTxxvsYnbALxfEVfaTFLTATH43jZYl9-inhk5thExb__ilBD6hn7g0Ry72WiDi2L2w==","rs_04df12867dccf958016a659b8cd7908197b51f1328b5f6e1fc",{"_548":522},[780],{"_46":781,"_92":627},"**Planning API data fetching and diff inspection**",{"_554":783,"_536":784,"_515":516,"_538":522},1785043853865,{"_539":785,"_42":777,"_622":786,"_92":624},[],[781],{"_554":788,"_536":789,"_515":516,"_538":522},1785043849998,{"_576":790,"_577":791,"_579":792,"_581":582,"_520":793,"_583":32,"_42":794,"_585":795,"_587":588,"_529":113,"_92":589},"1493 https://github.com/Chris0Jeky/Taskdeck/pull/1493\n","/bin/bash -lc \"curl -fsSL 'https://api.github.com/repos/Chris0Jeky/Taskdeck/pulls?state=open&per_page=100' > /tmp/prs.json; python3 - <<'PY'\nimport json\nxs=json.load(open('/tmp/prs.json'))\nfor x in xs:\n if x['head']['sha']=='b3838d0632d9465f4ec16216d13fca312d568d4d' or x['title']=='Reconcile stale failure ledger projections':\n print(x['number'], x['html_url'])\nPY\"",[796],683,"exec-d6188ca8-a930-479d-a712-5a749ec51f29","91411",{"_577":797,"_92":650},"curl -fsSL 'https://api.github.com/repos/Chris0Jeky/Taskdeck/pulls?state=open&per_page=100' > /tmp/prs.json; python3 - <<'PY'\nimport json\nxs=json.load(open('/tmp/prs.json'))\nfor x in xs:\n if x['head']['sha']=='b3838d0632d9465f4ec16216d13fca312d568d4d' or x['title']=='Reconcile stale failure ledger projections':\n print(x['number'], x['html_url'])\nPY",{"_536":799,"_515":516,"_538":522},{"_560":800,"_42":-5,"_543":801,"_282":-5,"_563":802,"_92":565},"call_yTKd5MKcOSiLOaP4lLWZIQi2",{"_548":522},{"_415":803,"_567":-5},[804,805],{"_46":806,"_92":571},{"_46":790,"_92":571},"Script completed\nWall time 0.8 seconds\nOutput:\n",{"_536":808,"_515":516,"_538":522},{"_560":800,"_42":809,"_610":810,"_543":811,"_282":613,"_614":-5,"_529":113,"_92":615},"ctc_04df12867dccf958016a659b8667e0819792b511b69e5c2838","const r = await tools.exec_command({cmd:\"curl -fsSL 'https://api.github.com/repos/Chris0Jeky/Taskdeck/pulls?state=open&per_page=100' > /tmp/prs.json; python3 - <<'PY'\\nimport json\\nxs=json.load(open('/tmp/prs.json'))\\nfor x in xs:\\n if x['head']['sha']=='b3838d0632d9465f4ec16216d13fca312d568d4d' or x['title']=='Reconcile stale failure ledger projections':\\n print(x['number'], x['html_url'])\\nPY\",\"workdir\":\"/workspace/Taskdeck\",\"yield_time_ms\":10000,\"max_output_tokens\":3000}); text(r.output);",{"_548":522},{"_536":813,"_515":516,"_538":522},{"_539":-5,"_618":814,"_42":815,"_543":816,"_622":817,"_92":624},"gAAAAABqZZuGCtJvUKO88J4t69yXv1XHqjrt-W9OQi2gJbde3CsaMxFEx-5qkInNVVpZbfjhdpd7-_NabVKPvSCkcNI5xRXPwb5K-5hXaCeM-_YgGjWrTyIFJLWT97tG53JVHHjrRHFo_lZJcoRUSS20zv8LVAhD3zuhqdslEONauBy-P24a4zza7igti5UwrOcVBViCBdnnnBwUuoApCgC1M5fALqmk5npDSG94B_iEPEbSUvFUaHu-rEoPKndCVfMcMDEzaDuXmE6BYgNheLH7pTnli9Bop5pi3CEncAaugFYCUNF06Zu7eBpOaHCYSEjs5MuRLsM8OR1FVFj4_IOTLpzXMSFG2IhE3rD4j0OW6i1TYwXK-vMwCkiuxvqEyGwF27pnNVS__xo1aVcpQ6A2J_0RWu2e01MeTruL22CtnheXmKE1q3OrIUNU6gdQzssi-VYTOoYcU-Qx2GCo-9cCBClxS_5h6mcAhEmYywr3P4O2Nd-AGv9tZKM3PYZU340w3jlDct0WJzbrWuod8-Oykogeb1zCyDnO8W6gdOqu0udNV5UAUzyZXT_nEtZ27hEEUMHt0zGs6WrFhYZBRf9bgobR2df4Jn7vXa9QiWgHnje3MzzJUgI2G9mTLHFhF5RRgHASFLkg08DNvpu-1u84hWQUsZWL6G_5ZBzjcNMAIugMOMCx9unxJgcgrKb7Sw4SN-Wn2FGwKC5tBWp4mPSbrFhpW6Zs82fKrl6unGTv1_pQocSo_L7fwpQeUB5B-PqD8-LhW5hQUWy4O89P77CvfidTUDst1_9_2te5yMu3SB-Lmt0LMXCoBGN9jTrl3EafAL2frLZ5cm0HMep8NvH2bPmz2vzFO495wpitZJ0X5B8HCFYJ8SNO-iuS02a7DvF8-pMY9u4jX9MMCfWj1iIbrgBVVR0v0f8TDD0W0y5FGtDH7ze1Kg-w7Ot8oYjqk36Fg9rRSNcl","rs_04df12867dccf958016a659b85e3ac81979ae28a96ed0f139a",{"_548":522},[818],{"_46":819,"_92":627},"**Considering using jq tool**",{"_554":821,"_536":822,"_515":516,"_538":522},1785043846350,{"_539":823,"_42":815,"_622":824,"_92":624},[],[819],{"_554":826,"_536":827,"_515":516,"_538":522},1785043844944,{"_576":828,"_577":829,"_579":830,"_581":582,"_520":831,"_583":832,"_42":833,"_585":834,"_587":588,"_529":835,"_92":589}," File \"\", line 1\n import json,sys; xs=json.load(sys.stdin); print(\"\\n\".join(f\"#{x[\\\"number\\\"]} {x[\\\"title\\\"]} {x[\\\"head\\\"][\\\"sha\\\"]}\" for x in xs if x[\"head\"][\"sha\"]==\"b3838d0632d9465f4ec16216d13fca312d568d4d\" or x[\"title\"]==\"Reconcile stale failure ledger projections\"))\n ^\nSyntaxError: unexpected character after line continuation character\n","/bin/bash -lc \"git config --get-regexp 'remote\\\\..*\\\\.(url|fetch)' || true; git branch -vv; curl -fsSL 'https://api.github.com/repos/Chris0Jeky/Taskdeck/pulls?state=open&per_page=100' | python3 -c 'import json,sys; xs=json.load(sys.stdin); print(\\\"\\\\n\\\".join(f\\\"#{x[\\\\\\\"number\\\\\\\"]} {x[\\\\\\\"title\\\\\\\"]} {x[\\\\\\\"head\\\\\\\"][\\\\\\\"sha\\\\\\\"]}\\\" for x in xs if x[\\\"head\\\"][\\\"sha\\\"]==\\\"b3838d0632d9465f4ec16216d13fca312d568d4d\\\" or x[\\\"title\\\"]==\\\"Reconcile stale failure ledger projections\\\"))'\"",[836],608,1,"exec-31f998ed-878b-4871-a643-34870c513625","76911","failed",{"_577":837,"_92":650},"git config --get-regexp 'remote\\..*\\.(url|fetch)' || true; git branch -vv; curl -fsSL 'https://api.github.com/repos/Chris0Jeky/Taskdeck/pulls?state=open&per_page=100' | python3 -c 'import json,sys; xs=json.load(sys.stdin); print(\"\\n\".join(f\"#{x[\\\"number\\\"]} {x[\\\"title\\\"]} {x[\\\"head\\\"][\\\"sha\\\"]}\" for x in xs if x[\"head\"][\"sha\"]==\"b3838d0632d9465f4ec16216d13fca312d568d4d\" or x[\"title\"]==\"Reconcile stale failure ledger projections\"))'",{"_536":839,"_515":516,"_538":522},{"_560":840,"_42":-5,"_543":841,"_282":-5,"_563":842,"_92":565},"call_qqgkWxsvhNZGArMBsIfWYi3h",{"_548":522},{"_415":843,"_567":-5},[844,845],{"_46":847,"_92":571},{"_46":846,"_92":571},"* work b3838d0 Test failure ledger reconciliation\n File \"\", line 1\n import json,sys; xs=json.load(sys.stdin); print(\"\\n\".join(f\"#{x[\\\"number\\\"]} {x[\\\"title\\\"]} {x[\\\"head\\\"][\\\"sha\\\"]}\" for x in xs if x[\"head\"][\"sha\"]==\"b3838d0632d9465f4ec16216d13fca312d568d4d\" or x[\"title\"]==\"Reconcile stale failure ledger projections\"))\n ^\nSyntaxError: unexpected character after line continuation character\n","Script completed\nWall time 0.7 seconds\nOutput:\n",{"_536":849,"_515":516,"_538":522},{"_560":840,"_42":850,"_610":851,"_543":852,"_282":613,"_614":-5,"_529":113,"_92":615},"ctc_04df12867dccf958016a659b80eaa08197a40f8ed2d3392c7d","const r = await tools.exec_command({cmd:\"git config --get-regexp 'remote\\\\..*\\\\.(url|fetch)' || true; git branch -vv; curl -fsSL 'https://api.github.com/repos/Chris0Jeky/Taskdeck/pulls?state=open&per_page=100' | python3 -c 'import json,sys; xs=json.load(sys.stdin); print(\\\"\\\\n\\\".join(f\\\"#{x[\\\\\\\"number\\\\\\\"]} {x[\\\\\\\"title\\\\\\\"]} {x[\\\\\\\"head\\\\\\\"][\\\\\\\"sha\\\\\\\"]}\\\" for x in xs if x[\\\"head\\\"][\\\"sha\\\"]==\\\"b3838d0632d9465f4ec16216d13fca312d568d4d\\\" or x[\\\"title\\\"]==\\\"Reconcile stale failure ledger projections\\\"))'\",\"workdir\":\"/workspace/Taskdeck\",\"yield_time_ms\":10000,\"max_output_tokens\":3000}); text(r.output);",{"_548":522},{"_536":854,"_515":516,"_538":522},{"_539":-5,"_618":855,"_42":856,"_543":857,"_622":858,"_92":624},"gAAAAABqZZuAr65zZGnVutVVJCQRDmG8q0jyj_Hjtb-APZqeQInlhPIuWJ7sgrPeGViBduFNWa940-2RCmt7V_cKPAlF-rGMUREEM00HHcBkU346RD7xVN0twerKhEv7LfPwTCnImekYcOTo23GJIXQZeO9AWdUkpbFbHppuk8HIy7B1PCwtoXqYIueqBYABaty5iVn-dRFecLVuuewmVZboSaCW3IdpvJPaC3OYuJPlO62KW8C8Poh3810pf2pyNU0rrQ1TO44xAgUjdi-K8yPrw0eFBjsXsL5_SMkws5MrOkdVBenigdX9boQ7sg5kNdiPHDqqBlvX2LiEMzKfi9-AnNxffc37X3qY3AQmsdBj3fz_K6aHkW0gt5GmuEgF2P_OvvZOJYSJXt_nPG_z0Tks17GlOKasD7MHcQgqEvhTayClg6ufK-4S-Cnzo5DgrOnYZQiKLP37QZt1OHeXxocFs2GBwUFQkh0PlffGKGVhXvKKamufPOOg552hgv4Fds_2pwavk8fOsdCnL7HOEQEuGR6v09d4CRDomzcUy0oDbbD44XMsy_GUwC8umv-EsCmzIcWEM0_sAG_3NYnhGJcxMA2w1IgYjFnaBpgz_WSl5sQGoFJzqIRCy2KCv_c_n6ZKfg5M_fo9gIaTiy_7pfj14-33u44BZ92N2yvApxeMMtAXfgNIVFQbKjUbLjy6CZMboA55EX8VEW6qISh2IWs6mtABw5L0Rauq5ozkTvEFn9RzmtL7uxA82bCz552tHpSKd1xE3QZFdIoLeLEY2UtITQQ6uAmLJ3QZBJorusO1uhS03xq23l3Q1XSU3V8z8QQdzDl1xUTJcyqhkqgKzVTFvd-lmt4BjwAuzaePwwvsMR4rn5icgzXjoS0PL5efA39c3sNjHNq2IJpprU2UOHDJAzPH7Ko_Ry-0Y8A-ADUsKxQ30PDqTkLaoy8DzWDcrGbQuLt0rK4MLsfUrszIPRvzs8m4zgERprSofqh2gTBwrW3BPxZCwlF8yxDm11RMNPEMLw2ewVS5aOCjZKKu2ndSf7i77HHivQ==","rs_04df12867dccf958016a659b7fc6ec8197a8a5011f648972f8",{"_548":522},[859],{"_46":860,"_92":627},"**Checking GitHub API authentication**",{"_554":862,"_536":863,"_515":516,"_538":522},1785043840858,{"_539":864,"_42":856,"_622":865,"_92":624},[],[860],{"_536":867,"_515":516,"_538":522},{"_560":868,"_42":-5,"_543":869,"_282":-5,"_563":870,"_92":565},"call_qzeKN1XHquTG0kYcDwq35IAy",{"_548":522},{"_415":871,"_567":-5},[872,873],{"_46":875,"_92":571},{"_46":874,"_92":571},"Script error:\nFatal error: http 401 Unauthorized: Some(\"{\\\"detail\\\":\\\"Unauthorized\\\"}\")","Script failed\nWall time 0.2 seconds\nOutput:\n",{"_536":877,"_515":516,"_538":522},{"_560":868,"_42":878,"_610":879,"_543":880,"_282":613,"_614":-5,"_529":113,"_92":615},"ctc_04df12867dccf958016a659b7d052c8197a24bb6f716b0e20c","const r = await tools.web__run({search_query:[{q:\"site:github.com/Chris0Jeky/Taskdeck/pull \\\"Reconcile stale failure ledger projections\\\"\"}],response_length:\"short\"}); text(r);\n",{"_548":522},{"_536":882,"_515":516,"_538":522},{"_539":-5,"_618":883,"_42":884,"_543":885,"_622":886,"_92":624},"gAAAAABqZZt9Ypr0Ffwo6qaa2TX5ZkUcmkKKQbr-tygJGXrEqkD1Zcqc7L5aJSSiIPf5n3l8bAYhOTc9O6Ae_uz1sdQdDuEJFURdDRbFjPfiIQ9cDqO-1Xb3Pzt3bchHCFgfWQfMt3hyIgbvuq3G9A7ijIX80odLH3y9x1Bt16wQ_YeQdXlZHWBzrzCD0E5NytbTrgNd25rkgQK7NYlDBweH3RybH3LkmE-ybvCrbTgGr3L_490B134CP1e6P5wO3O_Fj3rnn2LTNDpwuWG8JKSVk6U-2ynD2Ht_r5hVxWOvxf5EMqZXsg6ptd8-gW4cWRBMe6apN57b1LBl8Iv-KR88wGGt9OMWXygF8FcoGZRmVnTbJyJcydgM8Y2J-JB6Kh97NDmPqrfiYtb8pwQEAk7MyBzpTFvpdPxKrK-5J8DmbISatBOrd-YX3X1QEm-8IcnxIN-dwAcN31J0LRZSpYB9bvSyvLUb6qcGPcEIZoVbdizI4WlARGsB0ysgMGGgCwsiGKeU_5n-PAcMnvCZMEVwIu2eARwiw5TuYeY-7ZliN7Iq7iBIgfqmb8L5jX4eeOVCffzRJePNIIFy27HxVjSzAGTcOAKykKD9WIx5JhRSIQb4sv1hxTnY9fR0oZf3IxrV2hvpp8ei17IX8GnJ4j0J1Z9Uymg2ExRrv6dUog0Fym2ZNpSrRiG72Uqpc4vvs-dYCnEcrfMSp8Ycrnpc6F2dPQu2NdLknc2sBBI00hA3PbffjlwzDQQxyN6VwcBH-rdqTkR7QBWnjQdkD35o2vaEntf3niyRDzphIvKVfL_o7tHY-YeSmSTYudMgEvskC4kMAGUOXQZxpPh6Mrud4ObYG84CvQ6K2z2N_b36BnKzi-7RndZbBlxDVQn4nZ8_x5jJ7XF58CnEKXE03TmQeEygvaqiS52s3XQ_vdtYfkIp9VSNc48tQQtYtCC9vuIfVshfQchA27rbwOqLhSI-cWwiLK9aMxVfuPUW6C-tog7cOnbNxIaOnNF9XibqJBmb-8TyesCcz19I7cx9H4NGXBSynVSSuz3vtWImnR-zpvW6NyP2-ojclLYpdRAtGyDFT6LOdNc86kxb7guDXSqQFwN8kDk8ENBUYbMWcqrkTX8eTemVjdE9ZuTQ_Ctjx-Ssk6VXJkzWDtaHOdmafxmmLE438CRnok2_BcIGj3dkDthsw3IOepcBWvNkQH2OTImFsVBdSlTJZg_1tpqluBPquUGbTTA4E9mxkg==","rs_04df12867dccf958016a659b7ae6b88197bd0b8846f9b3b5b4",{"_548":522},[887],{"_46":888,"_92":627},"**Planning PR inspection via GitHub API**",{"_554":890,"_536":891,"_515":516,"_538":522},1785043836971,{"_539":892,"_42":884,"_622":893,"_92":624},[],[888],{"_536":895,"_515":516,"_538":522},{"_560":896,"_42":-5,"_543":897,"_282":-5,"_563":898,"_92":565},"call_oZKK0DlVAsMln6opWpmX8YVf",{"_548":522},{"_415":899,"_567":-5},[900,901],{"_46":572,"_92":571},{"_46":902,"_92":571},"b3838d0632d9465f4ec16216d13fca312d568d4d\nb3838d0 (HEAD -> work) Test failure ledger reconciliation\n6c92be7 Reconcile resolved failure ledger projections\n61f718a Merge pull request #1491 from Chris0Jeky/issue-1490/powershell-command-guide\n07563f3 Reject stale ripgrep exit state\n9a61863 Handle ripgrep launch failures in PowerShell guide\n docs/agentic/FAILURE_LEDGER.md | 9 +-\n docs/agentic/failure_ledger.jsonl | 4 +\n scripts/agent_hooks/render_failure_ledger.py | 33 +++---\n scripts/agent_hooks/test_render_failure_ledger.py | 127 +++++++++++++++++++++-\n 4 files changed, 150 insertions(+), 23 deletions(-)\n/bin/bash: line 1: gh: command not found\n",{"_554":904,"_536":905,"_515":516,"_538":522},1785043833311,{"_576":902,"_577":906,"_579":907,"_581":582,"_520":32,"_583":908,"_42":909,"_585":910,"_587":588,"_529":835,"_92":589},"/bin/bash -lc 'git remote -v; git rev-parse HEAD; git log --oneline --decorate -5; git diff --stat 61f718af941c56c31b8b7595333b9debd6e47da8..b3838d0632d9465f4ec16216d13fca312d568d4d; git diff --check 61f718af941c56c31b8b7595333b9debd6e47da8..b3838d0632d9465f4ec16216d13fca312d568d4d; gh pr view --json number,url,title,headRefOid,baseRefOid,closingIssuesReferences,comments,reviews,statusCheckRollup'",[911],127,"exec-64417590-40bc-40c2-ae03-5711758bb033","38440",{"_577":912,"_92":650},"git remote -v; git rev-parse HEAD; git log --oneline --decorate -5; git diff --stat 61f718af941c56c31b8b7595333b9debd6e47da8..b3838d0632d9465f4ec16216d13fca312d568d4d; git diff --check 61f718af941c56c31b8b7595333b9debd6e47da8..b3838d0632d9465f4ec16216d13fca312d568d4d; gh pr view --json number,url,title,headRefOid,baseRefOid,closingIssuesReferences,comments,reviews,statusCheckRollup",{"_536":914,"_515":516,"_538":522},{"_560":896,"_42":915,"_610":916,"_543":917,"_282":613,"_614":-5,"_529":113,"_92":615},"ctc_04df12867dccf958016a659b75dd2081979b4077af4323c394","const r = await tools.exec_command({cmd:\"git remote -v; git rev-parse HEAD; git log --oneline --decorate -5; git diff --stat 61f718af941c56c31b8b7595333b9debd6e47da8..b3838d0632d9465f4ec16216d13fca312d568d4d; git diff --check 61f718af941c56c31b8b7595333b9debd6e47da8..b3838d0632d9465f4ec16216d13fca312d568d4d; gh pr view --json number,url,title,headRefOid,baseRefOid,closingIssuesReferences,comments,reviews,statusCheckRollup\",\"workdir\":\"/workspace/Taskdeck\",\"yield_time_ms\":10000,\"max_output_tokens\":30000}); text(r.output);",{"_548":522},{"_536":919,"_515":516,"_538":522},{"_539":-5,"_618":920,"_42":921,"_543":922,"_622":923,"_92":624},"gAAAAABqZZt1HYS-PdkOIlG5V3MkKNn6Gs2VZeMRL5aUHWdjFjdoGvWqfmusOLvk4biE47e-21e7BVBmVdvrFEg-07pDgygvac0z8vYStTyCrpgjK1pF02RcljKWy1OD0H3Q4wE86K0E9W7XeKdar5DN_7Dw4tiKXPsTTnOoU4sBlKAlTN7NRL6x22QL64ChYi6TM5F7DcrgyKh78Jx9K7Emb4kMn_IG6XyolbqGYjd3XbHm8CUG2Tbz58CsZu6rKc_OiW99yU6suUk4kapWrvV3yrcZZGtbuzqp2v3lhzo4sEFHl_MYSWl2_gbMabYKYWgMGaY83DHj5-70hG619J4kFuS9JcqZsDH-ti7HmtEtN1V1TG3bx3tJ9WIVZRdClVzvFbkowgUXEV4k6pIa6TRIc-Rmn2a2BuVhMKpga9UWlEW7mDf0sOHdlpseMZSivQ22b6DokbXngB4JNeLeNy3WaS97wNcHO7SqDaml2bNjmc_sMv3mXlN-ZK4hTMxHySg0TWttaNewuPVDEbtl0bfR_GIAv1Svd9gFNfSxQPRbqtMY3YlVEjvkEmw6zNc-9IZWWmVie7G2QughzjeYEYDMP-5XarnsWX5mJp1-WQZe54plaqwZCe-_JeFPNpzc31N2NQzLagM0p3sD_aMlG39avs81BQ094PptuP6kT18LPIPH0c7LnmwhT4L8DlRM3vx3hkSrxC2XEd8YWhhSlfY7Cyr-K84GchBmlfXyfEWTRx3c7d20eMLBR-aGlSdkLAS2zuMoNR2dbIPTm5APdIzMy9TzQJdo6edDNE_KJtNpJc4DqD4skcItHqDZQulrgJ4IPHHOjX1WoUrx7YJwZi7Znnb46HaXROvkLrcQPZtbZWd6ynVMSZ4F5HehudRgYwrtOpIOQwYrF5m2K1z0uit37HQgfUkPFTowWXauoyqj4TskG05iO6dkOvKVLBm8i2UGFa009s83","rs_04df12867dccf958016a659b753b5c8197913dd697fa5832fc",{"_548":522},[924],{"_46":925,"_92":627},"**Switching to GitHub fallback**",{"_554":927,"_536":928,"_515":516,"_538":522},1785043829816,{"_539":929,"_42":921,"_622":930,"_92":624},[],[925],{"_536":932,"_515":516,"_538":522},{"_560":933,"_42":-5,"_543":934,"_282":-5,"_563":935,"_92":565},"call_6x1Go9E7wg4QbI5iTT3rf53v",{"_548":522},{"_415":936,"_567":-5},[937,938],{"_46":940,"_92":571},{"_46":939,"_92":571},"[{\"name\":\"mcp__make_pr__make_pr\",\"description\":\"Simple MCP server providing a make_pr tool for preparing pull request metadata.\\n\\nRecord a pull request title and body.\\ntitle: Title of the pull request\\nbody: Body message of the pull request\\n\\nexec tool declaration:\\n```ts\\ndeclare const tools: { mcp__make_pr__make_pr(args: { body: string; title: string; }): Promise>; };\\n```\"}]","Script completed\nWall time 0.0 seconds\nOutput:\n",{"_536":942,"_515":516,"_538":522},{"_560":933,"_42":943,"_610":944,"_543":945,"_282":613,"_614":-5,"_529":113,"_92":615},"ctc_04df12867dccf958016a659b72c97081979112af462fe04fbc","const names = ALL_TOOLS.filter(x => /github|pull request|make_pr/i.test(x.name+\" \"+x.description)); text(names);\n",{"_548":522},{"_536":947,"_515":516,"_538":522},{"_539":-5,"_618":948,"_42":949,"_543":950,"_622":951,"_92":624},"gAAAAABqZZtyWvELaSxgRuoA6Qp0zTWHUfoSUtLcKb8LVaSgBza3fG5hVTRyRyqqQhfgN6XkfF8-7ZUECQJTJtqh5-Wb1cxhFM7tFMY79FEZImEkA-l5HvwnWyHJy7kX1Eo8CGWiMfg-hwHSLzUnnE-ZEd--EKsi-r8xYferiuthuUgRQD-y_5dGiEdD6EbyMtmsmLxbNrpWKvniIem6UewLLote80E3PM2DxmjQEP6-M-55mSkH3PDaMXoZ3KeUKPfNlwnPr5BGL4OiHZlCNPEIoyRrePe6MIEWQ0E_KiI7RcUq6FowZ2nTgmMIEx3QYKUGftAiE74e7KwCpOcR_M4wcpKUZxc9Fn7r4eRo60Q5j9NXKVwYCLUAi33mh6aGKn1TNehAArcD86cX5L8fZZnjz9dGgv1NKz1MjsvWi6hx2qqxD6zAYmiZvdID1H1F4Qf8dR6XcBZEccFTgegKObGmuG-WWlsajkGrwJ2gtRVBheDju9odk1HJTpqG3XVO4NtZkEqstpFhs2SR3EVz0zFD_nzU_Vr1PMnLXoAo40gTuo_p5wT0GTj67wwwYNaSICszSOpB3HoX-ZGBCHXzbp-7p_XMGsX6mJ0QdMvI6yCyVfVq6ZNQdPrvMePHux6-LSgSKzj6XqeOrUUcHBAGdFz4DNLWj5l2LQWOQxXklYVT464BF8It0P-knSS5VYKCfUE7Nxb_ak7jPrYi0Gl6mVA4HiB2rYWkvgYIBEgste-JOe6BeWwY1D8awkesUCZ-5-NjWyuUFnoOlIHHKPdwxKTzm7rcD9reJcO-lvpnjJzEhFSfoI_VEhULUhhpvs8sEMo3LJFLd2HqabaOky2tMlTxMm6CbxhItL84Q0CV2DxMEHC_YVkgEUZQJT_c68sbV2docBJhUlOcQCeHbGhawb3_t0zQA0rsupEu77kct473E3cyRnm1BSYa1SllMGDhXp42p3Jbri0BrvLK7ki_OyJwoVXHiX-22t-fWbHMQcbONetVZHIkTqHoJBgJgXcK0X-YXWbeR4OF17HbqvfJA_wyhDPpWsX81U-keuLvgrlTIgmMblohGu8=","rs_04df12867dccf958016a659b70d62481979448b07b71bfc709",{"_548":522},[952],{"_46":953,"_92":627},"**Determining PR number and repo**",{"_554":955,"_536":956,"_515":516,"_538":522},1785043826728,{"_539":957,"_42":949,"_622":958,"_92":624},[],[953],{"_536":960,"_515":516,"_538":522},{"_560":961,"_42":-5,"_543":962,"_282":-5,"_563":963,"_92":565},"call_C0lpe0t1898nu0FeJco2Isay",{"_548":522},{"_415":964,"_567":-5},[965,966],{"_46":968,"_92":571},{"_46":967,"_92":571},"Warning: truncated output (original token count: 40028)\nTotal output lines: 961\n\nWarning: truncated output (original token count: 52760)\nTotal output lines: 1138\n\n--- status ---\n## work\n\n--- OUTSTANDING_TASKS.md ---\n# Outstanding Tasks\n\n**Purpose:** a durable, human-owned checklist of work the maintainer (Chris) wants to keep visible across sessions and agents, so nothing is forgotten between context resets.\n\n**Rules for agents (Claude, Codex, etc.):**\n1. **Read this file at the start of every session** (it is referenced from `CLAUDE.md` and `AGENTS.md` and the SessionStart hook).\n2. **Surface the open items** whenever you give a summary, status update, handoff, or \"what's next\" — list the open (`[ ]`) tasks with their IDs so the maintainer is reminded.\n3. **Only clear/check a task when the maintainer explicitly says it's done.** Do not auto-complete items just because a related PR was opened or you think it's finished. When told an item is complete, change `[ ]`→`[x]` (or remove it) and note the date in the changelog at the bottom.\n4. **Add new outstanding tasks here** when the maintainer asks you to remember something, or when substantial work is deferred. Keep entries short with a one-line \"how\" and a link to the GitHub issue/PR that holds the detail.\n5. Keep this file lean and scannable. Detail lives in the linked issues, not here.\n\nLast reviewed: 2026-07-13\n\n---\n\n## A. Merged PRs (confirmed by post-audit sweep 2026-05-31)\n\n- [x] **PR #1143** — Test loop: `npm test`→`vitest run` + stabilize the MetricsView flake. *(merged 2026-05-31)*\n- [x] **PR #1144** — Docs truth: STATUS↔TESTING_GUIDE contradiction, RFAI spine, broken links. *(merged 2026-05-31)*\n- [x] **PR #1145** — Release scripts aligned with CI flags + stale PKG-01 warning removed. *(merged 2026-05-31)*\n- [x] **PR #1146** — Proposal create returns 409 (not 500) on duplicate idempotency key. *(merged 2026-05-31, closes #1125)*\n- [x] **PR #1147** — `AsSplitQuery` on the multi-collection board read. *(merged 2026-05-31)*\n- [x] **#1126** — Un-skip INV-10/11/12 roadmap-invariant tests with real service assertions. *(PR #1153, merged 2026-05-31)*\n- [x] **#1134** (first slice) — Surface swallowed audit-log failures via shared `AuditLogWriter`. *(PR #1155, merged 2026-05-31)*\n\n## B. Next easy wins (seeded, not yet started)\n\n- [ ] **#1133** (rest) — Bound `NotificationRepository` paging (push ORDER BY+LIMIT to SQL), incremental SignalR board patch instead of full 3-call refetch, FTS-backed card search.\n\n## B2. Surfaced by post-audit correctness sweep (2026-05-31)\n\n- [ ] **Cohort metrics stub** — `AutomationMetricsController.GetCohortMetrics` returns empty data; `CohortDashboard` frontend is wired but always shows \"No cohort data available.\" *How:* build `ICohortMetricsService` with real cohort aggregation once learning-loop data layer design is decided. Tracked in #1142.\n- [ ] **Ollama real streaming** — `OllamaLlmProvider.StreamAsync` does pseudo-streaming (complete-then-drip-by-word). *How:* consume Ollama's `stream:true` API for genuine token streaming when Ollama provider goes beyond prototype.\n- [ ] **#1134 remaining acceptance criteria** — first slice (AuditLogWriter) shipped; 6 remaining criteria still open on the issue.\n\n## C. Strategic / larger tracks (seeded under tracker #1142)\n\n- [ ] **#1123** — v0.1.0 release: a **required revival Phase-1 ship-gate item** under ADR-0044/REVIVAL-07. Exercise the release pipeline, smoke-run the self-contained exe, publish the GHCR image, and fix the documented release-path breakage before strangers are invited. The release smoke step already landed in `release-desktop.yml`. *(Optional-archive framing from 2026-06-13 is superseded.)*\n- [ ] **#1132** — Make the required PR gate enforce security: gitleaks/SAST/dependency scan + CORS fail-closed + single ≥32 JWT floor + global `FallbackPolicy` + bundle-size in the required lane.\n- [x] **#1130** — SQLite local concurrency: enable WAL + `busy_timeout`, fix per-process `Migrate()` race (UI + MCP + CLI share one DB → `SQLITE_BUSY`). *(closed 2026-06-05; ACs 1+3 shipped in PR #1165 / da764b92. AC2 cross-process `Migrate()` serialization → #1164; export/import redesign → #1166.)*\n- [ ] **#1131** — CLI hardening: fresh-machine bootstrap (it crashes without `Connectors:EncryptionKey`) + route CLI mutations through board-access authorization.\n- [x] **#1124** — Core-loop polish: false-green expiry regression test (now asserts a real 409) + #678 dismiss gap (Approved+expired) + #680 provenance-404 console noise. *(closed 2026-06-05; all three fixed in PR #1162 / 77162b2d. Paper-view dismiss affordance → #1161.)*\n- [x] **#1161** — Paper review dismiss affordance (carries #1124's Paper remainder; maintainer 2026-06-05: take it, design-first — propose the affordance before building). *(Maintainer check-off 2026-06-19; delivered via PR #1219, **merged 2026-06-19**; issue #1161 closed.)*\n- [x] **#1164** — Serialize cross-process `Database.Migrate()` (advisory/single-owner lock; carries #1130 AC2). *(Maintainer check-off 2026-06-19; closed on GitHub via PR #1186 / SerializedMigrator.)*\n- [ ] **#1166** — Harden dev-sandbox export/import via the SQLite backup API (carries #1130's export/import follow-up).\n- [ ] **#1138** (rest) — Split the 1300+ line `STATUS.md` into a lean current-reality head + `docs/archive/status-history/`; add a rotation rule; recertify TESTING_GUIDE totals from a green CI run; add a markdown link-checker to nightly.\n- [ ] **#1136** (remainder) — ADR decision **delivered** (ADR-0038, Paper canonical / Legacy frozen; STATUS states the canonical stack) via PR #1207. **Still open:** remove/quarantine the dead paper composables (AC3) — scheduled for the Paper polish wave.\n- [ ] **#1137** — Refocus strategy/roadmap. ADR-0044 + `docs/REVIVAL_PLAN.md` now provide the revival direction and finite wave; pending maintainer check-off after the canonical-doc sync is merged. The 2026-06-13 archive framing is retained only as the checkpoint fallback.\n- [ ] **#1135 / #1140 / #1141 / #1139** — Code-health guardrails + oversized-view decomposition; workspace hygiene + one-command dev-up; i18n/a11y ADR; deployment docs (docker quickstart secret, desktop run docs). *(2026-06-19: **#1135 partial** — paper-night straggler tokens (PR #1216) — checked off by maintainer; guardrail/decomposition half + #1140/#1141/#1139 remain open.)*\n\n> Full audit context and the complete gap inventory: **GitHub issue #1142** (master tracker).\n\n## F. Generalist expansion wave (2026-07-13, ADR-0046 Proposed — extends §E as REVIVAL_PLAN Phase 4)\n\nDecision under ratification: **extend the single app** (artefact intake beyond transcripts, project dossiers, generalist legibility, friends-family channel); the twin generalist app is **deferred behind the GEN-12 evidence gate**, not built. Wave label `generalist`; strictly subordinate to the v0.1 ship gate.\n\n- [ ] **GEN-00 tracker (#1327)** — ratify ADR-0046 + Phase-4 placement + the tracker's decision checklist (SQLite blob storage, consent-gated vision MVP, twin-app deferral). Child issues: #1315–#1326 (GEN-01..12).\n- [ ] **Maintainer at checkpoint:** review GEN-12 (#1326) twin-app gate against friends-family signal (GEN-11 #1325) — recorded decision required, silence is not a close.\n\n## E. Revival wave (2026-07-10 pivot, ADR-0044 — supersedes the archive framing of §D)\n\nDirection: **free open beta → commercial horizon** (`docs/REVIVAL_PLAN.md` is the planning spine; `docs/analysis/2026-07-10_revival_assessment.md` is the evidence base). §D items are re-scoped in place — same work, new purpose (v0.1 ship gate instead of archive gate). Issue IDs below are seeded as the REVIVAL wave; see the tracker for the authoritative list.\n\n- [ ] **REVIVAL-00 tracker (#1311)** — charter + v0.1 ship-gate ratification (amends #1278); wave sequencing. Child issues: #1297–#1310 (REVIVAL-01..14); docs PR: #1296.\n- [ ] **Phase 0 — dogfooding starts now** (#1271, unchanged): real personal use including WhisperX transcripts through the existing transcript capture tab.\n- [ ] **Phase 1 — truth + safety before strangers**: registration gating flag; remove the fake undo timeline; de-stub Today dossier (#1272); Paper fonts + favicon; Paper onboarding/first-board path; README revival rewrite + demo GIF + MCP section; v0.1.0 tag → exercise release pipeline → GHCR image; fix render.yaml; branch protection (#1173); CI keep/kill (#1275); Paper E2E/axe re-point (#1274).\n- [ ] **Phase 2 — transcript engine** (authorized new-surface exception): LLM triage strategy behind `ICaptureTriageService` for transcript sources; chunking + cap raise; triage schema v2 (type/assignee/due + model-derived confidence); Transcript entity + evidence spans; OpenAICompatible provider + true SSE streaming; risk-tiered review prioritization and batch-confirm ergonomics (**never auto-apply or bypass ADR-0003's approve-then-execute gate**); (2b, gated on dogfooding value) audio upload + WhisperX sidecar.\n- [ ] **Phase 3 — slim + launch**: dead-surface amputation (#1276 expanded); MCP packaging + scoped keys + hash-pin wiring (#1154) + explicit multi-user-safe stdio identity (#1309); privacy-respecting beta feedback channel; launch checklist (r/selfhosted, Show HN, awesome-selfhosted, hosted demo).\n- [ ] **Checkpoint (~8 weeks)**: fall back to the §D archive plan only if there is no organic traction **and** dogfooding has not stuck; any mixed outcome requires an explicit maintainer assessment/plan amendment.\n\n## D. Historical archive closeout wave — re-scoped by ADR-0044\n\nAnalysis docs: `docs/PROJECT_TRAJECTORY.md` (strengths + path) and `docs/COURSE_CORRECTION.md` (what must change + ordered plan). These issue titles retain their ARCHIVE-* history, but **nothing in this section independently authorizes archival**: ADR-0044 re-scopes the still-useful work into the revival ship gate and keeps archive only as the checkpoint fallback. Wave source: **#1278** (originally ARCHIVE-00; amended by REVIVAL-00/#1311).\n\n- [ ] **#1278** — originally ARCHIVE-00; now the **v0.1 ship-gate source** amended by REVIVAL-00/#1311: ratify the repurposed exit criteria and revival additions, then use archive only if ADR-0044's checkpoint condition is met. *(Maintainer decision.)*\n- [ ] **#1269** — ARCHIVE-01: codify the two-tier review gate (LIGHT/FULL), issue-intake severity bar, no-new-backend-surface rule.\n- [ ] **#1270** — ARCHIVE-02: backlog triage hour — close ~16 already-decided issues with dated pivot notes. *(Maintainer sign-off on the list.)*\n- [ ] **#1271** — ARCHIVE-03: dogfooding sprint — ≥10 days of real personal use (the pivot's acceptance test; cannot be delegated).\n- [ ] **#1272** — ARCHIVE-04: Today dossier truth — de-stub the fabricated default daily surface (`useTodayDossier.ts` buildStubDossier).\n- [x] **#1273** — capture-triage provenance names the deterministic extractor, delivered by #1283; the v0.1 ship-gate item is done. *(Checked off 2026-07-25 on the maintainer's explicit instruction — see the rule-3 note in the changelog. GitHub issue #1273 was already closed 2026-07-03.)*\n- [ ] **#1274** — ARCHIVE-06: re-point E2E + axe coverage at the Paper UI (currently the least-tested UI).\n- [ ] **#1275** — ARCHIVE-07: CI estate right-sizing — keep/kill/gate per lane + short ADR (nightly red 28 days; mutation red 10+ weeks).\n- [ ] **#1276** — ARCHIVE-08: dead-surface removal — ink-bleed decision, orphaned Paper code, cohorts stub, voice capture, Ollama marking.\n- [ ] **#1277** — originally ARCHIVE-09; now the revival checkpoint/fallback record. Beta-facing README, release tag, and ship-gate checks live in REVIVAL-06/07/14; archive-only edits wait unless ADR-0044's checkpoint condition is met.\n- [x] **#1235** — revision-aware proposal diff (preview equals what Apply executes) was delivered by #1280 with regression coverage; the v0.1 ship-gate item is done. *(Checked off 2026-07-25 on the maintainer's explicit instruction — see the rule-3 note in the changelog. GitHub issue #1235 was already closed 2026-07-03.)*\n- [ ] **#1291** — Adopt agent-harness T3 profile: one-home policy collapse, .codex mirror retirement, skill read-first diet, region maps, review-twin merge, ledger triage cadence. *(Blueprint: sibling checkout `C:/Users/jekyt/source/agent-harness/BLUEPRINT.md` — outside this repo; complements #1138/#1269/#1275/#1276, no duplication.)*\n- *(Record, already done 2026-07-02:)* re-scope comments posted on #996, #1123/#1139, #1128, #1134 (+#1154 decision), #1135, #1138, #1173, #1175 (+#1174), #1210, #1215, #1222 (+#1227), #1228 — each carries updated finish-or-close ACs.\n\n## E. Revival overnight deferrals (added 2026-07-13)\n\n- [ ] **#1173** — Apply and verify the required branch-protection settings in GitHub. This is repository-settings work and remains maintainer-only.\n- [ ] **#1303** — Push the `v0.1.0` release tag only after the maintainer accepts the release deck and its pipeline evidence. Agents may repair the pipeline but must not push the tag.\n- [ ] **#1482 — Taskdeck name, pre-commercial legal residuals.** *(Supersedes the old \"#1299 trademark check\" line: #1299 shipped with PR #1337 on 2026-07-25 and its AC4 search + cost + recommendation are recorded on the issue.)* What remains is genuinely legal and none of it blocks the free beta: an **attorney registrability opinion** for Classes 9/42 asking about *descriptiveness* (not just conflict), a read on **TASKADE** (live, incontestable US Cl. 42 mark covering task management), the UKIPO/EUIPO coverage gaps (UKIPO hard-blocked automated access, so all GB data is indirect), perishable namespace reservations, and the **keep-or-rename decision before `v0.1.0` (#1303)** — renaming is nearly free pre-tag and expensive after.\n- [ ] **#1327 project sync access** — Run `gh auth refresh -s project`, then rerun `scripts/github/Sync-TaskdeckProjectPriority.ps1` in audit and apply modes and verify no issue/PR project item has an empty Priority.\n- [ ] **#1330** — Repair the CI Extended reusable-workflow permission contract; affected PRs remain ineligible while the workflow startup failure is red.\n- [ ] **#1282 / #1332 / #1335** — Stabilize the required full-suite harness: SQLite concurrency, Redis connect/dispose, and hosted-worker/presence lifecycle isolation. Narrow passes do not clear the recorded full-suite failures.\n- [ ] **#1338** — Map HTTP MCP and its API-key middleware to the same `/mcp` route before documenting or exposing HTTP transport; the current parameterless mapping serves MCP at an unintended unauthenticated root route.\n- [ ] **#1343** — Prevent late Home/Today summary responses from overwriting a newer local workspace-mode choice; add deterministic ordering tests and repeated error-recovery E2E proof.\n- [ ] **#1345 maintainer record check-off** — The code now centrally pins the matched SQLitePCLRaw 2.1.12 family, loads SQLite 3.53.3, enforces the advisory's >= 3.50.2 runtime floor, clears the solution vulnerability audit, preserves the EF model, and passes a self-contained `win-x64` health smoke. The implementation is complete; this checkbox remains human-owned.\n- [ ] **#1274 / `origin/issue-1274/paper-e2e-axe` at `993f188f`** — Resume the parked Paper E2E/axe re-point from the pushed WIP branch; fix tracked Paper Review blockers #1347/#1348, finish the named first-run/onboarding/smoke and axe coverage, then run the full frontend/E2E gates before opening a PR.\n- [ ] **#1347 / #1348** — Repair the Paper deep-review enum wire-contract crash and the SQLite-backed similar-past HTTP 500; both were reproduced by the real Paper capture/review path and must not be hidden by frontend fallbacks.\n- [ ] **#1323 prompt-rail remainder** — Bind the hostile transcript/PDF/image and malformed-response fixtures from PR #1340 to PR #1312's effective prompt/parser path before GEN-04; prove grounded-task-or-empty verdicts and deterministic fallback for schema escapes.\n- [ ] **#1456 / PR #1457 — Codex deny-floor adapter T4 gate.** Stages a security boundary and does not self-ratify: merging needs the maintainer to trust the project hook in a **fresh interactive Codex `/hooks` session** and to record live allow/deny canaries. No agent can perform or substitute for that. **Step-by-step instructions are posted on the PR** (2026-07-25), including the exact canary commands and what a failure looks like. *(Its pinned dispatcher hash was stale — v1.5.2 vs the installed 1.6.5 — and has been refreshed; verify it is still current before the trust session, since the floor shipped twice in one day. The other two standing holds are resolved: #1295 closed as superseded, #1337 merged.)*\n- [ ] **Prune the merged agent worktrees.** `git worktree remove` is blocked by the deny floor, so this is human-only and recurs after every wave (upstream: [agent-harness#41](https://github.com/Chris0Jeky/agent-harness/issues/41)). *(Added 2026-07-25.)*\n\n ```bash\n cd /c/Users/jekyt/source/Taskdeck\n git worktree remove .worktrees/claude-model-routing-canon # docs/model-routing-canonical-pointer\n git worktree remove .worktrees/claude-sweep-0725 # docs/sweep-2026-07-25\n git worktree remove .worktrees/codex-1299-licensing-pack # issue-1299/licensing-pack — merged as PR #1337\n git branch -d docs/model-routing-canonical-pointer docs/sweep-2026-07-25 issue-1299/licensing-pack\n ```\n\n All three are clean and fully merged into `main`. **Keep** `.worktrees/codex-1456-codex-deny-floor-adapter` — PR #1457 is still open and its trust session runs from there.\n- [ ] **Branch from an explicit base.** PR #1477 was closed-as-merged without anyone merging it. Root cause: `feat/1271-dogfooding-instrumentation` (PR #1478) was created with a bare `git checkout -b` **while standing on `fix/1123-release-dry-run`**, so it silently inherited `#1477`'s commit `0ebbf330`. Merging #1478 carried that commit onto `main`, GitHub detected `#1477`'s branch as fully merged and auto-closed it two seconds later, attributing the event to the acting token. The single-parent \"rebase\" appearance was GitHub recording the already-landed commit, not a rebase anyone performed. *How:* always name the base — `git checkout -b main` — and verify with `git log --oneline main..` before pushing. *(Added 2026-07-25. Supersedes an earlier item on this list that wrongly framed this as an unidentified autonomous merger — that alert was mine and it was wrong; caught by Codex on PR #1483.)*\n\n---\n\n## Changelog\n- 2026-07-25 (latest): **PR queue cleared — 8 PRs merged, 1 draft left.** `#1469` (`#1462` frontend pin), `#1471`, `#1472`, `#1477`+`#1481` (`#1123` release rehearsal), `#1478` (`#1271` dogfooding instrumentation), `#1479`, and `#1337` (`#1299` licensing pack — **`#1299` closed by that merge**, residuals → `#1482`). `#1295` **closed as superseded**, with the salvage plan and acceptance criteria recorded on `#1293`. Only `#1457` remains, and its step-by-step human procedure is now on the PR. Repo hardening: force-push and deletion blocked on `main`; 288 truncation-hidden project-priority mismatches synced. Under `#1270`, 12 already-decided issues closed with dated notes — but **`#1270` stays open**, because two of its own acceptance criteria are obsolete against ADR-0044 and REVIVAL_PLAN §6 and must not be run as written. Seeded `#1470` `#1473` `#1474` `#1475` `#1476` `#1480` `#1482` and upstream `agent-harness#56`. Dogfooding baseline measured for the first time and recorded in `docs/dogfooding/LOG.md`: **sustained use has not started**, though the core loop works (17/20 proposals reached Apply). No item below was checked off in this pass.\n- 2026-07-25 (later): **#1273 and #1235 checked off — rule-3 exception, on the maintainer's explicit instruction.** During a guided walkthrough the maintainer reviewed both record-only items and said \"please tick them yourself\". Recorded here because rule 3 reserves check-offs to …30028 tokens truncated…\n3. `#59` OPS-05 no-status safety view\n4. `#41` OPS-06 backlog seeding policy\n5. `#55` DOC-01 docs reconciliation ritual\n6. `#60` DOC-02 docs normalization sweep\n7. `#56` REL-01 RC hard-gate policy\n\n### Stage 1: Priority I - Phase 4 Completion\n\nSecurity/policy:\n1. `#33` SEC-02 claims-first identity retrofit\n2. `#34` SEC-03 authz regression matrix\n3. `#44` SEC-04 API error-contract assertions\n4. `#152` SEC-11 final cross-user policy convergence pass\n\nUX reliability:\n5. `#35` UX-01 archive lifecycle coherence\n6. `#45` UX-02 drag/edit interaction safety\n7. `#36` UX-03 command palette keyboard model\n8. `#37` UX-04 activity selector discoverability\n9. `#38` UX-04 shared input-assist scaffolding\n10. `#46` UX-05 escape behavior contract\n\nAutomation/provider:\n11. `#39` AUTO-01 production provider strategy\n12. `#40` AUTO-02 planner/executor hardening\n13. `#57` MVP-01 chat-to-project bootstrap\n\nStarter packs and debt blockers:\n14. `#47` PACK-01 manifest RFC/schema\n15. `#48` PACK-02 backend apply dry-run/conflicts\n16. `#49` PACK-03 frontend catalog preview/apply\n17. `#50` PACK-04 first-party starter packs\n18. `#51` PACK-05 deterministic fixture packs\n19. `#52` DEBT-01 nullability reduction\n20. `#53` DEBT-02 log query scalability\n21. `#54` DEBT-03 export/import implementation vs ADR\n\nPriority I addendum (demo-expansion migration wave, seeded 2026-03-02):\n22. `#297` Demo Expansion Migration Tracker (v0 -> v3 staged port)\n23. `#298` Batch A (`v0`) baseline demo seed + MVP-first UX defaults\n24. `#299` Batch B (`v1`) harness + scripted scenarios + API walkthrough + stakeholder clickthrough\n25. `#300` Batch C (`v2`) JSON scenario system + capture-aware autopilot\n26. `#301` Batch D (`v3`) demo director + tracing/snapshot + reliability fixes\n27. `#302` Batch E integration hardening + CI/docs policy\n\nExecution note (demo-expansion wave):\n- Run `#298` -> `#299` -> `#300` -> `#301` -> `#302` in strict dependency order.\n- Keep one branch per batch issue using the suggested branch name in each issue body.\n- Prefer file-scoped commits inside each batch to simplify review and rollback.\n- Current state (2026-03-06): `#298` through `#302` are delivered; retain this order as the historical dependency record for any future demo-tooling follow-ups.\n\nPriority I addendum (manual product audit follow-through wave, seeded 2026-03-26):\n28. `#363` ANL-2026-03-26 manual product audit follow-through tracker\n29. `#364` COL-05 realtime hub CORS/SignalR health\n30. `#365` CAP-23 Inbox triage freshness\n31. `#368` AUTO-04 live-provider status, degraded-mode messaging, and first-turn fidelity\n32. `#366` UX-20 Workbench/nav/docs truth alignment\n33. `#367` UX-21 board-history semantic alignment\n\nExecution note (manual product audit wave):\n- use `docs/analysis/2026-03-26_manual-product-audit.md` together with `docs/analysis/2026-03-26_manual-product-audit-followthrough.md`\n- keep the first pass focused on runtime trust/coherence, not broad future surface expansion\n- route the review raw-ID finding through existing issue `#326` instead of creating a duplicate\n- `#369` headed manual-audit Playwright follow-through is intentionally lower priority and should not block the Priority I runtime fixes above\n\n### Stage 2: Priority II - Foundation Wave (Post-Phase-4) (all delivered)\n\nExecution note (2026-02-22, updated 2026-03-28):\n- `#168` CI topology expansion is complete: required-lane reusable extraction, non-blocking (`ci-extended`), scheduled (`ci-nightly`, `nightly-quality`), release (`ci-release`, `release-security`) orchestrators, topology documentation in `ci-required.yml` header, and `CODEOWNERS` governance are all delivered. Remaining hardening tracks continue independently.\n\nAnalysis follow-through, CI topology, and hardening (all delivered):\n1. `#151` ANL-2026-02-21 analysis follow-through umbrella (delivered)\n2. `#168` OPS-19 CI workflow topology expansion and governance hardening (delivered)\n3. `#153` API-06 centralized exception handling/fallback error-contract uniformity (delivered)\n4. `#154` FE-11 frontend linting baseline + CI gate (delivered)\n5. `#155` FE-12 frontend coverage thresholds (delivered)\n6. `#157` TST-14 architecture-guard expansion (delivered)\n\nFoundation wave (all delivered):\n7. `#67` COL-01 realtime SignalR updates (delivered)\n8. `#68` OBS-01 observability baseline (delivered)\n9. `#70` TST-01 load/concurrency harness (delivered)\n10. `#71` ARCH-01 multi-tenancy strategy ADR (delivered)\n11. `#72` COL-02 notifications framework (delivered)\n12. `#73` COL-03 presence/conflict policy (delivered)\n13. `#74` COL-04 comments/mentions workflow (delivered)\n14. `#75` INT-01 import adapters foundation (delivered)\n15. `#76` INT-02 webhooks/integration security model (delivered)\n\nCapture realignment wave (2026-02-23, all delivered):\n16. `#199` CAP-00 capture wave tracker (delivered)\n17. `#200` CAP-01 capture persistence model/domain contract (delivered)\n18. `#201` CAP-02 capture API slice (delivered)\n19. `#202` CAP-03 queue proposal provenance fix (delivered)\n20. `#203` CAP-04 triage enqueue + status transitions (delivered)\n21. `#204` CAP-05 worker triage path -> proposal generation (delivered)\n22. `#205` CAP-06 strict triage schema + prompt versioning (delivered)\n23. `#206` CAP-07 inbox frontend route/list/detail (delivered)\n24. `#207` CAP-08 capture modal + command palette integration (delivered)\n25. `#208` CAP-09 triage trigger + proposal-linking UX (delivered)\n26. `#209` CAP-10 card/proposal provenance UX (delivered)\n27. `#210` CAP-11 capture loop E2E regression (delivered)\n28. `#211` CAP-12 canonical docs promotion (delivered)\n\nTesting harness guardrails wave (2026-02-23, all delivered):\n29. `#254` TST-15 testing harness wave tracker (delivered)\n30. `#255` TST-16 remove residual wall-clock flake patterns + centralize E2E polling helpers (delivered)\n31. `#256` TST-17 drag/drop persistence regression coverage (refresh-stable) (delivered)\n32. `#257` TST-18 API error-contract completeness expansion (`400/401/403/404/409`) (delivered)\n33. `#258` TST-19 OpenAPI generation + parse-validation CI artifact guardrail (delivered)\n34. `#259` DOC-06 golden principles baseline + minimal enforcement script (delivered)\n35. `#260` OPS-20 non-blocking nightly quality workflow (coverage + dependency/security signals) (delivered)\n\nProvider runtime expansion (2026-02-23, all delivered):\n36. `#232` AUTO-03 provider-agnostic LLM runtime (`OpenAI` + `Gemini`) with demo-first setup and safe `Mock` fallback (delivered)\n37. `#235` SEC-15 managed-key threat-model/control-plane tracker (delivered)\n38. `#236` SEC-16 managed-key identity attribution contract (delivered)\n39. `#237` SEC-17 managed-key quota/budget/kill-switch guardrails (delivered)\n\nMVP productization wave seeded from the 2026-03-07 integration (all delivered):\n40. `#318` `UX-13` MVP productization wave tracker (delivered)\n41. `#320` `UX-14` workspace mode foundation + `Home` summary shell (delivered)\n42. `#322` `UX-15` `Review`-first routing + empty/help states + board selectors (delivered)\n43. `#324` `UX-16` `Today` agenda + first-run onboarding path (delivered)\n44. `#326` `UX-17` proposal readability + board-centered action flow (delivered)\n45. `#96` `UX-10` interactive onboarding/help (delivered)\n46. `#100` `DOC-04` user guides/tutorials/FAQ (delivered)\n47. `#328` `TST-20` product first-run smoke + launch-criteria guardrail (delivered)\n\nSaul-facing demo alignment wave seeded from the 2026-03-26 reconciliation (all delivered):\n48. `#356` `DEMO-00` Saul-facing demo alignment tracker (delivered)\n49. `#354` `PACK-08` Saul-facing client-onboarding starter pack and deterministic demo scenario (delivered)\n50. `#326` `UX-17` proposal readability and trust-cue hardening (demo-critical Saul-facing subset; follow-up pass on position 44) (delivered)\n51. `#330` `UX-18` in-app demoability surfaces and hero-board quality (demo-critical Saul-facing subset) (delivered)\n52. `#355` `TST-24` Saul-facing demo rehearsal contract, acceptance checklist, and artifact guide (delivered)\n53. `#216` `GTM-01` thesis-aligned demo script / landing baseline (delivered)\n\nExecution note (Saul-facing demo wave):\n- use `docs/WIP/Taskdeck_Demo_Capability_Specification.md` together with `docs/analysis/2026-03-26_saul-demo-capability-reconciliation.md`\n\n--- .codex/README.md ---\n# Codex Workspace Control Plane\n\nThis `.codex/` layer is the Codex-facing control plane for Taskdeck. It routes agents to the active project truth, local skills, MCP configuration, and high-autonomy workflows without making `.codex` a second product roadmap.\n\n`docs/STATUS.md` remains the source of truth for current shipped reality. `docs/IMPLEMENTATION_MASTERPLAN.md` remains the source of truth for roadmap sequencing and delivery history.\n\n## Start Here\n\n1. Read [docs/STATUS.md](../docs/STATUS.md).\n2. Read [AGENTS.md](../AGENTS.md).\n3. Read [memories/00_ACTIVE.md](./memories/00_ACTIVE.md).\n4. Read [docs/IMPLEMENTATION_MASTERPLAN.md](../docs/IMPLEMENTATION_MASTERPLAN.md).\n5. Read [autodoc/AGENT_INDEX.md](../autodoc/AGENT_INDEX.md) for fast seam orientation.\n6. Pick the matching repo skill from [skills/README.md](./skills/README.md).\n\n## Current Routing\n\n- Taskdeck current state: [../docs/STATUS.md](../docs/STATUS.md).\n- Codex-local active gate after canonical docs: [memories/00_ACTIVE.md](./memories/00_ACTIVE.md).