ℹ️ About Codex in GitHub

\\n
\\n\\n[Your team has set up Codex to review pull requests in this repo](https://chatgpt.com/codex/cloud/settings/general). Reviews are triggered when you\\n- Open a pull request for review\\n- Mark a draft as ready\\n- Comment \\\"@codex review\\\".\\n\\nIf Codex has suggestions, it will comment; otherwise it will react with 👍.\\n\\n\\n\\n\\nCodex can also answer questions or update the PR. Try commenting \\\"@codex address that feedback\\\".\\n \\n

\",\"path\":null,\"side\":null,\"line\":null}","text_elements",[],{"_432":929,"_411":412,"_434":418},{"_435":930,"_437":-5,"_42":-5,"_439":931,"_441":-5,"_97":331,"_93":443},[932],{"_444":418},{"_46":925,"_93":489},{"_432":934,"_411":412,"_434":418},{"_435":935,"_437":-5,"_42":-5,"_439":936,"_441":-5,"_97":331,"_93":443},[937,938],{"_444":418},{"_46":940,"_93":489},{"_46":939,"_93":489},"\n /workspace/Taskdeck\n bash\n 2026-07-27\n Etc/UTC\n /workspace/Taskdeck\n","# AGENTS.md instructions for /workspace/Taskdeck\n\n\n# Repository Guidelines\n\nThis document is a concise contributor guide for the Taskdeck repository.\nIts scope applies to the entire repo unless overridden by more specific `AGENTS.md` files in subfolders.\n\n## Always start here (required)\n- Read `OUTSTANDING_TASKS.md` (repo root) — the maintainer's durable cross-session checklist. Surface its open items in any summary/status/handoff; only check items off when the maintainer says they are done.\n- Read `docs/STATUS.md` for Current Focus and constraints (source of truth).\n- Use `docs/IMPLEMENTATION_MASTERPLAN.md` for roadmap context.\n- Use `docs/GOLDEN_PRINCIPLES.md` for stable repository invariants and guardrails.\n- Use `docs/ISSUE_EXECUTION_GUIDE.md` for dependency-aware issue execution order.\n- For Codex routing, read `.codex/README.md` and `.codex/memories/00_ACTIVE.md`.\n- For Claude Code routing, read `.claude/README.md` and `CLAUDE.md`.\n- For test operations, see `docs/TESTING_GUIDE.md`.\n- Precedence when instructions conflict: `docs/STATUS.md` > this file > subfolder `AGENTS.md`.\n\n## MCP tools (agent tooling)\n- See `docs/MCP_TOOLING_GUIDE.md` for tool selection rules and safe usage.\n- For high-autonomy Codex issue/PR/CI batches, see `docs/tooling/CODEX_AUTONOMY_RUNBOOK.md`.\n- For low-context agent orientation, use `autodoc/AGENT_INDEX.md`.\n- For blocker questions, unresolved failures, guide updates, and skill routing, use `docs/agentic/`.\n- MCP-first default: when an MCP tool can perform a task, use MCP before shell/CLI alternatives.\n- Prefer MCP tools over guessing:\n - OpenAI/Codex/API docs -> openaiDeveloperDocs MCP\n - Third-party library docs -> Context7 MCP\n - UI reproduction/regression -> Playwright MCP\n - Repo search -> native `rg` (ripgrep MCP unreliable on Windows; fallback to GitHub search_code)\n - Issues/PRs/workflows -> GitHub MCP (write actions only when required)\n- Fallback rule:\n - if MCP is unavailable, failing, or lacks required capability, use shell/CLI fallback and state that fallback briefly in handoff notes.\n\n## Multi-Agent / Parallel Execution (required)\n- When the Codex runtime exposes spawned subagents, use them without asking for extra permission when they are efficient for safely parallelizable work — but right-size the fan-out (start inline; a few agents, not a reflexive fleet), and keep one coordinator for synthesis and final verification.\n- Split only when work can be separated by clear ownership and can proceed without blocking the coordinator's immediate next step.\n- If spawned agents are unavailable, use explicit git worktrees plus separate Codex/Claude sessions or GitHub coding-agent tasks; do not claim subagent execution unless it actually happened.\n- Split ownership by file/module/concern so concurrent work does not overlap.\n- Keep one coordinator responsible for issue selection, synthesis, conflict resolution, docs rehydration, project status/priority sync, and final verification.\n- Do not delegate final synthesis, ownership decisions, or broad vague cleanup.\n- For batch issue execution, PR review loops, CI recovery, and docs reconciliation, follow `docs/tooling/CODEX_AUTONOMY_RUNBOOK.md`.\n\n## Project Operations Automation (required)\n- Read `docs/GITHUB_PROJECT_AUTOMATION.md` before changing project operations, issue templates, or workflow conventions.\n- Canonical project status model is: `Pending`, `Now`, `Next`, `Blocked`, `Review`, `Done`.\n- Do not introduce labels in issue templates that are not in the required label set documented in `docs/GITHUB_PROJECT_AUTOMATION.md`.\n- Priority sync is mandatory:\n - For issue project items, set project `Priority` to match the issue's single priority label (`Priority I` to `Priority V`).\n - For PR project items, derive `Priority` from linked/referenced issues; if multiple priorities exist, choose highest urgency (`I` highest); if none can be derived, set `Priority V`.\n - Before handoff, verify no issue/PR project item has empty `Priority`.\n- If workflow/status conventions change, update both:\n - `docs/GITHUB_PROJECT_AUTOMATION.md`\n - this `AGENTS.md` (only if contributor behavior expectations changed)\n\n## Local skill packs\n- Repo-local Codex skills live under `.codex/skills/` and supplement `AGENTS.md`; they do not override it. Start with `.codex/skills/README.md`.\n- Repo-local Claude Code skills live under `.claude/skills/` and mirror the same Taskdeck workflows for Claude sessions. Start with `.claude/skills/README.md`.\n- Use `.codex/skills/taskdeck-issue-batch-orchestrator` when asked to take care of many issues, pick issues, coordinate worktrees/subagents, open PRs, run review loops, or reconcile a high-autonomy batch.\n- Use `.codex/skills/taskdeck-worktree-issue-worker` when implementing a single assigned issue in an isolated worktree.\n- Use `.codex/skills/taskdeck-pr-review-loop` when reviewing PRs, spinning fresh adversarial reviewers, posting findings, or addressing review/bot comments.\n- Use `.codex/skills/taskdeck-ci-conflict-recovery` when checking failing CI, resolving PR conflicts, inspecting bot comments, or recovering blocked PRs.\n- Use `.codex/skills/taskdeck-repo-onramp` when the request is broad, the repo area is unfamiliar, or current Taskdeck reality must be reconciled before planning.\n- Use `.codex/skills/taskdeck-backend-slice` for backend/API/application/infrastructure/worker/auth behavior changes.\n- Use `.codex/skills/taskdeck-frontend-workspace-slice` for frontend shell, workspace, route, help-state, and novice-legibility work outside the core capture-review semantics.\n- Use `.codex/skills/taskdeck-capture-review-loop` when capture, inbox, proposal review, execute flow, provenance, or board handoff semantics are involved.\n- Use `.codex/skills/taskdeck-demo-regression` when a task needs the right evidence path, seeded demo state, Playwright proof, or stakeholder-facing walkthrough validation.\n- Use `.codex/skills/taskdeck-verification-doc-sync` at the end of implementation to choose the right checks, update only the right docs, and prepare the required Taskdeck handoff summary.\n- Use `.codex/skills/taskdeck-question-batch` when ambiguity needs a blocker/assumption decision instead of context-expensive question loops.\n- Use `.codex/skills/taskdeck-failure-capture` when failed tools, tests, CI, MCP, docs checks, or workarounds must be classified and surfaced.\n- Use `.codex/skills/taskdeck-interface-map` when adding, splitting, or documenting complex seams that should be findable through `autodoc/AGENT_INDEX.md`.\n\n## Work protocol (required)\n- Before edits: write a short plan (files, approach, risks, tests).\n- Keep diffs small and scoped; avoid large mixed refactors.\n- Ask only for true blockers; otherwise proceed with explicit assumptions. Use `docs/agentic/QUESTION_PROTOCOL.md`.\n- Do not silently bury failed commands or tool workarounds. Use `docs/agentic/FAILURE_LEDGER.md` when unresolved failures matter for future agents or handoff confidence.\n- Prefer incremental execution with incremental, file-scoped commits when the work spans multiple files or concerns.\n- After edits: run required checks and report results.\n- If you cannot run checks, state exactly why and what you would run.\n- In this Windows PowerShell environment, do not chain commands with `&&`; use `;` and check `$LASTEXITCODE` when failure handling matters.\n- For product-facing slices, ensure issue scope and acceptance criteria explicitly align with the current thesis (reduce maintenance overhead/capture friction and preserve review-first trust).\n\n### Windows Git Reliability Fallback\n- Run `bash scripts/check-git-env.sh` at the start of a session to validate git resolution and index.lock state.\n- In PowerShell/Codex-native sessions, prefer `powershell -File scripts/check-git-env.ps1`; the Bash script remains available for Bash shells.\n- If `git` resolves to Cygwin or produces signal/pipe-style failures, use `C:\\Program Files\\Git\\cmd\\git.exe` explicitly for repo operations (or add `C:\\Program Files\\Git\\cmd` to the front of `PATH`).\n- Every new commit you create or submit to a pull request, including a locally created merge commit, must include a `Signed-off-by:` trailer. In automated/background terminals, use `git commit -s --no-gpg-sign` for ordinary commits, `git merge --signoff --no-gpg-sign BRANCH_NAME` for a clean commit-producing merge (replace `BRANCH_NAME` with the source ref), and `git commit -s --no-gpg-sign --no-edit` after staging conflict resolutions; `-s`/`--signoff` adds the DCO trailer while `--no-gpg-sign` avoids hidden GPG pinentry. GitHub's server-generated merge commit is outside the pull-request commit set; do not rewrite shared history to add a trailer to it. Never use `--no-verify`; hooks must run, and failures must be investigated.\n- If a commit fails because `.git/index.lock` cannot be created, first check for active `git` processes; remove `.git/index.lock` only when no git process is running. The `check-git-env.sh` script automates this detection.\n- For stacked branches with small conflict surfaces, prefer `merge` over `rebase` when branch reconciliation starts stalling (for example long-running interactive/conflict loops). Start a commit-producing reconciliation with `git merge --signoff --no-gpg-sign BRANCH_NAME` after replacing `BRANCH_NAME` with the source ref. If it conflicts, resolve and stage the files, then finish with `git commit -s --no-gpg-sign --no-edit` instead of `git merge --continue`.\n\n### Codex Worktree Safety\n- Use `scripts/git/New-CodexIssueWorktree.ps1` to create isolated issue worktrees under `.worktrees/`.\n- First command in a Codex worktree worker session must be `powershell -File scripts/worktree_guard.ps1` (or `source scripts/worktree_guard.sh` in Bash).\n- Do not pass absolute main-checkout paths to worktree workers; derive paths from `$env:WT_PROJECT_DIR` or `git rev-parse --show-toplevel`.\n- Only the coordinator should update canonical batch docs such as `docs/STATUS.md`, `docs/IMPLEMENTATION_MASTERPLAN.md`, and `docs/TESTING_GUIDE.md` unless a worker explicitly owns a docs-only issue.\n\n### Small Mainline Exception\n- If a change is very small and low-risk (especially minor docs wording/checklist updates), do not automatically create a branch/PR.\n- If the user already asked for the change directly, it may be applied on the current branch after checking git status and keeping the diff narrow.\n- If the user did not clearly ask for the change, prompt first and offer to let the user apply it directly on `main`.\n- Only proceed with branch/PR flow for these tiny changes when the user explicitly asks for it.\n\n## Review Policy (non-negotiable)\n\nEvery code review — self-review, adversarial review, subagent review — follows these rules:\n\n1. **Post findings on the PR.** Unless the user explicitly says otherwise, when a review targets a PR, post a comment with all findings organized by severity. This is the default, not optional.\n2. **Fix everything found.** Every finding at every severity (CRITICAL, HIGH, MEDIUM, LOW) must be addressed with a fix, commit, and verification. There is no \"non-blocking\" category that gets ignored. Do not skip lower-priority findings.\n3. **Out-of-scope findings get tracked, not buried.** If a finding is real but drifts outside the PR's scope, document it and seed a GitHub issue (or add to an existing tracking issue). Never silently drop it. Tech debt from reviews must be zero.\n4. **Inspect all existing PR comments.** Before posting findings, read ALL comments on the PR — human reviews, bot comments (Dependabot, CodeQL, CI bots), and previous adversarial review threads. Address anything unaddressed: fix it, reply with invalidation evidence, or seed a tracked follow-up.\n5. **Post fix evidence.** After fixing findings, post a follow-up comment mapping each finding to its fix commit and verification result.\n\nThese rules apply equally to Claude and Codex agents, subagents, and worktree workers.\n\n## Definition of Done (non-negotiable)\n- Behavior changes ship with tests (unit/integration/E2E as appropriate).\n- Handle error cases explicitly; do not swallow failures.\n- Update docs when reality changes:\n - `docs/STATUS.md` (what is true now)\n - `docs/IMPLEMENTATION_MASTERPLAN.md` (roadmap impact / next steps)\n\n## Security baseline (always on)\n- Never trust client input for identity/authority.\n- Enforce authn/authz consistently for protected resources.\n- Validate inputs server-side; fail safely.\n- Do not log secrets, tokens, or sensitive user data.\n\n## Project Structure & Modules\n- Backend (.NET): `backend/Taskdeck.sln` with layered projects under `backend/src`\n (`Taskdeck.Api`, `Taskdeck.Application`, `Taskdeck.Domain`, `Taskdeck.Infrastructure`, `Taskdeck.Cli`).\n- Backend tests: `backend/tests` with project-per-layer test suites.\n- Frontend (Vue 3 + Vite): `frontend/taskdeck-web` with app source in `src`, static assets in `public`.\n- Docs and planning: Start with `docs/STATUS.md` (source of truth),\n `docs/IMPLEMENTATION_MASTERPLAN.md` (active roadmap), `docs/GOLDEN_PRINCIPLES.md` (stable invariants), and `docs/TESTING_GUIDE.md` (test operations).\n Historical context lives under `docs/archive/`.\n\n## Build, Test & Run\n- Backend restore/build: `dotnet restore backend/Taskdeck.sln` and `dotnet build backend/Taskdeck.sln -c Release`.\n- Backend tests (required): `dotnet test backend/Taskdeck.sln -c Release -m:1`.\n- Backend API (local): from `backend/src/Taskdeck.Api`, run `dotnet run`.\n- Frontend dev server: from `frontend/taskdeck-web`, run `npm install` once, then `npm run dev`.\n- Frontend checks (required when frontend touched): from `frontend/taskdeck-web`,\n `npm run typecheck; if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }; npm run build; if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }; npx vitest --run` (PowerShell fail-fast; do not use `&&`).\n\n## Coding Style & Naming\n- Backend: C# conventions, 4-space indentation, PascalCase for classes and public members,\n camelCase for locals and parameters. Keep layers pure (e.g., `Domain` has no infrastructure dependencies).\n- Frontend: TypeScript + Vue SFCs in `PascalCase.vue`. Use script setup and composition APIs where existing code does.\n Prefer meaningful names over abbreviations.\n- Keep formatting consistent with existing files; do not introduce new style tools without discussion.\n\n## Testing Guidelines\n- Prefer unit tests close to the corresponding project (e.g., `Taskdeck.Application.Tests` for application logic).\n- Mirror production namespaces in test namespaces and file names (e.g., `FooServiceTests.cs` for `FooService`).\n- Add coverage for new branches and error paths, especially in application services and HTTP endpoints.\n- For frontend, add tests following the existing tooling (or document gaps clearly if tests are not yet present).\n\n## Commit & Pull Request Guidelines\n- Commits: Use clear, present-tense messages (e.g., `Add booking validation to application layer`).\n Default to small focused incremental commits, often one commit per changed file with a short file-specific description.\n Keep commits small and focused; avoid large mixed-topic commits.\n If a single logical change must touch multiple files, keep the smallest practical commit set and explain why.\n Exception: for pure file move/rename batches (no content changes), one grouped commit is acceptable and preferred.\n- Pull requests: Provide a short summary, key implementation notes, and testing evidence\n (commands run, screenshots for UI changes). Link related issues/tasks where applicable.\n- Keep PRs focused and small when possible; prefer follow-up PRs for refactors or additional cleanup.\n- PRs touching CI workflows (`.github/workflows/`), infrastructure (`deploy/`, `scripts/`), or project files (`*.csproj`) auto-trigger CI Extended. Ensure CI Extended is green before merging these PRs.\n- For issue execution unless the user explicitly says otherwise: open the PR after verification is complete, then perform a deliberate reviewer-style pass on the PR diff/comments before handoff. Follow the Review Policy: post findings, fix everything, address all existing comments, and seed issues for out-of-scope items. Follow the Review Policy: post findings, fix everything, address all existing comments, and seed issues for out-of-scope items.\n\n## Output expectations (after work)\nProvide:\n- Summary of changes\n- Files touched\n- Tests added/updated\n- Commands run + results\n- Docs updated (`STATUS` / `MASTERPLAN`)\n- Notable risks or follow-ups (if any)\n\nSee `docs/tooling/FUTURE_HARNESS_BACKLOG.md` for deferred harness/MCP upgrades.\n\nSee `docs/tooling/DEVTOOLS_OBSERVABILITY_ADDON.md` for Playwright vs DevTools vs logs decision rules.\n\n",{"_432":942,"_411":412,"_434":418},{"_435":943,"_437":-5,"_42":-5,"_439":944,"_441":-5,"_97":945,"_93":443},[946],{"_444":418},"developer",{"_46":947,"_93":489},"Do not spawn sub-agents unless the user or applicable AGENTS.md/skill instructions explicitly ask for sub-agents, delegation, or parallel agent work.",{"_432":949,"_411":412,"_434":418},{"_435":950,"_437":-5,"_42":-5,"_439":951,"_441":-5,"_97":945,"_93":443},[952],{"_444":418},{"_46":953,"_93":489},"You are `/root`, the primary agent in a team of agents collaborating to fulfill the user's goals.\n\nAt the start of your turn, you are the active agent.\nYou can spawn sub-agents to handle subtasks, and those sub-agents can spawn their own sub-agents.\nAll agents in the team, including the agents that you can assign tasks to, are equally intelligent and capable, and have access to the same set of tools.\n\nYou can use `spawn_agent` to create a new agent, `followup_task` to give an existing agent a new task and trigger a turn, and `send_message` to pass a message to a running agent without triggering a turn.\nChild agents can also spawn their own sub-agents.\nYou can decide how much context you want to propagate to your sub-agents with the `fork_turns` parameter.\n\nYou will receive messages in the analysis channel in the form:\n```\nMessage Type: MESSAGE | FINAL_ANSWER\nTask name: \nSender: \nPayload:\n\n```\nThey may be addressed as to=/root\n\nNote that collaboration tools cannot be called from inside `functions.exec`. Call `spawn_agent`, `send_message`, `followup_task`, `wait_agent`, `interrupt_agent`, and `list_agents` only as direct tool calls using the recipient shown in their tool definitions, such as `to=functions.collaboration.spawn_agent`, since they are intentionally absent from the `functions.exec` `tools.