\n- Roadmap and sequencing: [../docs/IMPLEMENTATION_MASTERPLAN.md](../docs/IMPLEMENTATION_MASTERPLAN.md).\n- Dependency-aware issue order: [../docs/ISSUE_EXECUTION_GUIDE.md](../docs/ISSUE_EXECUTION_GUIDE.md).\n- High-autonomy Codex workflow: [../docs/tooling/CODEX_AUTONOMY_RUNBOOK.md](../docs/tooling/CODEX_AUTONOMY_RUNBOOK.md).\n- MCP/tooling rules: [../docs/MCP_TOOLING_GUIDE.md](../docs/MCP_TOOLING_GUIDE.md).\n- Agentic question/failure/update protocols: [../docs/agentic/](../docs/agentic/).\n- Codex/Claude tool parity: [../docs/agentic/AGENT_TOOL_PARITY.md](../docs/agentic/AGENT_TOOL_PARITY.md).\n- Fast agent seam map: [../autodoc/AGENT_INDEX.md](../autodoc/AGENT_INDEX.md).\n\n## Canonical Vs Local\n\n- Canonical project docs: `docs/STATUS.md`, `docs/IMPLEMENTATION_MASTERPLAN.md`, `docs/TESTING_GUIDE.md`, `docs/MANUAL_TEST_CHECKLIST.md`, and `docs/GOLDEN_PRINCIPLES.md`.\n- Codex-local routing: `.codex/README.md`, `.codex/memories/00_ACTIVE.md`, `.codex/config.toml`, and `.codex/skills/*`.\n- Claude-local routing: `.claude/README.md`, `.claude/settings.json`, and `.claude/skills/*`.\n- Agentic operating layer: `docs/agentic/*`, `autodoc/AGENT_INDEX.md`, and `scripts/agent_hooks/*`.\n- Historical or research material: `docs/archive/` and `docs/InReview/`; use only when active docs point there or the task explicitly asks for reconciliation.\n\n## Development Loop\n\n1. Confirm active Taskdeck state in `docs/STATUS.md`.\n2. Check git state and run `powershell -File scripts/check-git-env.ps1` before multi-file or branch work.\n3. Create a scoped branch or worktree for non-trivial implementation.\n4. Keep ownership narrow and choose the relevant Taskdeck skill.\n5. Use the question protocol for true blockers and record assumptions for reversible choices.\n6. Run targeted checks first, then broaden based on blast radius.\n7. Record unresolved failures or workarounds through the failure protocol.\n8. Update canonical docs only when shipped reality, roadmap sequencing, testing expectations, or operator workflow changed.\n9. Open a PR by default for issue-scoped implementation, then perform self-review before handoff. Follow the Review Policy in `AGENTS.md`: post findings as a PR comment, fix everything at every severity, check and address all existing comments, and seed issues for out-of-scope findings.\n\n## Best Tool Baseline\n\n- Use `.codex/config.toml` MCP servers first for docs, GitHub, browser, Docker, OpenAPI, and runtime inspection tasks.\n- Use native `rg` for repository search; do not use ripgrep MCP on Windows unless it has been revalidated.\n- Use Codex-native patching for file edits and configured agents/worktrees only when runtime policy allows clean ownership splits.\n\n\n--- .codex/memories/00_ACTIVE.md ---\n# Active Taskdeck Agent Context\n\nLast updated: 2026-07-13\n\nThis file is the Codex active-gate pointer for Taskdeck. It intentionally summarizes routing only; the canonical state remains in `docs/STATUS.md`.\n\n## Current Authority\n\n- Current shipped state: `docs/STATUS.md`\n- Roadmap and sequencing: `docs/IMPLEMENTATION_MASTERPLAN.md`\n- Stable invariants: `docs/GOLDEN_PRINCIPLES.md`\n- Dependency-aware issue execution: `docs/ISSUE_EXECUTION_GUIDE.md`\n- Testing operations: `docs/TESTING_GUIDE.md`\n- MCP/tool usage: `docs/MCP_TOOLING_GUIDE.md`\n- High-autonomy Codex workflow: `docs/tooling/CODEX_AUTONOMY_RUNBOOK.md`\n- Fast agent seam map: `autodoc/AGENT_INDEX.md`\n- Agentic protocols: `docs/agentic/QUESTION_PROTOCOL.md`, `docs/agentic/FAILURE_LEDGER.md`, `docs/agentic/GUIDE_UPDATE_PROTOCOL.md`, `docs/agentic/SKILL_REGISTRY.md`, `docs/agentic/AGENT_TOOL_PARITY.md`\n\n## Current Focus Snapshot\n\n**Direction (2026-07-10 revival pivot, ADR-0044; extended 2026-07-13 by ADR-0046):** Taskdeck is being revived and shipped as a **free open beta** — the local-first, review-first action-item engine (transcripts/notes/artefacts in → evidence-linked proposals out → human-approved board apply), with the write-gated MCP server as the developer-facing second act. Active sequencing is `docs/REVIVAL_PLAN.md` (waves REVIVAL-00..14 `#1297`–`#1311`, `#1311` is the tracker; plus Phase 4 GEN-00..12 `#1315`–`#1327` — **ADR-0046 Accepted 2026-07-13, tracker GEN-00 `#1327`**), and the v0.1 ship gate has top priority. The 2026-06-13 archive pivot is **superseded** and retained only as the traction-checkpoint fallback. ADR-0046 adds generalist reach in the single app — artefact intake beyond transcripts, project dossiers, mode-scoped legibility; the twin generalist app is deferred behind the GEN-12 (`#1326`) evidence gate. Work not on the ratified wave list is not taken. The project thesis remains unchanged:\n\n- capture should be near-zero friction\n- automation-originated board writes must remain proposal-first and human-approved\n- provenance, confidence, side-effect disclosure, telemetry guardrails, and exfiltration controls are distinct safety surfaces\n- product legibility and trust take priority over broad new autonomy\n\n## Required Read Order\n\n1. `docs/STATUS.md`\n2. `AGENTS.md`\n3. `.codex/README.md`\n4. `docs/IMPLEMENTATION_MASTERPLAN.md`\n5. `docs/GOLDEN_PRINCIPLES.md`\n6. `docs/ISSUE_EXECUTION_GUIDE.md` when selecting or executing issues\n7. `autodoc/AGENT_INDEX.md` for cheap seam orientation\n8. the matching `.codex/skills/*/SKILL.md`\n9. feature, testing, MCP, agentic, or project-automation docs relevant to the task\n\nFor Claude Code, read `docs/STATUS.md` first, then use `.claude/README.md` and `CLAUDE.md` for Claude-specific routing.\n\n## Review Policy\n\nEvery review (self-review, adversarial, subagent) must: post findings on the PR as a comment, fix everything at every severity, check and address ALL existing PR comments (human, bot, previous reviews), and seed GitHub issues for out-of-scope findings. No \"non-blocking\" dismissals. See `AGENTS.md` Review Policy for full rules.\n\n## Agent Coordination Rules\n\n- Use spawned subagents without asking for extra permission when they are efficient or effective for safely parallelizable work.\n- When implementation needs isolation, create real git worktrees with `scripts/git/New-CodexIssueWorktree.ps1`.\n- Keep one coordinator responsible for issue selection, synthesis, docs rehydration, and final verification.\n- Do not update canonical docs for local-only guidance unless behavior, roadmap state, testing expectations, or operator workflow changed.\n- Use `docs/agentic/QUESTION_PROTOCOL.md` to batch true blockers and proceed with explicit assumptions for reversible choices.\n- Use `docs/agentic/FAILURE_LEDGER.md` for unresolved failures or workarounds that future agents should not rediscover.\n- Use `docs/agentic/AGENT_TOOL_PARITY.md` to keep Claude and Codex using equivalent capabilities through their runtime-native tools.\n\n--- .codex/skills/taskdeck-pr-review-loop/SKILL.md ---\n---\nname: taskdeck-pr-review-loop\ndescription: Perform Taskdeck PR self-review or fresh adversarial review, post review findings, address review comments and bot comments, verify fixes, and re-review. Use when the user asks to review PRs, spin fresh reviewers, check comments, address feedback, or run another adversarial pass on sensitive or failing work.\n---\n\n# Taskdeck PR Review Loop\n\nReview like a maintainer: find bugs, risks, missing tests, and docs drift before merge.\n\n## Read first\n\n1. `docs/STATUS.md`\n2. `AGENTS.md`\n3. `docs/GOLDEN_PRINCIPLES.md`\n4. The linked issue and PR body\n5. The PR diff\n\n## Review focus\n\nPrioritize:\n\n- auth/authz and cross-user policy regressions\n- proposal-first automation safety\n- persistence/migration correctness\n- error contract stability\n- missing tests or weak assertions\n- frontend keyboard/accessibility/loading/error states\n- docs/testing-guide drift\n- CI workflow or project automation side effects\n\nDo not spend review energy on unrelated style unless it creates risk.\n\n## Review output\n\nUnless the user explicitly says otherwise, post findings as a PR comment organized by severity. Each finding needs:\n\n- file and line if available\n- concrete risk\n- expected fix or test\n- severity (CRITICAL, HIGH, MEDIUM, LOW)\n\nAll findings at every severity must be addressed — there is no \"non-blocking\" category. Do not skip lower-priority findings.\n\nIf a finding is real but out of scope for this PR, seed a GitHub issue to track it. Never silently drop findings. Tech debt from reviews must be zero.\n\nIf there are no findings, post an explicit no-finding comment with residual risk and test gaps.\n\n## Sensitive PR rule\n\nRun a second fresh review when the PR touches:\n\n- security/auth/session/token behavior\n- migrations or data deletion/retention\n- MCP or external agent write surfaces\n- capture/review/proposal execution\n- GitHub workflows/project automation\n- broad frontend route or state flow\n- flaky/failing CI\n\nThe second reviewer should not rely on the first review summary unless addressing already-posted comments.\n\n## PR Comment Check (MANDATORY)\n\nBefore posting findings, read ALL existing PR comments:\n\n```bash\ngh api repos/{owner}/{repo}/pulls/{number}/comments\ngh pr view --comments\ngh api repos/{owner}/{repo}/issues/{number}/comments\n```\n\nLook for:\n- Human review comments not yet addressed\n- Dependabot alerts or suggestions\n- CodeQL / security scanning findings\n- CI bot failure messages\n- Previous adversarial review comments not yet resolved\n- Any automated tool output needing action\n\nAddress everything unaddressed: fix it, reply with invalidation evidence, or seed a tracked GitHub issue.\n\n## Addressing feedback\n\nWhen assigned to fix comments:\n\n1. Read all unresolved review threads, human comments, and bot comments.\n2. Group by root cause.\n3. Make focused fix commits.\n4. Run targeted checks.\n5. Reply to each thread with what changed and verification.\n6. Post a follow-up PR comment mapping each finding to its fix commit and verification result.\n7. Re-review the fixed diff.\n\nNever mark feedback resolved mentally without either fixing it, explaining why it is invalid, or seeding a follow-up as a GitHub issue.\n\n## Comment hygiene\n\nUse GitHub MCP for issue/PR metadata and comments when available. Use `gh` fallback when MCP is unavailable.\n\n## Rules\n\n- NEVER skip MEDIUM or LOW findings — there is no \"non-blocking\" category\n- Always check ALL existing PR comments (human, bot, previous reviews) before posting findings\n- Address every unaddressed comment: fix, invalidate with evidence, or seed a GitHub issue\n- Out-of-scope findings must be seeded as GitHub issues, never silently dropped\n- Always post a follow-up comment after fixes are pushed\n- Tech debt from reviews must be zero\n\nDo not merge PRs. Do not change repo settings, secrets, protections, environments, or workflow permissions.\n","Script completed\nWall time 0.3 seconds\nOutput:\n",{"_554":970,"_536":971,"_515":516,"_538":522},1785043822123,{"_576":972,"_577":973,"_579":974,"_581":582,"_520":429,"_583":32,"_42":975,"_585":976,"_587":588,"_529":113,"_92":589},"--- status ---\n## work\n\n--- OUTSTANDING_TASKS.md ---\n# Outstanding Tasks\n\n**Purpose:** a durable, human-owned checklist of work the maintainer (Chris) wants to keep visible across sessions and agents, so nothing is forgotten between context resets.\n\n**Rules for agents (Claude, Codex, etc.):**\n1. **Read this file at the start of every session** (it is referenced from `CLAUDE.md` and `AGENTS.md` and the SessionStart hook).\n2. **Surface the open items** whenever you give a summary, status update, handoff, or \"what's next\" — list the open (`[ ]`) tasks with their IDs so the maintainer is reminded.\n3. **Only clear/check a task when the maintainer explicitly says it's done.** Do not auto-complete items just because a related PR was opened or you think it's finished. When told an item is complete, change `[ ]`→`[x]` (or remove it) and note the date in the changelog at the bottom.\n4. **Add new outstanding tasks here** when the maintainer asks you to remember something, or when substantial work is deferred. Keep entries short with a one-line \"how\" and a link to the GitHub issue/PR that holds the detail.\n5. Keep this file lean and scannable. Detail lives in the linked issues, not here.\n\nLast reviewed: 2026-07-13\n\n---\n\n## A. Merged PRs (confirmed by post-audit sweep 2026-05-31)\n\n- [x] **PR #1143** — Test loop: `npm test`→`vitest run` + stabilize the MetricsView flake. *(merged 2026-05-31)*\n- [x] **PR #1144** — Docs truth: STATUS↔TESTING_GUIDE contradiction, RFAI spine, broken links. *(merged 2026-05-31)*\n- [x] **PR #1145** — Release scripts aligned with CI flags + stale PKG-01 warning removed. *(merged 2026-05-31)*\n- [x] **PR #1146** — Proposal create returns 409 (not 500) on duplicate idempotency key. *(merged 2026-05-31, closes #1125)*\n- [x] **PR #1147** — `AsSplitQuery` on the multi-collection board read. *(merged 2026-05-31)*\n- [x] **#1126** — Un-skip INV-10/11/12 roadmap-invariant tests with real service assertions. *(PR #1153, merged 2026-05-31)*\n- [x] **#1134** (first slice) — Surface swallowed audit-log failures via shared `AuditLogWriter`. *(PR #1155, merged 2026-05-31)*\n\n## B. Next easy wins (seeded, not yet started)\n\n- [ ] **#1133** (rest) — Bound `NotificationRepository` paging (push ORDER BY+LIMIT to SQL), incremental SignalR board patch instead of full 3-call refetch, FTS-backed card search.\n\n## B2. Surfaced by post-audit correctness sweep (2026-05-31)\n\n- [ ] **Cohort metrics stub** — `AutomationMetricsController.GetCohortMetrics` returns empty data; `CohortDashboard` frontend is wired but always shows \"No cohort data available.\" *How:* build `ICohortMetricsService` with real cohort aggregation once learning-loop data layer design is decided. Tracked in #1142.\n- [ ] **Ollama real streaming** — `OllamaLlmProvider.StreamAsync` does pseudo-streaming (complete-then-drip-by-word). *How:* consume Ollama's `stream:true` API for genuine token streaming when Ollama provider goes beyond prototype.\n- [ ] **#1134 remaining acceptance criteria** — first slice (AuditLogWriter) shipped; 6 remaining criteria still open on the issue.\n\n## C. Strategic / larger tracks (seeded under tracker #1142)\n\n- [ ] **#1123** — v0.1.0 release: a **required revival Phase-1 ship-gate item** under ADR-0044/REVIVAL-07. Exercise the release pipeline, smoke-run the self-contained exe, publish the GHCR image, and fix the documented release-path breakage before strangers are invited. The release smoke step already landed in `release-desktop.yml`. *(Optional-archive framing from 2026-06-13 is superseded.)*\n- [ ] **#1132** — Make the required PR gate enforce security: gitleaks/SAST/dependency scan + CORS fail-closed + single ≥32 JWT floor + global `FallbackPolicy` + bundle-size in the required lane.\n- [x] **#1130** — SQLite local concurrency: enable WAL + `busy_timeout`, fix per-process `Migrate()` race (UI + MCP + CLI share one DB → `SQLITE_BUSY`). *(closed 2026-06-05; ACs 1+3 shipped in PR #1165 / da764b92. AC2 cross-process `Migrate()` serialization → #1164; export/import redesign → #1166.)*\n- [ ] **#1131** — CLI hardening: fresh-machine bootstrap (it crashes without `Connectors:EncryptionKey`) + route CLI mutations through board-access authorization.\n- [x] **#1124** — Core-loop polish: false-green expiry regression test (now asserts a real 409) + #678 dismiss gap (Approved+expired) + #680 provenance-404 console noise. *(closed 2026-06-05; all three fixed in PR #1162 / 77162b2d. Paper-view dismiss affordance → #1161.)*\n- [x] **#1161** — Paper review dismiss affordance (carries #1124's Paper remainder; maintainer 2026-06-05: take it, design-first — propose the affordance before building). *(Maintainer check-off 2026-06-19; delivered via PR #1219, **merged 2026-06-19**; issue #1161 closed.)*\n- [x] **#1164** — Serialize cross-process `Database.Migrate()` (advisory/single-owner lock; carries #1130 AC2). *(Maintainer check-off 2026-06-19; closed on GitHub via PR #1186 / SerializedMigrator.)*\n- [ ] **#1166** — Harden dev-sandbox export/import via the SQLite backup API (carries #1130's export/import follow-up).\n- [ ] **#1138** (rest) — Split the 1300+ line `STATUS.md` into a lean current-reality head + `docs/archive/status-history/`; add a rotation rule; recertify TESTING_GUIDE totals from a green CI run; add a markdown link-checker to nightly.\n- [ ] **#1136** (remainder) — ADR decision **delivered** (ADR-0038, Paper canonical / Legacy frozen; STATUS states the canonical stack) via PR #1207. **Still open:** remove/quarantine the dead paper composables (AC3) — scheduled for the Paper polish wave.\n- [ ] **#1137** — Refocus strategy/roadmap. ADR-0044 + `docs/REVIVAL_PLAN.md` now provide the revival direction and finite wave; pending maintainer check-off after the canonical-doc sync is merged. The 2026-06-13 archive framing is retained only as the checkpoint fallback.\n- [ ] **#1135 / #1140 / #1141 / #1139** — Code-health guardrails + oversized-view decomposition; workspace hygiene + one-command dev-up; i18n/a11y ADR; deployment docs (docker quickstart secret, desktop run docs). *(2026-06-19: **#1135 partial** — paper-night straggler tokens (PR #1216) — checked off by maintainer; guardrail/decomposition half + #1140/#1141/#1139 remain open.)*\n\n> Full audit context and the complete gap inventory: **GitHub issue #1142** (master tracker).\n\n## F. Generalist expansion wave (2026-07-13, ADR-0046 Proposed — extends §E as REVIVAL_PLAN Phase 4)\n\nDecision under ratification: **extend the single app** (artefact intake beyond transcripts, project dossiers, generalist legibility, friends-family channel); the twin generalist app is **deferred behind the GEN-12 evidence gate**, not built. Wave label `generalist`; strictly subordinate to the v0.1 ship gate.\n\n- [ ] **GEN-00 tracker (#1327)** — ratify ADR-0046 + Phase-4 placement + the tracker's decision checklist (SQLite blob storage, consent-gated vision MVP, twin-app deferral). Child issues: #1315–#1326 (GEN-01..12).\n- [ ] **Maintainer at checkpoint:** review GEN-12 (#1326) twin-app gate against friends-family signal (GEN-11 #1325) — recorded decision required, silence is not a close.\n\n## E. Revival wave (2026-07-10 pivot, ADR-0044 — supersedes the archive framing of §D)\n\nDirection: **free open beta → commercial horizon** (`docs/REVIVAL_PLAN.md` is the planning spine; `docs/analysis/2026-07-10_revival_assessment.md` is the evidence base). §D items are re-scoped in place — same work, new purpose (v0.1 ship gate instead of archive gate). Issue IDs below are seeded as the REVIVAL wave; see the tracker for the authoritative list.\n\n- [ ] **REVIVAL-00 tracker (#1311)** — charter + v0.1 ship-gate ratification (amends #1278); wave sequencing. Child issues: #1297–#1310 (REVIVAL-01..14); docs PR: #1296.\n- [ ] **Phase 0 — dogfooding starts now** (#1271, unchanged): real personal use including WhisperX transcripts through the existing transcript capture tab.\n- [ ] **Phase 1 — truth + safety before strangers**: registration gating flag; remove the fake undo timeline; de-stub Today dossier (#1272); Paper fonts + favicon; Paper onboarding/first-board path; README revival rewrite + demo GIF + MCP section; v0.1.0 tag → exercise release pipeline → GHCR image; fix render.yaml; branch protection (#1173); CI keep/kill (#1275); Paper E2E/axe re-point (#1274).\n- [ ] **Phase 2 — transcript engine** (authorized new-surface exception): LLM triage strategy behind `ICaptureTriageService` for transcript sources; chunking + cap raise; triage schema v2 (type/assignee/due + model-derived confidence); Transcript entity + evidence spans; OpenAICompatible provider + true SSE streaming; risk-tiered review prioritization and batch-confirm ergonomics (**never auto-apply or bypass ADR-0003's approve-then-execute gate**); (2b, gated on dogfooding value) audio upload + WhisperX sidecar.\n- [ ] **Phase 3 — slim + launch**: dead-surface amputation (#1276 expanded); MCP packaging + scoped keys + hash-pin wiring (#1154) + explicit multi-user-safe stdio identity (#1309); privacy-respecting beta feedback channel; launch checklist (r/selfhosted, Show HN, awesome-selfhosted, hosted demo).\n- [ ] **Checkpoint (~8 weeks)**: fall back to the §D archive plan only if there is no organic traction **and** dogfooding has not stuck; any mixed outcome requires an explicit maintainer assessment/plan amendment.\n\n## D. Historical archive closeout wave — re-scoped by ADR-0044\n\nAnalysis docs: `docs/PROJECT_TRAJECTORY.md` (strengths + path) and `docs/COURSE_CORRECTION.md` (what must change + ordered plan). These issue titles retain their ARCHIVE-* history, but **nothing in this section independently authorizes archival**: ADR-0044 re-scopes the still-useful work into the revival ship gate and keeps archive only as the checkpoint fallback. Wave source: **#1278** (originally ARCHIVE-00; amended by REVIVAL-00/#1311).\n\n- [ ] **#1278** — originally ARCHIVE-00; now the **v0.1 ship-gate source** amended by REVIVAL-00/#1311: ratify the repurposed exit criteria and revival additions, then use archive only if ADR-0044's checkpoint condition is met. *(Maintainer decision.)*\n- [ ] **#1269** — ARCHIVE-01: codify the two-tier review gate (LIGHT/FULL), issue-intake severity bar, no-new-backend-surface rule.\n- [ ] **#1270** — ARCHIVE-02: backlog triage hour — close ~16 already-decided issues with dated pivot notes. *(Maintainer sign-off on the list.)*\n- [ ] **#1271** — ARCHIVE-03: dogfooding sprint — ≥10 days of real personal use (the pivot's acceptance test; cannot be delegated).\n- [ ] **#1272** — ARCHIVE-04: Today dossier truth — de-stub the fabricated default daily surface (`useTodayDossier.ts` buildStubDossier).\n- [x] **#1273** — capture-triage provenance names the deterministic extractor, delivered by #1283; the v0.1 ship-gate item is done. *(Checked off 2026-07-25 on the maintainer's explicit instruction — see the rule-3 note in the changelog. GitHub issue #1273 was already closed 2026-07-03.)*\n- [ ] **#1274** — ARCHIVE-06: re-point E2E + axe coverage at the Paper UI (currently the least-tested UI).\n- [ ] **#1275** — ARCHIVE-07: CI estate right-sizing — keep/kill/gate per lane + short ADR (nightly red 28 days; mutation red 10+ weeks).\n- [ ] **#1276** — ARCHIVE-08: dead-surface removal — ink-bleed decision, orphaned Paper code, cohorts stub, voice capture, Ollama marking.\n- [ ] **#1277** — originally ARCHIVE-09; now the revival checkpoint/fallback record. Beta-facing README, release tag, and ship-gate checks live in REVIVAL-06/07/14; archive-only edits wait unless ADR-0044's checkpoint condition is met.\n- [x] **#1235** — revision-aware proposal diff (preview equals what Apply executes) was delivered by #1280 with regression coverage; the v0.1 ship-gate item is done. *(Checked off 2026-07-25 on the maintainer's explicit instruction — see the rule-3 note in the changelog. GitHub issue #1235 was already closed 2026-07-03.)*\n- [ ] **#1291** — Adopt agent-harness T3 profile: one-home policy collapse, .codex mirror retirement, skill read-first diet, region maps, review-twin merge, ledger triage cadence. *(Blueprint: sibling checkout `C:/Users/jekyt/source/agent-harness/BLUEPRINT.md` — outside this repo; complements #1138/#1269/#1275/#1276, no duplication.)*\n- *(Record, already done 2026-07-02:)* re-scope comments posted on #996, #1123/#1139, #1128, #1134 (+#1154 decision), #1135, #1138, #1173, #1175 (+#1174), #1210, #1215, #1222 (+#1227), #1228 — each carries updated finish-or-close ACs.\n\n## E. Revival overnight deferrals (added 2026-07-13)\n\n- [ ] **#1173** — Apply and verify the required branch-protection settings in GitHub. This is repository-settings work and remains maintainer-only.\n- [ ] **#1303** — Push the `v0.1.0` release tag only after the maintainer accepts the release deck and its pipeline evidence. Agents may repair the pipeline but must not push the tag.\n- [ ] **#1482 — Taskdeck name, pre-commercial legal residuals.** *(Supersedes the old \"#1299 trademark check\" line: #1299 shipped with PR #1337 on 2026-07-25 and its AC4 search + cost + recommendation are recorded on the issue.)* What remains is genuinely legal and none of it blocks the free beta: an **attorney registrability opinion** for Classes 9/42 asking about *descriptiveness* (not just conflict), a read on **TASKADE** (live, incontestable US Cl. 42 mark covering task management), the UKIPO/EUIPO coverage gaps (UKIPO hard-blocked automated access, so all GB data is indirect), perishable namespace reservations, and the **keep-or-rename decision before `v0.1.0` (#1303)** — renaming is nearly free pre-tag and expensive after.\n- [ ] **#1327 project sync access** — Run `gh auth refresh -s project`, then rerun `scripts/github/Sync-TaskdeckProjectPriority.ps1` in audit and apply modes and verify no issue/PR project item has an empty Priority.\n- [ ] **#1330** — Repair the CI Extended reusable-workflow permission contract; affected PRs remain ineligible while the workflow startup failure is red.\n- [ ] **#1282 / #1332 / #1335** — Stabilize the required full-suite harness: SQLite concurrency, Redis connect/dispose, and hosted-worker/presence lifecycle isolation. Narrow passes do not clear the recorded full-suite failures.\n- [ ] **#1338** — Map HTTP MCP and its API-key middleware to the same `/mcp` route before documenting or exposing HTTP transport; the current parameterless mapping serves MCP at an unintended unauthenticated root route.\n- [ ] **#1343** — Prevent late Home/Today summary responses from overwriting a newer local workspace-mode choice; add deterministic ordering tests and repeated error-recovery E2E proof.\n- [ ] **#1345 maintainer record check-off** — The code now centrally pins the matched SQLitePCLRaw 2.1.12 family, loads SQLite 3.53.3, enforces the advisory's >= 3.50.2 runtime floor, clears the solution vulnerability audit, preserves the EF model, and passes a self-contained `win-x64` health smoke. The implementation is complete; this checkbox remains human-owned.\n- [ ] **#1274 / `origin/issue-1274/paper-e2e-axe` at `993f188f`** — Resume the parked Paper E2E/axe re-point from the pushed WIP branch; fix tracked Paper Review blockers #1347/#1348, finish the named first-run/onboarding/smoke and axe coverage, then run the full frontend/E2E gates before opening a PR.\n- [ ] **#1347 / #1348** — Repair the Paper deep-review enum wire-contract crash and the SQLite-backed similar-past HTTP 500; both were reproduced by the real Paper capture/review path and must not be hidden by frontend fallbacks.\n- [ ] **#1323 prompt-rail remainder** — Bind the hostile transcript/PDF/image and malformed-response fixtures from PR #1340 to PR #1312's effective prompt/parser path before GEN-04; prove grounded-task-or-empty verdicts and deterministic fallback for schema escapes.\n- [ ] **#1456 / PR #1457 — Codex deny-floor adapter T4 gate.** Stages a security boundary and does not self-ratify: merging needs the maintainer to trust the project hook in a **fresh interactive Codex `/hooks` session** and to record live allow/deny canaries. No agent can perform or substitute for that. **Step-by-step instructions are posted on the PR** (2026-07-25), including the exact canary commands and what a failure looks like. *(Its pinned dispatcher hash was stale — v1.5.2 vs the installed 1.6.5 — and has been refreshed; verify it is still current before the trust session, since the floor shipped twice in one day. The other two standing holds are resolved: #1295 closed as superseded, #1337 merged.)*\n- [ ] **Prune the merged agent worktrees.** `git worktree remove` is blocked by the deny floor, so this is human-only and recurs after every wave (upstream: [agent-harness#41](https://github.com/Chris0Jeky/agent-harness/issues/41)). *(Added 2026-07-25.)*\n\n ```bash\n cd /c/Users/jekyt/source/Taskdeck\n git worktree remove .worktrees/claude-model-routing-canon # docs/model-routing-canonical-pointer\n git worktree remove .worktrees/claude-sweep-0725 # docs/sweep-2026-07-25\n git worktree remove .worktrees/codex-1299-licensing-pack # issue-1299/licensing-pack — merged as PR #1337\n git branch -d docs/model-routing-canonical-pointer docs/sweep-2026-07-25 issue-1299/licensing-pack\n ```\n\n All three are clean and fully merged into `main`. **Keep** `.worktrees/codex-1456-codex-deny-floor-adapter` — PR #1457 is still open and its trust session runs from there.\n- [ ] **Branch from an explicit base.** PR #1477 was closed-as-merged without anyone merging it. Root cause: `feat/1271-dogfooding-instrumentation` (PR #1478) was created with a bare `git checkout -b` **while standing on `fix/1123-release-dry-run`**, so it silently inherited `#1477`'s commit `0ebbf330`. Merging #1478 carried that commit onto `main`, GitHub detected `#1477`'s branch as fully merged and auto-closed it two seconds later, attributing the event to the acting token. The single-parent \"rebase\" appearance was GitHub recording the already-landed commit, not a rebase anyone performed. *How:* always name the base — `git checkout -b main` — and verify with `git log --oneline main..` before pushing. *(Added 2026-07-25. Supersedes an earlier item on this list that wrongly framed this as an unidentified autonomous merger — that alert was mine and it was wrong; caught by Codex on PR #1483.)*\n\n---\n\n## Changelog\n- 2026-07-25 (latest): **PR queue cleared — 8 PRs merged, 1 draft left.** `#1469` (`#1462` frontend pin), `#1471`, `#1472`, `#1477`+`#1481` (`#1123` release rehearsal), `#1478` (`#1271` dogfooding instrumentation), `#1479`, and `#1337` (`#1299` licensing pack — **`#1299` closed by that merge**, residuals → `#1482`). `#1295` **closed as superseded**, with the salvage plan and acceptance criteria recorded on `#1293`. Only `#1457` remains, and its step-by-step human procedure is now on the PR. Repo hardening: force-push and deletion blocked on `main`; 288 truncation-hidden project-priority mismatches synced. Under `#1270`, 12 already-decided issues closed with dated notes — but **`#1270` stays open**, because two of its own acceptance criteria are obsolete against ADR-0044 and REVIVAL_PLAN §6 and must not be run as written. Seeded `#1470` `#1473` `#1474` `#1475` `#1476` `#1480` `#1482` and upstream `agent-harness#56`. Dogfooding baseline measured for the first time and recorded in `docs/dogfooding/LOG.md`: **sustained use has not started**, though the core loop works (17/20 proposals reached Apply). No item below was checked off in this pass.\n- 2026-07-25 (later): **#1273 and #1235 checked off — rule-3 exception, on the maintainer's explicit instruction.** During a guided walkthrough the maintainer reviewed both record-only items and said \"please tick them yourself\". Recorded here because rule 3 reserves check-offs to the maintainer, so the authorization — not the agent's judgement — is what permits these two. Both were delivered long ago (#1273 by #1283, #1235 by #1280 with regression coverage) and **both GitHub issues were already closed on 2026-07-03**; only the checkboxes lagged. No other item was touched, and rule 3 continues to apply to every remaining `[ ]`.\n- 2026-07-25: **Two human-only items added to §E** (no items checked off — rule 3). PR `#1469` closed `#1462` (frontend `approvedRevisionId`, now declared *required*) and the follow-up sweep `#1471` re-hydrated the canonical docs; both merged with green CI. Of the four open PRs, only `#1469` was agent-actionable — `#1295`, `#1337`, and `#1457` are all human-gated, and `#1457`'s `/hooks` trust gate plus the recurring merged-worktree pruning were the two that no file tracked, so they are recorded above. Seeded `#1470` (`DATA_MODEL.md` omits `ApprovedRevisionId`/`DeferredUntil`; stale snapshot figure). Correction on the record: `#1469`'s review comment reported 383 pre-existing spec typecheck errors for `#1468`; the figure by the documented method is **415**, and `#1468`, `#1470`, `#1469` and both canonical docs were corrected.\n- 2026-07-13 (later): **Revival + generalist-expansion wave SHIPPED — 15 PRs merged to `main`** under the maintainer's ratify-and-merge directive. **ADR-0044 / ADR-0045 / ADR-0046 all ratified to Accepted.** Merged: direction docs `#1296` (revival) + `#1328` (generalist); transcript engine `#1312` (REVIVAL-08 M1); GEN wave `#1341`→`#1346` (artefact storage + local text extraction), `#1339` (due-date/label apply — also fixed a latent silent WIP-limit-clear on reorder), `#1340` (threat model), `#1342` (guided nav); REVIVAL wave `#1334`→`#1344` (registration gating + Paper onboarding), `#1329` (fonts), `#1331` (README), `#1333` (Today dossier `#1272`); harness `#1294`; ops `#1336` (overnight human-action + failure-ledger record, `#1327`). Linchpin `#1352` (CI-Extended reusable-workflow permission fix, `#1330`) + dependabot `#1351`/`#1349` were merged first by the maintainer to unblock the deck. Real merge conflicts resolved (workspaceStore latest-request guard, AGENT_INDEX seam-map union, EF migration-snapshot verified clean via `has-pending-model-changes`). Seeded `#1355` (buffered-export blob batching, LOW). **NOT merged — human-gated (still open):** `#1295` (deny-floor overlay — 16 unresolved review threads incl. a CRITICAL, needs remediation) and `#1337` (licensing pack — blocked on trademark clearance). `docs/STATUS.md` + `IMPLEMENTATION_MASTERPLAN.md` synced. Items above are left unchecked pending maintainer sign-off (rule 3), even where a related PR shipped (e.g. `#1272` via `#1333`).\n- 2026-07-13: **Generalist expansion wave seeded (ADR-0046 Proposed).** Maintainer evaluated the artefact-intake research handoff + his twin-generalist-app idea; decision (pending ratification): extend the single app, defer the twin behind an evidence gate. Seeded GEN-00..12 (#1315–#1327, label `generalist`) as REVIVAL_PLAN Phase 4 (\"Every Artefact, Everyone\", v0.4); coordination comments posted on #1304 (dueDateHint apply gap → GEN-05) and #1305 (artefact/Transcript one-home constraint). Added §F above. Capability recon findings: no artefact/blob model exists; inert drop zone already shipped in PaperCaptureComposer; no operation applies due dates; prompt injection undefended beyond schema+review gate; guided/workbench/agent mode scaffold ready for generalist nav.\n- 2026-07-10: **Revival pivot decided (ADR-0044) — archive pivot superseded.** Maintainer decision after the WhisperX prototype + two-track revival analysis (`docs/analysis/2026-07-10_revival_assessment.md`). Direction: free open beta (adoption/feedback/exposure) → commercial horizon; positioning: local-first review-first action-item engine + write-gated MCP gateway; MIT stays MIT. Added §E (revival wave); §D items re-scoped in place as the v0.1 ship gate. Planning spine: `docs/REVIVAL_PLAN.md`. Seeded the REVIVAL issue wave on GitHub.\n- 2026-07-06: **Agent-harness blueprint adopted (step 1).** Estate-wide tiered blueprint landed at `source/agent-harness/`; Taskdeck declared T3 (`.claude/tier.json`). Footgun PR opened: committed `bypassPermissions` → settings.local.json, history-rewriter script fenced human-only. Remaining T3 diet seeded as #1291 (added to §D). Global layer shipped: `~/.claude/CLAUDE.md` laws, argv-aware deny floor (49-case tested), ESTATE.md registry, `~/.claude` now versioned (private repo claude-config).\n- 2026-07-02: **Whole-project analysis delivered + archive closeout wave seeded.** Multi-agent analysis (6 dimensions, 15 claims adversarially verified: 5 confirmed / 10 adjusted / 0 refuted) produced `docs/PROJECT_TRAJECTORY.md` + `docs/COURSE_CORRECTION.md`. Seeded issues #1269–#1278 (ARCHIVE-00..09, new `archive-closeout` label) and posted re-scope comments on 14 existing issues. Added §D above. Central findings: no checkable definition of done existed in the tracked repo; zero organic personal-usage data; the default Paper UI is the least-tested UI; the \"canonical\" exe run path has never been built; ~31% of open issues already decided-closed by the pivot but still open.\n- 2026-06-19 (later): **Merge hold lifted — deck merged.** The maintainer lifted the hold and all four PRs shipped to `main`: **#1220** (canonical-docs reconciliation; 14 Codex rounds + 3 drift sweeps), **#1219** (Paper File-away dismiss, closes #1161), **#1221** (reachable in-app Appearance theme toggle — a Paper-activation prerequisite), **#1225** (StackExchange.Redis + SignalR-backplane semver-major caps). Post-merge STATUS/masterplan sync in PR #1233. Seeded during this work: #1226 (net8.0 upgrade), #1227 (dated-snapshot staleness), #1228 (cd-staging-gate auto-trigger), + the #1195 GDPR caller-audit. Next: the Paper-review de-stubs (last Wave-2 blocker before the default-theme flip) — `onPreviewDiff` in PR #1234.\n- 2026-06-19: **Maintainer check-offs confirmed** — **#1161** (Paper File-away dismiss, PR #1219), **#1164** (cross-process Migrate, PR #1186), **#1189** (Redis lock starvation, PR #1213), **#1198** (dead `ProposalGeneratorV1` removed, PR #1214), and **#1135 partial** (paper-night straggler tokens, PR #1216) marked done. Also: PR #1223 (npm group) merged; PR #1224 (nuget) closed (framework-major bumps rejected per ADR-0039 net8.0 pin); PR #1225 opened (StackExchange.Redis major cap). PRs #1219/#1220/#1221 fully reviewed + green + aged but **merges held by maintainer**. Maintainer decision: revisit net8.0 framework-major upgrade later (issue seeded). ADR-0004 stays \"Accepted\" with the never-implemented note (TenantId never built; isolation is per-UserId/board-access).\n- 2026-06-13: **Archive-pivot wave (Waves 0–2) merged — 17 PRs** (see STATUS.md \"Archive-pivot delivery wave\"). Direction is now **finish-for-personal-use → archive** (supersedes ship-first); distribution tracks (#1167 code-signing, #544/#546/#550 GTM, #537/#548 cloud, #540 mobile) are de-scoped and will be closed not-planned in archive closeout. **Maintainer check-off pending** for items this wave appears to deliver: **#1140** (dev-up + clean-workspace scripts, PR #1208), **#1139** AC1 (compose-secret quickstart docs, PR #1205), **#1135** partial (paper-night straggler tokens, PR #1216 — guardrail/decomposition half still open), **#1189** (Redis lock starvation, PR #1213), **#1198** (dead `ProposalGeneratorV1` removed, PR #1214 — follow-up #1215 seeded). Not auto-checked per rule 3. **#1161** (Paper \"File away\" dismiss) built on the #1217 shared-actionability foundation and is in review as PR #1219 (awaiting CI/aging). New issues seeded: #1209, #1215, #1218.\n- 2026-06-05: Maintainer directive — **ship-first**: prioritise the v0.1.0 release-blockers (#1123, #1131, #1132) ahead of #1154 (deferred). Closed #1124 and #1130 as substantially delivered (PRs #1162/#1165); remainders carried by #1161/#1164/#1166. Merge autonomy retained (full adversarial-review + green-CI + aging gate). #1161 to be taken design-first.\n- 2026-05-31 (post-audit): Checked off §A (PRs #1143–#1147 confirmed merged), §B #1126/#1134-first-slice (PRs #1153/#1155 merged). Added §B2 with correctness-sweep findings (cohort stub, Ollama pseudo-streaming, #1134 remaining). Correctness sweep: 31 PRs audited, 0 corruption, 2 issues + 9 nitpicks fixed.\n- 2026-05-31: File created. Seeded from the 2026-05-31 deep audit (tracker #1142). #972 (RFAI tracker) closed; PR #1122 merged; PRs #1143–#1147 opened.\n\n--- docs/STATUS.md ---\n# Taskdeck Status (Source of Truth)\n\nLast Updated: 2026-07-26\n\nPaper-default regression alignment (2026-07-14, `#1274`): authenticated E2E sessions now follow the production Paper default unless a frozen Legacy-selector suite opts out explicitly. The refreshed core lane proves the real capture → Accept → Review → approve/apply → board path and runs the full axe WCAG 2.1 A/AA ruleset against settled Paper Home, Today, Inbox, Review, and a seeded Board, plus Login and functional skip-link keyboard coverage. The global Vitest Legacy pin remains intentional because those component tests assert the frozen Legacy DOM directly. Focused Chromium verification is 37/37 across `accessibility`, `onboarding`, `capture-loop`, `review-proposals`, `first-run`, and `smoke`.\n\nDirection change (2026-07-10, maintainer-decided, **ADR-0044**): **the 2026-06-13 archive pivot is superseded — Taskdeck is being revived** and shipped as a **free open beta** (adoption/feedback/exposure first; the commercial side is developed in parallel by the maintainer). Positioning: the local-first, review-first **action-item engine** — transcripts/notes in, evidence-linked proposals out, applied to a board only on human approval — with the write-gated MCP server as the developer-facing second act. Everything shipped under MIT stays MIT (no retroactive relicensing). The active planning spine is **`docs/REVIVAL_PLAN.md`** (Phase 1 \"truth + safety before strangers\" repurposes the #1278 archive exit criteria as the v0.1 ship gate; Phase 2 is the LLM transcript-triage engine — the largest authorized new-backend-surface slice; Phase 3 is the beta launch; other scoped exceptions include registration gating, feedback/telemetry, and MCP key/identity hardening as enumerated in §7; then a ~8-week traction checkpoint with the archive plan as the documented fallback). New backend surface is authorized only by REVIVAL_PLAN §7 — the Phase-2 transcript-engine grants (ADR-0044) plus the Phase-4 generalist-expansion grants (**ADR-0046, Accepted 2026-07-13**: artefact intake, dossier read model, mode-scoped navigation; tracker `#1327`; the twin generalist app is explicitly deferred behind the GEN-12 `#1326` evidence gate). Evidence base: `docs/analysis/2026-07-10_revival_assessment.md` (7 code-review dimensions, ~25 adversarially verified claims, live-verified market data). Archive-closeout issues #1269–#1278 are re-scoped in place (same work, new purpose); dogfooding (#1271) remains the acceptance test for either path. **Dogfooding is now instrumented (2026-07-25):** `docs/dogfooding/README.md` holds the protocol — a dedicated `TASKDECK_DOGFOOD_DB` so dev/demo/E2E traffic cannot contaminate the signal, `scripts/dogfooding/dogfood-snapshot.py` (read-only; counts and dates only) for objective metrics, `docs/dogfooding/LOG.md` for friction, and a checkpoint rubric fixed before any real usage data existed. Read it before collecting checkpoint evidence, or the evidence will not be comparable. The measured pre-dogfooding baseline is recorded in `LOG.md`: **8 active days, none in the last 28, last activity 2026-04-23, 10 of 13 boards demo/test residue** — sustained use has not started, though the loop itself works (**17 of 20 proposals reached Apply**, counted by `AppliedAt`; a status-based count reads 1/20 because `Dismiss()` overwrites an `Applied` status).\n\n\nSecurity runway slice (2026-07-26, `#1345`):\n- **The inherited HIGH SQLite native advisory is remediated without bypassing Central Package Management.** `Taskdeck.Infrastructure` now directly references the centrally pinned `SQLitePCLRaw.bundle_e_sqlite3` 2.1.12, so bundle, core, provider, and native library resolve as one 2.1.12 family instead of mixing a new native leaf with 2.1.6 managed components. The loaded SQLite runtime is 3.53.3, above the advisory's 3.50.2 security floor; a host-native integration test opens an in-memory database and enforces that floor. The solution vulnerability audit is clean, a fresh database update reports no pending model changes, and a self-contained `win-x64` published API booted against SQLite and returned `/health/ready` HTTP 200.\n\nPR-queue clearing wave (2026-07-25, **8 PRs merged**, and the open-PR queue is down to one human-gated draft):\n- **`#1469` (`#1462`) — the frontend `Proposal` type exposes `approvedRevisionId`,** declared **required** rather than optional because `MapToDto` always assigns it and the API serializes with default options, so an unpinned proposal arrives as an explicit `null` and never an absent key — which also turns a field-by-field rebuild that drops the pin into a compile error. Contract exposure only; no UI claim, per `#1298`. Held against a dead-code sweep by an exported type alias, because `tsconfig.app.json` excludes `src/tests/**` from typecheck (`#1468`, measured at **415** pre-existing errors when the exclusion is lifted).\n- **`#1337` (`#1299`) — the permanent licensing posture is published.** `LICENSING.md` states the MIT-forever commitment for everything already shipped, the never-gated free boundary, and an additive-only posture for any future commercial module; `ee/` is reserved with a separately-licensed placeholder; DCO sign-offs are required in contributor guidance behind a SHA-pinned advisory CI job; MIT is declared in npm and all 11 `.csproj` files. The root `LICENSE` is deliberately unchanged. Name/trademark availability was researched and recorded on `#1299` (**no registered TASKDECK mark found in any register that could be queried** — USPTO, TMview and WIPO, each null result control-validated against a known-hit term; UKIPO's own register hard-blocked automated access, so GB coverage is indirect via TMview, which EUIPO states is not an official register. The real risk is **registrability**, not collision). Pre-commercial legal residuals — attorney registrability/TASKADE opinion, the UKIPO/EUIPO coverage gaps, perishable namespace reservations, and the keep-or-rename decision before `v0.1.0` — are tracked as **`#1482`**.\n- **`#1477` + `#1481` (`#1123`) — the release pipeline is rehearsable without pushing a tag.** `create-release` had no condition and a bare `workflow_dispatch` resolved the version to the literal `refs/heads/main`, whose slashes broke packaging — so the pipeline could not be exercised at all before the one irreversible action `#1303` reserves to the maintainer. A blank-tag dispatch from a **branch** is now an explicit rehearsal (`v0.0.0-dryrun+`, builds, smoke-tests, uploads artifacts, publishes nothing); a tag push, a dispatch naming a tag, **or a dispatch whose ref is itself a tag** publishes. Rehearsed for real: all four platforms green, `create-release` skipped, **0 tags and 0 releases created**. Note the smoke test covers the **three runner-native RIDs** only — `osx-x64` is cross-arch on the arm64 macOS runner and ships with less release evidence than the other three.\n- **`#1478` (`#1271`) — dogfooding is instrumented.** A dedicated `TASKDECK_DOGFOOD_DB` so dev/demo/E2E traffic cannot contaminate the signal, a read-only snapshot script (counts and dates only; safe to paste into an issue), a friction log, and a checkpoint rubric fixed before any real usage data existed. **The measured pre-dogfooding baseline is the finding:** 8 active days, none in the last 28, last activity 2026-04-23, 10 of 13 boards demo/test residue — sustained use has not started. But the loop itself works: **17 of 20 proposals reached Apply**, counted by `AppliedAt`. A status-based count reads 1/20, because `Dismiss()` accepts an already-`Applied` proposal and overwrites `Status` — so filing away a finished item erases the evidence it applied. Seven adversarial review rounds; residual activity-source accuracy questions consolidated on **`#1480`**.\n- **`#1471`, `#1472`, `#1479` — canonical-doc and human-action hygiene:** the `#1462` residual list reconciled across both canonical docs (and a wrong measurement of my own corrected, 383 → **415**); `#1457`'s `/hooks` trust gate and the recurring merged-worktree prune recorded as human-only items, which no file previously tracked; `#1273`/`#1235` checked off on explicit maintainer instruction (a recorded rule-3 exception).\n- **`#1295` CLOSED as superseded, not merged.** The deny-floor overlay failed **13 of 13 of its own bypass tests** and targeted global floor v1.3.0 against an installed 1.6.5. A repo-local overlay is still needed — **11 rule-classes are `allow` at every tier including T4** — so the full salvage plan, with acceptance criteria and the branch's 16 review threads retained as the successor's regression corpus, is recorded on **`#1293`**.\n- **Repository hardening:** `main` previously permitted **force-pushes and deletions**; both are now blocked (deliberately relaxed otherwise — no required checks, no required approvals). The GitHub project priority sync was reporting a false all-clear because its default `-Limit 1000` silently truncated a 1444-item project; **288 items** were actually unsynced and are now clean (`#1474`).\n- **Backlog triage (`#1270`):** 12 already-decided issues closed with dated pivot notes, after an adversarial pass **bounced 13 of 25 proposed closures** — including `#1123`, the v0.1 ship-gate item. `#1270` itself stays open: two of its own acceptance criteria are obsolete against ADR-0044 and REVIVAL_PLAN §6 and must not be executed as written.\n- **Seeded this wave:** `#1470`, `#1473`, `#1474`, `#1475` (the repo hook denies 6 of 8 *benign* commands), `#1476` (`scripts/agent_hooks/` has **zero** CI coverage), `#1480`, `#1482`, plus upstream `agent-harness#56` (`docker exec` is not unwrapped by the global floor at any tier).\n- **Still open — human-gated:** `#1457` only. Its pinned dispatcher hash was stale (v1.5.2 vs installed 1.6.5) and has been refreshed; what remains is a fresh interactive Codex `/hooks` trust session plus recorded live allow/deny canaries, which no agent can perform.\n\nOvernight wave (2026-07-23/24, **6 PRs merged** + 3 dependabot PRs — the four feature/substrate PRs below plus `#1447`, the docs sync that recorded the maintainer-merged `#1414` (its content is the 2026-07-18 post-merge comment further down), and `#1448` below; per-PR gate: two independent adversarial review lenses, all-severity findings fixed with posted evidence, full backend suite on the exact head where code changed, required CI green, bot window honored with a content sweep). The wave's own delivery sweep was `#1454`; `#1448`, `#1427`, and dependabot `#1441` merged *after* that sweep ran, so their entries below were added on 2026-07-25:\n- **`#1439` (`#1428`, `#1424`) — the approved revision is pinned at approve time and Apply executes exactly it.** Approve reads the latest saved revision, validates it through the approve-time gates, and persists its id as `AutomationProposal.ApprovedRevisionId` (null pin = approved the original operations; a post-approval raced revision can no longer change what Apply executes — closes the `#1428` race). The migration backfills Approved proposals to their latest revision saved **at or before `DecidedAt`** (an explicit, reviewed reversal of latest-revision parity: the invariant is \"Apply executes exactly what the approver saw\", so a raced post-decision revision is never backfilled; empirically-proven SQLite text-format comparison). Single-proposal read/decide paths return the EFFECTIVE operation set with `Presentation` rebuilt from it (`#1424`); Rejected proposals freeze to the latest revision saved at or before decision time; the MCP terminal stored preview is suppressed whenever an effective revision applies (one payload can no longer carry revision operations beside an original-operations `DiffPreview`). Full suite on head: 7430/0/1. **`#1444` closed this residual:** the review-queue **list** endpoint now returns the same EFFECTIVE operations and rebuilt `Presentation` the single reads do, so a queue card can no longer disagree with the detail view, the diff and Apply. The former \"list maps originals\" boundary existed only to avoid a per-proposal revision query; a two-phase batched read (payload-free metadata for the page, then payloads for the winning revisions only) removes that cost without loading revision payloads the reader will not use, and both read shapes now select through one shared dispatcher. **`#1462` closed the frontend half** (PR `#1469`, merged 2026-07-25): the `Proposal` type in `types/automation.ts` now exposes `approvedRevisionId` (contract only — no UI claim, per `#1298`), declared **required rather than optional** because `MapToDto` always assigns it and the API serializes with default options (bare `AddControllers()`, no `DefaultIgnoreCondition`), so an unpinned proposal arrives as an explicit `null` and never an absent key — which also turns a field-by-field rebuild that drops the pin into a compile error. It is held against a dead-code sweep by an exported type alias because `tsconfig.app.json` excludes `src/tests/**` from typecheck. Remaining tracked residuals: `#1453` (reject-time pin: the `RevisedAt <= DecidedAt` heuristic is not commit-visibility; display-only), `#1464` (the review surfaces' \"recorded operations show the original submission\" caveat is inverted now that list reads are effective-set-aware; terminal proposals only — now unblocked by `#1462`), `#1465` (dismissing a rejected proposal drops its decision-time frozen revision back to the originals), `#1467` (the list resolution is bounded in bytes but not in row count, and reads proposal state and revision rows from two snapshots; display-only), `#1468` (frontend specs are never type-checked — lifting `src/tests/**` from `tsconfig.app.json` and running `npm run typecheck` surfaces **415** pre-existing errors, all of them under `src/tests/`, against a clean baseline of 0), `#1470` (`docs/architecture/DATA_MODEL.md` omits `ApprovedRevisionId` and `DeferredUntil`, and the \"855 lines, 37 entities\" figure describing it is stale — the file is 897 lines, and the figure lives in three historical delivery-ledger entries rather than in the document itself; find them with `grep -rn \"855 lines, 37 entities\" docs/`).\n- **`#1449` (`#1445`) — the nightly k6 Performance Regression Gate is recalibrated to same-code runner variance.** The gate had gone red 3 of 5 nights on an identical main SHA (board-write p95 observed 2.0–3.0 s either side of the old 2200 ms threshold; 2 of the 5 nights passed, and even a passing night cleared the gate by only ~10%). Tail gates moved to global p99 < 5000 ms / board-write p95 < 4500 ms (~1.5–1.7× worst observed-good; calibration evidence inline in the script comment), the 2000 ms measured-capacity warning retained, warning-band edges now pinned by tests (7/7), and every doc/contract mirror synced. The write tail itself (median ~12 ms, p90 1–2 s at 20 VUs — SQLite write convoy) is tracked as `#1446`, including the sub-order-of-magnitude masking window this calibration accepts. **Confirmed on the first post-recalibration night:** the 2026-07-24 06:06Z nightly (run `30071303816`, on `36d563d7`) passed the Performance Regression Gate, against 3 reds in the 5 nights before it. One passing night is not yet a trend — a fresh red is now real signal and should be read from the k6 numbers before any threshold is touched again.\n- **`#1451` (`#1438`) — `AuditLogRepositoryIntegrationTests` moved onto the workerless factory** (`#1391` family): the live `AuditRetentionWorker` startup pass can no longer race the ordering test's backdated seeds in full-suite runs; 6× consecutive class runs green. Seeded `#1452`: no test anywhere exercises the retention worker's real `ExecuteAsync` startup path (pre-existing gap a flake had been masquerading as).\n- **`#1427` (`#1313`) — the LLM quota-reservation lifecycle is hardened, and a client can no longer erase its own billed usage.** The security half (M1): the streaming and non-streaming `ChatService` surfaces plus the extractor now finalize with `CancellationToken.None` and settle in `finally`, so a client that aborts mid-stream after tokens are billed — including the read-one-token-and-disconnect variant — can no longer discard its own usage record (previously client-controllable). Alongside it: a TTL-swept reservation's real billed tokens are recovered into a committed row instead of being silently dropped (F1, idempotent, warns); `ReservationEstimatedTokens` is floored at 1 so a reservation can never be invisible to the token/global budget sums (F2); the capture-triage reservation settles in `finally` (F4); the release paths are pinned by tests (M2) — provider-throw, zero-token, no-LLM bootstrap, board-context-build throw, and a provider yielding only an error event all **release** the reservation, while cancel-after-billed-tokens is pinned to the **opposite** invariant (`StreamResponseAsync_CancelledAfterBilledTokens_ShouldCommitNotRelease`): once tokens are billed, cancellation must commit and must never release, because releasing there is precisely the bypass M1 closes; and reservation cleanup now wraps request/board-context construction, so a setup failure releases instead of leaking until TTL (Codex P2). **The check-then-insert atomicity guarantee is explicitly NOT closed here** — it was proven not closeable in-process (the reservation over-admits even under a global full-span lock, because of cold-start WAL `-shm` read-visibility), so the redesign it needs (eager `-shm` warm-up, or non-snapshot enforcement) is deferred to `#1435` and routed to the maintainer; the concurrency-guarantee tests are skipped pending that issue, which is why this hardening ships green. Merged on the maintainer's explicit merge-with-tracked ruling; residual review P2s tracked as `#1431`.\n- **`#1448` — FRUGALITY MODE is now *in* the Fable overnight manual** (`docs/agentic/OVERNIGHT_LOOP.fable.md`) instead of being re-pasted into each launch prompt, per the enforcement-ladder rule that an amendment surviving two runs belongs in the manual. Its review round also produced a reusable structural lesson: Codex found sampling-exemption classes one at a time across three rounds, and a single allowlist inversion — only pure mechanical-motion packets are sampleable, while suite/CI verdicts and reviewer/settlement packets never are — closed the whole class at once.\n- **Dependabot:** `#1443` (.NET 8.0.28 → 8.0.29 patch train + Test.Sdk 18.8.1) and `#1440` (npm minor-patch group incl. vue 3.5.40) merged green. `#1441` (actions group) was staged green and then **merged on explicit maintainer authorization** — workflow-file PRs remain maintainer-merge-only. `#1442` (pinia 3→4 MAJOR) was genuinely red and is **closed to snooze**; the migration slice it actually needs is tracked as `#1455` rather than rubber-stamped.\n- **Review-bot estate note:** the consumer Gemini Code Assist GitHub integration is sunset (its farewell notice now posts on every PR) and Copilot review is quota-exhausted — Codex is currently the only live external review bot; the in-house two-lens adversarial pass carries correspondingly more weight.\n\n\n\nFrugal wave (2026-07-18, wave #2 — the follow-on to the approve == apply trust-class closure wave below; **2 PRs merged** — per-PR gate: independent adversarial review, all-severity findings fixed, required CI green):\n- **`#1430` (split from `#1379`) — artefact extraction is now bounded by a permit/concurrency gate.** A new `ArtefactExtractionGate` (Application singleton) takes a non-blocking permit before the parse worker spawns and releases it on both the completed and abandoned paths (a runaway parse holds its permit for its full lifetime); saturation ⇒ a pre-parse `TooManyRequests` with no history row and no new thread. The bound is `ExtractionMaxConcurrency` (`int`, default 2, `[Range(1, 64)]`, startup-validated). This is the verified-sound permit half split out of the parked `#1417` extraction-resource-ceiling work; the decompression-bomb containment half is deliberately **not** here — PdfPig 0.1.15 decodes xref streams with a hard-coded provider before any injected ceiling exists, so a provider-injection ceiling is bypassed (proven on `#1417`) — and continues under `#1429`. Adds **ADR-0047** (artefact-extraction resource bounding: permit gate + provider-injection ceiling as ObjStm-covering defense-in-depth with the documented xref gap) and **ADR-0048** (decompression-bomb containment boundary: a memory-capped extraction worker process — Job Object on Windows / cgroup under Docker — reversing the earlier sidecar rejection on the new evidence).\n- **`#1432` (`#1426`) — `ValidatePermissionsAsync` always gates board access, even for an empty operation list.** The engine previously short-circuited an empty operation list to `Result.Success()` with the board half of the access gate skipped (`boardId` forced to `null`), silently treating an operation-less proposal as permitted and forcing every new consumer to bolt on its own board-access fallback (the `#1415`/`#1425` trap). Now the full requester/board access gate always runs; only the per-operation contract validator is skipped when the list is empty. Emptiness itself is still **not** rejected here by design (a legitimate transient shape for revise-into-validity, `#1423`) — the \"at least one operation\" rejection stays with the structure gate, which runs before permissions in every approve/apply/diff/executor chain, so **approve == apply is unchanged** and the change is strictly additive restriction (a previously-`Success` empty-op result can only become a denial). Chosen over forbidding zero-op proposals at create, which would break the create-empty-then-revise flow `#1423` pins.\n- **Nightly k6 confirmed GREEN:** the first nightly run after the `#1359` repair (run `29632619187` on `326b6b5b`) passed, and the `#1359` failure-ledger row was flipped to resolved (commit `4fdae133`).\n- **Seeded this wave:** `#1429` (memory-capped extraction worker process — the ADR-0048 containment boundary), `#1431`, `#1433`, `#1434`, `#1435`, `#1436`. `#1427` (LLM quota-reservation robustness hardening, `#1313`) sat in the final review gate at the close of this wave and **has since shipped** — see the 2026-07-23/24 wave above; its atomicity redesign remains open as `#1435`.\n- **Standing human-gated holds:** `#1337` (licensing pack — blocked on human-only trademark/name clearance) and `#1295` (deny-floor overlay). On 2026-07-25 the maintainer dispositioned `#1295` explicitly: **keep the evidence, return the PR to draft, retain the human gate, and do not revive it in place.** The branch is conflicting and hundreds of commits behind `main`, all 16 review threads remain unresolved (11 still current, including command-wrapper, root-delete, SQL/container, npm-executor, and Windows parsing bypasses), and its delegation model targets a global floor version the installed floor has long since moved past — so its old green checks establish nothing about current behavior. If `#1293` proceeds, the smallest Taskdeck-specific overlay is to be rebuilt from current `main` once the chosen agent-harness floor is itself reviewed and stable; conflict churn on the ancient branch is not the path.\n\nApprove == apply trust-class closure wave (2026-07-18, **6 PRs merged** — per-PR gate: independent adversarial review, all-severity findings fixed, required CI green): closes the \"a user approves or previews something the executor will then refuse\" (preview == apply) trust-violation class on the server, across the diff, approve, and MCP surfaces (the `#1370`→`#1374`, `#1376`→`#1395`, `#1398` chain).\n- **`#1413` (`#1398`) — the proposal diff now runs Apply's permission/existence gates.** `GetProposalDiffAsync` (both the revised-payload and original-operations paths, before the cached-`DiffPreview` fast-path return) now calls the same `ValidatePermissionsAsync` Apply calls: requester-exists → `404`, board-exists → `404`, board-access → `403`, then the operation-contract validator. Closes the third and last asymmetry from the `#1395` parity round — a reviewer whose board access was revoked (or whose board/requester was deleted) mid-review previewed a clean `200` then failed at Apply. Status-agnostic on purpose: terminal proposals no longer disclose stored board-derived content on preview — access errors (`403`/`404`) surface once the earlier structure/expiry gates pass (a preview denial, stricter than Apply's idempotent short-circuit); an expired, access-revoked proposal still reports expiry first (pinned by `GetProposalDiffAsync_ShouldReportExpiry_NotForbidden_WhenExpiredAndAccessRevoked`).\n- **`#1423` (`#1416`) — Approve runs Apply's structure + permission/contract gates before committing the transition.** `ApproveProposalAsync` validates the effective (revision-aware) operation set: structure → `400`, expiry → `409` (the existing domain-transition contract, deliberately not the diff path's `400` shape), permissions/contract → `400`/`403`/`404`. A zero-op or access-revoked proposal that used to approve `200` and only fail at Apply now fails at approve. Gate ordering (structure → expiry → permissions) mirrors diff/apply; only `PendingReview` runs the gates. Seeded `#1424` (approve/get DTO returns original ops even when a revision exists).\n- **`#1425` (`#1415`) — the MCP `proposal_detail` preview is gated through the diff path.** It no longer emits the raw stored `DiffPreview`: open proposals route through the fully-gated `GetProposalDiffAsync`; decided/terminal proposals serve the stored preview but re-check requester/board access via a new `GetTerminalProposalStoredPreviewAsync` seam, so a reviewer who lost board access is denied the stored preview instead of reading stale board contents through it. The payload gains a `diffPreviewSource` provenance marker (`\"live\"` vs `\"stored\"`).\n- **`#1421` (`#1403`) — SQLite timestamp bounds are parameterized so zero-fraction boundary rows compare correctly.** EF trims trailing fraction zeros (a whole-second instant stores as `...00:00:00+00:00`, no `.`), so the old fixed-width `.fffffff` bound strings mis-sorted at the exact boundary tick. `AuditLogRepository` (`CountByDateAsync`/`DeleteOldEntriesAsync`/`BuildSqliteQueryAsync`) and `OAuthAuthCodeRepository` (`DeleteExpiredAsync`/`TryConsumeAtomicAsync`) now pass `DateTimeOffset` predicates, UTC-normalized (`.ToUniversalTime()`) so the offset-preserving mapping can't mis-compare non-UTC bounds. Seeded `#1422` (repo-wide sweep of remaining timestamp seams).\n- **`#1420` (`#1409`) — removed the dead `ApiKeyService.ValidateKeyAsync` usage-recording path** and its `ApiKey.RecordUsage()` domain helper (zero production callers; a dual-writer trap — MCP auth records usage via `ApiKeyMiddleware`'s `ExecuteUpdateAsync`). `LastUsedAt` is untouched.\n- **`#1419` (`#1418`) — test isolation:** `WorkspaceApiTests` moved onto `HostedWorkerDisabledTestWebApplicationFactory` so the live capture-lane worker can't claim a seeded `Processing` row mid-test (the `#1335` boundary). Test-only.\n\nOvernight correctness + test-reliability wave #2 (2026-07-17, **7 PRs merged** — per-PR gate: independent adversarial review, all-severity findings fixed, required CI green; the late-evening/overnight follow-on to the 11-PR sweep below):\n- **`#1394` (`#1335`) — hosted-worker test-isolation factory.** A new `HostedWorkerDisabledTestWebApplicationFactory` strips app-assembly hosted services from the test host via a shared predicate (also asserted by a dedicated guard test); adopted by `LlmQueueRepositoryIntegrationTests`, `OutboundWebhookDeliveryRepositoryTests`, `AutomationProposalRepositoryIntegrationTests`, and a new `ProcessNextClaimRaceTests` (split out from `QueueClaimRaceTests`, whose CaptureTriage cases need live workers). Kills the hosted-worker pre-emption flake family in full-suite runs.\n- **`#1391` (`#1383`) — AuditRetention integration determinism.** `AuditRetentionRepositoryIntegrationTests` adopts the workerless factory and is hardened (`BackdateEntryAsync` asserts affected==1, InvariantCulture, `ReloadAsync` read-back) — root cause was the live `AuditRetentionWorker` startup pass (90-day cutoff) racing 100/200-day backdated seeds. Empirically pinned the EF SQLite `DateTimeOffset` storage format: `yyyy-MM-dd HH:mm:ss.FFFFFFFzzz` (trailing zeros trimmed).\n- **`#1392` (`#1332`) — deterministic Redis dispose-vs-connect seam.** `RedisCacheServiceTests` now reaches the connect seam through a dedicated named background `Thread` instead of `Task.Run` (eliminates the thread-pool-saturation flake) and disposes its `ManualResetEventSlim`s. Test-only.\n- **`#1395` (`#1376`) — proposal diff now runs apply's structure and expiry gates on every path.** `AutomationProposalService.GetProposalDiffAsync` runs the same gates apply runs (structure, then expiry) on all diff paths including the cached-`DiffPreview` fast path — expired → `400` \"Proposal has expired\", zero-op → `400` \"Proposal must contain at least one operation\" (was `200`/`404`). Extends the `#1374` preview==apply parity contract for the structure/expiry/cached-preview paths; full parity still excludes apply's `ValidatePermissionsAsync` access/existence gates (tracked below). Seeded `#1397` (frontend expired/zero-op preview UX + coverage) and `#1398` (fold `ValidatePermissionsAsync` access/existence gates into diff — the third asymmetry).\n- **`#1396` (`#1387`) — buffered account-export extraction-history N+1 removed.** A new `IArtefactExtractionRepository.GetByArtefactsForUserAsync` batch method (user-scoped IN query, 900-id cap, SQLite TEXT-ordering parity with the old paged path) is fed by the export's 500-id chunks. Seeded `#1399` (the streaming-path N+1, which needs a streaming-safe design).\n- **`#1400` (`#1393`) — production timestamp culture-invariance.** InvariantCulture on 5 hand-built SQLite timestamp string sites (`AuditLogRepository` CountByDateAsync/DeleteOldEntriesAsync + `DateOnly.Parse`; `OAuthAuthCodeRepository` TryConsumeAtomicAsync/DeleteExpiredAsync, now also `.UtcDateTime`-normalized; `KnowledgeFtsSearchService` CreatedAt parse) with hostile-culture regression tests. Seeded `#1403` (the fixed-digit vs EF-trimmed boundary residual).\n- **`#1401` (`#1384`) — MCP per-key rate budget charged once, at the right point.** The 60/min per-key budget is now spent inside `ApiKeyMiddleware` immediately after key resolution, BEFORE the Users lookup + `UpdateLastUsedAsync`, so valid over-quota keys no longer drive auth-stage DB work; the endpoint-stage policy is removed (one budget, checked once) across both co-hosted and standalone pipelines; the `#1381` pre-auth-IP-budget semantics and the `429` contract are preserved. Seeded `#1402` (`UpdateLastUsedAsync` silently never persists — a swallowed EF translation failure) and `#1404` (stale-owner-key IP-budget escape).\n- **Seeded this wave:** `#1397`, `#1398`, `#1399`, `#1402`, `#1403`, `#1404`. **Still open — NOT shipped:** `#1386` (wave-1 final review round) plus the standing human-gated holds `#1295` (deny-floor overlay), `#1337` (licensing pack), and `#1359`.\n\nOvernight substrate + correctness wave (2026-07-17, **11 PRs merged** — per-PR gate: independent adversarial review, all-severity findings fixed, required CI green; full backend suite reported 7223 passed / 0 failed / 1 skipped post-`#1373`):\n- **`#1373` (`#1282`) — the API test factory now mirrors production SQLite settings.** A new shared `UseTaskdeckSqlite` registration helper in Infrastructure is used by BOTH production DI and the integration test factory, so WAL/busy-timeout drift between them is now structurally impossible; retires the `test/sqlite-concurrency` ledger flake.\n- **`#1375` (`#1298`, REVIVAL-02 Phase-1 ship gate) — removed the fake Paper review undo timeline** and replaced the reversibility copy with factual apply-risk guidance (\"Apply considerations\"), while the confidence label now renders \"Operation safety\"; the stable side-effect wire shapes are preserved for GP-03. Full contract detail is in the 2026-07-17 REVIVAL-02 note directly above — not duplicated here.\n- **`#1374` (`#1370`; seeded `#1376`) — proposal preview aligned with apply for reorder/collision/structure.** The clamped reorder position is surfaced in the diff, create-card id collisions fail at validation with a stable `409`, and a shared `ProposalOperationStructureValidator` runs before original-proposal diffs (one source of truth with Apply). A true preview==apply parity contract test was added.\n- **`#1372` (`#1367`) — the standalone MCP host-security guard now mirrors `HostFilteringMiddleware` exactly.** It fails closed on all zero-host `AllowedHosts` shapes (`\";\"`, `\";;\"`, blank) while preserving port-suffixed / whitespace-bearing literals; a new in-process standalone-host integration test carries a mutation proof.\n- **`#1377` (`#1357`) — the concurrent-migrator test asserts final schema state** (any-`SqliteException` collision signature, at most one fault, exact `__EFMigrationsHistory` equivalence) instead of no-throw; adds a deterministic fail-open collision test and an `AcquireLock` exclusivity contract test (internal seam). Retires the windows-latest migrator flake.\n- **`#1378` (`#1369`; `#1379` expanded to a hard wiring gate) — artefact extraction is bounded by a wall-clock budget** (`Artefacts:ExtractionTimeoutSeconds`, default 30s) with warning-bearing `extraction-timeout` history rows and abandoned-task handling; real PdfPig / plain-text extractors are exercised through the budgeted path.\n- **`#1362` (`#1274`, P-I ship gate; seeded `#1363` earlier, `#1380`, `#1382`) — core E2E is re-pointed at Paper-default sessions** with explicit frozen-Legacy opt-outs (builds on the 2026-07-14 Paper-default alignment paragraph above, which it does not restate). Adds full axe WCAG 2.1 A/AA on Home/Today/Inbox/Review/seeded Board/Login, a real capture → review → apply lane with a hard-asserted confirmation dialog, a `PaperBoardCard` nested-interactive fix + focus-follows-selection, `--faint` token contrast floors, and a Boards shortcut ledger.\n- **`#1366` (`#1365`, `#1371`) — the presence stress test proves join/leave broadcast delivery** (not just tracker membership) with fail-closed controls; 15/15 consecutive runs post-`#1373` parity.\n- **`#1385` (`#1355`) — buffered account-export artefact blob loads are now batched.** A new `SourceArtefactRepository` batch blob-load feeds the buffered GDPR export in bounded chunks (idiomatic `Chunk()`), with a batch-id-count guard against the SQLite parameter limit (pass-side boundary pinned at 900 ids) and export-JSON round-trip + missing-blob contract tests. Closes the LOW efficiency finding seeded from the `#1341` security review.\n- **`#1381` (`#1368`) — the MCP pre-auth per-IP limiter is now a failure budget with admission control.** Budget is spent only on authentication failures (successful auth never consumes, so multiple keys behind one egress address keep independent per-key budgets); an exhausted address is rejected before the API-key lookup via non-consuming inspection; a per-IP concurrency gate (`RateLimiting:McpAuthenticationPerIpConcurrency`, default 16) caps in-flight pre-auth work; consumption is abort-proof (an auth-failed marker set before the 401 write is consumed in a `finally`, so abort-storms still spend budget); trusted forwarded headers now also apply to the standalone MCP host (default OFF — XFF is never trusted from an unknown peer).\n- **`#1390` — same-night hotfix of the `#1377` fail-open collision test.** The barrier design flaked an unrelated PR in the opposite direction of the flake it covered (run 29552875836: fast runners let the winner finish the whole chain before the loser applied anything, failing the required-collision assertion). The test now stages the interception structurally — migrator A runs alone until `__EFMigrationsHistory` polling proves it mid-chain, then B is released — and a pathological staging miss passes gracefully with a loud `WARNING: STAGING MISSED` diagnostic, so the test can never flake an unrelated PR again.\n- **Seeded follow-ups:** `#1376`, `#1379`, `#1380`, `#1382`, `#1383` (AuditRetention flake), `#1384`, `#1387`, `#1388`. **Still open — NOT shipped:** `#1386` (final review round in flight), plus the standing human-gated holds `#1295` (deny-floor overlay), `#1337` (licensing pack), and `#1359`.\n\nRevival + generalist-expansion wave delivery (2026-07-13, **15 PRs merged** — the revival/GEN direction is now live on `main`; per-PR review gate: independent adversarial reviews, all-severity findings fixed, real merge conflicts resolved, required CI green after the `#1352` CI-Extended fix):\n- **Direction ratified:** `#1296` (ADR-0044 revival pivot — open-beta direction + REVIVAL_PLAN spine + canonical doc sync), `#1328` (ADR-0046 generalist expansion — artefact intake + dossiers, Phase 4; the twin generalist app stays deferred behind the GEN-12 `#1326` evidence gate), `#1312` (ADR-0045 LLM transcript-triage engine, REVIVAL-08 M1). **ADR-0044 / ADR-0045 / ADR-0046 are all now Accepted.**\n- **Generalist expansion (GEN wave, ADR-0046):** `#1341` GEN-01 artefact-storage foundation (immutable user-owned `SourceArtefact` + blobs; claims-scoped, IDOR-safe upload/download/delete with a race-safe in-transaction board-access recheck; streaming size caps preserving HTTP 413; magic-byte content validation; FK cascade + GDPR export/delete — independently security-reviewed, no CRITICAL/HIGH) → `#1346` GEN-02 bounded local text extraction (plain-text / Markdown / PdfPig, immutable warning-bearing extraction history); `#1339` GEN-05 apply due dates + labels from proposals (closes the extract-but-unappliable gap — also fixed a latent bug where a tautological guard silently cleared a column's WIP limit on *every* reorder, and made proposal reorder atomic/lossless with the destination position shown in the approval diff); `#1340` GEN-09 untrusted-artefact threat model + injection canaries; `#1342` GEN-10 generalist-friendly guided navigation.\n- **Revival (ADR-0044):** `#1334` REVIVAL-01 registration gating by deployment mode (Open / InviteOnly / Closed; operator-minted bootstrap invite; new `AddRegistrationGating` migration) → `#1344` REVIVAL-05 Paper first-run onboarding (real capture → reviewed proposal → board-apply milestone; fail-closed registration availability; theme-aware on-ember CTA contrast + restored Legacy focus ring); `#1329` REVIVAL-04 self-hosted Paper fonts + branding metadata; `#1331` README rewrite for the revival beta; `#1333` de-stubbed the fabricated Today dossier (`#1272`, latest-request-wins guard).\n- **Infra / harness / ops:** the maintainer first merged the linchpin `#1352` (systemic CI-Extended reusable-workflow permission `startup_failure`, `#1330`) plus dependabot `#1351` / `#1349` to unblock the deck; this session then merged `#1294` (harness T3 region maps + skill read-first diet, `#1291`) and `#1336` (overnight human-action + failure-ledger record, `#1327`).\n- **MCP HTTP security boundary (`#1338`):** standalone and co-hosted Streamable HTTP now share the only `MapMcp(\"/mcp\")` registration; API-key auth, telemetry, user-scoped resources, pre-authentication IP throttling, and opaque-key-ID rate limiting run on that exact route, while `/` is no longer an alternate MCP endpoint. The route explicitly disables browser CORS. Standalone defaults to loopback and replaces blank or any-host configuration (`*`, `0.0.0.0`, `[::]`, including mixed lists) with an exact loopback allowlist; remote binds require explicit host configuration and TLS termination.\n- **Seeded follow-up:** `#1355` (batch the buffered-export artefact blob loads — LOW efficiency finding from the `#1341` security review). **Human-gated, NOT merged:** `#1295` (deny-floor overlay — 16 unresolved review threads including a CRITICAL, needs remediation) and `#1337` (licensing pack — blocked on human trademark clearance).\n\n\n\n\n\n\n\nWave-6 backend + run-story delivery (2026-06-26, **3 PRs merged**; full review gate per PR — independent adversarial reviews, all-severity findings fixed, Codex bot threads resolved, fresh green CI + aging):\n- **`#1236` (`#1195`) — bounded the `LlmQueueToProposalWorker` status reads at the database.** Replaced the unbounded `GetByStatusAsync` worker reads with **type-aware in-query bounded reads** (`GetOldestPendingNonCaptureAsync` / `GetOldestProcessingCaptureAsync` + `CountPendingNonCaptureAsync` / `CountProcessingCaptureAsync` for true backlog telemetry). Two adversarial reviews + Codex independently caught a **HIGH starvation regression** in the original generic-limit design (bounding raw status before the request-type filter lets older untriaged capture rows starve non-capture automation work) → re-architected to predicate-in-query bounded reads (SQLite raw-SQL `ORDER BY CreatedAt ASC LIMIT` + in-memory re-sort). The unbounded `GetByStatusAsync` is kept for full-set callers (health gauge, OpsCli) and is **GDPR-safe** (delete/export use `GetByUserAsync`). Seeded `#1237` (remaining unbounded Pending reads in `LlmQueueService`/`OpsCliService`).\n- **`#1238` (`#1193`) — paged `CaptureService.ListAsync` from the database.** New capture-only `GetCapturesByUserAsync(userId, limit, offset)` (newest-first `ORDER BY CreatedAt DESC, Id`, SQLite raw + EF) replaces loading the user's entire `LlmRequest` history then filtering/paging in memory; a fetch-until-enough loop with a `seenIds` dedup guard keeps filtered queries correctly filled across OFFSET page boundaries. `GetByUserAsync` untouched → GDPR-safe. Seeded `#1239` (push board/status filters into SQL).\n- **`#1240` (`#1131`) — made the self-contained desktop exe runnable without manually supplying a connector key.** `ShouldAutoGenerateConnectorKey(isProd, isHeadless) => !isProd || !isHeadless`: a desktop install (Production, not headless) auto-generates + persists the connector encryption key to `appsettings.local.json`; **headless Production (CI / container / Terraform) still hard-fails** without a supplied stable key (`backend.Dockerfile` sets `TASKDECK_HEADLESS=true` so every container image is classified headless). The AWS single-node Terraform `user_data` generates+persists the key onto the durable EBS data volume (refusing to regenerate when a DB already exists without a key), `scripts/backup.sh`/`restore.sh`/`restore.ps1` keep the key paired with the database, and a deep review loop hardened the persistence path against silent key loss (reuse a masked persisted key instead of overwriting it; self-heal a corrupt local config; case-insensitive + provider-lenient reads; read-vs-parse error separation; owner-only ACL on the restored key). **`ADR-0041`** records the decision. ~15 distinct review findings (1 HIGH + many P2) across 6 Codex rounds + a 2-lens adversarial sweep, all fixed with tests.\n- **ADR added on main:** `ADR-0041` (desktop connector-key auto-generation; headless Production excluded).\n- **Seeded follow-ups:** `#1237` (bound remaining unbounded Pending reads) **— shipped (`#1250`)**; `#1239` (push capture board/status filters into SQL) **— board pre-filter shipped 2026-06-30 (`#1254`); the status filter stays in-service (provenance-derived), so `#1239` remains open for that portion**. Shipped from earlier: `#1241` (Windows ACL on the desktop key file) **— 2026-07-02 (`#1263`)**. Still open from earlier: `#1242` (relocate persisted secrets to the durable app-data location).\n\nCanonical UI + historical archive period (2026-06-13; direction superseded 2026-07-10):\n- **Historical direction only:** from 2026-06-13 until ADR-0044 on 2026-07-10, the project direction was finish-for-personal-use, then archive, with no distribution. **That posture no longer controls execution.** The revival direction at the top of this file and `docs/REVIVAL_PLAN.md` are authoritative; previously de-scoped distribution work is re-triaged only where the ratified REVIVAL wave admits it.\n- **Paper is the canonical UI AND now the DEFAULT theme** per **ADR-0038** — the **Wave-3 default-theme flip shipped 2026-06-27**: `paperThemeStore` defaults to `'paper'` (was `'off'`), the storage key is bumped to `td.paper.mode.v2` with a one-time migration (a deliberate pre-flip `paper`/`paper-night`/`auto` choice carries over; a stored `'off'` — the old default / never-opted-in — and absent/invalid fall through to the new `'paper'` default), and the legacy `.td-*`-selector E2E specs pin Legacy via `authSession` (`td.paper.mode.v2='off'`). Legacy stays reachable through the Appearance toggle. **Activation prerequisites shipped earlier (2026-06-19):** the `#1161` \"File away\" dismiss affordance (`#1219`), the shared review-actionability composable (`#1217`), light-theme straggler tokenization (`#1216`), and a **real in-app Appearance theme toggle** (`#1221`, `AppearanceSettingsView` at `/workspace/settings/appearance` — off / paper / paper-night / auto) which replaces the unlinked `/styleguide/paper` route as the reachable Legacy escape hatch. **Paper-review de-stubs now shipped (2026-06-27):** `onPreviewDiff` (`#1234`), plus `onDefer` (snooze 1h — net-new `DeferredUntil` timing field + `POST /api/automation/proposals/{id}/defer`, the proposal leaves the queue and resurfaces without expiring, **ADR-0042**) and `onReportBadSuggestion` (net-new content-free `ProposalFeedback` table + `POST /api/automation/proposals/{id}/feedback`, orthogonal feedback that never changes status, **ADR-0043**) — **which unblocked the Wave-3 default-theme flip, now shipped (see above).** **All new frontend UX work targets the Paper views; Legacy is frozen** (no new fixes). The ~26 routes without Paper variants keep rendering Legacy views inside the Paper shell after a contrast pass.\n\nArchive-pivot delivery wave (2026-06-13, **17 PRs merged** across Waves 0–2, including 2 follow-on dependabot bumps `#1211`/`#1212`; **plus 4 follow-on PRs merged 2026-06-19** — `#1219`/`#1220`/`#1221`/`#1225`, see the \"Merged 2026-06-19\" sub-section below — for **21 total**; full review gate per PR — 2 independent adversarial reviews, all-severity findings fixed, Gemini/Codex/Copilot bot threads resolved, fresh green CI + aging):\n- **Wave 0 — PR deck cleared (7 PRs):** dependabot npm `#1202` + nuget `#1203` group bumps; automation-chat composable cleanup `#1199` (isDisposed guard on the unguarded `loadBoardOptions().then()` continuation); false-green E2E re-enabled on real Paper selectors `#1197` (the 7 `fixme`'d specs cover features that exist under Paper — paper-night class, dark-Paper toggle, PaperShortcutsOverlay, workspace-mode selector); queue-claim race fix `#1200` (the raw-SQL claim now `Reload()`s so the returned DTO shows Processing instead of a stale Pending identity-map entity — seeded `#1209` for the remaining non-capture stuck-in-Processing sweeper gap); **SDK pin + Central Package Management `#1196` (ADR-0039)** — carried the `#1203` NuGet bumps into `Directory.Packages.props` and copied `global.json` into the backend Dockerfile; **ExpiresAt UTC convention `#1201` (ADR-0040)** — global `ConfigureConventions` DateTimeOffset materialization so SQLite reads come back UTC.\n- **Wave 1 — decision + cheap foundations (3 PRs):** **ADR-0038 ratified — Paper is the canonical UI, Legacy frozen `#1207`** (STATUS + masterplan now state the canonical stack; storage-key migration deferred to the Wave-3 flip); `#1139` AC1 compose-secret quickstart docs `#1205` (README + `docs/ops/DEPLOYMENT_CONTAINERS.md` now name BOTH required secrets, since compose aborts on a missing `TASKDECK_CONNECTORS_ENCRYPTION_KEY`); `*.migrate.lock` gitignored + `.dockerignore` mirror `#1204` (the SerializedMigrator sidecar no longer dirties `git status` on every startup).\n- **Wave 2/6 — Paper activation prerequisites + backend quality (5 PRs):** paper-night straggler tokenization `#1216` (`#1135` — KeyboardShortcutsHelp border + full-opacity WCAG focus ring; seeded `#1218` for the repo-wide `focus:ring-primary/50` contrast sweep); **shared review-actionability composable `#1217`** — extracted `isProposalApplyActionable` / `isProposalRejectActionable` / `isProposalApproveActionable` / `isProposalDismissable` / `isProposalStale` as pure functions in `useReviewProposals` so Paper and Legacy can never drift at the 24h-stale or Approved+expired boundaries (the `#1124` bug class is now fixed once, not twice), and de-stubbed the fabricated `4s · 1.2k tokens` author metadata in favour of the real `/confidence` value; dead-code removal `#1198`/`#1214` (see below); Redis lock-starvation fix `#1213` (`#1189` — dropped the in-lock retry loop and the 3s blocking Connect inside the lock; single attempt per throttle window → null/no-cache fallthrough, proven by deterministic regression guards); **one-command dev-up + clean-workspace scripts `#1208` (`#1140`)** — `dev-up.ps1/.sh` (dependency check, `%LOCALAPPDATA%` DB path to fix the CWD-dependent `taskdeck.db`, port-bound API via `--no-launch-profile --urls`, `/health/ready` poll, npm dev, optional `-Seed demo/demo123`) and `clean-workspace.ps1/.sh` (stray DBs/migrate-locks/logs, process-held-DB refusal), with recursive process-tree kill, live-PID-file refusal, and a `.migrate.lock` guard against deletion during an active migration; the dev-up DB-pinning path was live-smoke-verified before merge.\n- **ADRs added on main:** `ADR-0038` (Paper UI canonical / Legacy frozen), `ADR-0039` (Central Package Management, SDK pin, 8.x dependency alignment), `ADR-0040` (global UTC DateTime materialization for SQLite).\n- **Seeded follow-ups:** `#1209` (no sweeper recovers non-capture `LlmRequests` stuck in Processing) **— shipped 2026-06-30 (`#1256`)**; `#1215` (`FieldVerifier`/`DeterministicPreExtractor` registered-but-unconsumed after V1 removal) **— removed as dead code 2026-07-04 (V2 generator cancelled by the archive pivot; the transitively-orphaned `FuzzyTextMatcher`, `FieldVerificationResult`, `ExtractedEntity`, and the `Microsoft.Recognizers.Text` packages were swept with it)**, `#1218` (repo-wide focus-ring contrast sweep) **— shipped 2026-07-02 (`#1265`)**.\n- **Merged 2026-06-19** (maintainer lifted the merge hold; all four shipped to `main` after 2 independent adversarial reviews, all-severity findings fixed, fresh green CI):\n - `#1219` (`#1161`) — Paper review \"File away\" dismiss affordance built on the `#1217` shared-actionability foundation (per-proposal filing rail in terminal states + bulk \"File away N settled\" + dual-purpose ⌫). Closes `#1161`.\n - `#1221` — reachable in-app **Appearance** theme toggle (`AppearanceSettingsView` at `/workspace/settings/appearance`; off / paper / paper-night / auto), the reachable Legacy escape hatch that replaces the unlinked `/styleguide/paper` route — a Paper-activation prerequisite.\n - `#1220` — canonical-docs reconciliation with the archive-pivot direction (14 Codex review rounds + 3 multi-agent drift sweeps; ~70 banner-vs-reality edges fixed).\n - `#1225` — `StackExchange.Redis` + `Microsoft.AspNetCore.SignalR.StackExchangeRedis` semver-major caps (dormant Redis under the archive pivot).\n\nDead-code removal (2026-06-13, `#1198`): deleted the unused `ProposalGeneratorV1` — the `IProposalGenerator` interface (incl. its V1-only `ProposalGenerationResult`/`GeneratedProposal` result DTOs), its sole DI registration, and its test class — after confirming **zero consumers** inject `IProposalGenerator` (the only non-definition reference was the DI line). This resolves the tracked partial-entity-tracking bug in `#1198` by removing the unreachable code path rather than patching it. The shared `FieldVerifier`/`IFieldVerifier` and `DeterministicPreExtractor`/`IDeterministicPreExtractor` utilities (V1 was their only consumer but each has standalone tests and DI registration) are retained for a future V2 generator. Build clean, Proposal-filtered backend tests green.\n\nSecurity gate + hardening epic (2026-06-05/06, 5 PRs merged; **2 independent adversarial reviews per PR** plus Gemini/Codex bot reviews, all findings of every severity fixed or tracked, merges gated on green CI + aging):\n- **#1132 (security gate + config hardening) delivered across 4 PRs**: a single ≥32-char JWT secret floor (`JwtSettings.MinSecretKeyLength`) with **fail-fast** registration (throws instead of silently no-op'ing auth) + CORS that **fails closed** in Production when no origins are configured (`#1169`, AC2/AC3); required **secret/dependency/SAST scans + the bundle-size budget promoted into the PR merge gate** (`#1170`, AC1/AC5), with **phased enforcement** per **ADR-0035** (gitleaks + bundle enforcing; dependency + SAST advisory pending baseline remediation) and the pre-existing Semgrep `pkg_resources`/`setuptools-82` crash fixed; a global default-deny `AuthorizationOptions.FallbackPolicy = RequireAuthenticatedUser` with an explicit `[AllowAnonymous]` audit (SPA fallback opt-out; the API-key MCP path now sets an authenticated principal in `ApiKeyMiddleware`) per **ADR-0036** (`#1176`, AC4).\n- **#1133 (backend query perf, first slices — `#1171`)**: `NotificationRepository.GetByUserIdAsync` now pushes ORDER BY + LIMIT/OFFSET into SQL (SQLite raw-SQL path for `DateTimeOffset` ordering, fully parameterized, negative-clamp guard) instead of materializing every row; `.AsSplitQuery()` on `CardRepository` collection reads. SignalR-incremental-refetch and FTS card-search remain open on `#1133`.\n- **#1131 AC1 (CLI hardening — `#1177`)**: the CLI provisions a connector encryption key on first run (CSPRNG 256-bit, atomic merge-preserving write under a cross-process mutex, `0600` perms, stderr-only diagnostics) so `taskdeck boards list` works on a clean machine; guarded the `Mutex` ctor against locked-down hosts and honored the documented `TASKDECK_CONNECTORS__ENCRYPTIONKEY` override. CLI authorization routing is **#1131 AC2** (deferred).\n- **New ADRs**: `ADR-0035` (required security-scan merge gate), `ADR-0036` (default-deny authorization fallback). **Seeded follow-ups**: `#1172` (AccountDeletion notification paging), `#1173` (branch-protection registration of the new check contexts — a repo-settings action), `#1174` (per-advisory dependency allowlist / break-glass), `#1175` (security-baseline remediation incl. the `NuGet.CommandLine`-via-Recognizers.Text transitive, then flip dependency/SAST to enforcing), `#1178` (apply the CLI's `0600` + guarded-mutex hardening to the API `FirstRunBootstrapper`).\n\nPost-audit correctness sweep (analysis 2026-05-31; landed as reviewed PR 2026-06-04): audited all 31 PRs merged since 2026-05-28 for CC 2.1.154–2.1.158 tool-channel corruption fallout. Results: **0 SUSPECT, 0 NO-OP, 31 CLEAN** — no corruption artifacts. Full build/test suite green (6,735 BE + 3,662 FE tests). Fan-out correctness review (4 agents, 219 tool calls) found 2 issues + 9 nitpicks, all addressed:\n- **Fixes applied**: `useGlobalSearch` dispose-race guard on the success, catch, and finally branches (no reactive writes after teardown); `useCaptureQueueSync` fire-and-forget replays switched to `void replayQueue()` (replayQueue wraps its body in try/catch/finally and logs internally, so the prior empty `.catch(() => {})` was dead code); Ollama `appsettings.json` BaseUrl changed from empty string to `null` with a clearer validation message pointing at the real `Llm:Ollama:BaseUrl` section; `RoadmapInvariantTests` placed in a named xUnit `[Collection]` so any future TelemetryGuard-mutating test class in the same assembly stays serialized with INV-11; `AutomationMetricsController` TODO comment replaced with honest stub note referencing `#1142`.\n- **PR #1160 review fixes**: two independent adversarial passes plus Gemini/Codex/Copilot bot reviews refined the sweep — the dispose-race guard was extended to the catch paths, the dead replay `.catch` became `void`, and the Ollama hint was corrected from the non-existent `LlmProviders:` path to `Llm:Ollama:BaseUrl`.\n- **Documented**: `AutomationMetricsController.GetCohortMetrics` is a stub returning empty data — `CohortDashboard` frontend works but will show \"No cohort data available\" until `ICohortMetricsService` ships (tracked in `#1142`). `OllamaLlmProvider.StreamAsync` uses pseudo-streaming (complete-then-drip), not Ollama's native streaming API.\n\nCleanup/hardening wave (2026-05-31, 8 PRs merged, 2 issues closed; 2 adversarial review passes per PR with all findings of every severity fixed and all bot threads resolved):\n- **Open-PR backlog cleared** (`#1143`–`#1147`): non-watch `vitest run` + MetricsView flake fix (`#1143`), docs-truth corrections (`#1144`), CI-aligned release scripts + stale PKG-01 warning removed (`#1145`), duplicate operation idempotency-key now returns **409 not 500** (`#1146`), `AsSplitQuery` on the multi-collection board read (`#1147`).\n- **Proposal endpoint hardened** (`#1125`/`#1151`): new `ProposalOperationInputValidator` rejects malformed operation input (markup/binary `actionType`/`targetType`, non-JSON / oversized / over-nested `parameters`) with **400** at the shared create path, using a permissive identifier-format check so it never rejects legitimate planner/chat/capture/MCP operations. Adversarial review caught a self-introduced HIGH (a null `operations` element → 500) which was fixed before merge.\n- **Roadmap invariants enforced** (`#1126`/`#1153`): INV-10 (MCP hash-pin), INV-11 (TelemetryGuard), INV-12 (provenance source spans) un-skipped with real assertions against the shipped services; only INV-09 (DataFlowRegistry, genuinely unbuilt) remains skipped. Surfaced that `McpToolDefinitionHashService` is registered but **not wired into the MCP runtime** (tracked `#1154`).\n- **Swallowed audit failures surfaced** (`#1134` first slice / `#1155`): the 4 copy-pasted empty-catch `SafeLogAsync` (Board/Card/Column/Label) now route through a shared `AuditLogWriter` that logs at **Warning** on a thrown exception or a returned failed `Result`, keeping the never-crash intent.\n- Seeded follow-ups: `#1149` (idempotency-key contract ADR), `#1150` (packaging-doc trim drift), `#1152` (Queue/V1 validator bypass), `#1154` (MCP hash wiring). `#1134` stays open for its remaining 6 acceptance criteria.\n\nContinuous-cycle wave (2026-05-29, 19 PRs merged, zero open PRs): cleared the entire open-PR backlog with two adversarial reviews per PR and all findings (all severities, including bot comments) addressed.\n- **RFAI roadmap complete**: RFAI-11 (`#983`/`#1079`, ambient channel — VS Code extension + voice prototype; voice composable is tested but not yet wired into any UI component) and RFAI-12 (`#984`/`#1080`, Ollama provider, ProvenanceDrawer, cohort dashboard shell) delivered. All 12 RFAI issues now shipped. **Note:** `CohortDashboard` frontend is wired but backend returns empty data (stub); `OllamaLlmProvider.StreamAsync` uses pseudo-streaming; `useVoiceCapture` has no UI integration yet. These are tracked in `OUTSTANDING_TASKS.md`.\n- **Composable hardening**: unhandled promise rejections (`#1093`/`#1095`), cleanup/memory-leak fixes with `onScopeDispose` (`#1094`/`#1104`), FilterPanel aria-labels (`#1097`/`#1098`).\n- **Identity/authz hardening**: an audit confirmed all 42 API controllers are claims-first with zero bypass risk; migrated `TelemetryController`/`EgressDisclosureController` onto `AuthenticatedControllerBase` (`#1109`/`#1111`) and added architecture guards enforcing per-action `[Authorize]`/`[AllowAnonymous]` (`#1110`/`#1116`).\n- **Dependency wave**: nuget/npm minor-patch groups, YamlDotNet 18, and a dotnet group (EF8/9 split fixed) merged; FluentAssertions moved to the free **7.x** line (`#1088`) instead of paid v8; durable dependabot `ignore` rules added for EF Core and FluentAssertions majors (`#1112`, `#1118`) so those churns stop recurring.\n- **Housekeeping** (`#1092`): STATUS.md contradiction fixed; v-for key stability (`#1107`/`#1108`); 112 stale stashes cleared and stale branches pruned.\n