*` namespace. Available tools in `functions.exec` are explicitly described with a `tools` namespace in the developer message.\n\nAll agents share the same directory. In detail:\n- All agents have access to the same container and filesystem as you.\n- All agents use the same current working directory.\n- As a result, edits made by one agent are immediately visible to all other agents.\n\nThere are 4 available concurrency slots, meaning that up to 4 agents can be active at once, including you.",{"_432":955,"_411":412,"_434":418},{"_435":956,"_437":-5,"_42":-5,"_439":957,"_441":-5,"_97":945,"_93":443},[958,959],{"_444":418},{"_46":961,"_93":489},{"_46":960,"_93":489},"\n## Skills\nA skill is a set of instructions provided through a `SKILL.md` source. Below is the list of skills that can be used. Each entry includes a name, description, and source locator. `file` locators are on the host filesystem, `environment resource` locators are owned by an execution environment, `orchestrator resource` locators are opaque non-filesystem resources, and `custom resource` locators use their provider's access mechanism.\n### Available skills\n- imagegen: Generate or edit raster images when the task benefits from AI-created bitmap visuals such as photos, illustrations, textures, sprites, mockups, or transparent-background cutouts. Use when Codex should create a brand-new image, transform an existing image, or derive visual variants from references, and the output should be a bitmap asset rather than repo-native code or vector. Do not use when the task is better handled by editing existing SVG/vector/code-native assets, extending an established icon or logo system, or building the visual directly in HTML/CSS/canvas. (file: /opt/codex/skills/.system/imagegen/SKILL.md)\n- openai-docs: Use when the user asks how to build with OpenAI products or APIs, asks about Codex itself or choosing Codex surfaces, needs up-to-date official documentation with citations, help choosing the latest model for a use case, or model upgrade and prompt-upgrade guidance; use OpenAI docs MCP tools for non-Codex docs questions, use the Codex manual helper first for broad Codex self-knowledge, and restrict fallback browsing to official OpenAI domains. (file: /opt/codex/skills/.system/openai-docs/SKILL.md)\n- plugin-creator: Create and scaffold plugin directories for Codex with a required `.codex-plugin/plugin.json`, optional plugin folders/files, valid manifest defaults, and personal-marketplace entries by default. Use when Codex needs to create a new personal plugin, add optional plugin structure, generate or update marketplace entries for plugin ordering and availability metadata, or update an existing local plugin during development with the CLI-driven cachebuster and reinstall flow. (file: /opt/codex/skills/.system/plugin-creator/SKILL.md)\n- skill-creator: Guide for creating effective skills. This skill should be used when users want to create a new skill (or update an existing skill) that extends Codex's capabilities with specialized knowledge, workflows, or tool integrations. (file: /opt/codex/skills/.system/skill-creator/SKILL.md)\n- skill-installer: Install Codex skills into $CODEX_HOME/skills from a curated list or a GitHub repo path. Use when a user asks to list installable skills, install a curated skill, or install a skill from another repo (including private repos). (file: /opt/codex/skills/.system/skill-installer/SKILL.md)\n- taskdeck-backend-slice: Implement Taskdeck backend changes safely. Use when changing .NET API, application, domain, infrastructure, worker, auth, provider-runtime, import-export, notification, archive, or persistence behavior. (file: /workspace/Taskdeck/.codex/skills/taskdeck-backend-slice/SKILL.md)\n- taskdeck-capture-review-loop: Protect Taskdeck's core capture-review-apply-board loop. Use when touching Inbox, capture, triage, automation proposals, proposal summaries, approve-reject-execute behavior, provenance, or board handoff semantics across backend or frontend. (file: /workspace/Taskdeck/.codex/skills/taskdeck-capture-review-loop/SKILL.md)\n- taskdeck-ci-conflict-recovery: Triage and fix Taskdeck PR failures involving CI, GitHub bot comments, merge conflicts, stale branches, flaky tests, or blocked checks. Use when the user asks Codex to check failing CI, inspect PR comments, fix conflicts, monitor runs, rerun checks, or recover PRs after review automation reports errors. (file: /workspace/Taskdeck/.codex/skills/taskdeck-ci-conflict-recovery/SKILL.md)\n- taskdeck-demo-regression: Validate Taskdeck with the smallest evidence path that proves the change. Use when a task needs seeded demo state, Playwright proof, screenshots, or stakeholder walkthrough evidence. (file: /workspace/Taskdeck/.codex/skills/taskdeck-demo-regression/SKILL.md)\n- taskdeck-failure-capture: Classify and record Taskdeck agent failures, failed commands, flaky or blocked checks, MCP/tool problems, CI failures, docs-governance warnings, and workarounds. Use whenever unresolved friction should be visible in handoff or promoted into guidance. (file: /workspace/Taskdeck/.codex/skills/taskdeck-failure-capture/SKILL.md)\n- taskdeck-frontend-workspace-slice: Implement Taskdeck frontend shell and workspace changes. Use when changing Vue routes, stores, components, Home, Today, Boards, workspace-mode flows, keyboard behavior, help states, or novice-first product legibility outside the core capture-review semantics. (file: /workspace/Taskdeck/.codex/skills/taskdeck-frontend-workspace-slice/SKILL.md)\n- taskdeck-interface-map: Maintain Taskdeck's agent-facing interface maps. Use when adding, splitting, refactoring, or documenting complex domains so future agents can find entry points, invariants, edit seams, traps, and verification commands without bulk-reading the repo. (file: /workspace/Taskdeck/.codex/skills/taskdeck-interface-map/SKILL.md)\n- taskdeck-issue-batch-orchestrator: Coordinate high-autonomy Taskdeck issue batches from selection through PR review and handoff. Use when the user asks Codex to take care of many issues, pick next issues, run a batch, coordinate subagents/worktrees, seed follow-ups, reconcile GitHub project status, or automate issue-to-PR execution across multiple independent workstreams. (file: /workspace/Taskdeck/.codex/skills/taskdeck-issue-batch-orchestrator/SKILL.md)\n- taskdeck-pr-review-loop: Perform Taskdeck PR self-review or fresh adversarial review, post review findings, address review comments and bot comments, verify fixes, and re-review. Use when the user asks to review PRs, spin fresh reviewers, check comments, address feedback, or run another adversarial pass on sensitive or failing work. (file: /workspace/Taskdeck/.codex/skills/taskdeck-pr-review-loop/SKILL.md)\n- taskdeck-question-batch: Decide whether a Taskdeck agent should ask the user, proceed with a documented assumption, or stop for safety. Use when a task is broad, underspecified, has possible product/security/schema ambiguity, or risks context-expensive question loops. (file: /workspace/Taskdeck/.codex/skills/taskdeck-question-batch/SKILL.md)\n- taskdeck-repo-onramp: Orient to the Taskdeck repo before editing. Use when starting a session, entering an unfamiliar area, reconciling a broad request against current reality, or turning a vague task into a scoped plan. (file: /workspace/Taskdeck/.codex/skills/taskdeck-repo-onramp/SKILL.md)\n- taskdeck-verification-doc-sync: Finish a Taskdeck change with the right checks and doc updates. Use at the end of implementation to choose verification scope, decide whether canonical docs changed, and prepare the required handoff summary. (file: /workspace/Taskdeck/.codex/skills/taskdeck-verification-doc-sync/SKILL.md)\n- taskdeck-worktree-issue-worker: Implement one Taskdeck GitHub issue in an isolated worktree with focused ownership, small commits, tests, PR creation, and handoff. Use when a coordinator assigns Codex a single issue, asks for issue-to-PR execution, or launches a worker/subagent for backend, frontend, docs, or testing implementation. (file: /workspace/Taskdeck/.codex/skills/taskdeck-worktree-issue-worker/SKILL.md)\n","\nFilesystem sandboxing defines which files can be read or written. `sandbox_mode` is `danger-full-access`: No filesystem sandboxing - all commands are permitted. Network access is enabled.\nApproval policy is currently never. Do not provide the `sandbox_permissions` for any reason, commands will be rejected.\n","turn/started",{"_411":412,"_88":964},{"_104":-5,"_42":418,"_419":965,"_421":422,"_423":424,"_425":966},[],"inProgress",{"_425":968,"_411":412},{"_969":970,"_93":971},"activeFlags",[],"active","thread/started",{"_974":975},"thread",{"_976":-5,"_977":-5,"_978":979,"_980":424,"_463":464,"_981":15,"_982":-5,"_983":-5,"_984":-5,"_985":986,"_42":412,"_987":988,"_191":-5,"_989":-5,"_166":990,"_991":205,"_992":424,"_993":412,"_470":994,"_425":995,"_996":-5,"_78":997,"_998":424},"agentNickname","agentRole","cliVersion","0.144.0-alpha.4","createdAt","ephemeral","extra","forkedFromId","gitInfo","historyMode","legacy","modelProvider","openai","parentThreadId","/opt/codex/sessions/2026/07/27/rollout-2026-07-27T02-59-12-019fa183-1c9b-7841-80e2-fe6c8bdba665.jsonl","preview","recencyAt","sessionId","vscode",{"_93":429},"threadSource",[],"updatedAt",[],"messages",[1002],{"_42":1003,"_1004":1005,"_1006":1007,"_1008":1007,"_435":1009,"_425":1010,"_437":-5,"_1011":32,"_1012":1013,"_1014":305,"_1015":-5},"d9373c39-b03d-4ece-a2f4-8664cfc6e32d","author",{"_97":331,"_191":-5,"_1012":1024},"create_time",1785121145.149437,"update_time",{"_1020":46,"_1021":1022},"finished_successfully","weight","metadata",{"_1016":1017},"recipient","channel","l1239dk1",{"_1018":1019},"inline_comments",[],"content_type","parts",[1023],"## Independent adversarial review #2 — security / governance / tests\n\n**Exact head reviewed:** `1ec17437a1a6c04de2feba95b456baf3e1af8fd3`\n\nI first inspected the PR conversation, reviews, and review threads, plus linked issue #1228 and its existing maintainer comment. At posting time the PR has the `@codex review` request and one Codex DCO thread; no other PR comments/reviews were present.