\nStatus Owner: Repository maintainers\nAuthoritative Scope: Current implementation, verified test execution, and active phase progress\nCompanion Active Docs:\n- `docs/STATUS.md`\n- `docs/IMPLEMENTATION_MASTERPLAN.md`\n- `docs/TESTING_GUIDE.md`\n- `docs/MANUAL_TEST_CHECKLIST.md`\n- `docs/GOLDEN_PRINCIPLES.md`\n\n## Project Summary\n\nTaskdeck is a local-first execution system for developers, built with a .NET 8 backend and a Vue 3 frontend.\nCore board workflows are stable, and advanced slices are implemented for automation proposals, chat, ops/log querying, archive recovery, and worker health reporting.\n\nRebranding thesis (2026-02-23):\n- capture should be near-zero friction\n- automation should remain review-first and provenance-visible\n- product value is reducing maintenance overhead, not maximizing opaque autonomy\n\nBulk merge wave (2026-05-16, PRs `#1055`–`#1074`, 15 PRs, all with 2+ rounds of adversarial review):\n- **Security hardening** (3 PRs): redirect handler buffer/header filtering (`#1055`), hardcoded encryption key removal + RBAC on abuse endpoints (`#1067`, SEC-31/SEC-32), health endpoint exception detail suppression (`#1068`, SEC-33)\n- **Test coverage** (2 PRs): MFA, API Keys, Board Access controller tests (`#1069`, TST-62), ConnectorProviders API + useAutomationChat composable tests (`#1072`)\n- **RFAI feature delivery** (5 PRs): `IProposalGenerator`/`FieldVerifier`/`ProposalGeneratorV1` (`#1071`, RFAI-03), revision endpoints + edit-before-approve flow (`#1058`, RFAI-04), Paper Review deep-dive frontend wiring (`#1062`, RFAI-05), egress disclosure API endpoint (`#1073`, RFAI-08), privacy insights API for proposal outcome cohorts (`#1074`, RFAI-08)\n- **PAPER frontend** (2 PRs): Today dossier real backend API wiring (`#1056`, PAPER-08), narrow companions with sidebar variants + board snap scroll (`#1057`, PAPER-11)\n- **Dependency updates** (3 PRs): `actions/dependency-review-action` 4→5 (`#1059`), npm minor/patch group 11 updates (`#1060`), NuGet minor/patch group 4 updates (`#1061`)\n- Post-merge verification: 6,532 backend tests pass (0 failures), 3,267 frontend tests pass (0 failures), both builds clean\n- Roadmap v4 RFAI progress: RFAI-01 through RFAI-09 now fully delivered (9 of 12 issues); remaining: RFAI-10 (PWA share-target), RFAI-11 (ambient channel), RFAI-12 (learning loop UI + beta gate)\n- PAPER progress: PAPER-03 (shell), PAPER-08 (today dossier), PAPER-11 (narrow companions) now delivered; remaining: PAPER-05 (board/kanban surface)\n\nPost-merge follow-up (2026-05-17, PRs `#1076`–`#1078` and `#1082`–`#1084`, 6 PRs merged after the bulk wave; `#1079`/`#1080` remain open):\n- **RFAI-10** (`#982`/`#1078`): PWA share-target quick capture with offline queue, browser extension prototype, share captures preserved after auth rejection, ambiguous POST provenance fail-closed; issue closed\n- **PAPER-05** (`#1001`/`#1083`): Paper board card drag E2E test with audit-log assertion\n- **Bug fix** (`#1077`): Encoding artifact in PaperBoardCard drag handle\n- **Test coverage** (`#1076`, `#1082`, `#1084`): MFA setup 409-Conflict integration test (`#1076`, TST-63), composable unit tests for inkBleed, reviewKeymap, useInboxOrchestrator, useReviewProposals\n- Roadmap RFAI progress: 10 of 12 delivered; 2 remaining (RFAI-11 `#1079`, RFAI-12 `#1080`)\n- PAPER progress: all 4 PAPER issues now delivered (PAPER-03, PAPER-05, PAPER-08, PAPER-11)\n\nAgentic operating layer expansion (2026-05-11):\n- Taskdeck now has a shared agentic protocol layer under `docs/agentic/` for blocker-question batching, failure/workaround capture, guide-update promotion rules, and skill routing.\n- `autodoc/AGENT_INDEX.md` is the fast agent seam map for low-context orientation, context traps, and verification hints; it is a pointer layer, not canonical product truth.\n- Codex and Claude skill mirrors now include `taskdeck-question-batch`, `taskdeck-failure-capture`, and `taskdeck-interface-map`.\n- Claude project hooks now route dangerous shell-command checks and failed-tool capture through `scripts/agent_hooks/`, while preserving existing Taskdeck-specific pre-commit and PR-review reminders.\n- Codex and Claude tool parity is explicit in `docs/agentic/AGENT_TOOL_PARITY.md`; Claude `.mcp.json` now mirrors the shared MCP baseline with OpenAI docs, GitHub, Context7, Playwright, Chrome DevTools, and Docker gateway access.\n\nPaper backend gap delivery (2026-05-05, PRs `#1031`--`#1040`, 10 of 10 issues `#1015`--`#1024`):\n- 10 Paper backend gaps delivered or merge-ready with two rounds of adversarial review per PR; ~480 new backend tests across the delivered set; bot review findings (Gemini Code Assist + Codex connector) addressed on delivered PRs\n- **Today dossier backends** (4 endpoints on `TodayController`, required by PAPER-08 `#1004`):\n - Cadence aggregation (`#1015`/`#1031`): `GET /api/today/cadence?date=` returns 24-hour activity buckets with first/peak/last action timestamps; `CadenceBucket` and `CadenceSnapshot` value objects with cached `Empty()` singleton; queries `IAuditLogRepository`; 26 tests\n - Streak query (`#1016`/`#1032`): `GET /api/today/streak?days=90` returns 90-day streak with intensity buckets (quartile-based) and current/longest streak lengths; `StreakDay`/`StreakResult` value objects; server-side `GROUP BY` via `CountByDateAsync` (replaced 100k entity load after review); 61 tests\n - Seal day action (`#1017`/`#1037`): `POST /api/today/seal` and `GET /api/today/seal?date=` for idempotent day-sealing with `DailySnapshot` entity; EF Core migration with unique index on `(UserId, Date)`; `UnitOfWork` unique constraint handler for concurrent seals; CancellationToken threaded through all layers after review; 28 tests\n - Line for tomorrow (`#1018`/`#1035`): `GET /api/today/tomorrow-note?date=` and `PUT /api/today/tomorrow-note` for autosave-friendly upsert; `TomorrowNote` entity (500 char max); 204 NoContent for missing notes; concurrent upsert race-condition handling via `UnitOfWork`; 25 tests\n- **Review deep-dive backends** (6 endpoints on `AutomationProposalsController`, required by PAPER-06 `#1002`):\n - Provenance rows (`#1019`/`#1039`): `GET /api/automation/proposals/{id}/provenance` returns `ProvenanceRowDto[]` with icon/key/value/weight; 26-entry icon map; weight bucketing from `ProvenanceField` confidence; FK migration added after review; `Math.Round` for confidence display; 41 tests\n - Side-effect analysis (`#1020`/`#1033`): `GET /api/automation/proposals/{id}/side-effects` returns 7-category breakdown (Cards/Subtasks/Comments/Activity/Notifications/Webhooks/Calendar) with active/passive tone and risk-based reversibility window (6h default, 3h for Critical); review fixed target-type checks and webhook-without-operations logic; 66 tests *[2026-07-17: the `windowMs` field is legacy review-attention metadata, not an undo capability — no revert endpoint exists; copy/semantics reframed to apply-risk guidance by REVIVAL-02 `#1298`, wire shape unchanged]*\n - Confidence breakdown (`#1021`/`#1036`): `GET /api/automation/proposals/{id}/confidence` returns 4-component weighted breakdown (Pattern match 0.30, Reach 0.20, Reversibility 0.35, Recency 0.15) with threshold and explanatory note; review fixed reach formula, promoted weights to static field, removed unused userId; 63 tests\n - Conflict detection (`#1022`/`#1040`): `GET /api/automation/proposals/{id}/conflicts` returns tone-classified Warn/Info/Ok rows for stale data, missing targets, projected WIP overflow, duplicate pending proposals, high-risk operations, outbound webhooks, active comments, multi-op card conflicts, and positive capacity/fresh-data signals; review fixed create-card false positives, JSON ValueKind guards, projected WIP accounting, missing-column detection, webhook event mapping, soft-deleted comment counts, and entity caching; 78 tests\n - Card history ledger (`#1023`/`#1034`): `GET /api/automation/proposals/{id}/history` returns per-card touch history with serial/event/age/status; bounded at 200 entries/card and 500 total; review fixed duplicate dedup, JSON property parsing, GUID single-pass, `InvariantCulture` formatting; 42 tests\n - Similar past decisions (`#1024`/`#1038`): `GET /api/automation/proposals/{id}/similar-past` returns 3 nearest-neighbour prior decisions with apply rate; board-scoped query (review fixed userId filter that excluded non-caller proposals); 200-proposal lookback limit; UTC week formatting; 50 tests\n- New EF Core migrations: `AddDailySnapshots`, `AddTomorrowNotes`, `AddProvenanceEntities`, `AddProposalProvenanceForeignKey`, `ExtendProposalOutcomesForMetrics`\n- New repository methods: `IAuditLogRepository.CountByDateAsync`, `IAutomationProposalRepository.GetTerminalByActionTypeAsync`, `IAutomationProposalRepository.GetPendingByOperationTargetAsync`, `ICardCommentRepository.CountByCardIdAsync`\n\nRoadmap v4 second-wave delivery (2026-04-25, PRs `#989`--`#994` + `#995`):\n- RFAI-02 (`#974`/`#989`): `IntentEnvelopeV1` domain spine with `SourceBlock`/`SourceSpan`, `IntentCandidate`, `EvidenceLink`, `TaskdeckProposalBatch`, `IIntentEnvelopeFactory` application interface, `IChatClient` adapter spike, handwritten `proposal-batch.v1.schema.json`; 117 tests; adversarial review fixed partial-write status transition bug, span length consistency, evidence fabrication prevention, nullable schema fields\n- RFAI-06 (`#978`/`#990`): `IVectorIndex` and `IEmbeddingGenerator` application interfaces, `InMemoryVectorIndex` (cosine similarity + SIMD), `InMemoryEmbeddingGenerator` (FNV-1a hash), `EmbeddingBackfillService` with batch processing and stale vector pruning, `FallbackSemanticSearchService`, `EmbeddingBackfillWorker`; 61 tests; adversarial review fixed batch API usage, stale vector cleanup, unbounded memory growth\n- RFAI-05 (`#977`/`#991`): `ConfidenceScore` value object, `FieldConfidence`, `SelfConsistencyQuota`, `SelfConsistencyPolicy`, `ConfidenceBucket`/`ConfidenceSource` enums, `ConfidenceAggregator`, `BrierScoreCalculator`; 136 tests; adversarial review fixed hash/equality contract violations, non-finite value rejection, BrierScore input validation\n- RFAI-08 (`#980`/`#992`): `TelemetryGuard` with allowlist-based metric validation and ReDoS-safe regex, `EgressRegistry` with wildcard host matching and thread safety, `InsightMetric`/`InsightCohort` content-free records, eval harness framework (`IEvalCase`, `EvalRunner`, 12 seed cases); 108 tests; adversarial review fixed wildcard matching, thread safety, volatile field, unsupported type rejection; CI failure was pre-existing flaky test (fixed in `#995`)\n- RFAI-03 (`#975`/`#993`): `ProposalProvenance`, `ProvenanceField` (extractive/inferred with confidence), `FieldVerificationResult`, `ProposalOutcome` (content-free decision ledger), `FuzzyTextMatcher` (Levenshtein sliding-window), `DeterministicPreExtractor` (Microsoft.Recognizers.Text), EF Core migration for `ProposalOutcomes`; 139 tests; adversarial review fixed verification-status/confidence consistency, provenance parent-ID validation, unbounded query limit\n- RFAI-04 (`#976`/`#994`): `ProposalRevision` entity (immutable revision chain), `IProposalCompiler` interface, `CompilerValidationResult`, `OperationRisk` value object, `OutcomeType` enum, `UnsupportedOperationFailure`, `IProposalRevisionService`, EF Core migration for `ProposalRevisions` and `ProposalOutcomes`; 70 tests; adversarial review fixed DateTime→DateTimeOffset alignment, redundant cast, documented TOCTOU race\n- Flaky CI test fix (`#995`): `Presence_RapidJoinLeave_EventuallyConsistent` replaced exact-count polling with stabilization-based assertions and range checks; timeout increased from 20s to 30s\n\nCurrent constraints are mostly hardening and consistency:\n- _(Historical — superseded first by the 2026-06-13 archive pivot and then by the 2026-07-10 revival pivot; the active execution order is `docs/REVIVAL_PLAN.md`, not `#972`.)_ `taskdeck-12-week-roadmap-v4.md` had been promoted from research input into the near-horizon planning spine via tracker `#972` and child issues `#973`--`#984` (RFAI complete 2026-05-29). The product framing it carried remains valid and unchanged: automation-originated board writes must stay proposal-first, manual board UI writes stay direct and auditable as user-manual activity, and outbound data flow must be guarded separately through the EgressEnvelope/disclosure/MCP-hash/telemetry controls.\n- Roadmap v4 execution progress: **RFAI-01 through RFAI-12 fully delivered (12 of 12 issues — roadmap complete)**; RFAI-10 PWA share-target merged in `#1078`, RFAI-11 ambient channel in `#1079`, RFAI-12 learning loop in `#1080` (2026-05-29).\n- Codex and Claude high-autonomy issue execution now have first-class local guidance: `.codex/README.md`, `.codex/memories/00_ACTIVE.md`, `.codex/skills/README.md`, `.claude/README.md`, `.claude/skills/README.md`, `docs/tooling/CODEX_AUTONOMY_RUNBOOK.md`, generalized worktree protocol, PowerShell git/worktree guards, GitHub helper scripts, Project v2 priority audit/sync support, and dedicated skills for batch orchestration, worktree issue workers, PR review loops, CI/conflict recovery, question batching, failure capture, and interface-map maintenance. A reusable Gitleaks workflow syntax issue in the summary heredoc has been corrected after the workflow began failing before job creation.\n- ~~**security bug discovered 2026-04-03**: `#722` (SEC-20) — `ChangePassword` endpoint does not verify caller identity~~ **RESOLVED** (`#722`/`#732`, 2026-04-04): `ChangePassword` now derives userId exclusively from JWT claims; `[Authorize]` enforced; `UserId` removed from request body; `AuthController` inherits `AuthenticatedControllerBase`; 5 integration tests proving the fix\n- security and identity behavior is converging but still not uniform across all controller families\n- some UX/operator surfaces are functional but not yet keyboard-first or discoverability-first\n- LLM flow now supports config-gated `OpenAI` and `Gemini` providers with deterministic `Mock` fallback for safe local/test posture; degraded provider responses are now structurally distinct (`messageType: \"degraded\"` + `degradedReason`) and the health endpoint supports opt-in probe verification (`?probe=true`); chat-to-proposal pipeline improvements delivered: `LlmIntentClassifier` now uses compiled regex patterns with word-distance matching, stemming/plurals, broader verb coverage, and negative context filtering for negations and other-tool questions (`#571`); parse failures now return structured hint payloads with closest-match suggestions and a frontend hint card with \"try this instead\" pre-fill (`#572`); dedicated classifier and chat-to-proposal integration test coverage added (`#577`); LLM-assisted instruction extraction now delivered (`#573`): OpenAI and Gemini providers request structured JSON output with a system prompt describing supported instruction patterns, parse the response into `LlmCompletionResult.Instructions`, and fall back to the static `LlmIntentClassifier` when structured parsing fails; `ChatService` iterates LLM-extracted instructions (supporting multiple proposals from a single message) and falls back to raw user message parsing when no instructions are extracted; Mock provider unchanged for deterministic test behavior; multi-instruction batch parsing now delivered (`#574`): `ParseBatchInstructionAsync` splits multiple natural-language instructions into individual planner calls, `ChatService` routes multi-instruction messages through batch parsing to generate multiple proposals from a single chat message; board-context LLM prompting now delivered (`#575`, expanded in `#617`): `BoardContextBuilder` constructs bounded board context (columns, card IDs, titles, labels) grouped per column and appends it to system prompts across OpenAI and Gemini providers via `LlmSystemPromptBuilder`; card IDs are included as first-8 hex chars so the LLM can generate `move card ` instructions; context budget increased to 4000 chars with single-query card fetch; **remaining gap**: conversational refinement (`#576`) remains undelivered; analysis at `docs/analysis/2026-03-29_chat_nlp_proposal_gap.md`\n- managed-key shared-token abuse-control strategy is now explicitly seeded in `#235` to `#240` before broad external exposure\n- testing-harness guardrail expansion from `#254` to `#260` is shipped; remaining work is normal follow-up hardening rather than the original wave\n- rigorous test expansion wave seeded 2026-04-03 (`#721` tracker, 22 issues `#699`–`#726`): systematic codebase audit identified 25+ untested infrastructure repositories, zero tests on the central worker, 6 controllers with untested HTTP surfaces, and no golden-path integration test for the capture → proposal → board pipeline; execution is tracked in `docs/TESTING_GUIDE.md`; first delivery: infrastructure repository integration tests (`#699`/`#730` — 77 tests across 7 repo classes against real SQLite); **major wave delivery 2026-04-04** (PRs `#732`–`#739`, 8 issues, ~300 new tests): SEC-20 ChangePassword fix (`#722`/`#732`), golden-path capture→board integration test (`#703`/`#735` — 7 tests proving full pipeline), cross-user data isolation tests (`#704`/`#733` — 38 tests across all major API boundaries), LlmQueueToProposalWorker integration tests (`#700`/`#734` — 24 tests, previously zero coverage), controller HTTP integration tests (`#702`/`#738` — 67 tests covering 6 untested controllers, found 2 pre-existing bugs), proposal lifecycle edge cases (`#708`/`#736` — 74 tests for state machine/expiry/race conditions), OAuth/auth edge cases (`#707`/`#737` — 44 tests, found and fixed `Substring` overflow bug in `ExternalLoginAsync`), MCP full resource/tool inventory (`#653`/`#739` — 9 resources + 11 tools with 42 tests, GP-06 compliant, user-scoping gap fixed during review); **second wave delivery 2026-04-04** (PRs `#740`–`#755`, 8 issues, ~586 new tests with two rounds of adversarial review, 47 review-fix commits): domain entity state machine exhaustive tests (`#701`/`#740` — 174 tests across 7 entities: CommandRun, ArchiveItem, ChatSession, UserPreference, NotificationPreference, CardLabel, CardCommentMention), SignalR hub and realtime integration tests (`#706`/`#751` — 19 tests covering auth, presence lifecycle, multi-user, authorization, edge cases), LLM provider abstraction and tool-calling edge cases (`#709`/`#747` — 101 tests across orchestrator, provider, classifier, registry), data export/import round-trip integrity tests (`#713`/`#752` — 64 tests covering JSON, CSV, GDPR, database, cross-format validation), API error contract regression and boundary validation (`#714`/`#753` — 57 tests across 7 endpoint families with GP-03 contract enforcement), archive and restore lifecycle integration tests (`#715`/`#755` — 74 tests: 45 domain + 29 API covering state machine, cross-user isolation, conflict detection, audit trail), board metrics and analytics accuracy verification (`#718`/`#749` — 61 tests: 51 service + 10 controller covering throughput, cycle time, WIP, blocked cards, done-column heuristic), notification delivery, deduplication, and preference filtering (`#719`/`#746` — 36 tests covering all 5 notification types, deduplication, preference filtering, cross-user isolation, batch operations)\n- MVP dogfooding flow now supports canonical checklist bootstrap in chat (proposal-first, board-scoped); broader template coverage remains future work\n- collaborative editing now includes board/card presence visibility and conflict-hinting guardrails for stale card writes\n- card collaboration now includes threaded comments with mention-linked notifications and moderation-aware edit/delete guardrails\n- capture/inbox realignment is now shipped for the CAP MVP loop (`#200` to `#211`); logging redaction guardrails are delivered in `#212`, and long-list virtualization for inbox/activity views is delivered in `#213`\n- frontend interaction latency budgets and instrumentation are delivered in `#250`: performance mark composable, route-transition/board/inbox/review/home/diff instrumentation, lazy route splitting, and documented thresholds in `docs/PERFORMANCE_BUDGETS.md`\n- post-demo-expansion planning is now explicitly biased toward product legibility before new surface breadth: novice-first entry, board-context continuity, readable review flows, and stronger in-app guidance take precedence over broad autonomy work\n- cold first-run now has launch-criteria proofing beyond route teaching; guided `Home`, durable workspace modes, review-first automation routing, the recoverable `Today` onboarding path, board-centered review/capture handoff, key-route contextual help, and the novice-first docs/help-center stack (root entry docs, chaptered manual, and page-level help/workflow guides) are now shipped, and the dedicated first-run smoke plus launch-criteria guardrail is delivered in `#328`\n- Saul-facing demo reconciliation is now explicit: the core `Home -> Inbox/Capture -> Review -> Board` proof is shipped, the business-facing substrate/trust-cue/hero-path slices are delivered through `#354` plus demo-critical follow-through from `#326` and `#330`; the rehearsal contract is now codified in `docs/product/SAUL_DEMO_REHEARSAL_CONTRACT.md` (`#355`), and the GTM baseline was delivered in `#216` with a timed demo script (`docs/product/DEMO_SCRIPT.md`), thesis-aligned landing copy (`docs/product/LANDING_COPY.md`), and beta intake workflow/cadence (`docs/product/BETA_INTAKE_WORKFLOW.md`) _(caveat — landing copy + beta intake are now **not-in-use per the 2026-06-13 archive pivot** (GTM retired); `DEMO_SCRIPT.md` stays a live demo asset)_\n- demo rehearsal walkthrough (2026-03-27) confirmed the core loop is visually correct but surfaced 9 runtime issues in seed tooling, scenario runner, and DX ergonomics; two are blockers for one-command deterministic rehearsal: seed re-run 409 conflicts (`#387`) and `--skip-llm` proposal alias resolution failure (`#389`); tracked in `#395` with analysis in `docs/analysis/2026-03-27_demo-rehearsal-runtime-issues.md`\n- fresh-registration manual test (2026-03-29) surfaced 2 P0 blockers and 16 additional bugs/observations spanning data isolation, board stability, dark-mode theming, chat utility, and UX polish; full findings at `docs/analysis/2026-03-29_manual_testing_consolidated_findings.md`; P0 blockers: queue data not scoped to the authenticated user (`#508`), board auto-switching on multi-board accounts (`#509`); P1 issues tracked in `#510` through `#515`; P2/P3 in `#516` through `#524`; **no external user onboarding should occur until `#508` is resolved**; two bugs from this session now resolved: activity audit trail not recording board mutations (`#521`, fixed — audit logging wired for all board/card/column/label mutations with `SafeLogAsync` resilience wrapper), archive board 30-second freeze (`#519`, fixed — navigation before reactive state teardown prevents cascading re-renders)\n- _(**Superseded 2026-06-13** by the archive pivot — the cloud/mobile/distribution pillars and the `v0.1.0`→`v1.0.0` GA versioning plan below are **de-scoped**; see the Direction note at the top of this file. Kept as a historical record.)_ platform expansion strategy (2026-03-29) covered four strategic pillars: market adoption (`#544`), packaging/distribution (`#532`), cloud/collaboration (`#537`), and mobile platform (`#540`); master strategy tracker at `#531`; strategy documents at `docs/strategy/`; release versioning plan: `v0.1.0` (self-contained exe) → `v0.2.0` (hosted cloud) → `v0.3.0` (PWA/mobile) → `v0.4.0` (collaboration) → `v0.5.0` (platform maturity) → `v1.0.0` (GA)\n- hands-on UX testing (2026-03-31) surfaced 8 areas of feedback spanning review, inbox, today, home, board, notifications, and LLM chat; 2 P1 issues (capture triage fails on natural-language text `#614`, chat response truncation showing raw JSON `#616`), 11 P2 usability/visual-coherence issues (`#611`–`#613`, `#615`, `#617`, `#620`, `#622`, `#624`–`#627`), and 4 P3 polish/strategic items (`#618`–`#619`, `#621`, `#623`); tracker at `#628`; full analysis at `docs/analysis/2026-03-31_manual_testing_ux_feedback.md`; cross-cutting themes: progressive disclosure needed across review/today/notifications, semantic color vocabulary for status tags, capture pipeline needs LLM-assisted extraction, and chat needs tool-calling/function-calling architecture; LLM tool-calling spike (`#618`) and MCP server spike (`#619`) seeded for strategic planning\n- UX feedback wave 1 delivered (2026-03-31): 6 of 17 issues from `#628` resolved — sidebar footer pinned (`#623`), card drag layout shift eliminated (`#621`), starter-pack modal migrated to design tokens (`#612`), capture triage error messages surfaced with retry hint (`#615`), board context expanded with card IDs for LLM chat (`#617`, N+1 query fixed), review proposal cards now use collapsible detail sections with risk color-coding and keyboard-accessible links dropdown (`#626`)\n- UX feedback wave 2 delivered (2026-03-31): 5 additional issues resolved — both P1 blockers closed: capture triage now handles dash-separated (` - `) and semicolon-delimited text with first-segment context hints and single-sentence fallback (`#614`), chat JSON array truncation detection extended to `[`-started responses with degraded message UX (`#616`); P2: notification list now has type-colored left borders, type badges, smart same-type grouping, time-based section headers, and batch \"Mark all read\" with board-scoped optimistic update (`#625`); P4: global search endpoint now supports `maxResults`/`offset` pagination with `hasMore`/`totalCardCount` response fields and frontend \"Load more\" in command palette (`#610`); ops: `ci-extended.yml` now auto-triggers on `.csproj`/workflow/deploy/script changes, PR template and AGENTS.md updated (`#608`); remaining open from `#628`: 0 P2 (~~`#613`~~ delivered in `#665`), 2 P3 strategic spikes (`#618`, `#619`) both completed with implementation waves delivered (Phase 1+2 for tool-calling `#647`, Phase 1 for MCP `#648`)\n- LLM tool-calling spike (`#618`) completed (2026-04-01): architecture document at `docs/spikes/SPIKE_618_COMPLETED.md`; decided on custom implementation over Semantic Kernel (~800 LOC, zero new dependencies), extending `ILlmProvider` with `CompleteWithToolsAsync`, 11 tools (5 read + 6 write, writes always produce proposals per GP-06), new `ToolCallingChatOrchestrator` with multi-turn loop (max 5 rounds, 60s timeout), Mock provider with pattern-based dispatch, ~$0.00088 per 3-round conversation on GPT-4o-mini; implementation tracker at `#647` with phase issues `#649` (read tools + orchestrator — delivered), `#650` (write tools + proposals — delivered), `#651` (Phase 3 refinements — delivered, PR `#773`)\n- LLM tool-calling Phase 1 delivered (`#649`, 2026-04-01): `CompleteWithToolsAsync` added to `ILlmProvider` with OpenAI, Gemini, and Mock implementations; 5 read tool executors (`list_board_columns`, `list_cards_in_column`, `get_card_details`, `search_cards`, `get_board_labels`) in Application layer; `ToolCallingChatOrchestrator` with multi-turn loop (max 5 rounds, 30s/round, 60s total timeout) and graceful degradation to single-turn on failure; Mock provider uses pattern-matching dispatch table for deterministic simulation; SignalR `ToolStatusEvent` integration for intermediate state streaming; `ChatService` delegates to orchestrator for board-scoped sessions with automatic single-turn fallback; 67 new tests\n- LLM tool-calling Phase 2 delivered (`#650`/`#731`, 2026-04-03): 6 write tool executors (`propose_create`, `propose_move`, `propose_archive`, `propose_update`, `propose_bulk_move`, `propose_create_column`) in Application layer; EF migration adds `ToolCallMetadataJson` for provenance; orchestrator now serves 11 tools (5 read + 6 write); writes always produce proposals per GP-06; frontend tool-status indicators show write-tool progress via SignalR\n- Double LLM call eliminated (`#672`/`#727`, 2026-04-03): `ChatService` reuses the orchestrator's text response when no tools are called instead of making a second LLM call; halves latency for non-tool chat messages; remaining follow-up items: argument replay (`#673`)\n- MCP server spike (`#619`) completed (2026-04-01): architecture document at `docs/spikes/SPIKE_619_COMPLETED.md`; decided on official MCP C# SDK (`ModelContextProtocol` v1.2.0), embedded in API process with `--mcp` startup flag, stdio transport first (Claude Code/Cursor), 9 resources under `taskdeck://` URI scheme, 9 tools (2 read + 5 write + 2 proposal management, `approve_proposal` intentionally excluded), API key auth (`tdsk_` prefix) for remote HTTP transport, write tools return proposal IDs for review-first compliance; implementation tracker at `#648` with phase issues `#652` (minimal prototype), `#653` (full inventory), `#654` (HTTP + auth), `#655` (production hardening, deferred)\n- MCP minimal prototype delivered (`#652`/`#664`, 2026-04-01): `ModelContextProtocol` NuGet v1.2.0 added; `IUserContextProvider` interface in Application layer with `StdioUserContextProvider` implementation; `BoardResources` class with `[McpServerResource]` for `taskdeck://boards` resource returning compact JSON (id, name, columnCount, cardCount, isArchived, updatedAt); `--mcp` startup flag in `Program.cs` selects stdio host builder skipping web server overhead; 11 integration tests covering shape, archived exclusion, counts, empty results, and multi-user scoping\n- UX feedback wave 3 delivered (2026-04-01): review proposal card UX improved (`#613`/`#665`) — sticky action footer with `position: sticky; bottom: 0` keeps action buttons visible regardless of card content length, cards constrained to `max-height: 70vh` (80vh mobile) with internal scrolling, detail section heights capped at `12rem`\n\n--- docs/IMPLEMENTATION_MASTERPLAN.md ---\n# Taskdeck Implementation Masterplan\n\nLast Updated: 2026-07-26\n
\nPlanning Horizon: the revival waves in `docs/REVIVAL_PLAN.md` (truth + safety → transcript engine → open-beta launch → generalist expansion [Phase 4, ADR-0046 Accepted]), then a maintainer checkpoint on beta traction — _(historical: 2026-06-13→2026-07-10 this was the finite archive-pivot waves; before that an open \"Next 8 to 12 weeks\" release horizon)_\nCompanion Active Docs:\n- `docs/STATUS.md`\n- `docs/IMPLEMENTATION_MASTERPLAN.md`\n- `docs/TESTING_GUIDE.md`\n- `docs/MANUAL_TEST_CHECKLIST.md`\n- `docs/GOLDEN_PRINCIPLES.md`\n\n## Delivery update (2026-07-26, security runway)\n\n- **SQLite native security floor (`#1345`):** centrally pin `SQLitePCLRaw.bundle_e_sqlite3` 2.1.12 and make Infrastructure's dependency direct, which moves the matched bundle/core/provider/native family from 2.1.6 to 2.1.12 without enabling global transitive pinning. A runtime regression enforces SQLite >= 3.50.2 (2.1.12 loads 3.53.3); the NuGet vulnerability audit is clean, EF reports no pending model changes after a fresh update, and a self-contained `win-x64` binary reaches `/health/ready` with SQLite loaded.\n\n## Delivery update (2026-07-25, PR-queue clearing wave)\n\n**8 PRs merged; the open-PR queue is down to a single human-gated draft.** Per-PR gate: independent adversarial review, all-severity findings fixed with posted evidence, required CI green on the exact head, every thread triaged.\n\n- **`#1469` (`#1462`)** — frontend `Proposal.approvedRevisionId`, declared **required** (the key is always on the wire), contract-only per `#1298`, guarded against a dead-code sweep by an exported type alias.\n- **`#1337` (`#1299`) — REVIVAL-03 licensing pack shipped.** `LICENSING.md` (MIT-forever, never-gated free boundary, additive-only commercial posture), reserved `ee/`, DCO guidance + SHA-pinned advisory CI job, MIT metadata across npm and 11 `.csproj`. Root `LICENSE` untouched. Name availability researched and recorded on `#1299` with filing costs and a **do-not-file-now** recommendation; pre-commercial legal residuals → **`#1482`**.\n- **`#1477` + `#1481` (`#1123`)** — the release pipeline can now be **rehearsed without pushing a tag**, which is what makes `#1303`'s tag push verifiable in advance rather than a first-run. Rehearsed live (run `30160400273`): four platforms built, **three smoke-tested**, `create-release` skipped, zero tags/releases created. `osx-x64` is built, packaged, checksummed and uploaded **without ever being launched** — it is cross-arch on the arm64 `macos-latest` runner (`if: matrix.rid != 'osx-x64'`), so that one archive carries less release evidence than the other three. Worth knowing before the `#1303` tag push.\n- **`#1478` (`#1271`) — dogfooding instrumented**, and the baseline measured: sustained use has **not** started (8 active days, three months stale, most boards fixtures), though the core loop works (**17/20 proposals reached Apply**, counted by `AppliedAt` — a status-based count reads 1/20 because `Dismiss()` overwrites an `Applied` status). Residual accuracy questions → **`#1480`**.\n- **`#1471`, `#1472`, `#1479`** — canonical-doc reconciliation, human-action tracking for `#1457`'s trust gate and the recurring worktree prune, and two record-only check-offs taken on explicit maintainer instruction.\n- **`#1295` closed as superseded** (13/13 bypass failures; targeted floor v1.3.0 vs installed 1.6.5). The overlay is still *needed* — 11 rule-classes are `allow` at every tier including T4 — so the salvage plan and acceptance criteria live on **`#1293`**.\n- **Repo hardening:** force-push and deletion blocked on `main` (otherwise deliberately relaxed); 288 truncation-hidden project-priority mismatches synced (`#1474`).\n- **`#1270` backlog triage:** 12 issues closed with dated notes; an adversarial pass bounced **13 of 25** proposed closures, including the `#1123` ship-gate item. `#1270` stays open — two of its own ACs are obsolete against ADR-0044 / REVIVAL_PLAN §6.\n- **Seeded:** `#1470` `#1473` `#1474` `#1475` `#1476` `#1480` `#1482`, plus upstream `agent-harness#56`.\n- **Remaining hold:** `#1457` only — pin refreshed to the installed floor; the interactive `/hooks` trust session and live canaries are maintainer-only.\n\n## Delivery update (2026-07-23/24, overnight wave)\n\n**6 PRs merged + 3 dependabot PRs** — the four feature/substrate PRs below plus `#1447` (the docs sync recording the maintainer-merged `#1414` stored-preview presentation) and `#1448` (below) — (per-PR gate: two independent adversarial review lenses, all-severity fixes with posted evidence, full backend suite on the exact head where code changed, CI green, bot window + content sweep). This wave's own delivery sweep was `#1454`; `#1448`, `#1427`, and dependabot `#1441` merged after it ran, so their entries here were recorded on 2026-07-25:\n\n- **Approved-revision pinning (`#1439`; closes `#1428` and `#1424`):** approve pins `ApprovedRevisionId` and Apply executes exactly that revision (null pin = original operations; post-approval raced revisions are inert). Migration backfill pins the latest revision saved at or before `DecidedAt` — a deliberate reviewed reversal of latest-revision parity in favor of the \"Apply executes exactly what the approver saw\" invariant. Read/decide DTOs return the effective operation set with rebuilt presentation; Rejected proposals freeze at decision time; the MCP terminal stored preview is suppressed when an effective revision applies. Full suite 7430/0/1 on the merged head. Residuals: `#1444` (revision-aware list mapping) **delivered** — list reads now return the effective set through one shared dispatcher plus a batched two-phase revision read; the frontend `approvedRevisionId` exposure **delivered** by `#1462` (PR `#1469`, merged 2026-07-25 — the field is declared *required*, not optional, because the key is always on the wire, so a field-by-field rebuild that drops the pin fails to compile). Still tracked: `#1453` (reject-time pin — the timestamp cutoff is not commit-visibility; display-only), `#1464` (inverted review-surface caveat, terminal proposals only), `#1465` (dismissing a rejected proposal drops its frozen revision), `#1467` (list resolution bounded in bytes but not rows, and read across two snapshots), `#1468` (frontend specs are never type-checked — **415** pre-existing errors surface when `src/tests/**` is lifted from `tsconfig.app.json`, against a clean baseline of 0), `#1470` (`DATA_MODEL.md` omits `ApprovedRevisionId`/`DeferredUntil`; the \"855 lines, 37 entities\" figure carried by its mirrors is stale — the file is 897 lines).\n- **Nightly k6 gate recalibration (`#1449`; closes `#1445`):** tail gates moved to global p99 < 5000 ms / board-write p95 < 4500 ms after the gate ran red 3 of 5 nights on an identical SHA (observed same-code board-write p95 2.0–3.0 s vs the old 2200 ms). Calibration evidence inline in the script and in `#1445`; warning-band edges pinned by tests; all doc/contract mirrors synced. Seeded `#1446` (the write-convoy tail itself + trend visibility for the accepted masking window). Confirmed green on the first post-recalibration nightly (run `30071303816`, `36d563d7`, 2026-07-24 06:06Z) — one night, not yet a trend.\n- **AuditLog flake closed (`#1451`; closes `#1438`):** the class adopted the workerless factory (#1391 family), 6× deterministic runs; seeded `#1452` (no test covers `AuditRetentionWorker.ExecuteAsync`'s real startup path — pre-existing).\n- **LLM quota-reservation hardening (`#1427`; `#1313`, atomicity deferred to `#1435`):** closes a client-controllable usage-erasure hole — streaming/non-streaming `ChatService` and the extractor finalize with `CancellationToken.None` and settle in `finally`, so aborting a stream after tokens are billed (including read-one-token-and-disconnect) no longer discards the usage record. Also recovers a TTL-swept reservation's real billed tokens into a committed row (idempotent), floors `ReservationEstimatedTokens` at 1 so reservations stay visible to budget sums, settles the capture-triage reservation in `finally`, pins the release paths with tests (provider-throw, zero-token, no-LLM bootstrap, board-context throw, error-event-only) while pinning cancel-after-billed-tokens to the opposite rule — commit, never release, since releasing there would reopen the very bypass M1 closes — and wraps request/board-context construction so setup failures release rather than leak to TTL. The check-then-insert atomicity guarantee is **not** closed: it is not closeable in-process (over-admits even under a global full-span lock, due to cold-start WAL `-shm` read-visibility) and needs a redesign routed to the maintainer as `#1435`; its concurrency tests are skipped pending that. Merged on the maintainer's merge-with-tracked ruling; residual P2s as `#1431`.\n- **Frugality mode promoted into the manual (`#1448`):** the overlay that survived two full runs now lives in `docs/agentic/OVERNIGHT_LOOP.fable.md` instead of the launch prompt (enforcement-ladder rule). Reusable lesson from its review: when a bot converges on a seam by enumerating exemptions one round at a time, invert the rule instead of extending the enumeration — one allowlist inversion (only pure mechanical-motion packets are sampleable; suite/CI verdicts and reviewer/settlement packets never are) ended a three-round cycle.\n- **Dependabot:** `#1443` (.NET 8.0.29 patch train) + `#1440` (npm minor-patch group) merged. `#1441` (actions group) was staged green and then merged on explicit maintainer authorization — workflow-file PRs stay maintainer-merge-only. `#1442` (pinia 3→4 major) was red and is closed to snooze, with the real migration slice tracked as `#1455`.\n- **Process/estate notes:** duplicate tracker `#1450` consolidated into `#1444`; Gemini Code Assist (consumer) is sunset and Copilot review quota-exhausted — Codex is the only live external review bot.\n\n## Delivery update (2026-07-18, post-wave)\n\nStored-preview review presentation — **1 PR maintainer-merged** (`#1414`, closes `#1397`; merged 2026-07-18 15:20Z after the frugal wave wrapped):\n\n- **Expired/terminal proposals present the stored preview instead of a live diff that `400`s (`#1414`, `#1397`):** frontend-only slice implementing the maintainer decision recorded on `#1397` — both review shells short-circuit read-only proposals (expired by server-authoritative or client clock, or terminal) to the stored `diffPreview` under an explicit read-only banner, render a backend `400` as an explicit **invalid** state (a pending zero-op proposal is flagged as containing no operations to apply — Apply will reject it — instead of showing an approvable \"No changes\" surface), and relabel the expired-path button to \"View/Hide stored preview\". Adds shared `isProposalReadOnly` / `isValidationError` helpers. The `#1395` backend `400` contract is unchanged. Residual review P2s tracked as `#1436` (merged-with-tracked per the maintainer's call).