\n\n### MEDIUM\n\n1. **The retained “manual approval” is not an active gate, so the workflow and canonical docs would report an approval that never occurred.**\n\n The promotion job merely references `environment: production` and then unconditionally writes “Manual approval: granted” ([workflow lines 188–205](https://github.com/Chris0Jeky/Taskdeck/blob/1ec17437a1a6c04de2feba95b456baf3e1af8fd3/.github/workflows/cd-staging-gate.yml#L188-L205)). A live `GET /repos/Chris0Jeky/Taskdeck/environments` immediately before this review returned only `copilot` and `github-pages`; there is no `production` environment or required-reviewer rule. GitHub documents that a workflow reference to a missing environment creates it **without protection rules or secrets**, so this job will not wait for approval ([GitHub environment documentation](https://docs.github.com/en/actions/how-tos/deploy/configure-and-manage-deployments/manage-environments#creating-an-environment)).\n\n This contradicts the new Masterplan claim that manual approval “remain[s] available” ([line 15](https://github.com/Chris0Jeky/Taskdeck/blob/1ec17437a1a6c04de2feba95b456baf3e1af8fd3/docs/IMPLEMENTATION_MASTERPLAN.md#L15)), the deployment guide’s “Requires manual approval” statement ([line 298](https://github.com/Chris0Jeky/Taskdeck/blob/1ec17437a1a6c04de2feba95b456baf3e1af8fd3/docs/ops/DEPLOYMENT_WORKFLOW.md#L298)), and the PR summary. The job does not itself deploy, which limits immediate blast radius, but it emits a false production-approval record. Either configure and prove a protected `production` environment with required reviewers (and record that external prerequisite), or make the job, PR body, and canonical docs truthful about the current unprotected environment reference.\n\n2. **The verification does not prove #1228’s requested negative-trigger behavior.**\n\n The existing maintainer comment on #1228 explicitly asks to confirm that a test tag/release event triggers nothing waiting on `production`. The PR’s Not verified section confirms no release event was emitted. Exact-head [Workflow Lint](https://github.com/Chris0Jeky/Taskdeck/actions/runs/30232985065/job/89875215961) proves Actions syntax, while [Docs Governance](https://github.com/Chris0Jeky/Taskdeck/actions/runs/30232973727/job/89875176488) proves the repository’s mechanical documentation rules; neither emits a `release` event nor asserts this workflow’s trigger set. The diff is persuasive manual evidence that `release: published` was deleted, but the linked verification requirement remains unproved and there is no executable regression guard. Add a deterministic trigger-contract check (Actions-aware parsing/assertion that this workflow exposes only `workflow_dispatch` with required `image_tag`) or keep #1228 open until authorized post-merge live negative-event evidence is recorded. The PR should not say hosted workflow validation will “exercise” the release-trigger change when it only lints it.\n\n### Existing-feedback triage\n\nThe Codex DCO thread is **invalid for this exact head**: it cites `2087697bf039c8ae6541a39067aad7a26ccff9e7`, which is not in the PR’s two-commit list and is not found by the repository commit API. The actual commits are `948d5705b1f9cc337382ca0a14556777f86087e9` and `1ec17437a1a6c04de2feba95b456baf3e1af8fd3`; both include matching `Signed-off-by:` trailers, and the exact-head [DCO check is green](https://github.com/Chris0Jeky/Taskdeck/actions/runs/30232973727/job/89875176413). No DCO rewrite is needed.\n\n### Other reviewed surfaces\n\n- Event syntax is valid and the head’s top-level trigger is now only `workflow_dispatch`.\n- `image_tag` remains a required string; `skip_smoke` remains a boolean, and the build/smoke job dependency behavior is unchanged.\n- Workflow permissions remain read-only (`contents: read`, `actions: read`); no new secret or write permission was introduced.\n- Scope is otherwise faithful: one trigger subscription removed, existing jobs retained, and the six-file diff is limited to workflow truth and its documentation mirrors.\nDisable automatic staging gate release trigger\n\nCloses #1228\n\n## Summary\n- remove the `release: published` subscription from the parked staging gate\n- retain explicit manual dispatch, required image-tag input, jobs, permissions, and environment approval\n- synchronize current-state, roadmap, deployment, and packaging documentation with the manual-only trigger\n\n## Verification\n- `node scripts/check-docs-governance.mjs`\n- `node scripts/check-golden-principles.mjs`\n- `node scripts/check-github-ops-governance.mjs`\n- `docker run --rm -v \"${PWD}:/repo\" -w /repo rhysd/actionlint:1.7.12 .github/workflows/cd-staging-gate.yml`\n- `git diff --check origin/main...HEAD`\n\n## Not verified\n- no release event was emitted; the workflow trigger change is proved statically and will be exercised by hosted workflow validation\n- no manual staging deployment was run because the staged cloud path remains parked\r\n\n@codex review\n**_{_{![P1 Badge](https://img.shields.io/badge/P1-orange?style=flat)}} Add the mandatory DCO sign-off**\n\nWhen this changeset is submitted, commit `2087697bf039c8ae6541a39067aad7a26ccff9e7` has no parsed trailers, so it violates the repository's mandatory DCO requirement and will leave the DCO signal red. Recreate the commit with `git commit -s --no-gpg-sign`, or otherwise add the matching `Signed-off-by:` trailer, before it enters shared history.\n\nAGENTS.md reference: [AGENTS.md:L85-L85](https://github.com/Chris0Jeky/Taskdeck/blob/1ec17437a1a6c04de2feba95b456baf3e1af8fd3/AGENTS.md#L85-L85)\n\nUseful? React with 👍 / 👎.\n\n### 💡 Codex Review\n\nHere are some automated review suggestions for this pull request.\n\n**Reviewed commit:** `1ec17437a1`\n \n\n

ℹ️ About Codex in GitHub

\n
\n\n[Your team has set up Codex to review pull requests in this repo](https://chatgpt.com/codex/cloud/settings/general). Reviews are triggered when you\n- Open a pull request for review\n- Mark a draft as ready\n- Comment \"@codex review\".\n\nIf Codex has suggestions, it will comment; otherwise it will react with 👍.\n\n\n\n\nCodex can also answer questions or update the PR. Try commenting \"@codex address that feedback\".\n \n

",{},"created",1785121329.4344006,"Completing the task","event_type","info",{"_93":443,"_97":94,"_435":4225},{"_93":1058,"_1059":1060},{"_93":1033,"_1034":548,"_1035":1036,"_1037":1038,"_1039":-5},"pr","pr_title","pr_message","### Motivation\n- Address the adversarial review findings that the staging gate workflow emitted a false \"Manual approval: granted\" record because the referenced `production` environment was not guaranteed to be protected. \n- Make the workflow and canonical docs truthful about the current parked/manual-only state so publishing a release does not silently invoke a non-protected environment gate. \n- Provide a deterministic, executable regression guard that proves the workflow exposes only `workflow_dispatch` with a required `image_tag` and rejects accidental `release` subscriptions or optional `image_tag` semantics.\n\n### Description\n- Update `.github/workflows/cd-staging-gate.yml` to remove implicit release-resolution branches, resolve the image tag from the required manual input only, and reword the Phase 3 step from an asserted approval to a protection-dependent promotion checkpoint. \n- Add `scripts/ci/check-staging-gate-trigger.mjs`, a deterministic checker that asserts the workflow's top-level triggers are only `workflow_dispatch` and that `image_tag` is declared as a required string. \n- Add `scripts/ci/check-staging-gate-trigger.test.mjs` with positive and negative cases and run it from the docs governance workflow by updating `.github/workflows/reusable-docs-governance.yml`. \n- Update `docs/IMPLEMENTATION_MASTERPLAN.md`, `docs/STATUS.md`, and `docs/ops/DEPLOYMENT_WORKFLOW.md` to explicitly note that the `production` environment reference does not itself guarantee manual approval until maintainers configure GitHub environment protection.\n\n### Testing\n- Ran `node --test scripts/ci/check-staging-gate-trigger.test.mjs` and the test suite passed (3 tests, all OK). \n- Ran the docs/governance checks `node scripts/check-docs-governance.mjs`, `node scripts/check-golden-principles.mjs`, and `node scripts/check-github-ops-governance.mjs`, and each returned success. \n- Ran `git diff --check` and repository lint checks that were available in this environment and observed no diff errors; `actionlint` was not runnable locally because Docker is unavailable here, so hosted Workflow Lint should be used for final workflow validation.","output_diff",{"_93":1037,"_1040":464,"_129":130,"_1041":-5,"_330":1042,"_1043":1044,"_1045":1046,"_1047":1048,"_1049":1050,"_1051":1052,"_1053":1054},"pre_apply_patch","repo_id","preapply_patch_base_commit_sha","diff --git a/.github/workflows/cd-staging-gate.yml b/.github/workflows/cd-staging-gate.yml\nindex 8c6dc4e397d0002c9f5522103ed3ea9da3569842..bfa39df709e4483eab846d941733a65268e51338 100644\n--- a/.github/workflows/cd-staging-gate.yml\n+++ b/.github/workflows/cd-staging-gate.yml\n@@ -1,29 +1,30 @@\n # =============================================================================\n # CD Staging Gate — Automated staging deployment verification and production\n-# promotion gate. Implements Phase 1-2 of the staged deployment workflow\n-# (docs/ops/DEPLOYMENT_WORKFLOW.md) with a manual approval gate for Phase 3.