\n\n## Delivery update (2026-07-18, wave 2)\n\nFrugal wave — **2 PRs merged** (per-PR gate: independent adversarial review, all-severity findings fixed, required CI green):\n\n- **Artefact-extraction permit/concurrency gate (`#1430`, split from `#1379`):** a new `ArtefactExtractionGate` (Application singleton) takes a non-blocking permit before the parse worker spawns and releases it on the completed and abandoned paths, so saturation yields a pre-parse `TooManyRequests` (no history row, no new thread); bound by `ExtractionMaxConcurrency` (default 2, `[Range(1, 64)]`, startup-validated). This is the verified-sound half split out of the parked `#1417` resource-ceiling work — the decompression-bomb containment half is NOT here (PdfPig 0.1.15 decodes xref streams with a hard-coded provider before any injected ceiling, bypassing a provider-injection ceiling) and continues under `#1429`. Adds **ADR-0047** (extraction resource bounding: permit gate + provider-injection ceiling as ObjStm-covering defense-in-depth with the documented xref gap) and **ADR-0048** (decompression-bomb containment boundary — a memory-capped extraction worker process, Job Object / cgroup, reversing the earlier sidecar rejection on the new evidence).\n- **Empty-op permission validation always gates board access (`#1432`, `#1426`):** `AutomationPolicyEngine.ValidatePermissionsAsync` no longer short-circuits an empty operation list to `Success` with the board access gate skipped — the full requester/board access gate now always runs, and only the per-operation contract validator is skipped when the list is empty. Emptiness stays a legitimate transient shape (revise-into-validity, `#1423`); the \"at least one operation\" rejection remains the structure gate's job (which runs before permissions in every chain), so approve == apply is unchanged and the change is strictly additive restriction. Closes the `#1415`/`#1425` bolt-on-your-own-board-access trap.\n- **Nightly k6 GREEN:** the first nightly run after the `#1359` repair (run `29632619187` on `326b6b5b`) passed; the `#1359` failure-ledger row was flipped to resolved (`4fdae133`).\n- **Seeded this wave:** `#1429` (memory-capped extraction worker — the ADR-0048 boundary), `#1431`, `#1433`, `#1434`, `#1435`, `#1436`. `#1427` (LLM quota-reservation robustness hardening, `#1313`) was in the final review gate when this wave closed and **has since shipped** in the 2026-07-23/24 wave above; its atomicity redesign is still open as `#1435`. Standing human-gated holds remain `#1337` and `#1295` — the latter dispositioned by the maintainer on 2026-07-25 as return-to-draft, do-not-revive-in-place (rebuild a minimal overlay from current `main` if `#1293` proceeds, rather than repairing a stale branch by conflict churn).\n\n## Delivery update (2026-07-18)\n\nApprove == apply trust-class closure — **6 PRs merged** (per-PR gate: independent adversarial review, all-severity findings fixed, required CI green): closes the preview/approve == apply trust-violation class (\"a user approves or previews something the executor then refuses\") server-side across the diff, approve, and MCP surfaces (the `#1370`→`#1374`, `#1376`→`#1395`, `#1398` chain).\n\n- **Diff permission/existence gates (`#1413`, `#1398`):** `GetProposalDiffAsync` (both paths, before the cached fast-path return) now runs the same `ValidatePermissionsAsync` Apply runs — requester-exists → `404`, board-exists → `404`, board-access → `403`, then the operation-contract validator — closing the third and last preview/apply asymmetry. Status-agnostic: terminal proposals no longer disclose stored board-derived content on preview; access errors (`403`/`404`) surface after the earlier structure/expiry gates pass (an expired, access-revoked proposal still reports expiry).\n- **Approve-time gates (`#1423`, `#1416`):** `ApproveProposalAsync` runs Apply's structure (`400`) → expiry (`409`, the existing domain-transition contract) → permission/contract (`400`/`403`/`404`) gates on the effective revision-aware operation set before committing the transition, so a zero-op or access-revoked proposal fails at approve instead of only at Apply. Seeded `#1424` (approve/get DTO returns original ops when a revision exists).\n- **MCP `proposal_detail` gating (`#1425`, `#1415`):** the resource no longer serves the raw stored `DiffPreview` — open proposals route through the fully-gated `GetProposalDiffAsync`; terminal proposals serve the stored preview but re-check requester/board access via a new `GetTerminalProposalStoredPreviewAsync` seam. Adds a `diffPreviewSource` (`live`/`stored`) provenance marker.\n- **SQLite timestamp-boundary correctness (`#1421`, `#1403`):** parameterized `DateTimeOffset` predicates (UTC-normalized) replace the fixed-width `.fffffff` bound strings in `AuditLogRepository` and `OAuthAuthCodeRepository`, fixing off-by-one-tick comparison at EF's zero-fraction (trailing-zeros-trimmed) boundary. Seeded `#1422` (repo-wide timestamp-seam sweep).\n- **Dead-path removal (`#1420`, `#1409`):** removed the unused `ApiKeyService.ValidateKeyAsync` usage-recording path + `ApiKey.RecordUsage()` (a dual-writer trap; MCP auth records usage in `ApiKeyMiddleware`). `LastUsedAt` untouched.\n- **Test isolation (`#1419`, `#1418`):** `WorkspaceApiTests` moved to `HostedWorkerDisabledTestWebApplicationFactory` so a live capture-lane worker can't pre-empt a seeded `Processing` row (the `#1335` boundary). Test-only.\n\n## Delivery update (2026-07-17, wave 2)\n\nOvernight correctness + test-reliability wave #2 — **7 PRs merged** (per-PR gate: independent adversarial review, all-severity findings fixed, required CI green; the late-evening/overnight follow-on to the 11-PR sweep below):\n\n- **Hosted-worker test isolation (`#1394`, `#1335`):** a new `HostedWorkerDisabledTestWebApplicationFactory` removes app-assembly hosted services from the test host through a shared predicate (also carried by a guard test), adopted by the LLM-queue, outbound-webhook, and automation-proposal integration suites plus a new `ProcessNextClaimRaceTests` split out from `QueueClaimRaceTests`. Retires the hosted-worker pre-emption flake family and resolves the `test/background-workers` failure-ledger row (with `#1391`).\n- **AuditRetention determinism (`#1391`, `#1383`):** the AuditRetention integration suite adopts the workerless factory and hardens read-back (affected-count assertion, InvariantCulture, `ReloadAsync`); root cause was the live `AuditRetentionWorker` startup pass racing 100/200-day backdated seeds. Pins the EF SQLite `DateTimeOffset` storage format empirically.\n- **Deterministic Redis dispose/connect seam (`#1392`, `#1332`):** `RedisCacheServiceTests` reaches the connect seam via a dedicated named background `Thread` (not `Task.Run`), eliminating the thread-pool-saturation flake, and disposes its `ManualResetEventSlim`s. Resolves the `test/redis-lifecycle` failure-ledger row.\n- **Preview==apply parity, third path (`#1395`, `#1376`):** `GetProposalDiffAsync` now runs the structure-then-expiry gates on every diff path including the cached `DiffPreview` fast path (expired/zero-op now `400`, was `200`/`404`), extending the `#1374` parity contract. Seeded `#1397` (frontend UX + coverage) and `#1398` (fold permission gates into diff).\n- **Export extraction-history N+1 removed (`#1396`, `#1387`):** a new `IArtefactExtractionRepository.GetByArtefactsForUserAsync` batch read (user-scoped IN query, 900-id cap, SQLite TEXT-ordering parity) is fed by the export's 500-id chunks. Seeded `#1399` (streaming-path N+1).\n- **Production timestamp culture-invariance (`#1400`, `#1393`):** InvariantCulture on 5 hand-built SQLite timestamp string sites (`AuditLogRepository`, `OAuthAuthCodeRepository` — now `.UtcDateTime`-normalized — and `KnowledgeFtsSearchService`) with hostile-culture regression tests. Seeded `#1403` (fixed-digit vs EF-trimmed boundary residual).\n- **MCP per-key budget enforcement point (`#1401`, `#1384`):** the 60/min per-key budget is charged once inside `ApiKeyMiddleware` immediately after key resolution — before the Users lookup and `UpdateLastUsedAsync` — so over-quota keys no longer drive auth-stage DB work; the endpoint-stage policy is removed (one budget, checked once) on both pipelines, preserving `#1381` pre-auth-IP semantics and the `429` contract. Seeded `#1402` (swallowed `UpdateLastUsedAsync` persistence failure) and `#1404` (stale-owner-key IP-budget escape).\n- **Seeded this wave:** `#1397`, `#1398`, `#1399`, `#1402`, `#1403`, `#1404`. **Still open / not shipped:** `#1386` (wave-1 final review round); standing human-gated holds `#1295`, `#1337`, `#1359`.\n\n## Delivery update (2026-07-17)\n\nOvernight substrate + correctness wave — **11 PRs merged** (per-PR gate: independent adversarial review, all-severity findings fixed, required CI green; full backend suite reported 7223 passed / 0 failed / 1 skipped after `#1373`):\n\n- **Test-substrate parity (`#1373`, `#1282`):** a shared `UseTaskdeckSqlite` registration helper in Infrastructure now backs both production DI and the API integration test factory, so SQLite WAL/busy-timeout settings can no longer drift between them. Retires the `test/sqlite-concurrency` failure-ledger flake and underwrites the `#1366` presence-parity result below.\n- **REVIVAL-02 Phase-1 ship gate (`#1375`, `#1298`):** the fabricated Paper review undo timeline is removed and reversibility copy becomes factual apply-risk guidance (\"Apply considerations\") while the confidence label renders \"Operation safety\"; the side-effect wire shapes are preserved for GP-03 (full contract detail in `docs/STATUS.md`).\n- **Proposal preview/apply alignment (reorder, collision, structure) (`#1374`, `#1370`; seeded `#1376`):** clamped reorder positions now surface in the diff, create-card id collisions fail at validation with a stable `409`, and a shared `ProposalOperationStructureValidator` runs before original-proposal diffs; a parity contract test locks it in.\n- **MCP host-security fail-closed (`#1372`, `#1367`):** the standalone MCP host guard mirrors `HostFilteringMiddleware` exactly — fails closed on separator-only/blank `AllowedHosts`, preserves port-suffixed and whitespace-bearing literals — proven by a new in-process integration test with a mutation.\n- **Migrator flake retired (`#1377`, `#1357`):** the concurrent-migrator test now asserts final schema state (any-`SqliteException` collision signature, at most one fault, exact `__EFMigrationsHistory` equivalence), plus a deterministic fail-open collision test and an `AcquireLock` exclusivity contract test.\n- **Bounded artefact extraction (`#1378`, `#1369`; `#1379` expanded to a hard wiring gate):** a wall-clock budget (`Artefacts:ExtractionTimeoutSeconds`, default 30s) with warning-bearing `extraction-timeout` history rows and abandoned-task handling, exercised by real PdfPig / plain-text extractors through the budgeted path.\n- **Paper P-I E2E ship gate (`#1362`, `#1274`; seeded `#1363` earlier, `#1380`, `#1382`):** core E2E re-pointed at Paper-default sessions with explicit frozen-Legacy opt-outs; full axe WCAG 2.1 A/AA on Home/Today/Inbox/Review/seeded Board/Login; a real capture → review → apply lane with a hard-asserted confirmation dialog; a `PaperBoardCard` nested-interactive fix + focus-follows-selection; `--faint` token contrast floors; a Boards shortcut ledger. Builds on the 2026-07-14 `#1274` delivery update below.\n- **Presence broadcast delivery proof (`#1366`, `#1365`, `#1371`):** the presence stress test now proves join/leave broadcast delivery (not just tracker membership) with fail-closed controls, green 15/15 after the `#1373` parity fix.\n- **Batched export blob loads (`#1385`, `#1355`):** the buffered GDPR account export now loads artefact blobs through a new `SourceArtefactRepository` batch read in bounded chunks, with a batch-id-count guard against the SQLite parameter limit (pass-side boundary pinned at 900 ids) and export-JSON round-trip + missing-blob contract tests. Closes the LOW efficiency finding from the `#1341` security review.\n- **MCP pre-auth failure budget + admission control (`#1381`, `#1368`):** the per-IP pre-auth limiter spends budget only on authentication failures (successful auth never consumes; exhausted addresses reject before the API-key lookup via non-consuming inspection); a per-IP concurrency gate (`RateLimiting:McpAuthenticationPerIpConcurrency`, default 16) caps in-flight pre-auth work; consumption is abort-proof (marker + `finally`, so aborted 401s still spend); trusted forwarded headers now also apply to the standalone MCP host (default OFF — XFF never trusted from an unknown peer).\n- **Same-night hotfix of the `#1377` collision test (`#1390`):** the fail-open collision test's barrier design flaked an unrelated PR (run 29552875836 — fast runners finished the chain before the loser applied anything, failing the required-collision assertion); the interception is now staged structurally (migrator A provably mid-chain via `__EFMigrationsHistory` polling before B is released) and a pathological staging miss passes gracefully with a loud `WARNING: STAGING MISSED` diagnostic.\n- **Seeded this wave:** `#1376`, `#1379`, `#1380`, `#1382`, `#1383` (AuditRetention flake), `#1384`, `#1387`, `#1388`. **Still open / not shipped:** `#1386` (final review round in flight); standing human-gated holds `#1295`, `#1337`, `#1359`.\n\n## Delivery update (2026-07-14)\n\n- **Paper-default regression alignment (`#1274`):** the shared authenticated Playwright session now follows the production Paper default, while frozen Legacy-selector suites opt out explicitly. Core coverage now exercises the real capture → Accept → Review → approve/apply → board flow and runs the full axe WCAG 2.1 A/AA ruleset against settled Paper Home, Today, Inbox, Review, and a seeded Board, plus Login and functional skip-link behavior. The global Vitest Legacy pin remains documented and intentional because those unit tests directly assert the frozen Legacy DOM. Focused Chromium verification: 37/37 across six core specs.\n\n## Purpose\n\nThis is the active execution guide for sequencing past, current, and the revival waves defined in `docs/REVIVAL_PLAN.md` (truth + safety before strangers → transcript engine → open-beta launch → traction checkpoint).\n`docs/STATUS.md` is authoritative for current shipped reality; this document tracks delivery history, planned work, roadmap sequencing, and strategic intentions.\nUpdate this file at the end of each meaningful delivery cycle or when new work is seeded.\n\n## Direction (2026-07-10, maintainer-decided): revival — free open beta → commercial horizon\n\n**The 2026-06-13 archive pivot is superseded (ADR-0044).** After the maintainer's successful WhisperX + cheap-LLM prototype and a two-track code + market analysis (`docs/analysis/2026-07-10_revival_assessment.md`), Taskdeck is being revived and shipped as a **free, wide-open beta** — for adoption, feedback, and exposure — while the maintainer develops the commercial side. Positioning: **the local-first, review-first action-item engine** (transcripts/notes in from any source, evidence-linked proposals out, applied to your board only on your approval), with the write-gated MCP server as the developer-facing second act. Everything shipped under MIT stays MIT — no retroactive relicensing (ADR-0044 Decision 3).\n\nThe active planning spine is **`docs/REVIVAL_PLAN.md`**: Phase 0 (charter + dogfooding), Phase 1 (truth + safety before strangers — the repurposed archive exit criteria become the v0.1 ship gate), Phase 2 (the LLM transcript-triage engine, the largest authorized new-backend-surface slice), Phase 3 (slim + launch), Phase 4 (generalist expansion — **ADR-0046, Accepted 2026-07-13, tracker GEN-00 `#1327`**: artefact intake beyond transcripts, project dossiers, generalist legibility, friends-family channel; the twin generalist app is deferred behind the GEN-12 `#1326` evidence gate), plus the other scoped exceptions enumerated in the plan's §7, then a **traction checkpoint** (~8 weeks): if the beta shows no traction and dogfooding has not stuck, fall back to the archive plan below, which Phase 1 keeps ~90% intact. New backend surface is authorized only where REVIVAL_PLAN §7 grants it (Phase-2 grants per ADR-0044; Phase-4 grants per ADR-0046). The finite-work discipline from `COURSE_CORRECTION.md` carries over — work not on the ratified wave list is, by definition, not taken.\n\nGoals, in order:\n\n1. **Truth + safety before strangers** — de-stub the fabricated Today dossier (`#1272`), remove the fake undo affordance, gate registration, protect main, ship v0.1.0 through the never-exercised release pipeline, make the README/onboarding/fonts honest and welcoming (REVIVAL wave, Phase 1).\n2. **The transcript engine** — LLM-backed triage for transcript sources behind `ICaptureTriageService`, durable Transcript entity, evidence-span deep links, OpenAI-compatible provider, risk-tiered approvals (REVIVAL wave, Phase 2).\n3. **Open-beta launch** — dead-surface amputation, MCP packaging, privacy-respecting feedback channel, launch (REVIVAL wave, Phase 3).\n4. **Generalist expansion** (ADR-0046) — artefact intake (screenshots/PDFs/files → extraction → the review-first triage lane), per-board dossiers from approved state, mode-scoped generalist legibility, friends-family beta channel (GEN wave, Phase 4 — strictly subordinate to the v0.1 ship gate).\n5. **Checkpoint** — re-evaluate on adoption/feedback + friends-family signals; fall back to archive only if there is no organic traction and dogfooding has not stuck, and any mixed outcome requires an explicit maintainer assessment/plan amendment; record the GEN-12 twin-app gate decision. **Instrumented 2026-07-25** (`docs/dogfooding/`): a dedicated dogfooding database, a read-only snapshot script, a friction log, and a rubric fixed before the data existed. Note a canonical-doc conflict this surfaced and did not resolve: `REVIVAL_PLAN.md:49/:149` starts the ~8-week clock at **Phase 0**, while ADR-0044 Decision 6 starts it at **beta launch** — weeks apart. The dogfooding guide follows the plan (the named active spine); the conflict itself still needs a ruling.\n\n## Direction (2026-06-13, superseded 2026-07-10): finish-for-personal-use → archive\n\n> **Superseded by the 2026-07-10 revival pivot above (ADR-0044).** Retained because the closeout analysis and most of its work items remain load-bearing: the archive exit criteria (#1278) are repurposed as the v0.1 ship gate, and the archive path is the documented fallback if the beta checkpoint fails.\n\n**Taskdeck will not be distributed.** The maintainer's decision is to finish it as a personal-use tool, then archive it as a completed project. This **supersedes** both the 2026-06-05 ship-first framing (v0.1.0 → … → v1.0.0 GA) and the 2026-03-29 platform-expansion \"four pillars\" framing. Goals, in order:\n\n1. **Finish + activate the Paper UI** as canonical (ADR-0038 ratified) — **DONE**: the default-theme flip to `paper` **shipped 2026-06-27** (`#1252`; `paperThemeStore` default `off`→`paper` + a `td.paper.mode.v2` storage migration). All prerequisites shipped first: the `#1161` File-away dismiss affordance (`#1219`) + the reachable in-app Appearance theme toggle / Legacy escape hatch (`#1221`, 2026-06-19), and the Paper-review de-stubs (`onPreviewDiff` `#1234` / `onDefer` + `onReportBadSuggestion` `#1245`, 2026-06-27). Legacy stays reachable behind the Appearance toggle. Remaining Paper work is polish (Wave 4), not activation.\n2. **Trivially easy to run** locally — one-command dev-up plus a self-contained exe as the canonical personal run path.\n3. **General quality** — backend correctness + usability, proactively found.\n4. **Archive cleanly** — docs reflect the final state; de-scoped trackers closed with dated pivot notes.\n\n**De-scoped permanently** (closed as not-planned or parked during archive closeout, with dated notes): distribution & code-signing (`#1167`), GTM/marketing (`#544`/`#546`/`#550`), cloud & collaboration (`#537`/`#548`), mobile (`#540`), beta intake, multi-DB *production* support (the production runtime is SQLite-only forever; the PostgreSQL Testcontainers compatibility lane in CI — `Taskdeck.Integration.Tests` / `reusable-container-integration.yml` — remains as a legacy regression guard, not a product direction), and multi-user scale work. The platform-expansion strategy docs under `docs/strategy/` and the cloud/platform ADRs **0014, 0020, 0023, 0026–0028** are retained as historical records of parked tracks, not active plans. Three ADRs in the 0023–0029 range decide behaviour that is **still live** in the single-instance app — only their multi-instance/enterprise premise is parked: **ADR-0024** (the `ICacheService` cache-aside abstraction, in-memory by default), **ADR-0025** (the `AddTaskdeckSignalR` Redis-backplane wiring, config-gated and dormant in the single-instance default), and **ADR-0029** (optional TOTP MFA + OIDC/OAuth). Likewise the single-self-contained-executable packaging path in `docs/strategy/02_PACKAGING_DISTRIBUTION_STRATEGY.md` stays the active personal run path; only its installer / cross-platform-distribution / GTM framing is parked. **ADR-0004** (shared-schema multi-tenancy) also stays **live** for its cross-user-isolation behaviour — enforced today by per-`UserId` and board-access predicates rather than a `TenantId` column (no `TenantId` symbol exists in `backend/src`, `backend/tests`, or the frontend), with the `403`/`404` existence policy enforced in the running app (consistent with GP-02 Claims-First Identity and GP-03 Stable Error Contracts); only its multi-organization / hosted-SaaS expansion premise (including any `TenantId`-keyed shared-schema tenancy) is parked — agents must neither park the live cross-user isolation security model nor resurrect multi-org tenancy work. The planning principles below remain valid for the *product* (review-first, capture-friction, novice legibility) even though the *distribution* roadmap is retired.\n\n## Planning Principles\n\n> **Precedence note (2026-07-10):** ADR-0044 and `docs/REVIVAL_PLAN.md` take precedence wherever the historical tranches or principles below imply a different execution order. The active priorities are truth + safety before strangers, the transcript engine, and the bounded open-beta launch, followed by the checkpoint. The review-first / capture-friction / novice-legibility principles remain mandatory throughout.\n\n- `docs/STATUS.md` is authoritative for current shipped reality.\n- Product north star: make capture nearly free and keep automation safe through review-first proposals.\n- Roadmap v4 north star: every automation-originated board write routes through proposals and human approval; manual board UI edits remain direct and auditable, not proposal-queued.\n- Mutation safety and exfiltration safety are distinct. Proposal-only writes do not protect local-first privacy; outbound data must be governed by EgressEnvelope, disclosure registry, MCP tool hash-pinning, and telemetry guardrails.\n- Product legibility is now the immediate product focus: the app should explain its core loop from inside the UI, not mainly through docs and demo scripts.\n- For near-horizon demo work, prefer packaging the shipped capture/review/board substrate into stakeholder-legible business workflows instead of reopening broad architecture.\n- Prefer finishing cross-cutting consistency work before adding new surface area.\n- Security and identity convergence remains the highest-priority engineering track.\n- Cross-user existence policy is fixed: return `403` for authenticated-but-unauthorized access and `404` for true missing resources.\n- Automation remains proposal-first and review-first by default.\n- Do not claim or ship silent/destructive autonomy by default; trust posture takes precedence over convenience.\n- MVP should include a dogfooding workflow: paste structured plan text in chat and bootstrap a board/project from approved proposals.\n- UX investments should be modular and reusable (keyboard-first, discoverable selectors, shared input-assist patterns).\n- Use `docs/InReview/MVP_EXPANSION/MINIMAL/` as the near-horizon execution filter and `docs/InReview/MVP_EXPANSION/EXPANDED/` as the staged roadmap reference.\n- Do not add major new surface breadth ahead of `Home` / `Today` / `Review` productization unless the work closes a real trust, safety, or operability gap.\n- Agent, knowledge, and integrations expansion stay sequenced behind novice-first productization even though their longer-term architecture is now clearer.\n- Every issue must carry exactly one priority label (`Priority I` through `Priority V`).\n- Out-of-code and configuration work (containerization, deployment, security posture, observability, DR) must be tracked as first-class backlog items.\n\n## Current Cycle Outcome (Completed)\n\nDelivered in the latest cycle:\n\nREVIVAL-02 — fake undo timeline removed (2026-07-17, `#1298`, Phase 1 truth + safety): the Paper review UI no longer advertises an undo window/countdown, an undo keyboard shortcut, or undo-rate copy — **no revert endpoint exists anywhere in the backend**, so the affordance was a lie. The stable side-effect `reversibility` wire shape (`summary`/`description`/`windowMs`) is preserved for GP-03 contract compatibility (assumption C6-01: a future *real* undo gets a deliberately versioned API, not this field), but the frontend maps it to factual apply-risk guidance (\"Apply considerations\") and the visible confidence label renders **\"Operation safety\"** while keeping the `/confidence` transport key unchanged (assumption C6-02: label copy only, no wire change). `PaperUndoTimeline` component + spec deleted; the countdown/undo-rate/shortcut promises removed in favour of factual elapsed age / apply considerations; executor/apply behavior untouched; truthful undo-adjacent language (destructive-action \"cannot be undone\" warnings, reversible archive restore, transaction rollback, parser negation handling) deliberately preserved. Proven by backend + frontend + Paper-review E2E gates.\n\nRevival + generalist-expansion wave (2026-07-13, **15 PRs merged** — the revival/GEN direction went live on `main` under the maintainer's ratify-and-merge directive; per-PR review gate: independent adversarial reviews, all-severity findings fixed, real merge conflicts resolved, required CI green after the `#1352` CI-Extended repair; full inventory in `docs/STATUS.md` \"Revival + generalist-expansion wave delivery\"):\n- **Direction ratified:** `#1296` (ADR-0044 revival pivot), `#1328` (ADR-0046 generalist expansion), `#1312` (ADR-0045 transcript-triage engine, REVIVAL-08 M1) — **all three ADRs now Accepted**.\n- **GEN wave (ADR-0046):** `#1341` GEN-01 artefact-storage foundation (independently security-reviewed — no CRITICAL/HIGH) → `#1346` GEN-02 bounded local text extraction; `#1339` GEN-05 apply due dates + labels (also fixed a latent silent WIP-limit-clearing bug on column reorder); `#1340` GEN-09 untrusted-artefact threat model; `#1342` GEN-10 generalist-friendly guided navigation.\n- **REVIVAL wave (ADR-0044):** `#1334` REVIVAL-01 registration gating by deployment mode → `#1344` REVIVAL-05 Paper first-run onboarding; `#1329` REVIVAL-04 self-hosted Paper fonts; `#1331` README revival rewrite; `#1333` de-stubbed the fabricated Today dossier (`#1272`).\n- **Infra / harness / ops:** the maintainer first merged the deck-wide linchpin `#1352` (systemic CI-Extended reusable-workflow permission failure, `#1330`) + dependabot `#1351` / `#1349`; this session then merged `#1294` (harness T3 region maps + skill diet, `#1291`) and `#1336` (overnight human-action + failure-ledger record, `#1327`).\n- **Seeded follow-up:** `#1355` (batch buffered-export artefact blob loads, LOW). **Human-gated, NOT merged:** `#1295` (deny-floor overlay — 16 unresolved review threads incl. a CRITICAL) and `#1337` (licensing pack — blocked on trademark clearance).\n\nSecurity + a11y quality slices (2026-07-02, **2 PRs merged** — `#1263` (`#1241`), `#1265` (`#1218`); full review gate per PR — independent adversarial reviews, all-severity findings fixed or tracked, Gemini/Copilot bot rounds resolved (+Codex rounds on `#1263`), fresh green CI + aging):\n- **Windows secrets-at-rest ACL:** `#1263` (`#1241`) locks `appsettings.local.json` (JWT secret + connector encryption key) to the current user — `RestrictFileToCurrentUser` (Unix `0600` / Windows protected owner-only DACL, dependency-free on net8.0) runs create→restrict→write in `PersistValue`, fail-closed (an unrestrictable file is never written; callers fall back in-memory), with startup forward remediation for pre-`#1241` installs and a locked-down `.corrupt-*` backup. Review rounds also hardened the **MCP launch paths**: both MCP modes now load the local config via the same hardened path as the web API (absolute exe-adjacent path — MCP clients launch stdio servers from arbitrary CWDs; corrupt-file quarantine; env-vars keep priority over the file). Seeded: `#1262` (CLI bootstrapper sibling), `#1264` (atomic create-with-ACL — in flight as `#1267`).\n- **WCAG focus-ring contrast sweep:** `#1265` (`#1218`) resolves all 19 remaining `ring-primary/50` sites (0 left repo-wide): 13 rendered focus rings + the selected-label state ring lifted to the full-opacity treatment (`#1216` precedent) — from a marginal 3.0–3.5:1 to 8.4–10.1:1 on every adjacent surface across all shipped themes — and 5 compile-proven dead checkbox `focus:ring-primary` classes removed (no ring-width utility, so they never painted; the global `*:focus-visible` rule already covers those checkboxes at 4.52:1). Seeded: `#1266` (pre-existing white ring-offset halo on the selected-label state).\n\nWave-3 default-theme flip — Paper is now the DEFAULT UI (2026-06-27, `#1252`): `paperThemeStore` default `'off'`→`'paper'` (Paper canonical per ADR-0038), with the storage key bumped to `td.paper.mode.v2` and a one-time migration (a deliberate pre-flip `paper`/`paper-night`/`auto` choice carries over and the legacy key is cleared; a stored `'off'` — the old default / never-opted-in — or absent/invalid resolves to the new `'paper'` default). Legacy stays reachable through the Appearance toggle and is pinned in the test suites: the E2E `authSession` helper and a global vitest `setup.ts` hook both pin `td.paper.mode.v2='off'` so the ~19 legacy `.td-*` E2E specs and the Legacy-DOM unit specs keep asserting Legacy, while Paper-variant specs opt in explicitly. Review: a 2-lens adversarial sweep (0 confirmed) + Gemini round (migration inlined into `readStoredMode`); CI caught a 112-spec blast radius (the view shells render Paper by default) → fixed with the global off-pin; full FE suite green (3,752 tests).\n\nTesting supersession (2026-07-14, `#1274`): the preceding paragraph records the flip-time compatibility strategy. Authenticated Playwright sessions now default to Paper, frozen Legacy consumers opt out explicitly, and only the global Vitest Legacy-DOM pin remains.\n\nPaper-review de-stubs — Wave-2 completion (2026-06-27, 1 PR; built design-first): the last two stubbed Paper deep-Review handlers were wired to net-new backend, **unblocking the Wave-3 default-theme flip** (now shipped, above):\n- **`onDefer` → snooze 1h (ADR-0042):** a nullable `DeferredUntil` timing field + `Defer(TimeSpan)` domain method (the proposal stays `PendingReview`) and `POST /api/automation/proposals/{id}/defer` (default 60min, optional override clamped to [1,1440]). The snooze pushes `ExpiresAt` beyond the window so a deferred proposal never silently expires; the queue read path hides it (status-gated) while the live clock + backend filter resurface it; `DeferredUntil` is cleared on every terminal transition. No notification, no outcome (defer is not a decision). Re-snooze is unbounded but non-silent (toast + DTO field).\n- **`onReportBadSuggestion` → quality feedback (ADR-0043):** a new **content-free** `ProposalFeedback` table (reason-category enum, **no free-text field**) + `POST /api/automation/proposals/{id}/feedback` → 204, idempotent via a UNIQUE `(ProposalId, ReportedByUserId)` index (last-specific-wins on reason). Orthogonal telemetry — reporting **never** changes proposal status; read-access so a read-only reviewer can still flag; the substrate for a future cohort `reported_bad_rate` metric (`#1142`).\n- A parallel design + adversarial-critique pass pre-fixed the subtle edges before code: clearing `DeferredUntil` on decide so a decided proposal can't vanish from list reads; a 409 (not 500) on concurrent decide+defer via the existing `UnitOfWork` concurrency-token mapping; `Enum.IsDefined` so a junk/numeric `reason` is 400 not 500; correct two-migration lineage off `AddMcpToolHashes`. Coverage: +15 backend tests (domain/application/api, incl. idempotency, last-specific-wins, content-free reflection, 403/404/400/401) + rewritten Paper-review vitest (records / error / in-flight-guard / stays-in-queue).\n\nWave-6 backend + run-story delivery (2026-06-26, **3 PRs merged** — `#1236` (`#1195`), `#1238` (`#1193`), `#1240` (`#1131`); full review gate per PR — independent adversarial reviews, all-severity findings fixed, Codex bot threads resolved, fresh green CI + aging):\n- **Backend query bounds (Wave 6):** `#1236` (`#1195`) bounded the `LlmQueueToProposalWorker` status reads with type-aware in-query reads (`GetOldestPendingNonCaptureAsync` / `GetOldestProcessingCaptureAsync` + count methods for true telemetry) after review caught a HIGH starvation regression in the naive generic-limit design; `#1238` (`#1193`) paged `CaptureService.ListAsync` via a capture-only `GetCapturesByUserAsync(limit, offset)` with an OFFSET-boundary dedup guard. Both keep the unbounded `GetByUserAsync` for GDPR delete/export. Seeded `#1237` (remaining unbounded Pending reads) and `#1239` (push capture filters into SQL).\n- **Run-story (Wave 5):** `#1240` (`#1131`) makes the self-contained desktop exe runnable with no manual key — `ShouldAutoGenerateConnectorKey(isProd, isHeadless) => !isProd || !isHeadless` auto-generates + persists the connector key for the desktop (Production, not headless) while headless Production (CI / container / Terraform, via `TASKDECK_HEADLESS=true` in `backend.Dockerfile`) still hard-fails without a supplied stable key. The AWS Terraform `user_data` generates+persists the key on the durable data volume (with an existing-DB upgrade guard), and `backup.sh`/`restore.sh`/`restore.ps1` keep it paired with the database. A deep review loop (1 HIGH + many P2 across 6 Codex rounds + a 2-lens adversarial sweep) hardened the persistence path against silent key loss: reuse a masked persisted key instead of overwriting it, self-heal a corrupt local config, case-insensitive + provider-lenient reads, read-vs-parse error separation, and owner-only ACL on the restored key. **ADR-0041** records the decision.\n- **ADR added:** `ADR-0041` (desktop connector-key auto-generation; headless Production excluded).\n\nWave-6 follow-through (2026-06-30, **2 PRs merged** — `#1254` (`#1239`), `#1256` (`#1209`); full review gate per PR — 2 independent adversarial reviews, all-severity findings fixed, Gemini/Codex bot rounds resolved, fresh green CI + aging):\n- **Capture board pre-filter pushed into SQL:** `#1254` (partially resolves `#1239`) gives `GetCapturesByUserAsync` an optional `boardId` that applies `(BoardId IS NULL OR BoardId = @boardId)` in-query (SQLite raw + EF), so a board-filtered capture scan no longer materializes other boards' captures; null-board rows are retained because applied-conversion provenance (resolved in the service) can still map them to the target board, and the effective-board + status filters stay in the service. A behavior-preserving optimization (the SQL pre-filter is an exact superset of the removed in-service raw-board check). The status filter is provenance-derived and is not pushable to SQL, so `#1239` stays open for that part.\n- **Stuck-Processing recovery for non-capture requests:** `#1256` (`#1209`) adds a recovery sweep to `LlmQueueToProposalWorker` (mirroring `OutboundWebhookDeliveryWorker`) that reclaims non-capture `LlmRequest`s a crashed worker left in `Processing` past the lease (`Math.Max(30, Workers:ProcessingLeaseSeconds)`): each is returned to `Pending` while retry budget remains or `Failed` when exhausted, and — if the crashed attempt already committed its proposal — `Completed` regardless of budget. The non-capture drain (`ProcessSingleItemAsync`) also gained an existing-proposal idempotency guard (parity with the capture path), so neither recovery nor in-band retry can produce duplicate queue proposals. Two Codex rounds hardened the duplicate-proposal handling.\n\nArchive-pivot delivery wave (2026-06-13, **17 PRs merged** across Waves 0–2 — **Wave 2 nearly finished** after the **+4 follow-on PRs merged 2026-06-19** (`#1219`/`#1220`/`#1221`/`#1225`; **21 total**), including 2 dependabot bumps; full review gate per PR — 2 independent adversarial reviews, all-severity findings fixed, bot threads resolved, fresh green CI + aging). This wave completed Waves 0–1 of the archive-pivot plan and the bulk of Wave 2 (clear the PR deck → ratify Paper-canonical + cheap foundations → Paper-activation prerequisites + backend quality); the one remaining Wave-2 straggler is the Paper-review de-stubs (see **Net** below):\n- **Decision/foundation:** **ADR-0038** ratifies Paper as the canonical UI with Legacy frozen (`#1207`); **ADR-0039** moves the backend to Central Package Management with a pinned SDK and 8.x dependency alignment (`#1196`, carrying the `#1203` NuGet bumps into `Directory.Packages.props`); **ADR-0040** adds a global UTC DateTime materialization convention for SQLite (`#1201`). `*.migrate.lock` is now gitignored (`#1204`); the docker-compose quickstart documents both required secrets (`#1205`, `#1139` AC1).\n- **Paper activation prerequisites:** the shared review-actionability composable (`#1217`) extracts `isProposalApply/Reject/Approve/Dismissable` + `isProposalStale` as pure functions so Paper and Legacy can no longer drift at the 24h-stale / Approved+expired boundaries (collapsing the `#1124` double-fix), and removes fabricated author metadata in favour of the real `/confidence` value; paper-night straggler tokens + a full-opacity WCAG focus ring landed (`#1216`, `#1135`; seeded `#1218`). The `#1161` \"File away\" dismiss affordance that builds on this foundation **shipped 2026-06-19** (`#1219`), as did the reachable in-app Appearance theme toggle (`#1221`, `AppearanceSettingsView`).\n- **Backend + run-story quality:** dead `ProposalGeneratorV1`/`IProposalGenerator` removed as never-consumed code (`#1198`/`#1214`; `FieldVerifier`/`DeterministicPreExtractor` then removed too — `#1215`, 2026-07-04 — once the archive pivot cancelled the V2 generator that would have consumed them); Redis distributed-lock starvation fixed (`#1213`, `#1189`); the queue-claim raw-SQL path now reloads so the DTO isn't a stale identity-map entity (`#1200`, seeded `#1209`); automation-chat composable continuation guarded against dispose (`#1199`); the false-green E2E specs were re-enabled on real Paper selectors (`#1197`); and the one-command `dev-up` + `clean-workspace` scripts shipped (`#1208`, `#1140`) — the canonical personal run path's biggest ergonomics gap.\n- **Dependency hygiene:** group npm/nuget bumps (`#1202`/`#1203` in-wave, `#1211`/`#1212` follow-on).\n- **Net:** Wave 0 (clear the PR deck) and Wave 1 (Paper-canonical decision + cheap foundations) are complete, and Wave 2 (Paper-activation prerequisites) is now **complete** — the shared review-actionability foundation, the `#1161` File-away dismiss affordance (`#1219`), and the reachable in-app Appearance theme toggle (`#1221`) **shipped 2026-06-19**, and the final Wave-2 straggler — the **Paper-review de-stubs** (`onPreviewDiff` `#1234`, plus `onDefer` + `onReportBadSuggestion` on 2026-06-27, ADR-0042/ADR-0043) — landed, clearing the last blocker, and the **Wave-3 default-theme flip then shipped 2026-06-27 (`#1252`)** — **Paper is now the default UI.** Paper polish (Wave 4) and the independent run-story (Wave 5) and backend-quality (Wave 6) tracks interleave in the meantime. _(Also merged 2026-06-19: `#1220` canonical-docs reconciliation, `#1225` Redis major-version caps.)_\n\nSecurity gate + hardening epic (2026-06-05/06, 5 PRs merged; 2 independent adversarial reviews per PR plus Gemini/Codex bot reviews, all findings of every severity fixed or tracked):\n- **#1132 security gate + config hardening** delivered across 4 PRs: ≥32 JWT secret floor + fail-fast registration + Production CORS fail-closed (`#1169`, AC2/AC3); secret/dependency/SAST scans + bundle-size promoted into the required PR merge gate with **phased enforcement** per **ADR-0035** (`#1170`, AC1/AC5, fixed the pre-existing Semgrep `setuptools-82` crash); global default-deny `FallbackPolicy` + `[AllowAnonymous]` audit per **ADR-0036** (`#1176`, AC4).\n- **#1133 backend query perf** first slices (`#1171`): NotificationRepository SQL paging + CardRepository `AsSplitQuery`.\n- **#1131 AC1 CLI hardening** (`#1177`): fresh-machine connector-key bootstrap (CSPRNG, atomic write, `0600`, guarded mutex).\n- New ADRs `0035`/`0036`; seeded follow-ups `#1172`–`#1175`, `#1178`. Remaining: branch-protection registration (`#1173`), flip dependency/SAST to enforcing after baseline remediation (`#1175`), CLI authz routing (`#1131` AC2).\n\nCleanup/hardening wave (2026-05-31, 8 PRs merged, 2 issues closed; 2 adversarial review passes per PR, all findings of every severity fixed, all bot threads resolved):\n- **Open-PR backlog cleared** (`#1143`–`#1147`): non-watch `vitest run` + MetricsView flake (`#1143`); docs-truth corrections incl. ADR-0023→0025 + `.gemini` link-depth fixes (`#1144`); release scripts aligned to CI flags + stale PKG-01 warning removed (`#1145`); duplicate operation idempotency-key → **409 not 500** (`#1146`); `AsSplitQuery` on the multi-collection board read (`#1147`).\n- **Proposal-create hardening** (`#1125`/`#1151`): `ProposalOperationInputValidator` rejects malformed operation input (non-identifier `actionType`/`targetType`, non-JSON / >64 KiB / >depth-32 `parameters`) with **400** at the shared `CreateProposalAsync` path — a permissive format check (not a membership allowlist) so no legitimate producer is rejected. Adversarial review found and fixed a self-introduced HIGH (null `operations` element → 500).\n- **Roadmap-invariant enforcement** (`#1126`/`#1153`): INV-10/11/12 un-skipped with real assertions against `McpToolDefinitionHashService` / `TelemetryGuard` / `SourceSpan`+`ProposalProvenance` (Architecture.Tests now references Domain+Application); only INV-09 (DataFlowRegistry) stays skipped. Found the MCP hash service is registered but un-wired into the runtime → `#1154`.\n- **Audit-failure observability** (`#1134` first slice / `#1155`): shared `AuditLogWriter` replaces 4 copy-pasted empty-catch `SafeLogAsync`, logging at Warning on a thrown exception or returned failed `Result` while preserving never-crash.\n- Seeded: `#1149` (idempotency contract ADR), `#1150` (packaging trim-doc drift), `#1152` (Queue/V1 validator bypass), `#1154` (MCP hash wiring). `#1134` remains open for its other 6 acceptance criteria.\n\nContinuous-cycle wave (2026-05-29, 19 PRs merged, backlog cleared to zero open PRs; 2 independent adversarial reviews per PR, all findings of every severity addressed including bot comments):\n- **RFAI roadmap complete (12 of 12)**: RFAI-11 (`#983`/`#1079`) ambient channel — VS Code extension + voice prototype (ADR-0033 ratified); RFAI-12 (`#984`/`#1080`) learning loop UI, Ollama provider, ProvenanceDrawer, cohort dashboard. Both heavily pre-reviewed; all Codex inline findings audited (one open item fixed on each: 1079 git-repo path-containment, 1080 already-clean).\n- **Composable hardening**: unhandled promise rejections (`#1093`/`#1095`), `onScopeDispose` cleanup + leak fixes (`#1094`/`#1104` — Review 2/2 added startClock double-start guard, fetch-generation invalidation on dispose, isDisposed finally guards, +3 tests), FilterPanel aria-labels + single-resolve label chips (`#1097`/`#1098`).\n- **Identity/authz hardening**: an audit confirmed all 42 API controllers are claims-first with zero bypass risk. `TelemetryController`/`EgressDisclosureController` migrated onto `AuthenticatedControllerBase` (`#1109`/`#1111`); a new `ApiControllerBoundaryTests` guard enforces per-action `[Authorize]`/`[AllowAnonymous]` on non-class-authorized controllers, with explicit attributes added to AuthController/HealthController (`#1110`/`#1116`).\n- **Dependency wave**: nuget/npm minor-patch groups, YamlDotNet 18, dotnet group (`#1101`/`#1103`/`#1102`/`#1105`/`#1115`) — **fixed a recurring EF Core 8/9 split** (dependabot bumped the core package to 9.x while Sqlite/Design stayed 8.x → ambiguous `ExecuteDeleteAsync`). FluentAssertions moved to the free **7.x** line (`#1088`) rather than paid v8. Durable dependabot `ignore` rules added for EF Core and FluentAssertions majors (`#1112`/`#1118`, ADR-0034) so neither churn recurs; documented in `docs/ops/DEPENDENCY_UPDATE_POLICY.md`.\n- **A11y + housekeeping**: stable v-for keys (`#1107`/`#1108`), decorative-SVG `aria-hidden` sweep with 5 icon-only-button accessible-name regressions caught by review and fixed (`#1099`/`#1120`), STATUS.md contradiction fix + cleanup (`#1092`/`#1119`), 112 stale stashes cleared.\n- Closed (not merged): `#1100`→recreated `#1105`, `#1113` (unwanted EF 9.x major), `#1106` (superseded), `#1117` (FluentAssertions v8 paid-license — declined).\n\nBulk merge wave (2026-05-16, PRs `#1055`--`#1074`, 15 PRs merged to main):\n- **Security fixes** (3 PRs, `#1055`/`#1067`/`#1068`): redirect handler hardening (buffer content, filter sensitive headers), SEC-31/SEC-32 (hardcoded key removal + RBAC on abuse endpoints), SEC-33 (health endpoint info disclosure suppression)\n- **Test coverage** (2 PRs, `#1069`/`#1072`): MFA/API Keys/Board Access controller integration tests, ConnectorProviders API + useAutomationChat composable tests\n- **RFAI-03** (`#1071`): `IProposalGenerator` interface, `FieldVerifier`, `ProposalGeneratorV1` with LLM-backed field extraction and verification. _(Update `#1198`, 2026-06-13: `ProposalGeneratorV1` and the `IProposalGenerator` interface were removed as dead code — they never acquired a runtime consumer; `FieldVerifier`/`DeterministicPreExtractor` are retained for a future V2 generator.)_ _(Update `#1215`, 2026-07-04: the V2 generator was cancelled by the archive pivot, so `FieldVerifier`/`DeterministicPreExtractor` — plus the transitively-orphaned `FuzzyTextMatcher`/`FieldVerificationResult`/`ExtractedEntity` and the `Microsoft.Recognizers.Text` packages — were removed as dead code. See STATUS.)