\n+# promotion checkpoint. Implements Phase 1-2 of the staged deployment workflow\n+# (docs/ops/DEPLOYMENT_WORKFLOW.md). The production environment reference becomes\n+# an approval gate only when maintainers configure its external protection rules.\n #\n # Triggers:\n # - Manual workflow dispatch (for re-runs or pre-release validation)\n #\n # ADR: ADR-0028 (Staged Deployment — Blue/Green with Canary Verification)\n # Issue: #101 (OPS-09)\n # =============================================================================\n \n name: CD Staging Gate\n \n on:\n workflow_dispatch:\n inputs:\n image_tag:\n description: \"Container image tag to deploy (e.g., v0.2.0)\"\n required: true\n type: string\n skip_smoke:\n description: \"Skip smoke tests (emergency only)\"\n required: false\n type: boolean\n default: false\n \n permissions:\n contents: read\n@@ -32,60 +33,52 @@ permissions:\n concurrency:\n group: cd-staging-${{ github.ref }}\n cancel-in-progress: false\n \n env:\n NUGET_PACKAGES: ${{ github.workspace }}/.nuget/packages\n \n jobs:\n # -----------------------------------------------------------------------\n # Phase 1: Build Verification\n # -----------------------------------------------------------------------\n build-verification:\n name: \"Phase 1: Build Verification\"\n runs-on: ubuntu-latest\n timeout-minutes: 20\n outputs:\n image_tag: ${{ steps.resolve-tag.outputs.tag }}\n steps:\n - name: Checkout\n uses: actions/checkout@v7\n \n - name: Resolve image tag\n id: resolve-tag\n env:\n INPUT_TAG: ${{ inputs.image_tag }}\n- EVENT_NAME: ${{ github.event_name }}\n- RELEASE_TAG: ${{ github.event.release.tag_name }}\n run: |\n- if [[ -n \"$INPUT_TAG\" ]]; then\n- TAG=\"$INPUT_TAG\"\n- elif [[ \"$EVENT_NAME\" == \"release\" ]]; then\n- TAG=\"$RELEASE_TAG\"\n- else\n- TAG=\"$(git describe --tags --always)\"\n- fi\n+ TAG=\"$INPUT_TAG\"\n echo \"tag=$TAG\" >> \"$GITHUB_OUTPUT\"\n echo \"Resolved image tag: $TAG\"\n \n - name: Setup .NET\n uses: actions/setup-dotnet@v6\n with:\n dotnet-version: 8.0.x\n cache: true\n cache-dependency-path: |\n backend/Taskdeck.sln\n backend/**/*.csproj\n backend/Directory.Packages.props\n \n - name: Setup Node\n uses: actions/setup-node@v7\n with:\n node-version: 24.13.1\n cache: npm\n cache-dependency-path: frontend/taskdeck-web/package-lock.json\n \n - name: Restore and build backend\n run: |\n dotnet restore backend/Taskdeck.sln\n dotnet build backend/Taskdeck.sln -c Release --no-restore\n \n@@ -163,47 +156,48 @@ jobs:\n - name: Collect logs on failure\n if: failure()\n run: |\n echo \"--- Container status ---\"\n docker compose -f deploy/docker-compose.yml --profile baseline ps\n echo \"\"\n echo \"--- Container logs ---\"\n docker compose -f deploy/docker-compose.yml --profile baseline logs --tail=100\n \n - name: Stop stack\n if: always()\n run: |\n docker compose -f deploy/docker-compose.yml --profile baseline down -v\n \n - name: Write Phase 2 summary\n run: |\n cat <> \"$GITHUB_STEP_SUMMARY\"\n ## Phase 2: Staging Smoke Tests -- PASSED\n \n - **Image tag**: \\`${{ needs.build-verification.outputs.image_tag }}\\`\n - All S1-S9 smoke checks passed\n - Stack started, verified, and cleaned up\n EOF\n \n # -----------------------------------------------------------------------\n- # Production Promotion Gate (manual approval)\n+ # Production Promotion Checkpoint (approval only when environment is protected)\n # -----------------------------------------------------------------------\n promotion-gate:\n- name: \"Phase 3: Production Promotion Gate\"\n+ name: \"Phase 3: Production Promotion Checkpoint\"\n needs: [build-verification, staging-smoke]\n if: always() && needs.build-verification.result == 'success' && (needs.staging-smoke.result == 'success' || needs.staging-smoke.result == 'skipped')\n runs-on: ubuntu-latest\n environment: production\n steps:\n- - name: Promotion approved\n+ - name: Record promotion checkpoint\n run: |\n cat <> \"$GITHUB_STEP_SUMMARY\"\n- ## Phase 3: Production Promotion Gate -- APPROVED\n+ ## Phase 3: Production Promotion Checkpoint -- REACHED\n \n - **Image tag**: \\`${{ needs.build-verification.outputs.image_tag }}\\`\n - Build verification: passed\n - Staging smoke: ${{ needs.staging-smoke.result }}\n- - Manual approval: granted\n+ - Environment reference: production\n+ - Approval status: protection-dependent; this workflow does not assert that approval occurred\n - **Next step**: Execute Phase 3 (canary deployment) and Phase 4 (promotion) per \\`docs/ops/DEPLOYMENT_WORKFLOW.md\\`\n EOF\n- echo \"Production promotion approved for tag: ${{ needs.build-verification.outputs.image_tag }}\"\n+ echo \"Production promotion checkpoint reached for tag: ${{ needs.build-verification.outputs.image_tag }}\"\n echo \"Follow the deployment workflow in docs/ops/DEPLOYMENT_WORKFLOW.md for Phases 3-4.\"\ndiff --git a/.github/workflows/reusable-docs-governance.yml b/.github/workflows/reusable-docs-governance.yml\nindex ea1650e778751936b788566e0eb43fdf60803541..158ab756cf5771ce3d1f4f5d1d7708671b0e11fc 100644\n--- a/.github/workflows/reusable-docs-governance.yml\n+++ b/.github/workflows/reusable-docs-governance.yml\n@@ -37,25 +37,28 @@ jobs:\n $tokens = $null\n $parseErrors = $null\n [System.Management.Automation.Language.Parser]::ParseFile(\n (Resolve-Path -LiteralPath $script).Path,\n [ref]$tokens,\n [ref]$parseErrors\n ) | Out-Null\n if ($parseErrors.Count -ne 0) {\n $parseErrors | ForEach-Object { Write-Error $_ }\n exit 1\n }\n \n & $script -SelfTest\n \n - name: Validate failure ledger projection synchronization\n run: python -m unittest discover -s scripts/agent_hooks -p \"test_render_failure_ledger.py\"\n \n - name: Validate docs governance invariants\n run: node scripts/check-docs-governance.mjs\n \n - name: Validate golden principles invariants\n run: node scripts/check-golden-principles.mjs\n \n - name: Validate GitHub operations governance invariants\n run: node scripts/check-github-ops-governance.mjs\n+\n+ - name: Validate parked staging gate trigger contract\n+ run: node --test scripts/ci/check-staging-gate-trigger.test.mjs\ndiff --git a/docs/IMPLEMENTATION_MASTERPLAN.md b/docs/IMPLEMENTATION_MASTERPLAN.md\nindex 43c799816125c0863d5b10bfad0ac94aee5517a2..0b0616c85e4926080bc4812d2e843d9f9cdc6d2f 100644\n--- a/docs/IMPLEMENTATION_MASTERPLAN.md\n+++ b/docs/IMPLEMENTATION_MASTERPLAN.md\n@@ -1,40 +1,40 @@\n # Taskdeck Implementation Masterplan\n \n Last Updated: 2026-07-27\n
\n Planning Horizon: the revival waves in `docs/REVIVAL_PLAN.md` (truth + safety → transcript engine → open-beta launch → generalist expansion [Phase 4, ADR-0046 Accepted]), then a maintainer checkpoint on beta traction — _(historical: 2026-06-13→2026-07-10 this was the finite archive-pivot waves; before that an open \"Next 8 to 12 weeks\" release horizon)_\n Companion Active Docs:\n - `docs/STATUS.md`\n - `docs/IMPLEMENTATION_MASTERPLAN.md`\n - `docs/TESTING_GUIDE.md`\n - `docs/MANUAL_TEST_CHECKLIST.md`\n - `docs/GOLDEN_PRINCIPLES.md`\n \n ## Delivery update (2026-07-27, release workflow truth)\n \n-- **Manual-only parked staging gate (`#1228`):** `.github/workflows/cd-staging-gate.yml` no longer subscribes to `release: published`; its required-input `workflow_dispatch` path, jobs, permissions, and manual `production` environment approval remain available for deliberate operator runs. Active beta release lanes (`release-desktop.yml`, `ci-release.yml`, and `release-security.yml`) are unchanged, so publishing a release cannot accidentally strand a staging run on a nonexistent environment.\n+- **Manual-only parked staging gate (`#1228`):** `.github/workflows/cd-staging-gate.yml` no longer subscribes to `release: published`; its required-input `workflow_dispatch` path, jobs, permissions, and `production` environment reference remain available for deliberate operator runs. That reference is not currently an approval guarantee: maintainers must configure GitHub environment protection before it becomes a manual gate. Required CI now asserts the workflow exposes only manual dispatch with a required string `image_tag`. Active beta release lanes (`release-desktop.yml`, `ci-release.yml`, and `release-security.yml`) are unchanged.\n \n ## Delivery update (2026-07-26, agentic governance)\n \n - **Failure-ledger projection gate (`#1492`):** Required Docs Governance now pins Python 3.12 and runs the existing JSONL↔Markdown synchronization unittest before the governance checks, so a JSONL-only change with stale generated Markdown fails Required CI without regeneration masking it. Local agentic update workflows use the distinct render-then-test order so hook-appended JSONL can be projected, and the smoke contract pins both sides of that distinction.\n - **Cross-platform agent-hook launchers (`#1487`):** native-Windows handlers and PowerShell-scoped agent-utility commands use the verified `py -3 -B` launcher instead of the unusable Microsoft Store aliases, while POSIX Bash guidance keeps `python3 -B`. The smoke harness uses its active `sys.executable -B` for child scripts, rejects drift in the exact configured-handler inventory and the five-utilities-plus-renderer-test permission surface, and proves that missing PreToolUse launchers or policies fail closed with exit 2. The smoke payloads identify `Bash`; native PowerShell-tool deny coverage is separate T4 work tracked by [#1497](https://github.com/Chris0Jeky/Taskdeck/issues/1497). No interpreter install, PATH mutation, resolver wrapper, or product-runtime change is added.