_\n- **RFAI-04** (`#1058`): `ProposalRevision` revision chain, edit-before-approve flow, `IProposalCompiler`, `CompilerValidationResult`, revision API endpoints\n- **RFAI-05** (`#1062`): Paper Review deep-dive wired to backend provenance/confidence/conflicts/history/similar-past APIs\n- **RFAI-08** (`#1073`/`#1074`): `EgressDisclosureController` with `IEgressRegistry`, `InsightsController` with bucketed privacy-preserving cohort analytics, `InsightsService`, 21 new tests\n- **PAPER-08** (`#1056`): Today dossier frontend wired to cadence/streak/seal/tomorrow-note backend APIs\n- **PAPER-11** (`#1057`): Narrow companions with sidebar variants + board snap scroll\n- **Dependencies** (3 PRs, `#1059`/`#1060`/`#1061`): actions/dependency-review-action 4→5, 11 npm updates, 4 NuGet updates\n- All 15 PRs had 2+ rounds of adversarial review with fix evidence; post-merge verification: 6,532 backend + 3,267 frontend tests passing\n- Roadmap RFAI progress: 9 of 12 delivered (RFAI-01 through RFAI-09, including RFAI-09 agent runtime hardening merged in `#1052`); 3 remaining (RFAI-10 through RFAI-12)\n\nPaper backend gap delivery (2026-05-05, PRs `#1031`--`#1040`, 10 of 10 issues `#1015`--`#1024`):\n- 10 backend endpoints delivered or merge-ready for the Paper UI surfaces (PAPER-08 Today dossier + PAPER-06 Review deep-dive), with the conflict-detection endpoint reconciled in `#1040`\n- Today dossier: cadence aggregation (`#1015`/`#1031`), 90-day streak query (`#1016`/`#1032`), seal-day action with EF migration (`#1017`/`#1037`), line-for-tomorrow autosave (`#1018`/`#1035`)\n- Review deep-dive: provenance rows with FK migration (`#1019`/`#1039`), 7-category side-effect analysis (`#1020`/`#1033`), 4-component confidence breakdown (`#1021`/`#1036`), conflict detection with tone-classified rows and projected WIP checks (`#1022`/`#1040`), card history ledger (`#1023`/`#1034`), similar past decisions with apply rate (`#1024`/`#1038`)\n- ~480 new backend tests across domain, application, and API layers in the delivered/merge-ready set\n\n--- docs/GOLDEN_PRINCIPLES.md ---\n# Taskdeck Golden Principles\n\nLast Updated: 2026-04-25\nCompanion Active Docs:\n- `docs/STATUS.md`\n- `docs/IMPLEMENTATION_MASTERPLAN.md`\n- `docs/TESTING_GUIDE.md`\n- `docs/MANUAL_TEST_CHECKLIST.md`\n- `docs/GOLDEN_PRINCIPLES.md`\n\n## Purpose\n\nThis document defines concise repository invariants that should remain stable as implementation details evolve.\nMechanical enforcement stays intentionally lightweight and focuses only on low-churn, high-signal checks.\n\n## Golden Principles\n\n- `GP-01 Layer Boundaries`\n - Keep domain/application/infrastructure/API boundaries coherent and avoid forbidden dependency direction.\n- `GP-02 Claims-First Identity`\n - Do not trust caller-supplied identity for protected resources; derive actor identity from authenticated claims.\n- `GP-03 Stable Error Contracts`\n - Preserve predictable JSON error payloads (`errorCode`, non-empty `message`) and consistent status semantics.\n- `GP-04 Test and CI Evidence`\n - Ship behavior changes with deterministic tests and run the required verification commands.\n- `GP-05 Canonical Docs Sync`\n - Keep canonical active docs aligned with shipped reality when behavior or workflow expectations change.\n- `GP-06 Review-First Automation Safety`\n - Keep automation-originated board writes proposal-first; do not introduce silent/destructive autonomy by default. Manual board UI edits remain direct and auditable.\n- `GP-07 Lightweight Mechanical Governance`\n - Prefer maintainable, low-brittleness checks over broad regex or policy sprawl.\n- `GP-08 Product Legibility Before Breadth`\n - Do not add major surface breadth ahead of a clear golden path; raw IDs in the happy path, dead-end empty states, or orphan pages without a next step are not novice-ready.\n- `GP-09 Traceable Agent Expansion`\n - Do not expose agent/autonomy breadth unless runs, policies, and resulting proposals/artifacts stay inspectable in product language.\n- `GP-10 Explicit Egress And Telemetry Boundaries`\n - Treat outbound data flow separately from mutation safety: every external destination must be disclosed/enforced, and local telemetry must reject user content by default.\n\n## Mechanical Enforcement (Current)\n\n- `scripts/check-docs-governance.mjs`\n - validates active canonical docs exist, are indexed, and keep required date stamps.\n- `scripts/check-golden-principles.mjs`\n - validates this document exists, has a `Last Updated` line, and retains core principle IDs.\n- `scripts/check-github-ops-governance.mjs`\n - validates issue-template and project-operations governance invariants.\n\n## Deferred Follow-ups\n\n- Snapshot/diff policy expansion should remain incremental and only move into CI after low-noise validation.\n- Any additional mechanical checks should be introduced only when signal quality is demonstrated.\n\n--- docs/ISSUE_EXECUTION_GUIDE.md ---\n# Issue Execution Guide\n\nLast Updated: 2026-07-13\nScope: How agents should execute the GitHub issue backlog safely, in dependency order, and with explicit priority discipline.\n\n> **⚠️ Revival override (2026-07-10, ADR-0044).** The active sequence is the ratified REVIVAL wave in `docs/REVIVAL_PLAN.md`: truth + safety before strangers → transcript engine → bounded open-beta launch → generalist expansion (Phase 4) → checkpoint. The 2026-06-13 archive sequence is superseded and retained only as the checkpoint fallback. ADR-0046's Phase-4 generalist expansion (Accepted 2026-07-13, tracker GEN-00 `#1327`) stays strictly subordinate to the v0.1 ship gate; the twin generalist app remains deferred behind the GEN-12 `#1326` evidence gate. Treat the `Priority I`–`V`, Phase-4, and expansion tranches below as historical framing; the *mechanics* below (clean-branch start protocol, project-status workflow, one-priority-label discipline, dependency ordering) still apply. Where the Start Protocol says \"pick the highest-priority issue,\" read that as **the next dependency-ready item admitted by the REVIVAL/authorized GEN wave**, not the historical tranches. When this guide and `docs/STATUS.md`/`docs/REVIVAL_PLAN.md` conflict, those active documents win.\n\n## Purpose\n\nUse this file when starting backlog work. It prevents out-of-order development and keeps security/ops/doc guardrails ahead of expansion.\n\n## Start Protocol (Required)\n\n1. Read `docs/STATUS.md`.\n2. Read `docs/IMPLEMENTATION_MASTERPLAN.md`.\n3. Read `docs/GITHUB_PROJECT_AUTOMATION.md`.\n4. Confirm current branch is clean and based on `main`.\n5. Pick the highest-priority issue whose dependencies are complete.\n6. Verify the issue has exactly one priority label (`Priority I` to `Priority V`).\n7. Use the project `No Status` view (`no:status`) and assign status before active work.\n\n## Project Status Workflow (Required)\n\n- Move issue to `Now` only when active implementation starts.\n- Move issue to `Review` when PR is open and linked.\n- Move issue to `Done` only after merge and verification notes are posted.\n- If item is blocked by dependency or external input, move to `Blocked` and add blocking note.\n\n## Priority Model (historical framing — see the revival override above)\n\n> _(The Phase-4 / post-Phase-4 / Expansion tranches below are historical framing that predates the revival plan. Active sequencing is the dependency-ready REVIVAL wave in `docs/REVIVAL_PLAN.md`; this section remains for historical continuity and label semantics only.)_\n\n- `Priority I`: Current Phase 4 completion path and blockers.\n- `Priority II`: Immediate post-Phase-4 foundation work, including novice-first productization.\n- `Priority III`: Expansion tranche (analytics/security/compliance).\n- `Priority IV`: Maturity tranche (platform/test/UX/docs).\n- `Priority V`: Meta/historical/low-urgency tracking.\n\nRule:\n- Never start a lower-priority issue while an unblocked higher-priority issue is ready, unless explicitly directed.\n\n## 2026-03-07 Productization Seeding Record and Execution Rule\n\nThe 2026-03-07 seeding pass created Wave P, the dedicated product-legibility wave, before promoting more disconnected future-breadth work.\n\nThe seeded sequence is:\n\n1. novice-first shell:\n - workspace mode preference (`guided`, `workbench`, `agent`)\n - `Home`\n - `Review` route/terminology\n - action-oriented empty/help states\n - board selectors instead of raw-ID happy paths\n2. board-centered daily workflow:\n - `Today`\n - onboarding checklist/wizard\n - proposal summary service/cards\n - board action rail\n - deep links and next-step shortcuts across inbox/review/notifications/boards\n3. docs/help/testing coherence:\n - `START_HERE`\n - manual/docs index reshape\n - first-run golden-path smoke\n - contextual help/help-center direction\n4. agent substrate\n5. knowledge and integrations surface\n\nReuse instead of duplicate when seeding:\n\n- `#96` onboarding/contextual help\n- `#93` global search and quick actions\n- `#100` user guides/tutorials/FAQ\n- `#216` thesis-aligned demo and landing baseline\n- `#77` metrics dashboard / telemetry alignment\n- `#75`, `#97`, `#98`, `#218`, `#219` for import/integration intake overlap\n\nExecution rule:\n\n- _(historical)_ Wave P was indexed in `#107` (now a **closed historical index** — see Stage 5)\n- do not promote agent/knowledge breadth ahead of the novice-first shell and board-centered workflow wave\n\nImplementation note from the full-source audit:\n\n- use `docs/analysis/2026-03-07_mvp-expansion-source-coverage-audit.md` when executing `#320`, `#324`, `#326`, `#96`, `#100`, and `#328`\n- preserve these carry-forwards explicitly during implementation:\n - durable workspace-mode preference and aggregate workspace summary APIs\n - guided/workbench/agent shell contract plus product-facing route aliases\n - application-layer proposal summary generation plus explicit board-aware action-rail behavior\n - plain-language top boxes, action-state empty/help states, and no orphan surfaces across board/inbox/review/notification flows\n - dismissible in-app help blocks and the `novice-first-first-run` smoke/scenario shape\n - manual/help work should stay aligned to `docs/manual/README.md` instead of drifting back to implementation-slice docs\n- treat the audit's secondary demoability/harness/productivity follow-through as deferred, not dropped\n- that secondary follow-through is now seeded as `#329` to `#334`; execute it only after the Wave P core is underway or delivered, and do not mix it into `#320`, `#322`, `#324`, `#326`, `#96`, `#100`, or `#328`\n- the remaining expanded-blueprint architecture is now seeded as `#335` to `#341`; execute it only after Wave Q is stable enough that agent/knowledge breadth will not compete with product legibility work\n\n## Execution Order (Dependency-Aware)\n\n### Stage 0: Historical Baseline/Governance (Closed)\n\n1. `#42` BASE-01 baseline verification pass\n2. `#43` BASE-02 active docs freeze\n3. `#59` OPS-05 no-status safety view\n4. `#41` OPS-06 backlog seeding policy\n5. `#55` DOC-01 docs reconciliation ritual\n6. `#60` DOC-02 docs normalization sweep\n7. `#56` REL-01 RC hard-gate policy\n\n### Stage 1: Priority I - Phase 4 Completion\n\nSecurity/policy:\n1. `#33` SEC-02 claims-first identity retrofit\n2. `#34` SEC-03 authz regression matrix\n3. `#44` SEC-04 API error-contract assertions\n4. `#152` SEC-11 final cross-user policy convergence pass\n\nUX reliability:\n5. `#35` UX-01 archive lifecycle coherence\n6. `#45` UX-02 drag/edit interaction safety\n7. `#36` UX-03 command palette keyboard model\n8. `#37` UX-04 activity selector discoverability\n9. `#38` UX-04 shared input-assist scaffolding\n10. `#46` UX-05 escape behavior contract\n\nAutomation/provider:\n11. `#39` AUTO-01 production provider strategy\n12. `#40` AUTO-02 planner/executor hardening\n13. `#57` MVP-01 chat-to-project bootstrap\n\nStarter packs and debt blockers:\n14. `#47` PACK-01 manifest RFC/schema\n15. `#48` PACK-02 backend apply dry-run/conflicts\n16. `#49` PACK-03 frontend catalog preview/apply\n17. `#50` PACK-04 first-party starter packs\n18. `#51` PACK-05 deterministic fixture packs\n19. `#52` DEBT-01 nullability reduction\n20. `#53` DEBT-02 log query scalability\n21. `#54` DEBT-03 export/import implementation vs ADR\n\nPriority I addendum (demo-expansion migration wave, seeded 2026-03-02):\n22. `#297` Demo Expansion Migration Tracker (v0 -> v3 staged port)\n23. `#298` Batch A (`v0`) baseline demo seed + MVP-first UX defaults\n24. `#299` Batch B (`v1`) harness + scripted scenarios + API walkthrough + stakeholder clickthrough\n25. `#300` Batch C (`v2`) JSON scenario system + capture-aware autopilot\n26. `#301` Batch D (`v3`) demo director + tracing/snapshot + reliability fixes\n27. `#302` Batch E integration hardening + CI/docs policy\n\nExecution note (demo-expansion wave):\n- Run `#298` -> `#299` -> `#300` -> `#301` -> `#302` in strict dependency order.\n- Keep one branch per batch issue using the suggested branch name in each issue body.\n- Prefer file-scoped commits inside each batch to simplify review and rollback.\n- Current state (2026-03-06): `#298` through `#302` are delivered; retain this order as the historical dependency record for any future demo-tooling follow-ups.\n\nPriority I addendum (manual product audit follow-through wave, seeded 2026-03-26):\n28. `#363` ANL-2026-03-26 manual product audit follow-through tracker\n29. `#364` COL-05 realtime hub CORS/SignalR health\n30. `#365` CAP-23 Inbox triage freshness\n31. `#368` AUTO-04 live-provider status, degraded-mode messaging, and first-turn fidelity\n32. `#366` UX-20 Workbench/nav/docs truth alignment\n33. `#367` UX-21 board-history semantic alignment\n\nExecution note (manual product audit wave):\n- use `docs/analysis/2026-03-26_manual-product-audit.md` together with `docs/analysis/2026-03-26_manual-product-audit-followthrough.md`\n- keep the first pass focused on runtime trust/coherence, not broad future surface expansion\n- route the review raw-ID finding through existing issue `#326` instead of creating a duplicate\n- `#369` headed manual-audit Playwright follow-through is intentionally lower priority and should not block the Priority I runtime fixes above\n\n### Stage 2: Priority II - Foundation Wave (Post-Phase-4) (all delivered)\n\nExecution note (2026-02-22, updated 2026-03-28):\n- `#168` CI topology expansion is complete: required-lane reusable extraction, non-blocking (`ci-extended`), scheduled (`ci-nightly`, `nightly-quality`), release (`ci-release`, `release-security`) orchestrators, topology documentation in `ci-required.yml` header, and `CODEOWNERS` governance are all delivered. Remaining hardening tracks continue independently.\n\nAnalysis follow-through, CI topology, and hardening (all delivered):\n1. `#151` ANL-2026-02-21 analysis follow-through umbrella (delivered)\n2. `#168` OPS-19 CI workflow topology expansion and governance hardening (delivered)\n3. `#153` API-06 centralized exception handling/fallback error-contract uniformity (delivered)\n4. `#154` FE-11 frontend linting baseline + CI gate (delivered)\n5. `#155` FE-12 frontend coverage thresholds (delivered)\n6. `#157` TST-14 architecture-guard expansion (delivered)\n\nFoundation wave (all delivered):\n7. `#67` COL-01 realtime SignalR updates (delivered)\n8. `#68` OBS-01 observability baseline (delivered)\n9. `#70` TST-01 load/concurrency harness (delivered)\n10. `#71` ARCH-01 multi-tenancy strategy ADR (delivered)\n11. `#72` COL-02 notifications framework (delivered)\n12. `#73` COL-03 presence/conflict policy (delivered)\n13. `#74` COL-04 comments/mentions workflow (delivered)\n14. `#75` INT-01 import adapters foundation (delivered)\n15. `#76` INT-02 webhooks/integration security model (delivered)\n\nCapture realignment wave (2026-02-23, all delivered):\n16. `#199` CAP-00 capture wave tracker (delivered)\n17. `#200` CAP-01 capture persistence model/domain contract (delivered)\n18. `#201` CAP-02 capture API slice (delivered)\n19. `#202` CAP-03 queue proposal provenance fix (delivered)\n20. `#203` CAP-04 triage enqueue + status transitions (delivered)\n21. `#204` CAP-05 worker triage path -> proposal generation (delivered)\n22. `#205` CAP-06 strict triage schema + prompt versioning (delivered)\n23. `#206` CAP-07 inbox frontend route/list/detail (delivered)\n24. `#207` CAP-08 capture modal + command palette integration (delivered)\n25. `#208` CAP-09 triage trigger + proposal-linking UX (delivered)\n26. `#209` CAP-10 card/proposal provenance UX (delivered)\n27. `#210` CAP-11 capture loop E2E regression (delivered)\n28. `#211` CAP-12 canonical docs promotion (delivered)\n\nTesting harness guardrails wave (2026-02-23, all delivered):\n29. `#254` TST-15 testing harness wave tracker (delivered)\n30. `#255` TST-16 remove residual wall-clock flake patterns + centralize E2E polling helpers (delivered)\n31. `#256` TST-17 drag/drop persistence regression coverage (refresh-stable) (delivered)\n32. `#257` TST-18 API error-contract completeness expansion (`400/401/403/404/409`) (delivered)\n33. `#258` TST-19 OpenAPI generation + parse-validation CI artifact guardrail (delivered)\n34. `#259` DOC-06 golden principles baseline + minimal enforcement script (delivered)\n35. `#260` OPS-20 non-blocking nightly quality workflow (coverage + dependency/security signals) (delivered)\n\nProvider runtime expansion (2026-02-23, all delivered):\n36. `#232` AUTO-03 provider-agnostic LLM runtime (`OpenAI` + `Gemini`) with demo-first setup and safe `Mock` fallback (delivered)\n37. `#235` SEC-15 managed-key threat-model/control-plane tracker (delivered)\n38. `#236` SEC-16 managed-key identity attribution contract (delivered)\n39. `#237` SEC-17 managed-key quota/budget/kill-switch guardrails (delivered)\n\nMVP productization wave seeded from the 2026-03-07 integration (all delivered):\n40. `#318` `UX-13` MVP productization wave tracker (delivered)\n41. `#320` `UX-14` workspace mode foundation + `Home` summary shell (delivered)\n42. `#322` `UX-15` `Review`-first routing + empty/help states + board selectors (delivered)\n43. `#324` `UX-16` `Today` agenda + first-run onboarding path (delivered)\n44. `#326` `UX-17` proposal readability + board-centered action flow (delivered)\n45. `#96` `UX-10` interactive onboarding/help (delivered)\n46. `#100` `DOC-04` user guides/tutorials/FAQ (delivered)\n47. `#328` `TST-20` product first-run smoke + launch-criteria guardrail (delivered)\n\nSaul-facing demo alignment wave seeded from the 2026-03-26 reconciliation (all delivered):\n48. `#356` `DEMO-00` Saul-facing demo alignment tracker (delivered)\n49. `#354` `PACK-08` Saul-facing client-onboarding starter pack and deterministic demo scenario (delivered)\n50. `#326` `UX-17` proposal readability and trust-cue hardening (demo-critical Saul-facing subset; follow-up pass on position 44) (delivered)\n51. `#330` `UX-18` in-app demoability surfaces and hero-board quality (demo-critical Saul-facing subset) (delivered)\n52. `#355` `TST-24` Saul-facing demo rehearsal contract, acceptance checklist, and artifact guide (delivered)\n53. `#216` `GTM-01` thesis-aligned demo script / landing baseline (delivered)\n\nExecution note (Saul-facing demo wave):\n- use `docs/WIP/Taskdeck_Demo_Capability_Specification.md` together with `docs/analysis/2026-03-26_saul-demo-capability-reconciliation.md`\n\n--- .codex/README.md ---\n# Codex Workspace Control Plane\n\nThis `.codex/` layer is the Codex-facing control plane for Taskdeck. It routes agents to the active project truth, local skills, MCP configuration, and high-autonomy workflows without making `.codex` a second product roadmap.\n\n`docs/STATUS.md` remains the source of truth for current shipped reality. `docs/IMPLEMENTATION_MASTERPLAN.md` remains the source of truth for roadmap sequencing and delivery history.\n\n## Start Here\n\n1. Read [docs/STATUS.md](../docs/STATUS.md).\n2. Read [AGENTS.md](../AGENTS.md).\n3. Read [memories/00_ACTIVE.md](./memories/00_ACTIVE.md).\n4. Read [docs/IMPLEMENTATION_MASTERPLAN.md](../docs/IMPLEMENTATION_MASTERPLAN.md).\n5. Read [autodoc/AGENT_INDEX.md](../autodoc/AGENT_INDEX.md) for fast seam orientation.\n6. Pick the matching repo skill from [skills/README.md](./skills/README.md).\n\n## Current Routing\n\n- Taskdeck current state: [../docs/STATUS.md](../docs/STATUS.md).\n- Codex-local active gate after canonical docs: [memories/00_ACTIVE.md](./memories/00_ACTIVE.md).\n- Roadmap and sequencing: [../docs/IMPLEMENTATION_MASTERPLAN.md](../docs/IMPLEMENTATION_MASTERPLAN.md).\n- Dependency-aware issue order: [../docs/ISSUE_EXECUTION_GUIDE.md](../docs/ISSUE_EXECUTION_GUIDE.md).\n- High-autonomy Codex workflow: [../docs/tooling/CODEX_AUTONOMY_RUNBOOK.md](../docs/tooling/CODEX_AUTONOMY_RUNBOOK.md).\n- MCP/tooling rules: [../docs/MCP_TOOLING_GUIDE.md](../docs/MCP_TOOLING_GUIDE.md).\n- Agentic question/failure/update protocols: [../docs/agentic/](../docs/agentic/).\n- Codex/Claude tool parity: [../docs/agentic/AGENT_TOOL_PARITY.md](../docs/agentic/AGENT_TOOL_PARITY.md).\n- Fast agent seam map: [../autodoc/AGENT_INDEX.md](../autodoc/AGENT_INDEX.md).\n\n## Canonical Vs Local\n\n- Canonical project docs: `docs/STATUS.md`, `docs/IMPLEMENTATION_MASTERPLAN.md`, `docs/TESTING_GUIDE.md`, `docs/MANUAL_TEST_CHECKLIST.md`, and `docs/GOLDEN_PRINCIPLES.md`.\n- Codex-local routing: `.codex/README.md`, `.codex/memories/00_ACTIVE.md`, `.codex/config.toml`, and `.codex/skills/*`.\n- Claude-local routing: `.claude/README.md`, `.claude/settings.json`, and `.claude/skills/*`.\n- Agentic operating layer: `docs/agentic/*`, `autodoc/AGENT_INDEX.md`, and `scripts/agent_hooks/*`.\n- Historical or research material: `docs/archive/` and `docs/InReview/`; use only when active docs point there or the task explicitly asks for reconciliation.\n\n## Development Loop\n\n1. Confirm active Taskdeck state in `docs/STATUS.md`.\n2. Check git state and run `powershell -File scripts/check-git-env.ps1` before multi-file or branch work.\n3. Create a scoped branch or worktree for non-trivial implementation.\n4. Keep ownership narrow and choose the relevant Taskdeck skill.\n5. Use the question protocol for true blockers and record assumptions for reversible choices.\n6. Run targeted checks first, then broaden based on blast radius.\n7. Record unresolved failures or workarounds through the failure protocol.\n8. Update canonical docs only when shipped reality, roadmap sequencing, testing expectations, or operator workflow changed.\n9. Open a PR by default for issue-scoped implementation, then perform self-review before handoff. Follow the Review Policy in `AGENTS.md`: post findings as a PR comment, fix everything at every severity, check and address all existing comments, and seed issues for out-of-scope findings.\n\n## Best Tool Baseline\n\n- Use `.codex/config.toml` MCP servers first for docs, GitHub, browser, Docker, OpenAPI, and runtime inspection tasks.\n- Use native `rg` for repository search; do not use ripgrep MCP on Windows unless it has been revalidated.\n- Use Codex-native patching for file edits and configured agents/worktrees only when runtime policy allows clean ownership splits.\n\n\n--- .codex/memories/00_ACTIVE.md ---\n# Active Taskdeck Agent Context\n\nLast updated: 2026-07-13\n\nThis file is the Codex active-gate pointer for Taskdeck. It intentionally summarizes routing only; the canonical state remains in `docs/STATUS.md`.\n\n## Current Authority\n\n- Current shipped state: `docs/STATUS.md`\n- Roadmap and sequencing: `docs/IMPLEMENTATION_MASTERPLAN.md`\n- Stable invariants: `docs/GOLDEN_PRINCIPLES.md`\n- Dependency-aware issue execution: `docs/ISSUE_EXECUTION_GUIDE.md`\n- Testing operations: `docs/TESTING_GUIDE.md`\n- MCP/tool usage: `docs/MCP_TOOLING_GUIDE.md`\n- High-autonomy Codex workflow: `docs/tooling/CODEX_AUTONOMY_RUNBOOK.md`\n- Fast agent seam map: `autodoc/AGENT_INDEX.md`\n- Agentic protocols: `docs/agentic/QUESTION_PROTOCOL.md`, `docs/agentic/FAILURE_LEDGER.md`, `docs/agentic/GUIDE_UPDATE_PROTOCOL.md`, `docs/agentic/SKILL_REGISTRY.md`, `docs/agentic/AGENT_TOOL_PARITY.md`\n\n## Current Focus Snapshot\n\n**Direction (2026-07-10 revival pivot, ADR-0044; extended 2026-07-13 by ADR-0046):** Taskdeck is being revived and shipped as a **free open beta** — the local-first, review-first action-item engine (transcripts/notes/artefacts in → evidence-linked proposals out → human-approved board apply), with the write-gated MCP server as the developer-facing second act. Active sequencing is `docs/REVIVAL_PLAN.md` (waves REVIVAL-00..14 `#1297`–`#1311`, `#1311` is the tracker; plus Phase 4 GEN-00..12 `#1315`–`#1327` — **ADR-0046 Accepted 2026-07-13, tracker GEN-00 `#1327`**), and the v0.1 ship gate has top priority. The 2026-06-13 archive pivot is **superseded** and retained only as the traction-checkpoint fallback. ADR-0046 adds generalist reach in the single app — artefact intake beyond transcripts, project dossiers, mode-scoped legibility; the twin generalist app is deferred behind the GEN-12 (`#1326`) evidence gate. Work not on the ratified wave list is not taken. The project thesis remains unchanged:\n\n- capture should be near-zero friction\n- automation-originated board writes must remain proposal-first and human-approved\n- provenance, confidence, side-effect disclosure, telemetry guardrails, and exfiltration controls are distinct safety surfaces\n- product legibility and trust take priority over broad new autonomy\n\n## Required Read Order\n\n1. `docs/STATUS.md`\n2. `AGENTS.md`\n3. `.codex/README.md`\n4. `docs/IMPLEMENTATION_MASTERPLAN.md`\n5. `docs/GOLDEN_PRINCIPLES.md`\n6. `docs/ISSUE_EXECUTION_GUIDE.md` when selecting or executing issues\n7. `autodoc/AGENT_INDEX.md` for cheap seam orientation\n8. the matching `.codex/skills/*/SKILL.md`\n9. feature, testing, MCP, agentic, or project-automation docs relevant to the task\n\nFor Claude Code, read `docs/STATUS.md` first, then use `.claude/README.md` and `CLAUDE.md` for Claude-specific routing.\n\n## Review Policy\n\nEvery review (self-review, adversarial, subagent) must: post findings on the PR as a comment, fix everything at every severity, check and address ALL existing PR comments (human, bot, previous reviews), and seed GitHub issues for out-of-scope findings. No \"non-blocking\" dismissals. See `AGENTS.md` Review Policy for full rules.\n\n## Agent Coordination Rules\n\n- Use spawned subagents without asking for extra permission when they are efficient or effective for safely parallelizable work.\n- When implementation needs isolation, create real git worktrees with `scripts/git/New-CodexIssueWorktree.ps1`.\n- Keep one coordinator responsible for issue selection, synthesis, docs rehydration, and final verification.\n- Do not update canonical docs for local-only guidance unless behavior, roadmap state, testing expectations, or operator workflow changed.\n- Use `docs/agentic/QUESTION_PROTOCOL.md` to batch true blockers and proceed with explicit assumptions for reversible choices.\n- Use `docs/agentic/FAILURE_LEDGER.md` for unresolved failures or workarounds that future agents should not rediscover.\n- Use `docs/agentic/AGENT_TOOL_PARITY.md` to keep Claude and Codex using equivalent capabilities through their runtime-native tools.\n\n--- .codex/skills/taskdeck-pr-review-loop/SKILL.md ---\n---\nname: taskdeck-pr-review-loop\ndescription: Perform Taskdeck PR self-review or fresh adversarial review, post review findings, address review comments and bot comments, verify fixes, and re-review. Use when the user asks to review PRs, spin fresh reviewers, check comments, address feedback, or run another adversarial pass on sensitive or failing work.\n---\n\n# Taskdeck PR Review Loop\n\nReview like a maintainer: find bugs, risks, missing tests, and docs drift before merge.\n\n## Read first\n\n1. `docs/STATUS.md`\n2. `AGENTS.md`\n3. `docs/GOLDEN_PRINCIPLES.md`\n4. The linked issue and PR body\n5. The PR diff\n\n## Review focus\n\nPrioritize:\n\n- auth/authz and cross-user policy regressions\n- proposal-first automation safety\n- persistence/migration correctness\n- error contract stability\n- missing tests or weak assertions\n- frontend keyboard/accessibility/loading/error states\n- docs/testing-guide drift\n- CI workflow or project automation side effects\n\nDo not spend review energy on unrelated style unless it creates risk.\n\n## Review output\n\nUnless the user explicitly says otherwise, post findings as a PR comment organized by severity. Each finding needs:\n\n- file and line if available\n- concrete risk\n- expected fix or test\n- severity (CRITICAL, HIGH, MEDIUM, LOW)\n\nAll findings at every severity must be addressed — there is no \"non-blocking\" category. Do not skip lower-priority findings.\n\nIf a finding is real but out of scope for this PR, seed a GitHub issue to track it. Never silently drop findings. Tech debt from reviews must be zero.\n\nIf there are no findings, post an explicit no-finding comment with residual risk and test gaps.\n\n## Sensitive PR rule\n\nRun a second fresh review when the PR touches:\n\n- security/auth/session/token behavior\n- migrations or data deletion/retention\n- MCP or external agent write surfaces\n- capture/review/proposal execution\n- GitHub workflows/project automation\n- broad frontend route or state flow\n- flaky/failing CI\n\nThe second reviewer should not rely on the first review summary unless addressing already-posted comments.\n\n## PR Comment Check (MANDATORY)\n\nBefore posting findings, read ALL existing PR comments:\n\n```bash\ngh api repos/{owner}/{repo}/pulls/{number}/comments\ngh pr view --comments\ngh api repos/{owner}/{repo}/issues/{number}/comments\n```\n\nLook for:\n- Human review comments not yet addressed\n- Dependabot alerts or suggestions\n- CodeQL / security scanning findings\n- CI bot failure messages\n- Previous adversarial review comments not yet resolved\n- Any automated tool output needing action\n\nAddress everything unaddressed: fix it, reply with invalidation evidence, or seed a tracked GitHub issue.\n\n## Addressing feedback\n\nWhen assigned to fix comments:\n\n1. Read all unresolved review threads, human comments, and bot comments.\n2. Group by root cause.\n3. Make focused fix commits.\n4. Run targeted checks.\n5. Reply to each thread with what changed and verification.\n6. Post a follow-up PR comment mapping each finding to its fix commit and verification result.\n7. Re-review the fixed diff.\n\nNever mark feedback resolved mentally without either fixing it, explaining why it is invalid, or seeding a follow-up as a GitHub issue.\n\n## Comment hygiene\n\nUse GitHub MCP for issue/PR metadata and comments when available. Use `gh` fallback when MCP is unavailable.\n\n## Rules\n\n- NEVER skip MEDIUM or LOW findings — there is no \"non-blocking\" category\n- Always check ALL existing PR comments (human, bot, previous reviews) before posting findings\n- Address every unaddressed comment: fix, invalidate with evidence, or seed a GitHub issue\n- Out-of-scope findings must be seeded as GitHub issues, never silently dropped\n- Always post a follow-up comment after fixes are pushed\n- Tech debt from reviews must be zero\n\nDo not merge PRs. Do not change repo settings, secrets, protections, environments, or workflow permissions.\n","/bin/bash -lc \"printf '%s\\\\n' '--- status ---'; git status --short --branch; for f in OUTSTANDING_TASKS.md docs/STATUS.md docs/IMPLEMENTATION_MASTERPLAN.md docs/GOLDEN_PRINCIPLES.md docs/ISSUE_EXECUTION_GUIDE.md .codex/README.md .codex/memories/00_ACTIVE.md .codex/skills/taskdeck-pr-review-loop/SKILL.md; do printf '\\\\n--- %s ---\\\\n' \\\"\"'$f\"; sed -n '\"'1,240p' \\\"\"'$f\"; done'",[977],"exec-0583657c-2281-4276-8406-dd8e0dd9aaa2","28158",{"_577":978,"_92":650},"printf '%s\\n' '--- status ---'; git status --short --branch; for f in OUTSTANDING_TASKS.md docs/STATUS.md docs/IMPLEMENTATION_MASTERPLAN.md docs/GOLDEN_PRINCIPLES.md docs/ISSUE_EXECUTION_GUIDE.md .codex/README.md .codex/memories/00_ACTIVE.md .codex/skills/taskdeck-pr-review-loop/SKILL.md; do printf '\\n--- %s ---\\n' \"$f\"; sed -n '1,240p' \"$f\"; done",{"_536":980,"_515":516,"_538":522},{"_560":961,"_42":981,"_610":982,"_543":983,"_282":613,"_614":-5,"_529":113,"_92":615},"ctc_04df12867dccf958016a659b6a8bc48197855e9de79cf1c452","const r = await tools.exec_command({cmd:\"printf '%s\\\\n' '--- status ---'; git status --short --branch; for f in OUTSTANDING_TASKS.md docs/STATUS.md docs/IMPLEMENTATION_MASTERPLAN.md docs/GOLDEN_PRINCIPLES.md docs/ISSUE_EXECUTION_GUIDE.md .codex/README.md .codex/memories/00_ACTIVE.md .codex/skills/taskdeck-pr-review-loop/SKILL.md; do printf '\\\\n--- %s ---\\\\n' \\\"$f\\\"; sed -n '1,240p' \\\"$f\\\"; done\",\"workdir\":\"/workspace/Taskdeck\",\"yield_time_ms\":10000,\"max_output_tokens\":40000}); text(r.output);",{"_548":522},{"_536":985,"_515":516,"_538":522},{"_539":-5,"_618":986,"_42":987,"_543":988,"_622":989,"_92":624},"gAAAAABqZZtqtgXxAfK-NJqAiiLpOut95T_TAEq8GOWOKKkh0UOKHdIx31EL9I8eQ_4OlvFMKjFYkdgqvPkVR0e7NUIib-XXUj1_Cmwtr6jOhgMyR8fn9SEihRLSk7i033BdATTrUrsV5z61eesPW4HFNPS0LwJtIn461VmUhuv9EFkj_0LVh8N-RYVS7Os7kZZ55wvAlbJjzIn-jL-mANsDF0TQYygdt3ztiQDeuAPyRejG9U5o3fiZ-B_7Mu7H5BSMRfOGNGNvY0gGjVuut2sUviCW4SLxRjuLCGknjYuEjW0HZsgG0QTWXYhKCAOGNmzimdHRgWKyhrodoyiZh3cD3gCa1CNrtgUxdl_aQoLXcKnra5PJzOJQdmtxTmElK3IMAbgxp7PWVwqzxGI0v0coQ6ZS4yJjAMAkxKFywfNdWRTxXoAv8HcbzrUlCu7GLuVfKw8GeYN11iBWUQ2hSgkM0WQInLPVv4sdBUt5BfwZzRuHkcvjj67bQX2jXNf1cIVIWZ3b6cQnNLtvucDnzzu-EH3Hjk6aGAutfUiCqWkvLCWHm5gbae8e_THeL_cbWyjrj6cAMR1TbBYtA4XRDzmAZpb9uwtuKAIx8iIqjQwelQkSRzEUm4uxDQrWNs_Gy5jmeMo9iciuJlTi1na4w6B8fDxD50JQEu7vJ8euyxdjWbzc2rwXdJATze0RgbT0TRaU6ZDHdCN5JsjcoSsa8kt_1QX7zCyOQn9rc5F-zaisX8tPd4FIbqIbs03gl-R4IKoeUs2_KLPoctpwVQuHraIzxAUwtqklVl816LVOITFHhcG3FfhTmCVDuA4AcFUG3ouiALDw0lFXGs_ix-dwqPlmbPl1scff2KcX8PRGFg9kLGN_iPyxBI4C88VOJvV9W0xTf6R7xzqcyiW0KZ0dWxM1MH6tGQEuYpf9NvycJ4bqXeD2iRJKy0k1Y8Btqr9OUcXfnoZ7LzdLPKzZP1p7kXps28sVLbSk3wQThT0w9DemgqkotD9NKto=","rs_04df12867dccf958016a659b69ad3c81978dc7500bd0fff761",{"_548":522},[990],{"_46":991,"_92":627},"**Resuming code execution after warning**",{"_554":993,"_536":994,"_515":516,"_538":522},1785043818488,{"_539":995,"_42":987,"_622":996,"_92":624},[],[991],{"_536":998,"_515":516,"_538":522},{"_560":999,"_42":-5,"_543":1000,"_282":-5,"_563":1001,"_92":565},"call_OAlnGR2aesZzJWpJK3cL60Nn",{"_548":522},{"_415":1002,"_567":-5},[1003,1004],{"_46":968,"_92":571},{"_46":1005,"_92":571},"[INFO] git path: /usr/bin/git\n[INFO] git version: git version 2.43.0\n[WARN] git appears to be Cygwin or MSYS2 (non-MinGW) git (/usr/bin/git).\n This can cause signal errors and path translation issues.\n Fix: add 'C:\\Program Files\\Git\\cmd' to the front of PATH.\n[OK] No .git/index.lock present.\n\nOne or more issues detected. See warnings above.\n",{"_554":1007,"_536":1008,"_515":516,"_538":522},1785043815880,{"_576":1005,"_577":1009,"_579":1010,"_581":582,"_520":32,"_583":832,"_42":1011,"_585":1012,"_587":588,"_529":835,"_92":589},"/bin/bash -lc \"bash scripts/check-git-env.sh && printf '\\\\n--- status ---\\\\n' && git status --short --branch && printf '\\\\n--- instructions ---\\\\n' && sed -n '1,220p' OUTSTANDING_TASKS.md && sed -n '1,180p' docs/STATUS.md && sed -n '1,160p' docs/IMPLEMENTATION_MASTERPLAN.md && sed -n '1,160p' docs/GOLDEN_PRINCIPLES.md && sed -n '1,180p' docs/ISSUE_EXECUTION_GUIDE.md && sed -n '1,160p' .codex/README.md && sed -n '1,180p' .codex/memories/00_ACTIVE.md && sed -n '1,240p' .codex/skills/taskdeck-pr-review-loop/SKILL.md\"",[1013],"exec-18b122ea-119f-4a0b-acf8-bd405153607c","30894",{"_577":1014,"_92":650},"bash scripts/check-git-env.sh && printf '\\n--- status ---\\n' && git status --short --branch && printf '\\n--- instructions ---\\n' && sed -n '1,220p' OUTSTANDING_TASKS.md && sed -n '1,180p' docs/STATUS.md && sed -n '1,160p' docs/IMPLEMENTATION_MASTERPLAN.md && sed -n '1,160p' docs/GOLDEN_PRINCIPLES.md && sed -n '1,180p' docs/ISSUE_EXECUTION_GUIDE.md && sed -n '1,160p' .codex/README.md && sed -n '1,180p' .codex/memories/00_ACTIVE.md && sed -n '1,240p' .codex/skills/taskdeck-pr-review-loop/SKILL.md",{"_536":1016,"_515":516,"_538":522},{"_560":999,"_42":1017,"_610":1018,"_543":1019,"_282":613,"_614":-5,"_529":113,"_92":615},"ctc_04df12867dccf958016a659b6331c88197bba77e01290dc963","const r = await tools.exec_command({cmd:\"bash scripts/check-git-env.sh && printf '\\\\n--- status ---\\\\n' && git status --short --branch && printf '\\\\n--- instructions ---\\\\n' && sed -n '1,220p' OUTSTANDING_TASKS.md && sed -n '1,180p' docs/STATUS.md && sed -n '1,160p' docs/IMPLEMENTATION_MASTERPLAN.md && sed -n '1,160p' docs/GOLDEN_PRINCIPLES.md && sed -n '1,180p' docs/ISSUE_EXECUTION_GUIDE.md && sed -n '1,160p' .codex/README.md && sed -n '1,180p' .codex/memories/00_ACTIVE.md && sed -n '1,240p' .codex/skills/taskdeck-pr-review-loop/SKILL.md\",\"workdir\":\"/workspace/Taskdeck\",\"yield_time_ms\":10000,\"max_output_tokens\":30000}); text(r.output);",{"_548":522},{"_536":1021,"_515":516,"_538":522},{"_539":1022,"_541":-5,"_42":1023,"_543":1024,"_545":1025,"_96":93,"_92":547},[1026],"msg_04df12867dccf958016a659b5e75d8819793c15f89b5c01d2f",{"_548":522},"commentary",{"_46":1027,"_92":551},"Plan:\n1. Rehydrate repository and PR-review instructions, then verify the current branch/head and worktree state.\n2. Inspect the exact-head diff, ledger projection semantics, tests, append-only history, generated output, and live PR metadata/comments/checks.\n3. Run the focused verification commands. If I find a defect, I’ll implement and test a narrowly scoped fix, commit it with sign-off, and open a follow-up PR; otherwise I’ll post the exact-head review result without changing the codebase. Key risks are mutable-ledger test coupling, overclaimed resolution evidence, and unsafe GitHub closing references.",{"_554":1029,"_536":1030,"_515":516,"_538":522},1785043811214,{"_42":1023,"_545":1025,"_46":1027,"_92":557},{"_536":1032,"_515":516,"_538":522},{"_539":-5,"_618":1033,"_42":1034,"_543":1035,"_622":1036,"_92":624},"gAAAAABqZZtesheS4T0im0NIh9bTMzfWT6iN5MxxrIe4N22bvdkrDB5QF4LX69TsxI-cRVkrnYZiws0yTHkelLjPcXlPeT6_usHAV8ms7N5HQlNdRh5Bg__DCOaI8JjpIy5qaSXoKiOhfApeV4umIYl-EQnY79XpskOn7Lo7AysAUVWlrEJn50KJAX5UPzv8R91Be13Qaxf_t2OjPlMfr6mXPSFwI6I9l7Bd5eRPYIcBQH_XL5GOOyYBuBdhKjjLlIOjypiZS_cXlPDiBpWfBnB1Cx_fUJ1EOTqs0ljr-LLTMF4eV0lbp5C6t_nc8aTfbhYK8B6_Ai2xyfFhrJZYV3nkuLKtg43AYzpQRdey6fOXm30pWTs_tqbonaAATZVG0lqL-Z5ALths4p-KcieNpdYIASJyIp1OK7yRwgHl9bGTbX2H7XdQkUl21AOlHcbRGUf9sIAvuXG_xPEVgWa2xjRg81Q7XdamSa9eIaGQb1SdQ4SFbY6pvWY17KBy5KiqAeZsOImlmKDM2UrDrh9v6DgrqCQ1pDsb8bUS02krMQ08SDO7AgGhjn1_Ge87w1_riv7jRYtBylBdE7OLP3OrUz4fUAn3NVON1DV7wKjKYP2RJmPKu24GvCeXBGRJUfAXdufigOhhoqVD3KilHSWA7Mhd3No6K7gvZRtXM9U5eR9TGEsSuLhfdu2nHhHOvxGAcCvhXZzEOq3D3rmvPVS1xzZkc6CTkAurSU8OlS81zkh5DlSYs3KZ8vwjgpzQUt7_ABT0dH42gPFFS3ACzB8b8wBuGSeUt9V4vle8MvCBK5kQ3AEEnP4rea8J0hHzEPu3v0rWrfb55mqOvX8V2wV5UNPSrhJFG8jobxrZT0UWY_YWYr_V2N_zid1k163nfvfyZS1wl-y6eyfco0aFMSnM3t_sIp-Q2f7_uni8_4z7OFJRc58YghuWafIkUbyWVz0ZJ495leNfvog2ik1iq-_4XAdNft-VmStVoFLfoPxcG0l_FvCPBRjiuxGDlVT1jaoQ25ZeZQWrGzeSqS5PrrkUTNacQtG-hNlq0GCXMJX73A1-cL6WN-3dPgTugfyhCILt9-Zr-9SEVao9RFmvHIyY9fF3YWiH91KENuLLyo8TJAulV7LW5n7-kmxui6v8Zh1afFtVCIfNOHgtfmhpA0DWAbheQiYO3Rf6gy-fJf60J2v_rflSjtx8us2xdeQWg-MZOcP2IOjPr4RoikTtHMHfgzCfhKWo0Ztxxf2lL_EKImAVhJNRrK3Z2IUehtmWiyA99hsDJTjprGTLfAGFTM83DmyR3VUyjoSHebqE53iCasXtIN5XpHWNElooFF9lNI68YIBrSkG7SZqYCrXmkHA00JtXtGUEDqyklPDDgI7gUJkA6yY5CeQ18Wk=","rs_04df12867dccf958016a659b5ad7f08197aff68e59132ddd58",{"_548":522},[1037],{"_46":1038,"_92":627},"**Planning GitHub review and PR process**",{"_554":1040,"_536":1041,"_515":516,"_538":522},1785043806402,{"_539":1042,"_42":1034,"_622":1043,"_92":624},[],[1038],{"_554":1045,"_536":1046,"_515":516,"_538":522},1785043800999,{"_1047":-5,"_539":1048,"_42":1049,"_92":1050},"clientId",[1051],"019f9ce6-d3a6-7000-b989-16b3b53ea365","userMessage",{"_46":1052,"_1053":1054,"_92":46},"\nYou are Codex, assisting with follow-up actions on a GitHub pull request.\n\nInput blocks\n------------\n… # The comment or event that invoked you\n… # PR metadata (title, branches, SHAs, status, etc.)\n… # Comments / Reviews for the PR\n\nPossible triggers\n• A user mentions you (@codex)\n• A reviewer requests changes\n• An automated or internal system asks you to review / update\n\nGuidelines\n1. Read the block first and treat it as the primary intent.\n2. Always consult and to interpret and validate the trigger; use only context that materially affects your decision and ignore the rest.\n3. If the trigger comes from a comment thread, the first block will be combined earlier comments from the same thread, clearly indicated with `Comments in the same thread`.\n4. Remaining blocks are in chronological order, oldest first, one block per comment.\n5. When the trigger relates to CI/build status (e.g., “help me fix CI”), incorporate CI/status details found in as supporting context.\n6. If code change is needed, generate a **new** PR with the requested changes. The PR title and message should summarize the changes **on top** of the original pull request.\n## Deliberate self-review findings — exact head `b3838d0632d9465f4ec16216d13fca312d568d4d`\n\n### HIGH — PR metadata could close the parent tracker unintentionally\n\nThe initial PR body used a negated close-keyword sentence beside `#1291`. GitHub nevertheless added both `#1291` and `#1492` to `closingIssuesReferences`, so merging the PR could have closed the still-open parent tracker.\n\nExpected fix: remove every close/fix/resolve keyword near `#1291`, retain only `Closes #1492`, and verify the live closing-link set rather than trusting the prose.\n\nStatus: fixed in PR metadata before handoff.\n\n### MEDIUM — regression test froze a mutable append-only ledger\n\nThe first local test draft loaded the repository JSONL directly and hard-coded today's `23 raw / 15 projected / 14 resolved / 1 open` counts. The next legitimate ledger append would have failed the renderer unit suite even if projection behavior remained correct.\n\nExpected fix: use a deterministic synthetic fixture containing seed metadata, the issue-less E2E row, and the four open/resolved projection pairs; keep live repository counts as verification evidence only.\n\nStatus: fixed before push in test commit `b3838d0632d9465f4ec16216d13fca312d568d4d`.\n\n### Other severities\n\n- CRITICAL: none.\n- LOW: none.\n- Out-of-scope findings: none.\n\nExisting-comment triage at review time: one `@codex` exact-head review request is pending; there are no inline threads or submitted reviews yet.{\"title\":\"Reconcile stale failure ledger projections\",\"body\":\"## Summary\\n\\n- Append qualified resolution records for #1343, #1347, #1348, and #1490 while preserving all 19 original JSONL rows.\\n- Suppress `class=seed` metadata from every rendered projection, including seed-only input, without hiding issue-less non-seed rows.\\n- Regenerate the human-readable ledger and add deterministic projection/regression coverage.\\n\\nPart of #1291; #1291 remains open.\\n\\nCloses #1492\\n\\n## Implementation Notes\\n\\n- Projection identity remains `(surface, first tracking issue in future_fix)`; each resolution row keeps its target issue first.\\n- #1343 records the core #1386 repair while retaining separate #1388/#1410 residual debt.\\n- #1348 records both the #1361 SQLite root fix and #1362 unmocked Paper-browser completion.\\n- The raw ledger diff is append-only: 4 additions, 0 deletions.\\n\\n## Verification\\n\\n- [ ] `dotnet test backend/Taskdeck.sln -c Release` (not run: no backend/product behavior changed)\\n- [ ] `Push-Location frontend/taskdeck-web; npm run typecheck; if ($LASTEXITCODE -ne 0) { Pop-Location; exit $LASTEXITCODE }; npm run build; if ($LASTEXITCODE -ne 0) { Pop-Location; exit $LASTEXITCODE }; npx vitest --run; $code = $LASTEXITCODE; Pop-Location; if ($code -ne 0) { exit $code }` (not run: no frontend behavior changed)\\n- [ ] Playwright smoke/E2E executed (not applicable: no UI or cross-surface behavior changed)\\n- [x] `py -3 -m unittest test_render_failure_ledger.py` from `scripts/agent_hooks` — 5/5 passed\\n- [x] Fresh renderer run is byte-identical — SHA-256 `52C4CBC17BC401AC41B3DA50A4CBA9A3AB95AA5AEA52A857DC492FD6EF8E4B7B`\\n- [x] JSONL parsed with required fields — raw 23 (9 open/14 resolved), projected 15 (1 open/14 resolved)\\n- [x] Sole open projection remains `invalid_signal / ci/e2e-smoke`; raw seed count 1, projected seed count 0\\n- [x] `node scripts/check-docs-governance.mjs`\\n- [x] `node scripts/check-golden-principles.mjs`\\n- [x] `node scripts/check-github-ops-governance.mjs`\\n- [x] `git diff --check 61f718af941c56c31b8b7595333b9debd6e47da8..HEAD`\\n- [x] Exact four-file scope, clean worktree, and DCO 2/2\\n\\n## Documentation\\n\\n- [x] `docs/agentic/failure_ledger.jsonl` appended and `docs/agentic/FAILURE_LEDGER.md` regenerated\\n- [x] `docs/STATUS.md` reviewed and unchanged; shipped product reality did not change\\n- [x] `docs/IMPLEMENTATION_MASTERPLAN.md` reviewed and unchanged; roadmap sequencing did not change\\n- [x] `docs/TESTING_GUIDE.md` / `docs/MANUAL_TEST_CHECKLIST.md` reviewed and unchanged; verification flow did not change\\n\\n## Tracking\\n\\n- [x] Linked issue included: `Closes #1492`\\n- [x] Linked issue and PR project items verified as `Review / Priority II`\\n\\n## CI Workflow Validation\\n\\n- [ ] CI Extended passes on the exact head (auto-triggered because `scripts/` changed; hosted evidence pending)\\n\\n## Risk Notes\\n\\n- Security impact: none; no runtime enforcement or product code changes.\\n- Behavior/regression risk: low; projection behavior is directly covered, raw history is append-only, and the generated Markdown is byte-stable.\\n- Follow-up tasks: #1388/#1410 remain explicit residuals for #1343; data-policy-blocked draft PR #1488 must absorb this new main history before it can proceed.\\n\",\"base_ref\":\"61f718af941c56c31b8b7595333b9debd6e47da8\",\"head_ref\":\"b3838d0632d9465f4ec16216d13fca312d568d4d\",\"merge_commit_sha\":null,\"type\":\"pull_request_info\"}{\"type\":\"pull_request_comment\",\"body\":\"@codex review exact head b3838d0632d9465f4ec16216d13fca312d568d4d. Please focus on seed-only and issue-less projection semantics, append-only ledger truth, resolution evidence/overclaiming, future appendability of tests, linked-issue safety, and generated-render synchronization. All earlier-head evidence is stale if this head moves.\",\"path\":null,\"side\":null,\"line\":null}","text_elements",[],{"_536":1056,"_515":516,"_538":522},{"_539":1057,"_541":-5,"_42":-5,"_543":1058,"_545":-5,"_96":426,"_92":547},[1059],{"_548":522},{"_46":1052,"_92":571},{"_536":1061,"_515":516,"_538":522},{"_539":1062,"_541":-5,"_42":-5,"_543":1063,"_545":-5,"_96":426,"_92":547},[1064,1065],{"_548":522},{"_46":1067,"_92":571},{"_46":1066,"_92":571},"\n /workspace/Taskdeck\n bash\n 2026-07-26\n Etc/UTC\n /workspace/Taskdeck\n","# AGENTS.md instructions for /workspace/Taskdeck\n\n\n# Repository Guidelines\n\nThis document is a concise contributor guide for the Taskdeck repository.\nIts scope applies to the entire repo unless overridden by more specific `AGENTS.md` files in subfolders.