\n \n ## Delivery update (2026-07-26, security runway)\n \n - **SQLite native security floor (`#1345`):** centrally pin `SQLitePCLRaw.bundle_e_sqlite3` 2.1.12 and make Infrastructure's dependency direct, which moves the matched bundle/core/provider/native family from 2.1.6 to 2.1.12 without enabling global transitive pinning. A runtime regression enforces SQLite >= 3.50.2 (2.1.12 loads 3.53.3); the NuGet vulnerability audit is clean, EF reports no pending model changes after a fresh update, and a self-contained `win-x64` binary reaches `/health/ready` with SQLite loaded.\n - **Project priority completeness (`#1458`, delivered by PR #1488):** the helper now replaces the capped ProjectV2 sample with cursor-complete stable snapshots and fail-closed checks for saturation, identity, nested truncation, source/plan drift, invalid Issue labels, typed references, option drift, partial writes, and stale post-state reporting. External Issue references remain visible but non-authoritative: their labels never rank, external-only PRs derive `Priority V`, and an external closing Issue permits same-repository body fallback. The authentication-free 64-check suite runs in Required CI. All 130 formerly unlabeled Taskdeck Issues were classified and verified; the reviewed Apply then succeeded 141/141. Its built-in audit, two fresh pre-merge audits, and the final post-merge handoff audit each proved 1,472/1,472 items, 12 ignored external references, and zero remaining drift. Issue #1458 and both project items are `Done / Priority I`.\n \n ## Delivery update (2026-07-25, PR-queue clearing wave)\n \n **8 PRs merged; the open-PR queue is down to a single human-gated draft.** Per-PR gate: independent adversarial review, all-severity findings fixed with posted evidence, required CI green on the exact head, every thread triaged.\n \n - **`#1469` (`#1462`)** — frontend `Proposal.approvedRevisionId`, declared **required** (the key is always on the wire), contract-only per `#1298`, guarded against a dead-code sweep by an exported type alias.\n - **`#1337` (`#1299`) — REVIVAL-03 licensing pack shipped.** `LICENSING.md` (MIT-forever, never-gated free boundary, additive-only commercial posture), reserved `ee/`, DCO guidance + SHA-pinned advisory CI job, MIT metadata across npm and 11 `.csproj`. Root `LICENSE` untouched. Name availability researched and recorded on `#1299` with filing costs and a **do-not-file-now** recommendation; pre-commercial legal residuals → **`#1482`**.\n - **`#1477` + `#1481` (`#1123`)** — the release pipeline can now be **rehearsed without pushing a tag**, which is what makes `#1303`'s tag push verifiable in advance rather than a first-run. Rehearsed live (run `30160400273`): four platforms built, **three smoke-tested**, `create-release` skipped, zero tags/releases created. `osx-x64` is built, packaged, checksummed and uploaded **without ever being launched** — it is cross-arch on the arm64 `macos-latest` runner (`if: matrix.rid != 'osx-x64'`), so that one archive carries less release evidence than the other three. Worth knowing before the `#1303` tag push.\n - **`#1478` (`#1271`) — dogfooding instrumented**, and the baseline measured: sustained use has **not** started (8 active days, three months stale, most boards fixtures), though the core loop works (**17/20 proposals reached Apply**, counted by `AppliedAt` — a status-based count reads 1/20 because `Dismiss()` overwrites an `Applied` status). Residual accuracy questions → **`#1480`**.\n - **`#1471`, `#1472`, `#1479`** — canonical-doc reconciliation, human-action tracking for `#1457`'s trust gate and the recurring worktree prune, and two record-only check-offs taken on explicit maintainer instruction.\n - **`#1295` closed as superseded** (13/13 bypass failures; targeted floor v1.3.0 vs installed 1.6.5). The overlay is still *needed* — 11 rule-classes are `allow` at every tier including T4 — so the salvage plan and acceptance criteria live on **`#1293`**.\n - **Repo hardening:** force-push and deletion blocked on `main` (otherwise deliberately relaxed); a 1,444-item snapshot synced 288 truncation-hidden project-priority mismatches (`#1474`), while `#1458` owns the durable complete-audit and remaining data-cleanup gate.\n - **`#1270` backlog triage:** 12 issues closed with dated notes; an adversarial pass bounced **13 of 25** proposed closures, including the `#1123` ship-gate item. `#1270` stays open — two of its own ACs are obsolete against ADR-0044 / REVIVAL_PLAN §6.\n - **Seeded:** `#1470` `#1473` `#1474` `#1475` `#1476` `#1480` `#1482`, plus upstream `agent-harness#56`.\n - **Remaining T4 hold:** `#1457` only — do not run the published canaries yet. Its current head has red DCO, stale review evidence, and material main-branch drift; the 2026-07-26 audit also found its v1.6.5 pin behind the installed/producer v1.6.12 floor while root/common-directory hook discovery remains unresolved. Repair those prerequisites and regenerate exact-head CI/reviews before the maintainer-only `/hooks` trust and live-canary step.\ndiff --git a/docs/STATUS.md b/docs/STATUS.md\nindex bbd43cefa7a1d00f13523aaf4493559ee8e2abd3..ec9985bfa28a93e7b525dbb3dd94941c1e7b10c0 100644\n--- a/docs/STATUS.md\n+++ b/docs/STATUS.md\n@@ -560,51 +560,51 @@ Ten parallel worktree agents delivered platform hardening, testing infrastructur\n \n **PWA & Offline:**\n - **UX-09 PWA/offline readiness** (`#95`/`#802`): VitePWA integration with `prompt` registerType, `navigateFallback` with `/api/`+`/mcp` denylist, `NetworkFirst` API caching + `CacheFirst` static assets; `useOnlineStatus` composable with reactive `navigator.onLine` tracking; `OfflineBanner` component with ARIA `role=\"status\"`; `SwUpdatePrompt` component via `virtual:pwa-register` for controlled SW update lifecycle; offline behavior doc at `docs/platform/PWA_OFFLINE_BEHAVIOR.md`; 18 tests (11 composable + 7 component); adversarial review eliminated duplicate SW lifecycle handlers (double-reload race), fixed misleading sync text, corrected opaque response caching and SVG icon sizes\n \n **Ops & Architecture Documentation:**\n - **OPS-12 Cloud cost observability** (`#104`/`#798`): ADR-0026 documents proactive cost observability decision; framework at `docs/ops/CLOUD_COST_OBSERVABILITY.md` (6 cost dimensions, 3-tier alerts at 70/90/100%, monthly review workflow, Terraform budget template); hotspot registry at `docs/ops/COST_HOTSPOT_REGISTRY.md` (6 features with per-request LLM costs, monthly projections at 4 usage levels); breach runbook at `docs/ops/BUDGET_BREACH_RUNBOOK.md` (5-phase playbook); adversarial review fixed phantom config keys, wrong API endpoint, incorrect JSON payload, compute instance types\n - **OPS-14 Cloud topology ADR** (`#111`/`#799`): ADR-0027 documents container-based ECS Fargate topology; autoscaling policy (CPU 65%/25%, 1000 req/min, 500 WS connections); health checks (liveness/readiness/startup); SLO targets (99.5% availability, p95 read <300ms, write <800ms); cost estimate ~$147-152/month; reference architecture at `docs/ops/CLOUD_REFERENCE_ARCHITECTURE.md` (VPC layout, ECS tasks, CI/CD pipeline, DR strategy); adversarial review fixed cost inconsistency, missing worker service, latency alarm gap, health check endpoint accuracy, connection pooling risk\n \n **ADR numbering note**: All 5 PRs that created ADRs originally used ADR-0023. The canonical numbering is ADR-0023 (SQLite migration) through ADR-0027 (cloud topology). PR branches need ADR file renames during merge to match this index.\n \n ## Feature, Security, and Ops Expansion Wave (2026-04-09, PRs `#806`–`#813`, 8 issues)\n \n Eight parallel worktree agents delivered new features, security infrastructure, ops tooling, and developer experience improvements across 8 PRs. Each PR received two rounds of adversarial review (original self-review + independent cold review). The independent round caught 9 CRITICAL and 11 HIGH findings — all resolved before merge.\n \n **Features:**\n - **UX-08 Calendar/timeline views** (`#94`/`#810`): `WorkspaceService.GetCalendarAsync` with board-access-scoped date-range card query (90-day cap, 500-result limit); `CardRepository.GetByDueDateRangeAsync`; `GET /api/workspace/calendar?from=&to=` endpoint defaulting to current month; frontend `CalendarView.vue` with grid mode (monthly calendar, color-coded due-date cards, overflow \"+N more\") and timeline mode (chronological date-grouped list); month navigation, status indicators (on-track/overdue/blocked), drill-down to board/card; loading/error/empty states; ARIA grid roles; sidebar nav item; 8 backend + 20+ frontend tests; adversarial review fixed UTC timezone mismatch, overdue logic inconsistency, and unbounded query results\n - **INT-05 Note-style import and web clip intake** (`#334`/`#809`): `NoteImportService` with markdown heading-based section splitting and web clip metadata intake; `CaptureSource.MarkdownImport` and `CaptureSource.WebClip` enum values; `NoteImportController` with `POST /api/import/notes/markdown` and `POST /api/import/notes/webclip` (auth + rate limiting); all imported content routes through `ICaptureService.CreateAsync` (GP-06 compliant — no silent board mutations); provenance via `ExternalRef` (filename/URL) and `TitleHint`; frontend markdown upload and web clip paste tabs in `ExportImportView`; security: path traversal validation, URL scheme restriction (http/https only), no outbound requests (no SSRF), content as plain text (no XSS); 38 backend + 6 frontend tests; adversarial review fixed silent success on all-sections-fail and ExternalRef overflow\n - **AGT-03 Agents/Runs surfaces** (`#338`/`#808`): `AgentsView.vue` (profile list with status badges), `AgentRunsView.vue` (run list per agent with proposal linkage), `AgentRunDetailView.vue` (vertical event timeline with human-readable labels, JSON payload display, proposal navigation); `agentStore` Pinia store with 3 data slices; `agentApi` HTTP client with enum normalization for backend integer serialization; 3 lazy-loaded routes under `/workspace/agents` gated to `agent` workspace mode; sidebar nav item with `primaryModes: ['agent']`; loading/error/empty states throughout; 42 frontend tests; adversarial review confirmed clean (no CRITICAL/HIGH)\n - **UI-12 Storybook baseline** (`#251`/`#807`): Storybook 10.3.5 (`@storybook/vue3-vite`) configured for Vue 3 + Vite 8; stories for all 17 Td* UI primitives (TdButton, TdIconButton, TdInput, TdTextarea, TdSelect, TdFieldWrapper, TdDialog, TdDropdown, TdPopover, TdTooltip, TdToast, TdInlineAlert, TdSpinner, TdSkeleton, TdBadge, TdTag, TdEmptyState) showing key state variants; design token CSS import + obsidian theme background; `viteFinal` hook strips PWA plugin for storybook builds; `npm run storybook` (dev server :6006) and `npm run storybook:build` scripts; adversarial review confirmed clean\n \n **Security & Auth:**\n - **SEC-07 SSO/OIDC with MFA** (`#82`/`#813`): configurable OIDC provider support (Microsoft Entra ID, Google, generic OIDC) via `IOidcProviderFactory` with pluggable registration; OIDC is config-gated and disabled by default; OIDC login/callback/exchange endpoints with open-redirect protection and short-lived single-use authorization codes; TOTP-based MFA (RFC 6238) with setup (secret + QR URI + 8 recovery codes), confirm, verify, and disable endpoints; recovery codes bcrypt-hashed at rest; constant-time comparison and replay protection; `MfaPolicy` configuration (`EnableMfaSetup`, `RequireMfaForSensitiveActions`) gating password change and account deletion; frontend OIDC login buttons on LoginView (config-gated), `MfaSetup.vue` settings component, `MfaChallengeModal.vue` for protected actions; no auto-linking by email (prevents account takeover); ADR-0029 documents design decisions; 30+ backend tests; adversarial review fixed dead MFA enforcement code, permanent user lockout via DisableAsync, and OIDC endpoint routing\n - **CLD-03 OAuth PKCE and account linking** (`#676`/`#812`): DB-backed auth code store replacing in-memory `ConcurrentDictionary` — `OAuthAuthCode` entity with EF migration, `IOAuthAuthCodeRepository` with atomic `TryConsumeAtomicAsync` (raw SQL `UPDATE WHERE IsConsumed = 0 AND ExpiresAt > now`); PKCE support via `UsePkce = true` in ASP.NET Core 8 OAuth middleware; account linking endpoints (`POST /api/auth/github/link`, `DELETE /api/auth/github/link`, `GET /api/auth/linked-accounts`) with conflict detection and session verification; frontend Linked Accounts section in `ProfileSettingsView` with Link/Unlink buttons and avatar display; 24+ backend tests; adversarial review fixed CSRF on account linking, TOCTOU in expiry check, JWT plaintext in DB, DoS via full-table load, and unbounded table growth\n \n **Ops & Observability:**\n-- **OPS-09 Staged deployment workflow** (`#101`/`#806`): ADR-0028 documents blue/green + canary deployment strategy with rollback criteria; `docs/ops/DEPLOYMENT_WORKFLOW.md` canonical 4-phase workflow (build verification → staging → production canary → production promotion) with rollback procedures, database migration safety, emergency hotfix override, and ownership/escalation model; `docs/ops/RELEASE_CHECKLIST.md` versioned smoke verification (7 pre-deploy + 9 automated staging + 7 manual staging + 7 canary + 6 post-promotion + 5 post-release checks) with failure response matrix; `scripts/deploy/smoke-test.sh` portable smoke test (9 automated checks: health, API, auth, board auth gate, frontend, SignalR, static assets, security headers, container restart detection); `.github/workflows/cd-staging-gate.yml` with `production` environment manual approval gate; adversarial review fixed script injection in CI workflow and unscoped container checks. _(⚠️ Parked by the 2026-06-13 archive pivot — staged cloud rollout de-scoped, see the parked-cloud note below. The workflow is manual-dispatch-only after **#1228**, so publishing a beta release no longer invokes the nonexistent `production` environment gate.)_\n+- **OPS-09 Staged deployment workflow** (`#101`/`#806`): ADR-0028 documents blue/green + canary deployment strategy with rollback criteria; `docs/ops/DEPLOYMENT_WORKFLOW.md` canonical 4-phase workflow (build verification → staging → production canary → production promotion) with rollback procedures, database migration safety, emergency hotfix override, and ownership/escalation model; `docs/ops/RELEASE_CHECKLIST.md` versioned smoke verification (7 pre-deploy + 9 automated staging + 7 manual staging + 7 canary + 6 post-promotion + 5 post-release checks) with failure response matrix; `scripts/deploy/smoke-test.sh` portable smoke test (9 automated checks: health, API, auth, board auth gate, frontend, SignalR, static assets, security headers, container restart detection); `.github/workflows/cd-staging-gate.yml` references the `production` environment, but no repository-controlled approval is guaranteed until maintainers configure required-reviewer protection externally; adversarial review fixed script injection in CI workflow and unscoped container checks. _(⚠️ Parked by the 2026-06-13 archive pivot — staged cloud rollout de-scoped, see the parked-cloud note below. The workflow is manual-dispatch-only after **#1228**, so publishing a beta release no longer invokes the parked checkpoint.)_\n - **OBS-02 Error tracking and product analytics** (`#549`/`#811`): config-gated Sentry SDK for backend (`Sentry.AspNetCore` with `BeforeSend` PII scrubbing for emails/JWTs, `ServerName` blanked) and frontend; opt-in product telemetry service (`TelemetryEventService`) aligned with `docs/product/TELEMETRY_TAXONOMY.md` — property key allowlist (15 safe keys), max 10 properties, 200-char value truncation; `TelemetryController` with anonymous config endpoint and authenticated events endpoint; Plausible/Umami analytics script injection (`useAnalyticsScript`) with HTTPS-only URL validation; Pinia `telemetryStore` with consent management, event buffering, and flush; DNT/GPC privacy signal detection prevents auto-restore of consent; telemetry consent toggle in `ProfileSettingsView`; `docs/ops/OBSERVABILITY_SETUP.md` configuration guide; all telemetry opt-in and disabled by default; 38 backend + 25 frontend tests; adversarial review fixed Sentry PII leak, arbitrary properties injection, XSS via script URL, and DNT non-compliance\n \n ## Post-Merge Housekeeping (2026-04-12)\n \n Batch merge of 7 PRs (`#800`, `#805`, `#811`, `#813`, `#815`, `#819`, `#820`) with conflict resolution and documentation sweep. All features are now on `main`:\n - Resilience and degraded-mode behavior tests (PR `#820`, 34 tests across 6 files)\n - OAuth auth code store and token lifecycle tests (PR `#815`, 19+ integration tests)\n - Cross-browser E2E matrix (PR `#800`, Chromium/Firefox/WebKit/mobile-chrome/mobile-safari)\n - Error tracking and product analytics with Sentry integration (PR `#811`, telemetry events, consent management)\n - MCP HTTP transport and API key authentication (PR `#819`, CLI commands, HTTP endpoint, rate limiting)\n - SSO/OIDC integration with optional TOTP MFA (PR `#813`, MfaController, recovery codes, OIDC login)\n - Distributed caching with ICacheService (PR `#805`, InMemory/Redis/NoOp implementations, cache-aside pattern)\n \n Test suite recertified: backend 4,279 tests, frontend 2,245 tests, combined ~6,500+ passing (2026-04-12). Latest recertification (2026-04-25): backend 5,060, frontend 2,805, combined 7,865+.\n \n Estimated totals after PRs `#821`–`#826` supplementary wave + PRs `#837`–`#841` validation/integrations wave: backend ~4,530+, frontend ~2,463+, E2E 61+ new scenarios, combined ~7,070+ passing. Actuals after PRs `#960`–`#969` audit remediation wave: backend 5,060, frontend 2,805, combined 7,865+.\n \n ## Phase Progress (Reconciled)\n \n Progress is tracked against `filesAndResources/taskdeck_technical_design_document.md`.\n \n 1. Phase 1 - Core Data Model and API: COMPLETE (100%)\n 2. Phase 2 - Basic Web UI: COMPLETE (100%)\n 3. Phase 3 - UX Improvements: COMPLETE (100%)\n 4. Phase 4 - Advanced Features: IN PROGRESS (97%)\ndiff --git a/docs/ops/DEPLOYMENT_WORKFLOW.md b/docs/ops/DEPLOYMENT_WORKFLOW.md\nindex 97e0a3c1723b4e309c9761d155ea64d09dea10e2..b27335c99315eb34cd85563f2a213b9c0e7c779a 100644\n--- a/docs/ops/DEPLOYMENT_WORKFLOW.md\n+++ b/docs/ops/DEPLOYMENT_WORKFLOW.md\n@@ -273,48 +273,48 @@ Taskdeck uses EF Core auto-migration on API startup. When blue and green slots s\n - **Shared database risk**: During the canary window, both slots read/write the same database. If the new migration alters behavior for existing data, ensure the active slot can still function with the migrated schema.\n \n If blue and green are deployed on separate hosts with separate databases (e.g., in a hypothetical multi-node topology; not planned — single-instance is permanent per the 2026-06-13 archive pivot), migration safety is simplified since each slot has its own schema lifecycle.\n \n ## Emergency Hotfix Override\n \n For critical production incidents where the standard workflow would take too long:\n \n 1. The release owner or on-call responder can skip the canary phase.