\n\n## Always start here (required)\n- Read `OUTSTANDING_TASKS.md` (repo root) — the maintainer's durable cross-session checklist. Surface its open items in any summary/status/handoff; only check items off when the maintainer says they are done.\n- Read `docs/STATUS.md` for Current Focus and constraints (source of truth).\n- Use `docs/IMPLEMENTATION_MASTERPLAN.md` for roadmap context.\n- Use `docs/GOLDEN_PRINCIPLES.md` for stable repository invariants and guardrails.\n- Use `docs/ISSUE_EXECUTION_GUIDE.md` for dependency-aware issue execution order.\n- For Codex routing, read `.codex/README.md` and `.codex/memories/00_ACTIVE.md`.\n- For Claude Code routing, read `.claude/README.md` and `CLAUDE.md`.\n- For test operations, see `docs/TESTING_GUIDE.md`.\n- Precedence when instructions conflict: `docs/STATUS.md` > this file > subfolder `AGENTS.md`.\n\n## MCP tools (agent tooling)\n- See `docs/MCP_TOOLING_GUIDE.md` for tool selection rules and safe usage.\n- For high-autonomy Codex issue/PR/CI batches, see `docs/tooling/CODEX_AUTONOMY_RUNBOOK.md`.\n- For low-context agent orientation, use `autodoc/AGENT_INDEX.md`.\n- For blocker questions, unresolved failures, guide updates, and skill routing, use `docs/agentic/`.\n- MCP-first default: when an MCP tool can perform a task, use MCP before shell/CLI alternatives.\n- Prefer MCP tools over guessing:\n - OpenAI/Codex/API docs -> openaiDeveloperDocs MCP\n - Third-party library docs -> Context7 MCP\n - UI reproduction/regression -> Playwright MCP\n - Repo search -> native `rg` (ripgrep MCP unreliable on Windows; fallback to GitHub search_code)\n - Issues/PRs/workflows -> GitHub MCP (write actions only when required)\n- Fallback rule:\n - if MCP is unavailable, failing, or lacks required capability, use shell/CLI fallback and state that fallback briefly in handoff notes.\n\n## Multi-Agent / Parallel Execution (required)\n- When the Codex runtime exposes spawned subagents, use them without asking for extra permission when they are efficient for safely parallelizable work — but right-size the fan-out (start inline; a few agents, not a reflexive fleet), and keep one coordinator for synthesis and final verification.\n- Split only when work can be separated by clear ownership and can proceed without blocking the coordinator's immediate next step.\n- If spawned agents are unavailable, use explicit git worktrees plus separate Codex/Claude sessions or GitHub coding-agent tasks; do not claim subagent execution unless it actually happened.\n- Split ownership by file/module/concern so concurrent work does not overlap.\n- Keep one coordinator responsible for issue selection, synthesis, conflict resolution, docs rehydration, project status/priority sync, and final verification.\n- Do not delegate final synthesis, ownership decisions, or broad vague cleanup.\n- For batch issue execution, PR review loops, CI recovery, and docs reconciliation, follow `docs/tooling/CODEX_AUTONOMY_RUNBOOK.md`.\n\n## Project Operations Automation (required)\n- Read `docs/GITHUB_PROJECT_AUTOMATION.md` before changing project operations, issue templates, or workflow conventions.\n- Canonical project status model is: `Pending`, `Now`, `Next`, `Blocked`, `Review`, `Done`.\n- Do not introduce labels in issue templates that are not in the required label set documented in `docs/GITHUB_PROJECT_AUTOMATION.md`.\n- Priority sync is mandatory:\n - For issue project items, set project `Priority` to match the issue's single priority label (`Priority I` to `Priority V`).\n - For PR project items, derive `Priority` from linked/referenced issues; if multiple priorities exist, choose highest urgency (`I` highest); if none can be derived, set `Priority V`.\n - Before handoff, verify no issue/PR project item has empty `Priority`.\n- If workflow/status conventions change, update both:\n - `docs/GITHUB_PROJECT_AUTOMATION.md`\n - this `AGENTS.md` (only if contributor behavior expectations changed)\n\n## Local skill packs\n- Repo-local Codex skills live under `.codex/skills/` and supplement `AGENTS.md`; they do not override it. Start with `.codex/skills/README.md`.\n- Repo-local Claude Code skills live under `.claude/skills/` and mirror the same Taskdeck workflows for Claude sessions. Start with `.claude/skills/README.md`.\n- Use `.codex/skills/taskdeck-issue-batch-orchestrator` when asked to take care of many issues, pick issues, coordinate worktrees/subagents, open PRs, run review loops, or reconcile a high-autonomy batch.\n- Use `.codex/skills/taskdeck-worktree-issue-worker` when implementing a single assigned issue in an isolated worktree.\n- Use `.codex/skills/taskdeck-pr-review-loop` when reviewing PRs, spinning fresh adversarial reviewers, posting findings, or addressing review/bot comments.\n- Use `.codex/skills/taskdeck-ci-conflict-recovery` when checking failing CI, resolving PR conflicts, inspecting bot comments, or recovering blocked PRs.\n- Use `.codex/skills/taskdeck-repo-onramp` when the request is broad, the repo area is unfamiliar, or current Taskdeck reality must be reconciled before planning.\n- Use `.codex/skills/taskdeck-backend-slice` for backend/API/application/infrastructure/worker/auth behavior changes.\n- Use `.codex/skills/taskdeck-frontend-workspace-slice` for frontend shell, workspace, route, help-state, and novice-legibility work outside the core capture-review semantics.\n- Use `.codex/skills/taskdeck-capture-review-loop` when capture, inbox, proposal review, execute flow, provenance, or board handoff semantics are involved.\n- Use `.codex/skills/taskdeck-demo-regression` when a task needs the right evidence path, seeded demo state, Playwright proof, or stakeholder-facing walkthrough validation.\n- Use `.codex/skills/taskdeck-verification-doc-sync` at the end of implementation to choose the right checks, update only the right docs, and prepare the required Taskdeck handoff summary.\n- Use `.codex/skills/taskdeck-question-batch` when ambiguity needs a blocker/assumption decision instead of context-expensive question loops.\n- Use `.codex/skills/taskdeck-failure-capture` when failed tools, tests, CI, MCP, docs checks, or workarounds must be classified and surfaced.\n- Use `.codex/skills/taskdeck-interface-map` when adding, splitting, or documenting complex seams that should be findable through `autodoc/AGENT_INDEX.md`.\n\n## Work protocol (required)\n- Before edits: write a short plan (files, approach, risks, tests).\n- Keep diffs small and scoped; avoid large mixed refactors.\n- Ask only for true blockers; otherwise proceed with explicit assumptions. Use `docs/agentic/QUESTION_PROTOCOL.md`.\n- Do not silently bury failed commands or tool workarounds. Use `docs/agentic/FAILURE_LEDGER.md` when unresolved failures matter for future agents or handoff confidence.\n- Prefer incremental execution with incremental, file-scoped commits when the work spans multiple files or concerns.\n- After edits: run required checks and report results.\n- If you cannot run checks, state exactly why and what you would run.\n- In this Windows PowerShell environment, do not chain commands with `&&`; use `;` and check `$LASTEXITCODE` when failure handling matters.\n- For product-facing slices, ensure issue scope and acceptance criteria explicitly align with the current thesis (reduce maintenance overhead/capture friction and preserve review-first trust).\n\n### Windows Git Reliability Fallback\n- Run `bash scripts/check-git-env.sh` at the start of a session to validate git resolution and index.lock state.\n- In PowerShell/Codex-native sessions, prefer `powershell -File scripts/check-git-env.ps1`; the Bash script remains available for Bash shells.\n- If `git` resolves to Cygwin or produces signal/pipe-style failures, use `C:\\Program Files\\Git\\cmd\\git.exe` explicitly for repo operations (or add `C:\\Program Files\\Git\\cmd` to the front of `PATH`).\n- Every new commit you create or submit to a pull request, including a locally created merge commit, must include a `Signed-off-by:` trailer. In automated/background terminals, use `git commit -s --no-gpg-sign` for ordinary commits, `git merge --signoff --no-gpg-sign BRANCH_NAME` for a clean commit-producing merge (replace `BRANCH_NAME` with the source ref), and `git commit -s --no-gpg-sign --no-edit` after staging conflict resolutions; `-s`/`--signoff` adds the DCO trailer while `--no-gpg-sign` avoids hidden GPG pinentry. GitHub's server-generated merge commit is outside the pull-request commit set; do not rewrite shared history to add a trailer to it. Never use `--no-verify`; hooks must run, and failures must be investigated.\n- If a commit fails because `.git/index.lock` cannot be created, first check for active `git` processes; remove `.git/index.lock` only when no git process is running. The `check-git-env.sh` script automates this detection.\n- For stacked branches with small conflict surfaces, prefer `merge` over `rebase` when branch reconciliation starts stalling (for example long-running interactive/conflict loops). Start a commit-producing reconciliation with `git merge --signoff --no-gpg-sign BRANCH_NAME` after replacing `BRANCH_NAME` with the source ref. If it conflicts, resolve and stage the files, then finish with `git commit -s --no-gpg-sign --no-edit` instead of `git merge --continue`.\n\n### Codex Worktree Safety\n- Use `scripts/git/New-CodexIssueWorktree.ps1` to create isolated issue worktrees under `.worktrees/`.\n- First command in a Codex worktree worker session must be `powershell -File scripts/worktree_guard.ps1` (or `source scripts/worktree_guard.sh` in Bash).\n- Do not pass absolute main-checkout paths to worktree workers; derive paths from `$env:WT_PROJECT_DIR` or `git rev-parse --show-toplevel`.\n- Only the coordinator should update canonical batch docs such as `docs/STATUS.md`, `docs/IMPLEMENTATION_MASTERPLAN.md`, and `docs/TESTING_GUIDE.md` unless a worker explicitly owns a docs-only issue.\n\n### Small Mainline Exception\n- If a change is very small and low-risk (especially minor docs wording/checklist updates), do not automatically create a branch/PR.\n- If the user already asked for the change directly, it may be applied on the current branch after checking git status and keeping the diff narrow.\n- If the user did not clearly ask for the change, prompt first and offer to let the user apply it directly on `main`.\n- Only proceed with branch/PR flow for these tiny changes when the user explicitly asks for it.\n\n## Review Policy (non-negotiable)\n\nEvery code review — self-review, adversarial review, subagent review — follows these rules:\n\n1. **Post findings on the PR.** Unless the user explicitly says otherwise, when a review targets a PR, post a comment with all findings organized by severity. This is the default, not optional.\n2. **Fix everything found.** Every finding at every severity (CRITICAL, HIGH, MEDIUM, LOW) must be addressed with a fix, commit, and verification. There is no \"non-blocking\" category that gets ignored. Do not skip lower-priority findings.\n3. **Out-of-scope findings get tracked, not buried.** If a finding is real but drifts outside the PR's scope, document it and seed a GitHub issue (or add to an existing tracking issue). Never silently drop it. Tech debt from reviews must be zero.\n4. **Inspect all existing PR comments.** Before posting findings, read ALL comments on the PR — human reviews, bot comments (Dependabot, CodeQL, CI bots), and previous adversarial review threads. Address anything unaddressed: fix it, reply with invalidation evidence, or seed a tracked follow-up.\n5. **Post fix evidence.** After fixing findings, post a follow-up comment mapping each finding to its fix commit and verification result.\n\nThese rules apply equally to Claude and Codex agents, subagents, and worktree workers.\n\n## Definition of Done (non-negotiable)\n- Behavior changes ship with tests (unit/integration/E2E as appropriate).\n- Handle error cases explicitly; do not swallow failures.\n- Update docs when reality changes:\n - `docs/STATUS.md` (what is true now)\n - `docs/IMPLEMENTATION_MASTERPLAN.md` (roadmap impact / next steps)\n\n## Security baseline (always on)\n- Never trust client input for identity/authority.\n- Enforce authn/authz consistently for protected resources.\n- Validate inputs server-side; fail safely.\n- Do not log secrets, tokens, or sensitive user data.\n\n## Project Structure & Modules\n- Backend (.NET): `backend/Taskdeck.sln` with layered projects under `backend/src`\n (`Taskdeck.Api`, `Taskdeck.Application`, `Taskdeck.Domain`, `Taskdeck.Infrastructure`, `Taskdeck.Cli`).\n- Backend tests: `backend/tests` with project-per-layer test suites.\n- Frontend (Vue 3 + Vite): `frontend/taskdeck-web` with app source in `src`, static assets in `public`.\n- Docs and planning: Start with `docs/STATUS.md` (source of truth),\n `docs/IMPLEMENTATION_MASTERPLAN.md` (active roadmap), `docs/GOLDEN_PRINCIPLES.md` (stable invariants), and `docs/TESTING_GUIDE.md` (test operations).\n Historical context lives under `docs/archive/`.\n\n## Build, Test & Run\n- Backend restore/build: `dotnet restore backend/Taskdeck.sln` and `dotnet build backend/Taskdeck.sln -c Release`.\n- Backend tests (required): `dotnet test backend/Taskdeck.sln -c Release -m:1`.\n- Backend API (local): from `backend/src/Taskdeck.Api`, run `dotnet run`.\n- Frontend dev server: from `frontend/taskdeck-web`, run `npm install` once, then `npm run dev`.\n- Frontend checks (required when frontend touched): from `frontend/taskdeck-web`,\n `npm run typecheck; if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }; npm run build; if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }; npx vitest --run` (PowerShell fail-fast; do not use `&&`).\n\n## Coding Style & Naming\n- Backend: C# conventions, 4-space indentation, PascalCase for classes and public members,\n camelCase for locals and parameters. Keep layers pure (e.g., `Domain` has no infrastructure dependencies).\n- Frontend: TypeScript + Vue SFCs in `PascalCase.vue`. Use script setup and composition APIs where existing code does.\n Prefer meaningful names over abbreviations.\n- Keep formatting consistent with existing files; do not introduce new style tools without discussion.\n\n## Testing Guidelines\n- Prefer unit tests close to the corresponding project (e.g., `Taskdeck.Application.Tests` for application logic).\n- Mirror production namespaces in test namespaces and file names (e.g., `FooServiceTests.cs` for `FooService`).\n- Add coverage for new branches and error paths, especially in application services and HTTP endpoints.\n- For frontend, add tests following the existing tooling (or document gaps clearly if tests are not yet present).\n\n## Commit & Pull Request Guidelines\n- Commits: Use clear, present-tense messages (e.g., `Add booking validation to application layer`).\n Default to small focused incremental commits, often one commit per changed file with a short file-specific description.\n Keep commits small and focused; avoid large mixed-topic commits.\n If a single logical change must touch multiple files, keep the smallest practical commit set and explain why.\n Exception: for pure file move/rename batches (no content changes), one grouped commit is acceptable and preferred.\n- Pull requests: Provide a short summary, key implementation notes, and testing evidence\n (commands run, screenshots for UI changes). Link related issues/tasks where applicable.\n- Keep PRs focused and small when possible; prefer follow-up PRs for refactors or additional cleanup.\n- PRs touching CI workflows (`.github/workflows/`), infrastructure (`deploy/`, `scripts/`), or project files (`*.csproj`) auto-trigger CI Extended. Ensure CI Extended is green before merging these PRs.\n- For issue execution unless the user explicitly says otherwise: open the PR after verification is complete, then perform a deliberate reviewer-style pass on the PR diff/comments before handoff. Follow the Review Policy: post findings, fix everything, address all existing comments, and seed issues for out-of-scope items. Follow the Review Policy: post findings, fix everything, address all existing comments, and seed issues for out-of-scope items.\n\n## Output expectations (after work)\nProvide:\n- Summary of changes\n- Files touched\n- Tests added/updated\n- Commands run + results\n- Docs updated (`STATUS` / `MASTERPLAN`)\n- Notable risks or follow-ups (if any)\n\nSee `docs/tooling/FUTURE_HARNESS_BACKLOG.md` for deferred harness/MCP upgrades.\n\nSee `docs/tooling/DEVTOOLS_OBSERVABILITY_ADDON.md` for Playwright vs DevTools vs logs decision rules.\n\n",{"_536":1069,"_515":516,"_538":522},{"_539":1070,"_541":-5,"_42":-5,"_543":1071,"_545":-5,"_96":1072,"_92":547},[1073],{"_548":522},"developer",{"_46":1074,"_92":571},"Do not spawn sub-agents unless the user or applicable AGENTS.md/skill instructions explicitly ask for sub-agents, delegation, or parallel agent work.",{"_536":1076,"_515":516,"_538":522},{"_539":1077,"_541":-5,"_42":-5,"_543":1078,"_545":-5,"_96":1072,"_92":547},[1079],{"_548":522},{"_46":1080,"_92":571},"You are `/root`, the primary agent in a team of agents collaborating to fulfill the user's goals.\n\nAt the start of your turn, you are the active agent.\nYou can spawn sub-agents to handle subtasks, and those sub-agents can spawn their own sub-agents.\nAll agents in the team, including the agents that you can assign tasks to, are equally intelligent and capable, and have access to the same set of tools.\n\nYou can use `spawn_agent` to create a new agent, `followup_task` to give an existing agent a new task and trigger a turn, and `send_message` to pass a message to a running agent without triggering a turn.\nChild agents can also spawn their own sub-agents.\nYou can decide how much context you want to propagate to your sub-agents with the `fork_turns` parameter.\n\nYou will receive messages in the analysis channel in the form:\n```\nMessage Type: MESSAGE | FINAL_ANSWER\nTask name: \nSender: \nPayload:\n\n```\nThey may be addressed as to=/root\n\nNote that collaboration tools cannot be called from inside `functions.exec`. Call `spawn_agent`, `send_message`, `followup_task`, `wait_agent`, `interrupt_agent`, and `list_agents` only as direct tool calls using the recipient shown in their tool definitions, such as `to=functions.collaboration.spawn_agent`, since they are intentionally absent from the `functions.exec` `tools.*` namespace. Available tools in `functions.exec` are explicitly described with a `tools` namespace in the developer message.\n\nAll agents share the same directory. In detail:\n- All agents have access to the same container and filesystem as you.\n- All agents use the same current working directory.\n- As a result, edits made by one agent are immediately visible to all other agents.\n\nThere are 4 available concurrency slots, meaning that up to 4 agents can be active at once, including you.",{"_536":1082,"_515":516,"_538":522},{"_539":1083,"_541":-5,"_42":-5,"_543":1084,"_545":-5,"_96":1072,"_92":547},[1085,1086],{"_548":522},{"_46":1088,"_92":571},{"_46":1087,"_92":571},"\n## Skills\nA skill is a set of instructions provided through a `SKILL.md` source. Below is the list of skills that can be used. Each entry includes a name, description, and source locator. `file` locators are on the host filesystem, `environment resource` locators are owned by an execution environment, `orchestrator resource` locators are opaque non-filesystem resources, and `custom resource` locators use their provider's access mechanism.\n### Available skills\n- imagegen: Generate or edit raster images when the task benefits from AI-created bitmap visuals such as photos, illustrations, textures, sprites, mockups, or transparent-background cutouts. Use when Codex should create a brand-new image, transform an existing image, or derive visual variants from references, and the output should be a bitmap asset rather than repo-native code or vector. Do not use when the task is better handled by editing existing SVG/vector/code-native assets, extending an established icon or logo system, or building the visual directly in HTML/CSS/canvas. (file: /opt/codex/skills/.system/imagegen/SKILL.md)\n- openai-docs: Use when the user asks how to build with OpenAI products or APIs, asks about Codex itself or choosing Codex surfaces, needs up-to-date official documentation with citations, help choosing the latest model for a use case, or model upgrade and prompt-upgrade guidance; use OpenAI docs MCP tools for non-Codex docs questions, use the Codex manual helper first for broad Codex self-knowledge, and restrict fallback browsing to official OpenAI domains. (file: /opt/codex/skills/.system/openai-docs/SKILL.md)\n- plugin-creator: Create and scaffold plugin directories for Codex with a required `.codex-plugin/plugin.json`, optional plugin folders/files, valid manifest defaults, and personal-marketplace entries by default. Use when Codex needs to create a new personal plugin, add optional plugin structure, generate or update marketplace entries for plugin ordering and availability metadata, or update an existing local plugin during development with the CLI-driven cachebuster and reinstall flow. (file: /opt/codex/skills/.system/plugin-creator/SKILL.md)\n- skill-creator: Guide for creating effective skills. This skill should be used when users want to create a new skill (or update an existing skill) that extends Codex's capabilities with specialized knowledge, workflows, or tool integrations. (file: /opt/codex/skills/.system/skill-creator/SKILL.md)\n- skill-installer: Install Codex skills into $CODEX_HOME/skills from a curated list or a GitHub repo path. Use when a user asks to list installable skills, install a curated skill, or install a skill from another repo (including private repos). (file: /opt/codex/skills/.system/skill-installer/SKILL.md)\n- taskdeck-backend-slice: Implement Taskdeck backend changes safely. Use when changing .NET API, application, domain, infrastructure, worker, auth, provider-runtime, import-export, notification, archive, or persistence behavior. (file: /workspace/Taskdeck/.codex/skills/taskdeck-backend-slice/SKILL.md)\n- taskdeck-capture-review-loop: Protect Taskdeck's core capture-review-apply-board loop. Use when touching Inbox, capture, triage, automation proposals, proposal summaries, approve-reject-execute behavior, provenance, or board handoff semantics across backend or frontend. (file: /workspace/Taskdeck/.codex/skills/taskdeck-capture-review-loop/SKILL.md)\n- taskdeck-ci-conflict-recovery: Triage and fix Taskdeck PR failures involving CI, GitHub bot comments, merge conflicts, stale branches, flaky tests, or blocked checks. Use when the user asks Codex to check failing CI, inspect PR comments, fix conflicts, monitor runs, rerun checks, or recover PRs after review automation reports errors. (file: /workspace/Taskdeck/.codex/skills/taskdeck-ci-conflict-recovery/SKILL.md)\n- taskdeck-demo-regression: Validate Taskdeck with the smallest evidence path that proves the change. Use when a task needs seeded demo state, Playwright proof, screenshots, or stakeholder walkthrough evidence. (file: /workspace/Taskdeck/.codex/skills/taskdeck-demo-regression/SKILL.md)\n- taskdeck-failure-capture: Classify and record Taskdeck agent failures, failed commands, flaky or blocked checks, MCP/tool problems, CI failures, docs-governance warnings, and workarounds. Use whenever unresolved friction should be visible in handoff or promoted into guidance. (file: /workspace/Taskdeck/.codex/skills/taskdeck-failure-capture/SKILL.md)\n- taskdeck-frontend-workspace-slice: Implement Taskdeck frontend shell and workspace changes. Use when changing Vue routes, stores, components, Home, Today, Boards, workspace-mode flows, keyboard behavior, help states, or novice-first product legibility outside the core capture-review semantics. (file: /workspace/Taskdeck/.codex/skills/taskdeck-frontend-workspace-slice/SKILL.md)\n- taskdeck-interface-map: Maintain Taskdeck's agent-facing interface maps. Use when adding, splitting, refactoring, or documenting complex domains so future agents can find entry points, invariants, edit seams, traps, and verification commands without bulk-reading the repo. (file: /workspace/Taskdeck/.codex/skills/taskdeck-interface-map/SKILL.md)\n- taskdeck-issue-batch-orchestrator: Coordinate high-autonomy Taskdeck issue batches from selection through PR review and handoff. Use when the user asks Codex to take care of many issues, pick next issues, run a batch, coordinate subagents/worktrees, seed follow-ups, reconcile GitHub project status, or automate issue-to-PR execution across multiple independent workstreams. (file: /workspace/Taskdeck/.codex/skills/taskdeck-issue-batch-orchestrator/SKILL.md)\n- taskdeck-pr-review-loop: Perform Taskdeck PR self-review or fresh adversarial review, post review findings, address review comments and bot comments, verify fixes, and re-review. Use when the user asks to review PRs, spin fresh reviewers, check comments, address feedback, or run another adversarial pass on sensitive or failing work. (file: /workspace/Taskdeck/.codex/skills/taskdeck-pr-review-loop/SKILL.md)\n- taskdeck-question-batch: Decide whether a Taskdeck agent should ask the user, proceed with a documented assumption, or stop for safety. Use when a task is broad, underspecified, has possible product/security/schema ambiguity, or risks context-expensive question loops. (file: /workspace/Taskdeck/.codex/skills/taskdeck-question-batch/SKILL.md)\n- taskdeck-repo-onramp: Orient to the Taskdeck repo before editing. Use when starting a session, entering an unfamiliar area, reconciling a broad request against current reality, or turning a vague task into a scoped plan. (file: /workspace/Taskdeck/.codex/skills/taskdeck-repo-onramp/SKILL.md)\n- taskdeck-verification-doc-sync: Finish a Taskdeck change with the right checks and doc updates. Use at the end of implementation to choose verification scope, decide whether canonical docs changed, and prepare the required handoff summary. (file: /workspace/Taskdeck/.codex/skills/taskdeck-verification-doc-sync/SKILL.md)\n- taskdeck-worktree-issue-worker: Implement one Taskdeck GitHub issue in an isolated worktree with focused ownership, small commits, tests, PR creation, and handoff. Use when a coordinator assigns Codex a single issue, asks for issue-to-PR execution, or launches a worker/subagent for backend, frontend, docs, or testing implementation. (file: /workspace/Taskdeck/.codex/skills/taskdeck-worktree-issue-worker/SKILL.md)\n","\nFilesystem sandboxing defines which files can be read or written. `sandbox_mode` is `danger-full-access`: No filesystem sandboxing - all commands are permitted. Network access is enabled.\nApproval policy is currently never. Do not provide the `sandbox_permissions` for any reason, commands will be rejected.\n","turn/started",{"_515":516,"_87":1091},{"_103":-5,"_42":522,"_523":1092,"_525":526,"_527":528,"_529":1093},[],"inProgress",{"_529":1095,"_515":516},{"_1096":1097,"_92":1098},"activeFlags",[],"active","thread/started",{"_1101":1102},"thread",{"_1103":-5,"_1104":-5,"_1105":1106,"_1107":528,"_581":582,"_1108":15,"_1109":-5,"_1110":-5,"_1111":-5,"_1112":1113,"_42":516,"_1114":1115,"_282":-5,"_1116":-5,"_209":1117,"_1118":300,"_1119":528,"_1120":516,"_587":1121,"_529":1122,"_1123":-5,"_77":1124,"_1125":528},"agentNickname","agentRole","cliVersion","0.144.0-alpha.4","createdAt","ephemeral","extra","forkedFromId","gitInfo","historyMode","legacy","modelProvider","openai","parentThreadId","/opt/codex/sessions/2026/07/26/rollout-2026-07-26T05-29-57-019f9ce6-c584-78f3-8bf9-88f4273990f5.jsonl","preview","recencyAt","sessionId","vscode",{"_92":533},"threadSource",[],"updatedAt",[],"messages",[1129],{"_42":1130,"_1131":1132,"_1133":1134,"_1135":1134,"_539":1136,"_529":1137,"_541":-5,"_1138":32,"_1139":1140,"_1141":400,"_1142":-5},"0856f0eb-350e-4aef-8099-c0190646b4c3","author",{"_96":426,"_282":-5,"_1139":1151},"create_time",1785043796.661544,"update_time",{"_1147":46,"_1148":1149},"finished_successfully","weight","metadata",{"_1143":1144},"recipient","channel","l1239dk1",{"_1145":1146},"inline_comments",[],"content_type","parts",[1150],"## Deliberate self-review findings — exact head `b3838d0632d9465f4ec16216d13fca312d568d4d`\n\n### HIGH — PR metadata could close the parent tracker unintentionally\n\nThe initial PR body used a negated close-keyword sentence beside `#1291`. GitHub nevertheless added both `#1291` and `#1492` to `closingIssuesReferences`, so merging the PR could have closed the still-open parent tracker.\n\nExpected fix: remove every close/fix/resolve keyword near `#1291`, retain only `Closes #1492`, and verify the live closing-link set rather than trusting the prose.\n\nStatus: fixed in PR metadata before handoff.\n\n### MEDIUM — regression test froze a mutable append-only ledger\n\nThe first local test draft loaded the repository JSONL directly and hard-coded today's `23 raw / 15 projected / 14 resolved / 1 open` counts. The next legitimate ledger append would have failed the renderer unit suite even if projection behavior remained correct.\n\nExpected fix: use a deterministic synthetic fixture containing seed metadata, the issue-less E2E row, and the four open/resolved projection pairs; keep live repository counts as verification evidence only.\n\nStatus: fixed before push in test commit `b3838d0632d9465f4ec16216d13fca312d568d4d`.\n\n### Other severities\n\n- CRITICAL: none.\n- LOW: none.\n- Out-of-scope findings: none.\n\nExisting-comment triage at review time: one `@codex` exact-head review request is pending; there are no inline threads or submitted reviews yet.\nReconcile stale failure ledger projections\n\n## Summary\n\n- Append qualified resolution records for #1343, #1347, #1348, and #1490 while preserving all 19 original JSONL rows.\n- Suppress `class=seed` metadata from every rendered projection, including seed-only input, without hiding issue-less non-seed rows.\n- Regenerate the human-readable ledger and add deterministic projection/regression coverage.\n\nPart of #1291; #1291 remains open.\n\nCloses #1492\n\n## Implementation Notes\n\n- Projection identity remains `(surface, first tracking issue in future_fix)`; each resolution row keeps its target issue first.\n- #1343 records the core #1386 repair while retaining separate #1388/#1410 residual debt.\n- #1348 records both the #1361 SQLite root fix and #1362 unmocked Paper-browser completion.\n- The raw ledger diff is append-only: 4 additions, 0 deletions.\n\n## Verification\n\n- [ ] `dotnet test backend/Taskdeck.sln -c Release` (not run: no backend/product behavior changed)\n- [ ] `Push-Location frontend/taskdeck-web; npm run typecheck; if ($LASTEXITCODE -ne 0) { Pop-Location; exit $LASTEXITCODE }; npm run build; if ($LASTEXITCODE -ne 0) { Pop-Location; exit $LASTEXITCODE }; npx vitest --run; $code = $LASTEXITCODE; Pop-Location; if ($code -ne 0) { exit $code }` (not run: no frontend behavior changed)\n- [ ] Playwright smoke/E2E executed (not applicable: no UI or cross-surface behavior changed)\n- [x] `py -3 -m unittest test_render_failure_ledger.py` from `scripts/agent_hooks` — 5/5 passed\n- [x] Fresh renderer run is byte-identical — SHA-256 `52C4CBC17BC401AC41B3DA50A4CBA9A3AB95AA5AEA52A857DC492FD6EF8E4B7B`\n- [x] JSONL parsed with required fields — raw 23 (9 open/14 resolved), projected 15 (1 open/14 resolved)\n- [x] Sole open projection remains `invalid_signal / ci/e2e-smoke`; raw seed count 1, projected seed count 0\n- [x] `node scripts/check-docs-governance.mjs`\n- [x] `node scripts/check-golden-principles.mjs`\n- [x] `node scripts/check-github-ops-governance.mjs`\n- [x] `git diff --check 61f718af941c56c31b8b7595333b9debd6e47da8..HEAD`\n- [x] Exact four-file scope, clean worktree, and DCO 2/2\n\n## Documentation\n\n- [x] `docs/agentic/failure_ledger.jsonl` appended and `docs/agentic/FAILURE_LEDGER.md` regenerated\n- [x] `docs/STATUS.md` reviewed and unchanged; shipped product reality did not change\n- [x] `docs/IMPLEMENTATION_MASTERPLAN.md` reviewed and unchanged; roadmap sequencing did not change\n- [x] `docs/TESTING_GUIDE.md` / `docs/MANUAL_TEST_CHECKLIST.md` reviewed and unchanged; verification flow did not change\n\n## Tracking\n\n- [x] Linked issue included: `Closes #1492`\n- [x] Linked issue and PR project items verified as `Review / Priority II`\n\n## CI Workflow Validation\n\n- [ ] CI Extended passes on the exact head (auto-triggered because `scripts/` changed; hosted evidence pending)\n\n## Risk Notes\n\n- Security impact: none; no runtime enforcement or product code changes.\n- Behavior/regression risk: low; projection behavior is directly covered, raw history is append-only, and the generated Markdown is byte-stable.\n- Follow-up tasks: #1388/#1410 remain explicit residuals for #1343; data-policy-blocked draft PR #1488 must absorb this new main history before it can proceed.\n\n@codex review exact head b3838d0632d9465f4ec16216d13fca312d568d4d. Please focus on seed-only and issue-less projection semantics, append-only ledger truth, resolution evidence/overclaiming, future appendability of tests, linked-issue safety, and generated-render synchronization. All earlier-head evidence is stale if this head moves.",{},"created",1785043945.8580575,"Completing the task","event_type","info",{"_92":547,"_96":93,"_539":1379},{"_92":1159,"_1160":1161},"partial_repo_snapshot","files",[1162,1163,1164,1165],{"_209":1315,"_1167":-5,"_1168":1316,"_1170":-5},{"_209":1234,"_1167":-5,"_1168":1235,"_1170":-5},{"_209":1207,"_1167":-5,"_1168":1208,"_1170":-5},{"_209":1166,"_1167":-5,"_1168":1169,"_1170":-5},"docs/agentic/FAILURE_LEDGER.md","contents","line_range_contents",[1171],"missing_reason",{"_1172":832,"_1173":1174,"_539":1175,"_1176":59},"line_range_start","line_range_end",37,[1177,300,1178,1179,1180,300,1181,300,1182,1183,1184,1185,1186,1187,1188,1189,1190,1191,1192,1193,1194,1195,1196,1197,1198,300,1199,300,1200,1201,1202,1203,300,1204,300,1205,1206],"contains_end_of_file","# Agent Failure Ledger","This is the human-readable view of recurring agent, tool, test, CI, and workflow failures.","Machine-appended raw entries live in `docs/agentic/failure_ledger.jsonl`.","Rows sharing a surface and first tracking issue in `future_fix` show only their latest state here; the JSONL retains append-only history.","## Entries","| Date | Class | Surface | Failure | Workaround | Future fix | Status |","| --- | --- | --- | --- | --- | --- | --- |","| 2026-05-29 | blocker | dependabot/nuget | dotnet-minor-patch repeatedly proposed EF Core 9.x while Sqlite/Design remained 8.x, causing ambiguous ExecuteDeleteAsync errors on #1102/#1106 | Pin EF Core back to 8.0.27 per PR | Resolved by #1112 ignore rule and the EF runtime 8.x pins in #760/#767 | resolved |","| 2026-05-29 | blocker | dependabot/nuget | After FluentAssertions moved to free 7.x in #1088, Dependabot immediately proposed paid v8 in #1117 | Close the v8 PR | Resolved by the FluentAssertions major ignore rule in #1118/ADR-0034 | resolved |","| 2026-05-29 | invalid_signal | ci/e2e-smoke | E2E Smoke intermittently times out at multi-board.spec.ts:197 restoredBoard visibility with a transient DB connection error unrelated to the PR diff | Investigate against the diff; rerun only the failed job when unrelated | Stabilize the archive-to-restore seed or adjust the visibility wait after root-cause proof | open |","| 2026-05-29 | non_blocking_risk | git/worktree | gh pr merge --delete-branch on a stacked base auto-closed dependent PR #1096; it could not reopen after the base disappeared | Recover the dependent on a new main-based branch/PR (#1104) | Retarget dependent PRs before deleting any stacked base branch | resolved |","| 2026-07-13 | pre_existing_noise | test/sqlite-concurrency | Required Windows/full-suite runs on #1328, #1298, and #1334 produced HTTP 500s in concurrent capture/card tests while exact repetitions passed | Keep the full run non-green; run exact tests for diagnosis and move unrelated work on without merging | Resolved by #1373 (closes #1282): a shared UseTaskdeckSqlite helper backs both production DI and the API test factory so WAL/busy-timeout can no longer drift; f... | resolved |","| 2026-07-13 | pre_existing_noise | test/redis-lifecycle | #1298's second full backend run failed RedisCacheServiceTests.Dispose_IsNotSerialized_BehindAnInFlightConnect; the exact test passed 5/5 | Park #1298 without a PR instead of treating a narrow rerun as a green full gate | Resolved by #1392 (closes #1332) on 2026-07-17: a dedicated named background Thread replaces Task.Run so the dispose-vs-connect seam is reached deterministicall... | resolved |","| 2026-07-13 | pre_existing_noise | test/background-workers | #1334's full suite let a hosted LLM worker pre-claim a test row and a delayed presence join arrive after events were cleared | Keep the full run non-green and link exact evidence from the PR | Resolved 2026-07-17: workers half by #1394 (closes #1335) + #1391 (closes #1383); presence half by #1366 (snapshot ordering) + #1371 (phase drains). A shared Ho... | resolved |","| 2026-07-17 | non_blocking_risk | github/project-sync | Resolution record for the 2026-07-13 project-sync scope row: the gh token lacked read:project scope so Priority fields were unaudited | No workaround needed any longer | Resolved 2026-07-17 (#1327 scope item): maintainer ran gh auth refresh -s project; Sync-TaskdeckProjectPriority.ps1 audit scanned 1000 items with 0 needing sync | resolved |","| 2026-07-14 | blocker | ci/extended-workflow | Resolution record for the earlier #1330 open row: CI Extended reusable Gitleaks permission startup failures are repaired and the tracking issue is closed | No workaround remains; use exact-head Extended runs as the verification signal | Resolved by 66382e6c (Fix CI Extended Gitleaks permissions); #1330 closed 2026-07-13 | resolved |","| 2026-07-14 | blocker | ci/nightly-k6 | CI Nightly run 29229402012 and prior runs lost both k6 summary JSON files to bind-mount permission denial while the tagged SQLite board-write p95 gate failed at... | Do not treat the always-red lane as trustworthy regression evidence until summary ownership and the measured capacity contract are repaired | #1358: map both k6 containers to the host UID/GID, warn at the measured 2000ms capacity, gate at 2200ms, and prove exact-head CI. Resolved: First post-#1359 nig... | resolved |","| 2026-07-25 | non_blocking_risk | dependency/sqlite-native | Resolution record: the inherited HIGH SQLite native advisory is removed from Taskdeck's resolved dependency graph | No workaround remains; keep the runtime security-floor regression and dependency audit green | #1345 resolved by centrally pinning the matched SQLitePCLRaw bundle/core/provider/native family at 2.1.12; SQLite 3.53.3 loads, the >= 3.50.2 floor test passes,... | resolved |","| 2026-07-26 | pre_existing_noise | frontend/workspace-mode-ordering | Resolution record for the #1343 preference-vs-summary ordering defect; the original observed failure remains in append-only history | No workaround remains for the core stale-summary overwrite; retain separate residual debt instead of overstating closure | #1343 core resolved by PR #1386 merge dba47320e348b80ecb678c41a51b686c954527ee; separate server-order/cross-device and client-state residuals remain #1388/#1410... | resolved |","| 2026-07-26 | blocker | frontend/paper-review-contract | Resolution record for the #1347 numeric deep-review enum wire-contract crash; the original observed failure remains in append-only history | No workaround remains; valid numeric payloads render directly and unexpected values fail closed to visible warning states | #1347 resolved by PR #1360 merge ed2538ffb0388523882238653b34fcc6f431a512: API numeric-enum serialization, frontend mapping, conservative malformed-value handli... | resolved |","| 2026-07-26 | blocker | backend/similar-past | Resolution record for the #1348 SQLite-backed similar-past HTTP 500; the original observed failure remains in append-only history | No workaround remains; keep the bounded board/user scope and real SQLite/browser coverage as regression evidence | #1348 resolved by PR #1361 merge ccd7bf93721c07171099383c77bfb508c23fbf48; Paper-browser completion by PR #1362 merge 40b7bb2f3819dcc7d0bd6349a8f516fd3169190f. ... | resolved |","| 2026-07-26 | non_blocking_risk | agent/tool-command-composition | Resolution record for the repeated #1490 PowerShell/native command-composition failures; the original recurrence remains in append-only history | No workaround remains; use the copyable safe forms and classify future failures through the ledger process | #1490 resolved by PR #1491 merge 61f718af941c56c31b8b7595333b9debd6e47da8: the MCP tooling guide now covers collected foreach output, optional rg exits, safe mu... | resolved |","## Classification","- `blocker`: work cannot safely continue.","- `non_blocking_risk`: work can continue, but verification confidence is reduced.","- `pre_existing_noise`: unrelated existing failure that should still be visible.","- `invalid_signal`: false alarm, stale check, or non-applicable warning.","## Promotion Rule","A ledger entry should become a guide or skill update only when it is reproducible, project-specific, and likely to recur.","Use `docs/agentic/GUIDE_UPDATE_PROTOCOL.md`; do not mutate root instructions after a single ambiguous failure.","docs/agentic/failure_ledger.jsonl",[1209],{"_1172":832,"_1173":435,"_539":1210,"_1176":59},[1211,1212,1213,1214,1215,1216,1217,1218,1219,1220,1221,1222,1223,1224,1225,1226,1227,1228,1229,1230,1231,1232,1233],"{\"ts\":\"2026-05-11T00:00:00Z\",\"class\":\"seed\",\"surface\":\"agentic-pack\",\"failure\":\"Ledger created\",\"workaround\":\"n/a\",\"future_fix\":\"Start recording recurring failures and promote confirmed lessons\",\"status\":\"open\"}","{\"ts\":\"2026-05-29T00:00:00Z\",\"class\":\"blocker\",\"surface\":\"dependabot/nuget\",\"failure\":\"dotnet-minor-patch repeatedly proposed EF Core 9.x while Sqlite/Design remained 8.x, causing ambiguous ExecuteDeleteAsync errors on #1102/#1106\",\"workaround\":\"Pin EF Core back to 8.0.27 per PR\",\"future_fix\":\"Resolved by #1112 ignore rule and the EF runtime 8.x pins in #760/#767\",\"status\":\"resolved\"}","{\"ts\":\"2026-05-29T00:00:00Z\",\"class\":\"blocker\",\"surface\":\"dependabot/nuget\",\"failure\":\"After FluentAssertions moved to free 7.x in #1088, Dependabot immediately proposed paid v8 in #1117\",\"workaround\":\"Close the v8 PR\",\"future_fix\":\"Resolved by the FluentAssertions major ignore rule in #1118/ADR-0034\",\"status\":\"resolved\"}","{\"ts\":\"2026-05-29T00:00:00Z\",\"class\":\"invalid_signal\",\"surface\":\"ci/e2e-smoke\",\"failure\":\"E2E Smoke intermittently times out at multi-board.spec.ts:197 restoredBoard visibility with a transient DB connection error unrelated to the PR diff\",\"workaround\":\"Investigate against the diff; rerun only the failed job when unrelated\",\"future_fix\":\"Stabilize the archive-to-restore seed or adjust the visibility wait after root-cause proof\",\"status\":\"open\"}","{\"ts\":\"2026-05-29T00:00:00Z\",\"class\":\"non_blocking_risk\",\"surface\":\"git/worktree\",\"failure\":\"gh pr merge --delete-branch on a stacked base auto-closed dependent PR #1096; it could not reopen after the base disappeared\",\"workaround\":\"Recover the dependent on a new main-based branch/PR (#1104)\",\"future_fix\":\"Retarget dependent PRs before deleting any stacked base branch\",\"status\":\"resolved\"}","{\"ts\":\"2026-07-13T03:00:00Z\",\"class\":\"pre_existing_noise\",\"surface\":\"test/sqlite-concurrency\",\"failure\":\"Required Windows/full-suite runs on #1328, #1298, and #1334 produced HTTP 500s in concurrent capture/card tests while exact repetitions passed\",\"workaround\":\"Keep the full run non-green; run exact tests for diagnosis and move unrelated work on without merging\",\"future_fix\":\"Resolved by #1373 (closes #1282): a shared UseTaskdeckSqlite helper backs both production DI and the API test factory so WAL/busy-timeout can no longer drift; full suite reported 7223/0/1 and #1366 presence stress ran 15/15\",\"status\":\"resolved\"}","{\"ts\":\"2026-07-13T03:52:00Z\",\"class\":\"pre_existing_noise\",\"surface\":\"test/redis-lifecycle\",\"failure\":\"#1298's second full backend run failed RedisCacheServiceTests.Dispose_IsNotSerialized_BehindAnInFlightConnect; the exact test passed 5/5\",\"workaround\":\"Park #1298 without a PR instead of treating a narrow rerun as a green full gate\",\"future_fix\":\"Resolved by #1392 (closes #1332) on 2026-07-17: a dedicated named background Thread replaces Task.Run so the dispose-vs-connect seam is reached deterministically (thread-pool-saturation flake eliminated) and the ManualResetEventSlims are disposed\",\"status\":\"resolved\"}","{\"ts\":\"2026-07-13T04:07:00Z\",\"class\":\"pre_existing_noise\",\"surface\":\"test/background-workers\",\"failure\":\"#1334's full suite let a hosted LLM worker pre-claim a test row and a delayed presence join arrive after events were cleared\",\"workaround\":\"Keep the full run non-green and link exact evidence from the PR\",\"future_fix\":\"Resolved 2026-07-17: workers half by #1394 (closes #1335) + #1391 (closes #1383); presence half by #1366 (snapshot ordering) + #1371 (phase drains). A shared HostedWorkerDisabledTestWebApplicationFactory removes app-assembly hosted services from the test host (adopted by the queue/webhook/proposal integration suites plus a split ProcessNextClaimRaceTests); the AuditRetention suite adopted the same workerless factory after the live AuditRetentionWorker startup pass was proven to race backdated seeds\",\"status\":\"resolved\"}","{\"ts\":\"2026-07-13T03:35:00Z\",\"class\":\"blocker\",\"surface\":\"ci/extended-workflow\",\"failure\":\"CI Extended starts no jobs because reusable gitleaks requests pull-requests: read while its caller grants no permissions; reproduced across unrelated PRs\",\"workaround\":\"Do not merge affected PRs; continue independent work and record the shared blocker\",\"future_fix\":\"#1330: repair the least-privilege caller/callee permission contract and prove a real Extended run\",\"status\":\"open\"}","{\"ts\":\"2026-07-13T03:14:00Z\",\"class\":\"non_blocking_risk\",\"surface\":\"github/project-sync\",\"failure\":\"Sync-TaskdeckProjectPriority.ps1 cannot audit or apply Priority because the current gh token lacks read:project/project write scope\",\"workaround\":\"Continue repo/PR work, keep priority labels correct, and disclose that project fields are unaudited\",\"future_fix\":\"#1327: maintainer runs gh auth refresh -s project, then reruns audit/apply and verifies no empty Priority fields\",\"status\":\"open\"}","{\"ts\":\"2026-07-17T16:20:00Z\",\"class\":\"non_blocking_risk\",\"surface\":\"github/project-sync\",\"failure\":\"Resolution record for the 2026-07-13 project-sync scope row: the gh token lacked read:project scope so Priority fields were unaudited\",\"workaround\":\"No workaround needed any longer\",\"future_fix\":\"Resolved 2026-07-17 (#1327 scope item): maintainer ran gh auth refresh -s project; Sync-TaskdeckProjectPriority.ps1 audit scanned 1000 items with 0 needing sync\",\"status\":\"resolved\"}","{\"ts\":\"2026-07-13T05:04:00Z\",\"class\":\"pre_existing_noise\",\"surface\":\"frontend/workspace-mode-ordering\",\"failure\":\"#1334 required E2E observed a late workspace summary restore guided after the user selected workbench during a failed preference save; exact local Playwright then passed 6/6\",\"workaround\":\"Treat the CI failure as real, track the asynchronous ordering seam separately from the auth PR, and rerun only after focused investigation\",\"future_fix\":\"#1343: version summary mode application against newer explicit preference actions and prove it with deterministic store tests plus repeated E2E\",\"status\":\"open\"}","{\"ts\":\"2026-07-13T06:22:00Z\",\"class\":\"non_blocking_risk\",\"surface\":\"dependency/sqlite-native\",\"failure\":\"#1316 package verification found pre-existing HIGH advisory GHSA-2m69-gcr7-jv3q in transitive SQLitePCLRaw.lib.e_sqlite3 2.1.6; the official advisory currently lists all published versions through 2.1.11 as affected\",\"workaround\":\"Track the inherited advisory without blaming PdfPig or claiming an unavailable patched upgrade\",\"future_fix\":\"#1345: adopt a patched upstream release when available or prove a safe provider/mitigation change\",\"status\":\"open\"}","{\"ts\":\"2026-07-13T06:25:00Z\",\"class\":\"blocker\",\"surface\":\"frontend/paper-review-contract\",\"failure\":\"Real Paper Review proposals deserialize numeric ConflictTone values into a frontend string-only contract, causing tone.toLowerCase to throw and the ErrorBoundary to replace the review surface\",\"workaround\":\"Park #1274 after preserving a clean local branch; do not treat passing API-level apply assertions as valid Paper UI proof\",\"future_fix\":\"#1347: align deep-review enum wire contracts and add serialized API plus Paper browser regressions\",\"status\":\"open\"}","{\"ts\":\"2026-07-13T06:25:00Z\",\"class\":\"blocker\",\"surface\":\"backend/similar-past\",\"failure\":\"GET /api/automation/proposals/{id}/similar-past returned HTTP 500 for at least four distinct real SQLite-backed capture proposals during #1274 Paper runs\",\"workaround\":\"Keep the failure visible despite Promise.allSettled fallback and frontend retries; park the coverage PR rather than certifying a noisy review path\",\"future_fix\":\"#1348: capture the server exception in a SQLite API test and repair the bounded board-scoped query path\",\"status\":\"open\"}","{\"ts\":\"2026-07-14T00:00:00Z\",\"class\":\"blocker\",\"surface\":\"ci/extended-workflow\",\"failure\":\"Resolution record for the earlier #1330 open row: CI Extended reusable Gitleaks permission startup failures are repaired and the tracking issue is closed\",\"workaround\":\"No workaround remains; use exact-head Extended runs as the verification signal\",\"future_fix\":\"Resolved by 66382e6c (Fix CI Extended Gitleaks permissions); #1330 closed 2026-07-13\",\"status\":\"resolved\"}","{\"ts\":\"2026-07-14T00:00:00Z\",\"class\":\"blocker\",\"surface\":\"ci/nightly-k6\",\"failure\":\"CI Nightly run 29229402012 and prior runs lost both k6 summary JSON files to bind-mount permission denial while the tagged SQLite board-write p95 gate failed at its stale 1500ms target\",\"workaround\":\"Do not treat the always-red lane as trustworthy regression evidence until summary ownership and the measured capacity contract are repaired\",\"future_fix\":\"#1358: map both k6 containers to the host UID/GID, warn at the measured 2000ms capacity, gate at 2200ms, and prove exact-head CI. Resolved: First post-#1359 nightly green on 326b6b5b @ 2026-07-18T05:39:02Z (run 29632619187).\",\"status\":\"resolved\"}","{\"ts\":\"2026-07-25T23:34:12Z\",\"class\":\"non_blocking_risk\",\"surface\":\"dependency/sqlite-native\",\"failure\":\"Resolution record: the inherited HIGH SQLite native advisory is removed from Taskdeck's resolved dependency graph\",\"workaround\":\"No workaround remains; keep the runtime security-floor regression and dependency audit green\",\"future_fix\":\"#1345 resolved by centrally pinning the matched SQLitePCLRaw bundle/core/provider/native family at 2.1.12; SQLite 3.53.3 loads, the >= 3.50.2 floor test passes, the solution vulnerability audit is clean, EF has no pending model changes, and the self-contained win-x64 API health smoke returns 200\",\"status\":\"resolved\"}","{\"ts\":\"2026-07-26T03:59:00Z\",\"class\":\"non_blocking_risk\",\"surface\":\"agent/tool-command-composition\",\"failure\":\"Repeated PowerShell/native composition mistakes caused parser failures, GitHub body argument splitting, jq quote loss, and optional rg exits hiding independent evidence during Cycle 4\",\"workaround\":\"Collect statement-form foreach output before piping; handle optional rg exit 1 explicitly; use typed GitHub connectors for multiline bodies; prefer gh --json plus ConvertFrom-Json; avoid Markdown-bearing double-quoted wrappers\",\"future_fix\":\"#1490: add copyable PowerShell/native composition forms to the MCP tooling guide, verify the failure-ledger renderer and docs gates, then append a resolution record only after merge and issue closure\",\"status\":\"open\"}","{\"ts\":\"2026-07-26T05:11:40Z\",\"class\":\"pre_existing_noise\",\"surface\":\"frontend/workspace-mode-ordering\",\"failure\":\"Resolution record for the #1343 preference-vs-summary ordering defect; the original observed failure remains in append-only history\",\"workaround\":\"No workaround remains for the core stale-summary overwrite; retain separate residual debt instead of overstating closure\",\"future_fix\":\"#1343 core resolved by PR #1386 merge dba47320e348b80ecb678c41a51b686c954527ee; separate server-order/cross-device and client-state residuals remain #1388/#1410. The merged Home/Today guard has deterministic store and repeated E2E proof.\",\"status\":\"resolved\"}","{\"ts\":\"2026-07-26T05:11:40Z\",\"class\":\"blocker\",\"surface\":\"frontend/paper-review-contract\",\"failure\":\"Resolution record for the #1347 numeric deep-review enum wire-contract crash; the original observed failure remains in append-only history\",\"workaround\":\"No workaround remains; valid numeric payloads render directly and unexpected values fail closed to visible warning states\",\"future_fix\":\"#1347 resolved by PR #1360 merge ed2538ffb0388523882238653b34fcc6f431a512: API numeric-enum serialization, frontend mapping, conservative malformed-value handling, and Paper Chromium coverage prove the repaired wire contract.\",\"status\":\"resolved\"}","{\"ts\":\"2026-07-26T05:11:40Z\",\"class\":\"blocker\",\"surface\":\"backend/similar-past\",\"failure\":\"Resolution record for the #1348 SQLite-backed similar-past HTTP 500; the original observed failure remains in append-only history\",\"workaround\":\"No workaround remains; keep the bounded board/user scope and real SQLite/browser coverage as regression evidence\",\"future_fix\":\"#1348 resolved by PR #1361 merge ccd7bf93721c07171099383c77bfb508c23fbf48; Paper-browser completion by PR #1362 merge 40b7bb2f3819dcc7d0bd6349a8f516fd3169190f. The SQLite root cause and unmocked UI path are covered.\",\"status\":\"resolved\"}","{\"ts\":\"2026-07-26T05:11:40Z\",\"class\":\"non_blocking_risk\",\"surface\":\"agent/tool-command-composition\",\"failure\":\"Resolution record for the repeated #1490 PowerShell/native command-composition failures; the original recurrence remains in append-only history\",\"workaround\":\"No workaround remains; use the copyable safe forms and classify future failures through the ledger process\",\"future_fix\":\"#1490 resolved by PR #1491 merge 61f718af941c56c31b8b7595333b9debd6e47da8: the MCP tooling guide now covers collected foreach output, optional rg exits, safe multiline GitHub bodies, Markdown/backtick boundaries, and gh --json plus ConvertFrom-Json; #1490 closed 2026-07-26.\",\"status\":\"resolved\"}","scripts/agent_hooks/test_render_failure_ledger.py",[1236],{"_1172":832,"_1173":1237,"_539":1238,"_1176":59},176,[1239,1240,300,1241,300,300,1242,1243,1244,1245,1246,1247,1248,1249,1245,1246,1250,1251,1249,1252,300,1253,300,1254,300,1255,1244,1245,1246,1247,1251,1249,1245,1246,1256,1248,1249,1252,300,1253,300,1257,300,1258,1244,1245,1259,1260,1261,1248,1249,1245,1259,1260,1261,1251,1249,1252,300,1253,300,1257,300,1262,1244,1245,1263,1264,1265,1266,1248,1267,1252,300,1268,1269,300,1270,1271,300,1272,1244,1245,1264,1265,1273,1248,1249,1245,1259,1260,1261,1248,1249,1245,1274,1275,1276,1248,1249,1245,1277,1278,1279,1248,1249,1245,1277,1280,1281,1248,1249,1245,1282,1283,1284,1248,1249,1245,1274,1275,1285,1251,1249,1245,1277,1278,1286,1251,1249,1245,1277,1280,1287,1251,1249,1245,1282,1283,1288,1251,1249,1252,300,1253,1289,1290,1291,1292,1293,1294,300,1295,1296,1297,1298,300,1299,1300,1301,1302,1303,1304,1305,1306,1307,300,1308,1309,1310,1311,1312,300,300,1313,1314],"import unittest","from collections import Counter","from render_failure_ledger import project_latest_entries, render_markdown","class FailureLedgerProjectionTests(unittest.TestCase):"," def test_latest_state_supersedes_same_surface_and_tracking_issue(self) -> None:"," entries = ["," {"," \"surface\": \"ci/extended-workflow\","," \"future_fix\": \"#1330: repair workflow permissions\","," \"status\": \"open\","," },"," \"future_fix\": \"Resolved by 66382e6c; #1330 closed\","," \"status\": \"resolved\","," ]"," projected = project_latest_entries(entries)"," self.assertEqual([entry[\"status\"] for entry in projected], [\"resolved\"])"," def test_same_surface_with_different_tracking_issues_remains_visible(self) -> None:"," \"future_fix\": \"#1400: repair a separate workflow fault\","," self.assertEqual(projected, entries)"," def test_rows_without_tracking_issues_remain_unique(self) -> None:"," \"class\": \"invalid_signal\","," \"surface\": \"ci/e2e-smoke\","," \"future_fix\": \"Stabilize the archive-to-restore seed\","," def test_seed_only_input_renders_no_failure_rows(self) -> None:"," \"ts\": \"2026-05-11T00:00:00Z\","," \"class\": \"seed\","," \"surface\": \"agentic-pack\","," \"failure\": \"Ledger created\","," }"," rendered = render_markdown(entries)"," data_rows = rendered.split(\"| --- | --- | --- | --- | --- | --- | --- |\", 1)[1]"," self.assertNotIn(\"| seed |\", rendered)"," self.assertFalse(any(line.startswith(\"| \") for line in data_rows.splitlines()))"," def test_reconciled_targets_project_exact_latest_state(self) -> None:"," \"future_fix\": \"Start recording recurring failures\","," \"class\": \"pre_existing_noise\","," \"surface\": \"frontend/workspace-mode-ordering\","," \"future_fix\": \"#1343: guard summary mode application\","," \"class\": \"blocker\","," \"surface\": \"frontend/paper-review-contract\","," \"future_fix\": \"#1347: align enum wire contracts\","," \"surface\": \"backend/similar-past\","," \"future_fix\": \"#1348: repair the SQLite query\","," \"class\": \"non_blocking_risk\","," \"surface\": \"agent/tool-command-composition\","," \"future_fix\": \"#1490: document safe composition\","," \"future_fix\": \"#1343 resolved by PR #1386\","," \"future_fix\": \"#1347 resolved by PR #1360\","," \"future_fix\": \"#1348 resolved by PR #1361 and PR #1362\","," \"future_fix\": \"#1490 resolved by PR #1491\","," target_surfaces = {"," \"#1343\": \"frontend/workspace-mode-ordering\","," \"#1347\": \"frontend/paper-review-contract\","," \"#1348\": \"backend/similar-past\","," \"#1490\": \"agent/tool-command-composition\","," }"," self.assertEqual(len(entries), 10)"," self.assertEqual(len(projected), 5)"," self.assertEqual(Counter(entry[\"status\"] for entry in projected), {\"resolved\": 4, \"open\": 1})"," self.assertFalse(any(entry.get(\"class\") == \"seed\" for entry in projected))"," for issue, surface in target_surfaces.items():"," matches = ["," entry"," for entry in projected"," if entry.get(\"surface\") == surface"," and str(entry.get(\"future_fix\", \"\")).startswith(issue)"," ]"," self.assertEqual(len(matches), 1, issue)"," self.assertEqual(matches[0][\"status\"], \"resolved\", issue)"," open_entries = [entry for entry in projected if entry[\"status\"] == \"open\"]"," self.assertEqual("," [(entry[\"class\"], entry[\"surface\"]) for entry in open_entries],"," [(\"invalid_signal\", \"ci/e2e-smoke\")],"," )","if __name__ == \"__main__\":"," unittest.main()","scripts/agent_hooks/render_failure_ledger.py",[1317],{"_1172":832,"_1173":1318,"_539":1319,"_1176":59},107,[1320,1321,1322,300,1323,1324,1325,300,1326,1327,1328,300,1329,300,1178,1179,1180,300,1181,300,1182,1183,1330,300,1331,300,1199,300,1200,1201,1202,1203,300,1204,300,1205,1206,1330,300,1332,300,300,1333,1334,1335,300,300,1336,1337,1338,1339,300,1340,300,300,1341,1342,1343,1344,1345,300,1346,1347,1348,1349,300,1350,1351,1352,1353,1354,300,300,1355,1356,1357,1358,1359,1360,1361,1362,1312,300,1363,300,300,1364,1365,1366,1367,1368,1369,1370,1371,1372,1369,1373,1369,1374,300,1375,1376,1377,300,300,1313,1378],"#!/usr/bin/env python3","\"\"\"Render docs/agentic/failure_ledger.jsonl into FAILURE_LEDGER.md table rows.\"\"\"","from __future__ import annotations","import json","import re","from pathlib import Path","ROOT = Path(__file__).resolve().parents[2]","JSONL = ROOT / \"docs\" / \"agentic\" / \"failure_ledger.jsonl\"","MD = ROOT / \"docs\" / \"agentic\" / \"FAILURE_LEDGER.md\"","HEADER = \"\"\"# Agent Failure Ledger","\"\"\"","FOOTER = \"\"\"","TRACKING_ISSUE = re.compile(r\"#\\d+\")","def cell(value: object, limit: int = 160) -> str:"," text = str(value or \"\").replace(\"\\n\", \" \").replace(\"|\", \"\\\\|\")"," return text[:limit] + (\"...\" if len(text) > limit else \"\")","def projection_key(entry: dict[str, object], index: int) -> tuple[str, ...]:"," tracking_issue = TRACKING_ISSUE.search(str(entry.get(\"future_fix\", \"\")))"," if tracking_issue is None:"," return (\"row\", str(index))"," return (\"tracked_failure\", str(entry.get(\"surface\", \"\")), tracking_issue.group(0))","def project_latest_entries(entries: list[dict[str, object]]) -> list[dict[str, object]]:"," \"\"\"Hide seed metadata and keep the latest tracked surface/issue state.\"\"\""," visible_entries = [entry for entry in entries if entry.get(\"class\") != \"seed\"]"," latest_indexes: dict[tuple[str, ...], int] = {}"," keys: list[tuple[str, ...]] = []"," for index, entry in enumerate(visible_entries):"," key = projection_key(entry, index)"," keys.append(key)"," latest_indexes[key] = index"," return ["," entry"," for index, (entry, key) in enumerate(zip(visible_entries, keys, strict=True))"," if latest_indexes[key] == index"," ]","def render_markdown(entries: list[dict[str, object]]) -> str:"," \"\"\"Render projected ledger entries without inventing fallback history.\"\"\""," rows: list[str] = []"," for entry in project_latest_entries(entries):"," date = str(entry.get(\"ts\", \"\"))[:10] or \"unknown\""," rows.append("," f\"| {cell(date, 20)} | {cell(entry.get('class'), 40)} | {cell(entry.get('surface'), 80)} | \""," f\"{cell(entry.get('failure'))} | {cell(entry.get('workaround'))} | {cell(entry.get('future_fix'))} | {cell(entry.get('status'), 40)} |\""," return HEADER + \"\\n\".join(rows) + FOOTER","def main() -> int:"," entries: list[dict[str, object]] = []"," if JSONL.exists():"," for line in JSONL.read_text(encoding=\"utf-8\").splitlines():"," if not line.strip():"," continue"," try:"," entry = json.loads(line)"," except json.JSONDecodeError:"," if not isinstance(entry, dict):"," entries.append(entry)"," MD.parent.mkdir(parents=True, exist_ok=True)"," MD.write_text(render_markdown(entries), encoding=\"utf-8\")"," return 0"," raise SystemExit(main())",[1380,1381,1382,1383,1384,1385,1386,1387,1388,1389],{"_1147":46,"_46":1404},{"_1147":1391,"_209":1315,"_1172":1402,"_1173":1403},{"_1147":46,"_46":1401},{"_1147":1391,"_209":1234,"_1172":1399,"_1173":1400},{"_1147":1391,"_209":1234,"_1172":1397,"_1173":1398},{"_1147":46,"_46":1396},{"_1147":1391,"_209":1207,"_1172":1395,"_1173":435},{"_1147":46,"_46":1394},{"_1147":1391,"_209":1166,"_1172":1392,"_1173":1393},{"_1147":46,"_46":1390},"\n- Live GitHub API checks confirmed issues `#1343`, `#1347`, `#1348`, and `#1490` are closed, and the cited PRs/merge SHAs match the ledger records.\n- PR metadata contains only `Closes #1492`; `#1291` is referenced without a close/fix/resolve keyword.\n- All existing PR comments, inline comments, reviews, and exact-head checks were inspected. There were no unresolved inline threads or submitted reviews.\n- No code changes were necessary, so no commit or follow-up PR was created.\n\n## Testing and Verification\n\n- ✅ `python3 -m unittest test_render_failure_ledger.py` — 5 tests passed.\n- ✅ `python3 render_failure_ledger.py; cmp -s /tmp/FAILURE_LEDGER.before ../../docs/agentic/FAILURE_LEDGER.md` — regenerated Markdown was byte-identical.\n- ✅ `node scripts/check-docs-governance.mjs`\n- ✅ `node scripts/check-golden-principles.mjs`\n- ✅ `node scripts/check-github-ops-governance.mjs`\n- ✅ `git diff --check 61f718af941c56c31b8b7595333b9debd6e47da8..HEAD`\n- ✅ Synthetic/live projection audit — 23 raw rows → 15 projected rows; 14 resolved and one open; zero projected seed rows.\n- ✅ Append-only audit — exact base contained 19 rows, head contains 23 rows, and the first 19 rows are unchanged.\n- ✅ GitHub REST verification — all four cited issues are closed and all five cited PR merge SHAs match.\n- ✅ DCO audit — both commits contain `Signed-off-by:` trailers.\n- ✅ `git status --short --branch` — clean worktree at completion.\n- ⚠️ `bash scripts/check-git-env.sh` — repository was usable and no `index.lock` existed, but the script warned that `/usr/bin/git` appears MSYS/Cygwin-like.\n- ❌ Initial governance checks from `scripts/agent_hooks` — agent invocation error because the scripts expect repository-root working directory; immediately rerun from `/workspace/Taskdeck`, where all three passed.\n\n## Outstanding Maintainer Items\n\n`OUTSTANDING_TASKS.md` still contains human-owned open work, notably `#1291`, the v0.1/revival and generalist tracks, project-priority synchronization, the `#1457` interactive trust gate, and merged-worktree pruning. None were checked off during this review.","repo_file_citation",13,25,"\n- The generated Markdown is synchronized with the projected ledger: seed metadata is absent, the issue-less E2E failure remains open, and the four reconciled entries render resolved. ",20,"\n- The ledger remains append-only: the four reconciliation records occupy new lines 20–23, and their resolution claims retain precise issue, PR, merge-SHA, and residual-debt evidence. ",81,172,64,79,"\n- The deterministic synthetic fixture covers seed-only rendering, the issue-less E2E entry, and four open/resolved projection pairs without coupling the test suite to mutable repository counts. ",48,71,"## Review Result\n\n**No findings at exact head `b3838d0632d9465f4ec16216d13fca312d568d4d`.**\n\n- Seed rows are removed before projection, while issue-less non-seed rows receive unique file-order keys and remain independently visible. ",{"_92":426,"_42":84,"_96":426,"_1407":1408,"_1409":1410,"_1411":1412,"_132":-5,"_119":1413},[83],"input_items",[1432,1433,1434],"external_post_config",{"_1414":1415,"_363":297,"_1416":406,"_374":-5,"_1417":357,"_1418":-5,"_1419":-5,"_1420":1421,"_1422":1423,"_1424":-5,"_1425":-5,"_1426":1427,"_1428":15,"_1429":59,"_1430":54,"_1431":15},"user_model_slug","slug",1785043789.124714,"installation_id",71831362,"pr_number","repo_id","gitlab_service_account_project_id","review_trigger","comment_id",5082202137,"comment_type","issue","pr_write_guard_token","pending_pr_reaction_id","pending_comment_reaction_id",387887003,"comment_if_no_findings","comment_on_error","share_url","is_parallel_review",{"_92":547,"_96":426,"_539":1442},{"_413":414,"_415":416,"_1439":420,"_1440":129,"_422":-5,"_92":1441},{"_92":1435,"_415":1436,"_209":-5,"_1437":-5,"_1438":-5},"pull_request_comment","@codex review exact head b3838d0632d9465f4ec16216d13fca312d568d4d. Please focus on seed-only and issue-less projection semantics, append-only ledger truth, resolution evidence/overclaiming, future appendability of tests, linked-issue safety, and generated-render synchronization. All earlier-head evidence is stale if this head moves.","side","line","base_ref","head_ref","pull_request_info",[1443],{"_1147":46,"_46":1444},"## Deliberate self-review findings — exact head `b3838d0632d9465f4ec16216d13fca312d568d4d`\n\n### HIGH — PR metadata could close the parent tracker unintentionally\n\nThe initial PR body used a negated close-keyword sentence beside `#1291`. GitHub nevertheless added both `#1291` and `#1492` to `closingIssuesReferences`, so merging the PR could have closed the still-open parent tracker.\n\nExpected fix: remove every close/fix/resolve keyword near `#1291`, retain only `Closes #1492`, and verify the live closing-link set rather than trusting the prose.\n\nStatus: fixed in PR metadata before handoff.\n\n### MEDIUM — regression test froze a mutable append-only ledger\n\nThe first local test draft loaded the repository JSONL directly and hard-coded today's `23 raw / 15 projected / 14 resolved / 1 open` counts. The next legitimate ledger append would have failed the renderer unit suite even if projection behavior remained correct.\n\nExpected fix: use a deterministic synthetic fixture containing seed metadata, the issue-less E2E row, and the four open/resolved projection pairs; keep live repository counts as verification evidence only.\n\nStatus: fixed before push in test commit `b3838d0632d9465f4ec16216d13fca312d568d4d`.\n\n### Other severities\n\n- CRITICAL: none.\n- LOW: none.\n- Out-of-scope findings: none.\n\nExisting-comment triage at review time: one `@codex` exact-head review request is pending; there are no inline threads or submitted reviews yet.",[1945,1946],[],{"_1152":1153,"_46":1154,"_1155":1156},{"_1127":1936},{"_437":1935},{"_437":1528},{"_405":406,"_395":407,"_408":409,"_410":15,"_411":59,"_412":15,"_413":414,"_415":416,"_417":367,"_418":127,"_419":420,"_421":129,"_422":423,"_424":-5,"_425":-5,"_426":1527,"_428":429,"_430":431,"_432":433,"_434":435},{"_42":123,"_294":295,"_296":297,"_298":15,"_299":300,"_301":302,"_303":1516,"_305":-5,"_306":-5,"_307":15,"_308":1517,"_310":300,"_311":300,"_312":1518,"_314":1519,"_316":1520,"_318":-5,"_319":320,"_321":322,"_323":324,"_325":1521,"_55":-5,"_119":327,"_328":1522,"_330":1523,"_332":333,"_334":15,"_335":15},{"_133":1509},[1455,1456,1457,1458,1459,1460,1461,1462,1463,1464,1465,1466,1467,1468,1469,1470,1471,1472,1473,1474,1475,1476,1477,1478,1479,1480,1481,1482,1483,1484,1485,1486,1487,1488,1489,1490,1491,1492,1493,1494,1495,1496,1497,1498,1499,1500,1501,1502,1503,1504,1505,1506,1507,1508],{"_196":273,"_198":199,"_200":201,"_202":211,"_204":265,"_206":207,"_208":32,"_209":-5},{"_196":271,"_198":199,"_200":201,"_202":211,"_204":272,"_206":207,"_208":32,"_209":-5},{"_196":269,"_198":199,"_200":201,"_202":203,"_204":270,"_206":207,"_208":32,"_209":-5},{"_196":268,"_198":199,"_200":201,"_202":203,"_204":261,"_206":207,"_208":32,"_209":-5},{"_196":266,"_198":199,"_200":201,"_202":254,"_204":261,"_206":207,"_208":267,"_209":-5},{"_196":264,"_198":199,"_200":201,"_202":211,"_204":265,"_206":207,"_208":32,"_209":-5},{"_196":263,"_198":199,"_200":201,"_202":203,"_204":261,"_206":207,"_208":32,"_209":-5},{"_196":260,"_198":199,"_200":201,"_202":254,"_204":261,"_206":207,"_208":262,"_209":-5},{"_196":259,"_198":199,"_200":201,"_202":211,"_204":255,"_206":207,"_208":32,"_209":-5},{"_196":258,"_198":199,"_200":201,"_202":203,"_204":255,"_206":207,"_208":32,"_209":-5},{"_196":257,"_198":199,"_200":201,"_202":211,"_204":255,"_206":207,"_208":32,"_209":-5},{"_196":253,"_198":199,"_200":201,"_202":254,"_204":255,"_206":207,"_208":256,"_209":-5},{"_196":252,"_198":199,"_200":201,"_202":211,"_204":212,"_206":207,"_208":32,"_209":-5},{"_196":251,"_198":199,"_200":201,"_202":203,"_204":205,"_206":207,"_208":32,"_209":-5},{"_196":250,"_198":199,"_200":201,"_202":211,"_204":212,"_206":207,"_208":32,"_209":-5},{"_196":249,"_198":199,"_200":201,"_202":203,"_204":205,"_206":207,"_208":32,"_209":-5},{"_196":248,"_198":199,"_200":201,"_202":211,"_204":212,"_206":207,"_208":32,"_209":-5},{"_196":247,"_198":199,"_200":201,"_202":203,"_204":205,"_206":207,"_208":32,"_209":-5},{"_196":246,"_198":199,"_200":201,"_202":211,"_204":212,"_206":207,"_208":32,"_209":-5},{"_196":245,"_198":199,"_200":201,"_202":203,"_204":205,"_206":207,"_208":32,"_209":-5},{"_196":244,"_198":199,"_200":201,"_202":211,"_204":212,"_206":207,"_208":32,"_209":-5},{"_196":243,"_198":199,"_200":201,"_202":203,"_204":205,"_206":207,"_208":32,"_209":-5},{"_196":242,"_198":199,"_200":201,"_202":211,"_204":212,"_206":207,"_208":32,"_209":-5},{"_196":241,"_198":199,"_200":201,"_202":203,"_204":205,"_206":207,"_208":32,"_209":-5},{"_196":240,"_198":199,"_200":201,"_202":211,"_204":212,"_206":207,"_208":32,"_209":-5},{"_196":239,"_198":199,"_200":201,"_202":203,"_204":205,"_206":207,"_208":32,"_209":-5},{"_196":238,"_198":199,"_200":201,"_202":211,"_204":212,"_206":207,"_208":32,"_209":-5},{"_196":237,"_198":199,"_200":201,"_202":203,"_204":205,"_206":207,"_208":32,"_209":-5},{"_196":236,"_198":199,"_200":201,"_202":211,"_204":212,"_206":207,"_208":32,"_209":-5},{"_196":235,"_198":199,"_200":201,"_202":203,"_204":205,"_206":207,"_208":32,"_209":-5},{"_196":234,"_198":199,"_200":201,"_202":211,"_204":212,"_206":207,"_208":32,"_209":-5},{"_196":233,"_198":199,"_200":201,"_202":203,"_204":205,"_206":207,"_208":32,"_209":-5},{"_196":232,"_198":199,"_200":201,"_202":211,"_204":212,"_206":207,"_208":32,"_209":-5},{"_196":231,"_198":199,"_200":201,"_202":203,"_204":205,"_206":207,"_208":32,"_209":-5},{"_196":230,"_198":199,"_200":201,"_202":211,"_204":212,"_206":207,"_208":32,"_209":-5},{"_196":229,"_198":199,"_200":201,"_202":203,"_204":205,"_206":207,"_208":32,"_209":-5},{"_196":228,"_198":199,"_200":201,"_202":211,"_204":212,"_206":207,"_208":32,"_209":-5},{"_196":227,"_198":199,"_200":201,"_202":203,"_204":205,"_206":207,"_208":32,"_209":-5},{"_196":226,"_198":199,"_200":201,"_202":211,"_204":212,"_206":207,"_208":32,"_209":-5},{"_196":225,"_198":199,"_200":201,"_202":203,"_204":205,"_206":207,"_208":32,"_209":-5},{"_196":224,"_198":199,"_200":201,"_202":211,"_204":212,"_206":207,"_208":32,"_209":-5},{"_196":223,"_198":199,"_200":201,"_202":203,"_204":205,"_206":207,"_208":32,"_209":-5},{"_196":222,"_198":199,"_200":201,"_202":211,"_204":212,"_206":207,"_208":32,"_209":-5},{"_196":221,"_198":199,"_200":201,"_202":203,"_204":205,"_206":207,"_208":32,"_209":-5},{"_196":220,"_198":199,"_200":201,"_202":211,"_204":212,"_206":207,"_208":32,"_209":-5},{"_196":219,"_198":199,"_200":201,"_202":203,"_204":205,"_206":207,"_208":32,"_209":-5},{"_196":218,"_198":199,"_200":201,"_202":211,"_204":212,"_206":207,"_208":32,"_209":-5},{"_196":217,"_198":199,"_200":201,"_202":203,"_204":205,"_206":207,"_208":32,"_209":-5},{"_196":216,"_198":199,"_200":201,"_202":211,"_204":212,"_206":207,"_208":32,"_209":-5},{"_196":215,"_198":199,"_200":201,"_202":203,"_204":205,"_206":207,"_208":32,"_209":-5},{"_196":214,"_198":199,"_200":201,"_202":211,"_204":212,"_206":207,"_208":32,"_209":-5},{"_196":213,"_198":199,"_200":201,"_202":203,"_204":205,"_206":207,"_208":32,"_209":-5},{"_196":210,"_198":199,"_200":201,"_202":211,"_204":212,"_206":207,"_208":32,"_209":-5},{"_196":197,"_198":199,"_200":201,"_202":203,"_204":205,"_206":207,"_208":32,"_209":-5},[1510,1511,1512],{"_278":1515,"_280":291},{"_278":1514,"_280":287},{"_278":1513,"_280":281},{"_282":283,"_92":284,"_119":285},{"_282":288,"_92":284,"_119":289},{"_282":292,"_92":284,"_119":293},{"_397":398,"_399":400,"_401":300,"_402":-5,"_403":-5,"_404":-5},[357],{"_357":1524},{"_339":340,"_341":342,"_343":344,"_345":346,"_347":348,"_349":350,"_351":352,"_353":354,"_355":356},{},[],{"_338":59},{"_336":59,"_337":300},{"_42":359,"_282":360,"_361":1525,"_363":297,"_364":365,"_366":367,"_368":369,"_370":371,"_372":373,"_374":64,"_375":15,"_376":-5,"_377":-5,"_378":-5,"_379":-5,"_380":-5,"_381":-5,"_208":382,"_383":-5,"_55":1526},{"_389":390,"_42":391,"_92":392,"_393":394,"_395":396},{"_385":15,"_386":15,"_387":15,"_388":15},{"_389":390,"_282":390,"_436":-5,"_393":394,"_42":391},[1529,1530,1531,1532,1533,1534,1535,1536,1537,1538,1539,1540,1541,1542,1543,1544,1545,1546,1547,1548,1549,1550,1551,1552,1553,1554,1555,1556,1557,1558,1559,1560,1561,1562,1563,1564,1565,1566,1567,1568,1569,1570,1571,1572,1573,1574,1575,1576,1577,1578,1579,1580,1581,1582,1583,1584,1585,1586,1587,1588,1589,1590,1591,1592,1593,1594,1595,1596,1597,1598,1599,1600,1601],{"_202":1099,"_513":1931},{"_202":530,"_513":1928},{"_202":1089,"_513":1925},{"_202":534,"_513":1919},{"_202":534,"_513":1914},{"_202":534,"_513":1909},{"_202":534,"_513":1903},{"_202":534,"_513":1898},{"_202":552,"_513":1893},{"_202":552,"_513":1889},{"_202":534,"_513":1884},{"_202":552,"_513":1882},{"_202":534,"_513":1877},{"_202":534,"_513":1874},{"_202":552,"_513":1870},{"_202":534,"_513":1863},{"_202":552,"_513":1859},{"_202":534,"_513":1854},{"_202":534,"_513":1851},{"_202":552,"_513":1847},{"_202":534,"_513":1840},{"_202":552,"_513":1836},{"_202":534,"_513":1831},{"_202":534,"_513":1828},{"_202":534,"_513":1821},{"_202":552,"_513":1817},{"_202":534,"_513":1812},{"_202":534,"_513":1809},{"_202":552,"_513":1805},{"_202":534,"_513":1798},{"_202":552,"_513":1794},{"_202":534,"_513":1789},{"_202":534,"_513":1786},{"_202":534,"_513":1779},{"_202":552,"_513":1775},{"_202":534,"_513":1770},{"_202":534,"_513":1767},{"_202":534,"_513":1760},{"_202":552,"_513":1756},{"_202":552,"_513":1752},{"_202":534,"_513":1747},{"_202":534,"_513":1744},{"_202":534,"_513":1737},{"_202":552,"_513":1733},{"_202":552,"_513":1729},{"_202":534,"_513":1724},{"_202":534,"_513":1721},{"_202":534,"_513":1714},{"_202":552,"_513":1710},{"_202":552,"_513":1706},{"_202":534,"_513":1700},{"_202":534,"_513":1697},{"_202":534,"_513":1690},{"_202":552,"_513":1686},{"_202":552,"_513":1682},{"_202":534,"_513":1677},{"_202":534,"_513":1674},{"_202":534,"_513":1667},{"_202":552,"_513":1663},{"_202":552,"_513":1659},{"_202":534,"_513":1654},{"_202":534,"_513":1651},{"_202":552,"_513":1647},{"_202":534,"_513":1640},{"_202":552,"_513":1636},{"_202":534,"_513":1631},{"_202":534,"_513":1628},{"_202":552,"_513":1621},{"_202":534,"_513":1614},{"_202":552,"_513":1612},{"_202":534,"_513":1607},{"_202":530,"_513":1605},{"_202":512,"_513":1602},{"_515":516,"_87":1603},{"_518":519,"_520":521,"_103":-5,"_42":522,"_523":1604,"_525":526,"_527":528,"_529":113},[],{"_529":1606,"_515":516},{"_92":533},{"_536":1608,"_515":516,"_538":522},{"_539":1609,"_541":-5,"_42":542,"_543":1610,"_545":546,"_96":93,"_92":547},[1611],{"_548":522},{"_46":550,"_92":551},{"_554":555,"_536":1613,"_515":516,"_538":522},{"_42":542,"_545":546,"_46":550,"_92":557},{"_536":1615,"_515":516,"_538":522},{"_560":561,"_42":-5,"_543":1616,"_282":-5,"_563":1617,"_92":565},{"_548":522},{"_415":1618,"_567":-5},[1619,1620],{"_46":572,"_92":571},{"_46":570,"_92":571},{"_554":574,"_536":1622,"_515":516,"_538":522},{"_576":570,"_577":578,"_579":1623,"_581":582,"_520":32,"_583":32,"_42":584,"_585":586,"_587":588,"_529":113,"_92":589},[1624,1625,1626,1627],{"_577":604,"_282":605,"_209":606,"_92":597},{"_577":601,"_282":602,"_209":603,"_92":597},{"_577":598,"_282":599,"_209":600,"_92":597},{"_577":594,"_282":595,"_209":596,"_92":597},{"_536":1629,"_515":516,"_538":522},{"_560":561,"_42":609,"_610":611,"_543":1630,"_282":613,"_614":-5,"_529":113,"_92":615},{"_548":522},{"_536":1632,"_515":516,"_538":522},{"_539":-5,"_618":619,"_42":620,"_543":1633,"_622":1634,"_92":624},{"_548":522},[1635],{"_46":626,"_92":627},{"_554":629,"_536":1637,"_515":516,"_538":522},{"_539":1638,"_42":620,"_622":1639,"_92":624},[],[626],{"_536":1641,"_515":516,"_538":522},{"_560":635,"_42":-5,"_543":1642,"_282":-5,"_563":1643,"_92":565},{"_548":522},{"_415":1644,"_567":-5},[1645,1646],{"_46":572,"_92":571},{"_46":300,"_92":571},{"_554":642,"_536":1648,"_515":516,"_538":522},{"_576":-5,"_577":644,"_579":1649,"_581":582,"_520":32,"_583":32,"_42":646,"_585":647,"_587":588,"_529":113,"_92":589},[1650],{"_577":649,"_92":650},{"_536":1652,"_515":516,"_538":522},{"_560":635,"_42":653,"_610":654,"_543":1653,"_282":613,"_614":-5,"_529":113,"_92":615},{"_548":522},{"_536":1655,"_515":516,"_538":522},{"_539":-5,"_618":658,"_42":659,"_543":1656,"_622":1657,"_92":624},{"_548":522},[1658],{"_46":663,"_92":627},{"_554":665,"_536":1660,"_515":516,"_538":522},{"_539":1661,"_42":659,"_622":1662,"_92":624},[],[663],{"_554":670,"_536":1664,"_515":516,"_538":522},{"_576":672,"_577":673,"_579":1665,"_581":582,"_520":675,"_583":32,"_42":676,"_585":677,"_587":588,"_529":113,"_92":589},[1666],{"_577":679,"_92":650},{"_536":1668,"_515":516,"_538":522},{"_560":682,"_42":-5,"_543":1669,"_282":-5,"_563":1670,"_92":565},{"_548":522},{"_415":1671,"_567":-5},[1672,1673],{"_46":688,"_92":571},{"_46":672,"_92":571},{"_536":1675,"_515":516,"_538":522},{"_560":682,"_42":691,"_610":692,"_543":1676,"_282":613,"_614":-5,"_529":113,"_92":615},{"_548":522},{"_536":1678,"_515":516,"_538":522},{"_539":-5,"_618":696,"_42":697,"_543":1679,"_622":1680,"_92":624},{"_548":522},[1681],{"_46":701,"_92":627},{"_554":703,"_536":1683,"_515":516,"_538":522},{"_539":1684,"_42":697,"_622":1685,"_92":624},[],[701],{"_554":708,"_536":1687,"_515":516,"_538":522},{"_576":710,"_577":711,"_579":1688,"_581":713,"_520":714,"_583":32,"_42":715,"_585":716,"_587":588,"_529":113,"_92":589},[1689],{"_577":718,"_92":650},{"_536":1691,"_515":516,"_538":522},{"_560":721,"_42":-5,"_543":1692,"_282":-5,"_563":1693,"_92":565},{"_548":522},{"_415":1694,"_567":-5},[1695,1696],{"_46":727,"_92":571},{"_46":710,"_92":571},{"_536":1698,"_515":516,"_538":522},{"_560":721,"_42":730,"_610":731,"_543":1699,"_282":613,"_614":-5,"_529":113,"_92":615},{"_548":522},{"_536":1701,"_515":516,"_538":522},{"_539":-5,"_618":735,"_42":736,"_543":1702,"_622":1703,"_92":624},{"_548":522},[1704,1705],{"_46":742,"_92":627},{"_46":741,"_92":627},{"_554":744,"_536":1707,"_515":516,"_538":522},{"_539":1708,"_42":736,"_622":1709,"_92":624},[],[742,741],{"_554":749,"_536":1711,"_515":516,"_538":522},{"_576":751,"_577":752,"_579":1712,"_581":582,"_520":754,"_583":32,"_42":755,"_585":756,"_587":588,"_529":113,"_92":589},[1713],{"_577":758,"_92":650},{"_536":1715,"_515":516,"_538":522},{"_560":761,"_42":-5,"_543":1716,"_282":-5,"_563":1717,"_92":565},{"_548":522},{"_415":1718,"_567":-5},[1719,1720],{"_46":768,"_92":571},{"_46":767,"_92":571},{"_536":1722,"_515":516,"_538":522},{"_560":761,"_42":771,"_610":772,"_543":1723,"_282":613,"_614":-5,"_529":113,"_92":615},{"_548":522},{"_536":1725,"_515":516,"_538":522},{"_539":-5,"_618":776,"_42":777,"_543":1726,"_622":1727,"_92":624},{"_548":522},[1728],{"_46":781,"_92":627},{"_554":783,"_536":1730,"_515":516,"_538":522},{"_539":1731,"_42":777,"_622":1732,"_92":624},[],[781],{"_554":788,"_536":1734,"_515":516,"_538":522},{"_576":790,"_577":791,"_579":1735,"_581":582,"_520":793,"_583":32,"_42":794,"_585":795,"_587":588,"_529":113,"_92":589},[1736],{"_577":797,"_92":650},{"_536":1738,"_515":516,"_538":522},{"_560":800,"_42":-5,"_543":1739,"_282":-5,"_563":1740,"_92":565},{"_548":522},{"_415":1741,"_567":-5},[1742,1743],{"_46":806,"_92":571},{"_46":790,"_92":571},{"_536":1745,"_515":516,"_538":522},{"_560":800,"_42":809,"_610":810,"_543":1746,"_282":613,"_614":-5,"_529":113,"_92":615},{"_548":522},{"_536":1748,"_515":516,"_538":522},{"_539":-5,"_618":814,"_42":815,"_543":1749,"_622":1750,"_92":624},{"_548":522},[1751],{"_46":819,"_92":627},{"_554":821,"_536":1753,"_515":516,"_538":522},{"_539":1754,"_42":815,"_622":1755,"_92":624},[],[819],{"_554":826,"_536":1757,"_515":516,"_538":522},{"_576":828,"_577":829,"_579":1758,"_581":582,"_520":831,"_583":832,"_42":833,"_585":834,"_587":588,"_529":835,"_92":589},[1759],{"_577":837,"_92":650},{"_536":1761,"_515":516,"_538":522},{"_560":840,"_42":-5,"_543":1762,"_282":-5,"_563":1763,"_92":565},{"_548":522},{"_415":1764,"_567":-5},[1765,1766],{"_46":847,"_92":571},{"_46":846,"_92":571},{"_536":1768,"_515":516,"_538":522},{"_560":840,"_42":850,"_610":851,"_543":1769,"_282":613,"_614":-5,"_529":113,"_92":615},{"_548":522},{"_536":1771,"_515":516,"_538":522},{"_539":-5,"_618":855,"_42":856,"_543":1772,"_622":1773,"_92":624},{"_548":522},[1774],{"_46":860,"_92":627},{"_554":862,"_536":1776,"_515":516,"_538":522},{"_539":1777,"_42":856,"_622":1778,"_92":624},[],[860],{"_536":1780,"_515":516,"_538":522},{"_560":868,"_42":-5,"_543":1781,"_282":-5,"_563":1782,"_92":565},{"_548":522},{"_415":1783,"_567":-5},[1784,1785],{"_46":875,"_92":571},{"_46":874,"_92":571},{"_536":1787,"_515":516,"_538":522},{"_560":868,"_42":878,"_610":879,"_543":1788,"_282":613,"_614":-5,"_529":113,"_92":615},{"_548":522},{"_536":1790,"_515":516,"_538":522},{"_539":-5,"_618":883,"_42":884,"_543":1791,"_622":1792,"_92":624},{"_548":522},[1793],{"_46":888,"_92":627},{"_554":890,"_536":1795,"_515":516,"_538":522},{"_539":1796,"_42":884,"_622":1797,"_92":624},[],[888],{"_536":1799,"_515":516,"_538":522},{"_560":896,"_42":-5,"_543":1800,"_282":-5,"_563":1801,"_92":565},{"_548":522},{"_415":1802,"_567":-5},[1803,1804],{"_46":572,"_92":571},{"_46":902,"_92":571},{"_554":904,"_536":1806,"_515":516,"_538":522},{"_576":902,"_577":906,"_579":1807,"_581":582,"_520":32,"_583":908,"_42":909,"_585":910,"_587":588,"_529":835,"_92":589},[1808],{"_577":912,"_92":650},{"_536":1810,"_515":516,"_538":522},{"_560":896,"_42":915,"_610":916,"_543":1811,"_282":613,"_614":-5,"_529":113,"_92":615},{"_548":522},{"_536":1813,"_515":516,"_538":522},{"_539":-5,"_618":920,"_42":921,"_543":1814,"_622":1815,"_92":624},{"_548":522},[1816],{"_46":925,"_92":627},{"_554":927,"_536":1818,"_515":516,"_538":522},{"_539":1819,"_42":921,"_622":1820,"_92":624},[],[925],{"_536":1822,"_515":516,"_538":522},{"_560":933,"_42":-5,"_543":1823,"_282":-5,"_563":1824,"_92":565},{"_548":522},{"_415":1825,"_567":-5},[1826,1827],{"_46":940,"_92":571},{"_46":939,"_92":571},{"_536":1829,"_515":516,"_538":522},{"_560":933,"_42":943,"_610":944,"_543":1830,"_282":613,"_614":-5,"_529":113,"_92":615},{"_548":522},{"_536":1832,"_515":516,"_538":522},{"_539":-5,"_618":948,"_42":949,"_543":1833,"_622":1834,"_92":624},{"_548":522},[1835],{"_46":953,"_92":627},{"_554":955,"_536":1837,"_515":516,"_538":522},{"_539":1838,"_42":949,"_622":1839,"_92":624},[],[953],{"_536":1841,"_515":516,"_538":522},{"_560":961,"_42":-5,"_543":1842,"_282":-5,"_563":1843,"_92":565},{"_548":522},{"_415":1844,"_567":-5},[1845,1846],{"_46":968,"_92":571},{"_46":967,"_92":571},{"_554":970,"_536":1848,"_515":516,"_538":522},{"_576":972,"_577":973,"_579":1849,"_581":582,"_520":429,"_583":32,"_42":975,"_585":976,"_587":588,"_529":113,"_92":589},[1850],{"_577":978,"_92":650},{"_536":1852,"_515":516,"_538":522},{"_560":961,"_42":981,"_610":982,"_543":1853,"_282":613,"_614":-5,"_529":113,"_92":615},{"_548":522},{"_536":1855,"_515":516,"_538":522},{"_539":-5,"_618":986,"_42":987,"_543":1856,"_622":1857,"_92":624},{"_548":522},[1858],{"_46":991,"_92":627},{"_554":993,"_536":1860,"_515":516,"_538":522},{"_539":1861,"_42":987,"_622":1862,"_92":624},[],[991],{"_536":1864,"_515":516,"_538":522},{"_560":999,"_42":-5,"_543":1865,"_282":-5,"_563":1866,"_92":565},{"_548":522},{"_415":1867,"_567":-5},[1868,1869],{"_46":968,"_92":571},{"_46":1005,"_92":571},{"_554":1007,"_536":1871,"_515":516,"_538":522},{"_576":1005,"_577":1009,"_579":1872,"_581":582,"_520":32,"_583":832,"_42":1011,"_585":1012,"_587":588,"_529":835,"_92":589},[1873],{"_577":1014,"_92":650},{"_536":1875,"_515":516,"_538":522},{"_560":999,"_42":1017,"_610":1018,"_543":1876,"_282":613,"_614":-5,"_529":113,"_92":615},{"_548":522},{"_536":1878,"_515":516,"_538":522},{"_539":1879,"_541":-5,"_42":1023,"_543":1880,"_545":1025,"_96":93,"_92":547},[1881],{"_548":522},{"_46":1027,"_92":551},{"_554":1029,"_536":1883,"_515":516,"_538":522},{"_42":1023,"_545":1025,"_46":1027,"_92":557},{"_536":1885,"_515":516,"_538":522},{"_539":-5,"_618":1033,"_42":1034,"_543":1886,"_622":1887,"_92":624},{"_548":522},[1888],{"_46":1038,"_92":627},{"_554":1040,"_536":1890,"_515":516,"_538":522},{"_539":1891,"_42":1034,"_622":1892,"_92":624},[],[1038],{"_554":1045,"_536":1894,"_515":516,"_538":522},{"_1047":-5,"_539":1895,"_42":1049,"_92":1050},[1896],{"_46":1052,"_1053":1897,"_92":46},[],{"_536":1899,"_515":516,"_538":522},{"_539":1900,"_541":-5,"_42":-5,"_543":1901,"_545":-5,"_96":426,"_92":547},[1902],{"_548":522},{"_46":1052,"_92":571},{"_536":1904,"_515":516,"_538":522},{"_539":1905,"_541":-5,"_42":-5,"_543":1906,"_545":-5,"_96":426,"_92":547},[1907,1908],{"_548":522},{"_46":1067,"_92":571},{"_46":1066,"_92":571},{"_536":1910,"_515":516,"_538":522},{"_539":1911,"_541":-5,"_42":-5,"_543":1912,"_545":-5,"_96":1072,"_92":547},[1913],{"_548":522},{"_46":1074,"_92":571},{"_536":1915,"_515":516,"_538":522},{"_539":1916,"_541":-5,"_42":-5,"_543":1917,"_545":-5,"_96":1072,"_92":547},[1918],{"_548":522},{"_46":1080,"_92":571},{"_536":1920,"_515":516,"_538":522},{"_539":1921,"_541":-5,"_42":-5,"_543":1922,"_545":-5,"_96":1072,"_92":547},[1923,1924],{"_548":522},{"_46":1088,"_92":571},{"_46":1087,"_92":571},{"_515":516,"_87":1926},{"_103":-5,"_42":522,"_523":1927,"_525":526,"_527":528,"_529":1093},[],{"_529":1929,"_515":516},{"_1096":1930,"_92":1098},[],{"_1101":1932},{"_1103":-5,"_1104":-5,"_1105":1106,"_1107":528,"_581":582,"_1108":15,"_1109":-5,"_1110":-5,"_1111":-5,"_1112":1113,"_42":516,"_1114":1115,"_282":-5,"_1116":-5,"_209":1117,"_1118":300,"_1119":528,"_1120":516,"_587":1121,"_529":1933,"_1123":-5,"_77":1934,"_1125":528},{"_92":533},[],[],[1937],{"_42":1130,"_1131":1938,"_1133":1134,"_1135":1134,"_539":1939,"_529":1137,"_541":-5,"_1138":32,"_1139":1940,"_1141":400,"_1142":-5},{"_96":426,"_282":-5,"_1139":1944},{"_1147":46,"_1148":1943},{"_1143":1941},{"_1145":1942},[],[1150],{},{"_92":547,"_96":93,"_539":1964},{"_92":1159,"_1160":1947},[1948,1949,1950,1951],{"_209":1315,"_1167":-5,"_1168":1961,"_1170":-5},{"_209":1234,"_1167":-5,"_1168":1958,"_1170":-5},{"_209":1207,"_1167":-5,"_1168":1955,"_1170":-5},{"_209":1166,"_1167":-5,"_1168":1952,"_1170":-5},[1953],{"_1172":832,"_1173":1174,"_539":1954,"_1176":59},[1177,300,1178,1179,1180,300,1181,300,1182,1183,1184,1185,1186,1187,1188,1189,1190,1191,1192,1193,1194,1195,1196,1197,1198,300,1199,300,1200,1201,1202,1203,300,1204,300,1205,1206],[1956],{"_1172":832,"_1173":435,"_539":1957,"_1176":59},[1211,1212,1213,1214,1215,1216,1217,1218,1219,1220,1221,1222,1223,1224,1225,1226,1227,1228,1229,1230,1231,1232,1233],[1959],{"_1172":832,"_1173":1237,"_539":1960,"_1176":59},[1239,1240,300,1241,300,300,1242,1243,1244,1245,1246,1247,1248,1249,1245,1246,1250,1251,1249,1252,300,1253,300,1254,300,1255,1244,1245,1246,1247,1251,1249,1245,1246,1256,1248,1249,1252,300,1253,300,1257,300,1258,1244,1245,1259,1260,1261,1248,1249,1245,1259,1260,1261,1251,1249,1252,300,1253,300,1257,300,1262,1244,1245,1263,1264,1265,1266,1248,1267,1252,300,1268,1269,300,1270,1271,300,1272,1244,1245,1264,1265,1273,1248,1249,1245,1259,1260,1261,1248,1249,1245,1274,1275,1276,1248,1249,1245,1277,1278,1279,1248,1249,1245,1277,1280,1281,1248,1249,1245,1282,1283,1284,1248,1249,1245,1274,1275,1285,1251,1249,1245,1277,1278,1286,1251,1249,1245,1277,1280,1287,1251,1249,1245,1282,1283,1288,1251,1249,1252,300,1253,1289,1290,1291,1292,1293,1294,300,1295,1296,1297,1298,300,1299,1300,1301,1302,1303,1304,1305,1306,1307,300,1308,1309,1310,1311,1312,300,300,1313,1314],[1962],{"_1172":832,"_1173":1318,"_539":1963,"_1176":59},[1320,1321,1322,300,1323,1324,1325,300,1326,1327,1328,300,1329,300,1178,1179,1180,300,1181,300,1182,1183,1330,300,1331,300,1199,300,1200,1201,1202,1203,300,1204,300,1205,1206,1330,300,1332,300,300,1333,1334,1335,300,300,1336,1337,1338,1339,300,1340,300,300,1341,1342,1343,1344,1345,300,1346,1347,1348,1349,300,1350,1351,1352,1353,1354,300,300,1355,1356,1357,1358,1359,1360,1361,1362,1312,300,1363,300,300,1364,1365,1366,1367,1368,1369,1370,1371,1372,1369,1373,1369,1374,300,1375,1376,1377,300,300,1313,1378],[1965,1966,1967,1968,1969,1970,1971,1972,1973,1974],{"_1147":46,"_46":1404},{"_1147":1391,"_209":1315,"_1172":1402,"_1173":1403},{"_1147":46,"_46":1401},{"_1147":1391,"_209":1234,"_1172":1399,"_1173":1400},{"_1147":1391,"_209":1234,"_1172":1397,"_1173":1398},{"_1147":46,"_46":1396},{"_1147":1391,"_209":1207,"_1172":1395,"_1173":435},{"_1147":46,"_46":1394},{"_1147":1391,"_209":1166,"_1172":1392,"_1173":1393},{"_1147":46,"_46":1390},[1977,1978,1979],{"_1414":1415,"_363":297,"_1416":406,"_374":-5,"_1417":357,"_1418":-5,"_1419":-5,"_1420":1421,"_1422":1423,"_1424":-5,"_1425":-5,"_1426":1427,"_1428":15,"_1429":59,"_1430":54,"_1431":15},{"_92":547,"_96":426,"_539":1980},{"_413":414,"_415":416,"_1439":420,"_1440":129,"_422":-5,"_92":1441},{"_92":1435,"_415":1436,"_209":-5,"_1437":-5,"_1438":-5},[1981],{"_1147":46,"_46":1444},"task_e_6a659b4bb92483339ef5527aba1e705b",1785043787.723358,"GitHub Mention: Reconcile stale failure ledger projections","has_generated_title","has_unread_turn","denormalized_metadata",{"_2012":32,"_2013":2014,"_2015":-5,"_2016":-5,"_2007":2017,"_2018":-5,"_2019":-5,"_2020":-5,"_2021":-5},"task_status_display",{"_2001":2002,"_2003":297,"_130":127,"_2004":-5,"_2005":2006},"creator_workspace","external_pull_requests",[1994],{"_42":1995,"_1996":83,"_1997":1998,"_1999":129},"github-1098648347-1493","assistant_turn_id","pull_request",{"_405":406,"_395":407,"_408":409,"_410":15,"_411":59,"_412":15,"_413":414,"_415":416,"_417":367,"_418":127,"_419":420,"_421":129,"_422":423,"_424":-5,"_425":-5,"_426":2000,"_428":429,"_430":431,"_432":433,"_434":435},"codex_updated_sha",{"_389":390,"_282":390,"_436":-5,"_393":394,"_42":391},"latest_turn_status_display",{"_548":83,"_112":113,"_2007":-5,"_94":2008,"_2009":-5,"_2010":-5,"_2011":2006,"_114":-5},"environment_label","fix_task_id","initial_intent","pr","diff_stats",[],"image_asset_pointer_citations","issue_counts","intent","num_follow_ups","repo_name_map",{},"last_user_turn_created_at","last_turn_status",{"_2022":-5,"_2023":-5,"_2024":-5},"last_pushed_turn_id","start_branch_name","pushed_branch_name","cached_pull_request_data","files_modified","lines_added","lines_removed","dd",{"_2037":2038,"_2039":2040},"disablePrefetch","shouldPrefetchAccount","shouldPrefetchUser","shouldPrefetchSystemHints","promoteCss","disableSSR","stripModulepreloadImports","paidCampaignAppRedirect","statsigGateEvaluationsPromise",["P",2036],"traceId","3083367713931007291","traceTime",1785609335563]