\n 2. Deploy directly to the idle slot and immediately switch traffic.\n 3. Document the override reason in the release log.\n 4. Run the full smoke test immediately after traffic switch.\n 5. File a post-incident review within 24 hours.\n \n Emergency overrides must still pass Phase 1 (CI build) and Phase 2 (staging smoke). Skipping CI entirely is never permitted.\n \n ## GitHub Actions Integration\n \n The `cd-staging-gate.yml` workflow automates Phase 1 and Phase 2 gates:\n \n > ⚠️ _(Parked by the 2026-06-13 archive pivot — staged cloud deployment de-scoped. After **#1228**, the workflow is manual-dispatch-only, so release publication cannot invoke its parked `production` environment gate. See `docs/ops/README.md`.)_\n \n - Triggers only on manual dispatch with an explicit image tag\n - Builds and verifies container images\n - Runs the smoke test suite against a CI-hosted staging environment\n-- Requires manual approval (GitHub environment protection) before Phase 3 can proceed\n+- References the `production` GitHub environment before the Phase 3 checkpoint. This is **not currently a manual approval guarantee**: repository maintainers must first configure required-reviewer protection on that environment; an unprotected or newly created environment does not wait for approval.\n - See `.github/workflows/cd-staging-gate.yml` for the workflow definition\n \n ## Ownership and Escalation\n \n | Role | Responsibility |\n |---|---|\n | **Release owner** | Initiates deployment, monitors canary, approves promotion or triggers rollback |\n | **On-call responder** | Fallback authority for rollback if release owner is unavailable |\n | **Platform team** | Maintains deployment tooling, scripts, and Terraform modules |\n \n Escalation path: Release owner (15 min) -> On-call responder (30 min) -> Platform team lead.\n \n ## References\n \n - ADR-0028: Staged Deployment — Blue/Green with Canary Verification\n - `docs/ops/RELEASE_CHECKLIST.md` — smoke verification checklist\n - `docs/ops/DEPLOYMENT_CONTAINERS.md` — container baseline\n - `docs/ops/DEPLOYMENT_TERRAFORM_BASELINE.md` — Terraform baseline\n - `docs/ops/DISASTER_RECOVERY_RUNBOOK.md` — disaster recovery procedures\n - `docs/ops/INCIDENT_REHEARSAL_CADENCE.md` — incident rehearsal schedule\n - `.github/workflows/cd-staging-gate.yml` — staging gate workflow\n - `scripts/deploy/smoke-test.sh` — portable smoke test script\ndiff --git a/scripts/ci/check-staging-gate-trigger.mjs b/scripts/ci/check-staging-gate-trigger.mjs\nnew file mode 100644\nindex 0000000000000000000000000000000000000000..add9df9d262acdf687e762fb3766cacd13a34253\n--- /dev/null\n+++ b/scripts/ci/check-staging-gate-trigger.mjs\n@@ -0,0 +1,37 @@\n+#!/usr/bin/env node\n+\n+import { readFile } from 'node:fs/promises'\n+import { resolve } from 'node:path'\n+\n+const workflowPath = process.argv[2] ?? '.github/workflows/cd-staging-gate.yml'\n+const workflow = await readFile(resolve(workflowPath), 'utf8')\n+const lines = workflow.split(/\\r?\\n/)\n+\n+function fail(message) {\n+ console.error(`Staging gate trigger contract failed: ${message}`)\n+ process.exit(1)\n+}\n+\n+const onIndex = lines.findIndex((line) => line === 'on:')\n+if (onIndex < 0) fail('missing the top-level on mapping')\n+\n+const triggerLines = []\n+for (const line of lines.slice(onIndex + 1)) {\n+ if (/^[^\\s#]/.test(line)) break\n+ if (/^ [A-Za-z0-9_-]+:/.test(line)) triggerLines.push(line.trim().slice(0, -1))\n+}\n+\n+if (triggerLines.length !== 1 || triggerLines[0] !== 'workflow_dispatch') {\n+ fail(`expected only workflow_dispatch, found: ${triggerLines.join(', ') || '(none)'}`)\n+}\n+\n+const dispatchStart = lines.findIndex((line, index) => index > onIndex && line === ' workflow_dispatch:')\n+const dispatchEnd = lines.findIndex((line, index) => index > dispatchStart && /^[^\\s#]/.test(line))\n+const dispatchBlock = lines.slice(dispatchStart, dispatchEnd < 0 ? undefined : dispatchEnd).join('\\n')\n+\n+if (!/^ inputs:\\s*$/m.test(dispatchBlock)) fail('workflow_dispatch must declare inputs')\n+if (!/^ image_tag:\\s*$/m.test(dispatchBlock)) fail('workflow_dispatch must declare image_tag')\n+if (!/^ required: true\\s*$/m.test(dispatchBlock)) fail('image_tag must remain required')\n+if (!/^ type: string\\s*$/m.test(dispatchBlock)) fail('image_tag must remain a string')\n+\n+console.log('Staging gate trigger contract passed: manual workflow_dispatch with required string image_tag only.')\ndiff --git a/scripts/ci/check-staging-gate-trigger.test.mjs b/scripts/ci/check-staging-gate-trigger.test.mjs\nnew file mode 100644\nindex 0000000000000000000000000000000000000000..aa1ba16d0bbe4f42a07e3545c28c03126107b545\n--- /dev/null\n+++ b/scripts/ci/check-staging-gate-trigger.test.mjs\n@@ -0,0 +1,50 @@\n+import assert from 'node:assert/strict'\n+import { spawnSync } from 'node:child_process'\n+import { mkdtemp, readFile, rm, writeFile } from 'node:fs/promises'\n+import { tmpdir } from 'node:os'\n+import { join } from 'node:path'\n+import test from 'node:test'\n+import { fileURLToPath } from 'node:url'\n+\n+const checkerPath = fileURLToPath(new URL('./check-staging-gate-trigger.mjs', import.meta.url))\n+const workflowPath = fileURLToPath(new URL('../../.github/workflows/cd-staging-gate.yml', import.meta.url))\n+\n+function runChecker(path = workflowPath) {\n+ return spawnSync(process.execPath, [checkerPath, path], { encoding: 'utf8' })\n+}\n+\n+async function withMutatedWorkflow(mutate, assertion) {\n+ const tempDir = await mkdtemp(join(tmpdir(), 'taskdeck-staging-trigger-'))\n+ const tempWorkflow = join(tempDir, 'workflow.yml')\n+ try {\n+ await writeFile(tempWorkflow, mutate(await readFile(workflowPath, 'utf8')), 'utf8')\n+ assertion(runChecker(tempWorkflow))\n+ } finally {\n+ await rm(tempDir, { recursive: true, force: true })\n+ }\n+}\n+\n+test('accepts the checked-in manual-only trigger contract', () => {\n+ const result = runChecker()\n+ assert.equal(result.status, 0, result.stderr)\n+})\n+\n+test('rejects a release subscription', async () => {\n+ await withMutatedWorkflow(\n+ (workflow) => workflow.replace('\\npermissions:', '\\n release:\\n types: [published]\\n\\npermissions:'),\n+ (result) => {\n+ assert.equal(result.status, 1)\n+ assert.match(result.stderr, /expected only workflow_dispatch, found: workflow_dispatch, release/)\n+ },\n+ )\n+})\n+\n+test('rejects an optional image tag', async () => {\n+ await withMutatedWorkflow(\n+ (workflow) => workflow.replace(' required: true', ' required: false'),\n+ (result) => {\n+ assert.equal(result.status, 1)\n+ assert.match(result.stderr, /image_tag must remain required/)\n+ },\n+ )\n+})\n","external_storage_diff",{"_1055":1056,"_1057":-5},"files_modified",7,"lines_added",104,"lines_removed",20,"commit_message","Harden staging gate trigger contract\n\nSigned-off-by: Codex ","additional_parent_commit_shas",[],"file_id","file_00000000d8b881f79c359abc06a57940","ttl","partial_repo_snapshot","files",[1061,1062,1063,1064,1065,1066,1067],{"_166":4092,"_1069":-5,"_1070":4093,"_1072":-5},{"_166":4062,"_1069":-5,"_1070":4063,"_1072":-5},{"_166":4022,"_1069":-5,"_1070":4023,"_1072":-5},{"_166":3966,"_1069":-5,"_1070":3967,"_1072":-5},{"_166":2490,"_1069":-5,"_1070":2491,"_1072":-5},{"_166":1272,"_1069":-5,"_1070":1273,"_1072":-5},{"_166":1068,"_1069":-5,"_1070":1071,"_1072":-5},"docs/ops/DEPLOYMENT_WORKFLOW.md","contents","line_range_contents",[1073],"missing_reason",{"_1074":1075,"_1076":1077,"_435":1078,"_1079":59},"line_range_start",1,"line_range_end",320,[1080,205,1081,1082,1083,205,1084,205,1085,205,1086,205,1087,205,1088,1089,1090,1091,1092,1093,1094,1095,1088,205,1096,205,1097,1098,1099,1100,1101,205,1102,205,1103,1104,1105,1106,1107,205,1108,205,1109,205,1110,205,1111,1112,1113,1114,1115,1116,1117,205,1118,1119,1120,1121,1122,205,1123,205,1124,205,1125,205,1126,1127,1128,1129,1130,205,1131,1127,1132,1133,1130,205,1134,1127,1135,1136,1137,1130,205,1138,1127,1139,1140,1130,205,1141,1127,1142,1130,205,1143,205,1144,205,1145,205,1125,205,1146,205,1147,205,1148,1127,1149,1150,1151,1130,205,1152,1127,1153,1154,1155,1130,205,1156,1127,1157,1158,1159,1130,205,1160,1127,1161,1130,205,1162,1127,1163,1164,1165,1166,1167,1168,1169,1170,1171,1168,1172,1173,1130,205,1174,1175,1176,1177,205,1178,205,1179,205,1180,205,1181,1127,1164,1165,1182,1168,1169,1183,1168,1172,1173,1130,205,1184,1127,1185,1130,205,1186,1127,1187,1130,205,1188,205,1189,1127,1190,1130,205,1191,205,1192,205,1193,205,1194,205,1195,205,1196,1197,1198,1199,1200,1201,1202,1203,1201,1204,1205,1088,205,1206,205,1196,1207,1208,1209,1088,205,1210,205,1211,205,1196,1212,1213,205,1198,1199,1214,1201,1202,1215,1201,1204,1205,205,1216,1217,1088,205,1218,205,1219,1220,1221,1222,1223,205,1224,205,1225,205,1226,1220,1227,1228,1229,1230,1231,1232,205,1233,205,1234,205,1235,1236,1237,1238,205,1239,205,1240,205,1241,205,1242,1243,1244,1245,1246,205,1247,205,1248,205,1249,205,1250,205,1251,1252,1253,1254,1255,205,1256,205,1257,1258,1259,1260,1261,205,1262,205,1263,205,1264,1265,1266,1267,1268,1269,1270,1271],"contains_end_of_file","# Staged Deployment Workflow","Last Updated: 2026-04-09","Issue: `#101` OPS-09 staged deployment with blue/green and canary release policy","ADR: `ADR-0028`","> **⚠️ Reference-only — parked by the 2026-06-13 archive pivot.** This blue/green + canary workflow implements **ADR-0028**, whose multi-instance / hosted-deployment premise is de-scoped. Taskdeck's personal run path is the self-contained exe plus the `release-desktop.yml` release smoke — **not** this staged cloud workflow. Retained as a historical record, not a mandatory process. See `docs/STATUS.md`.","This document **was** the canonical reference for Taskdeck's staging-to-production deployment workflow on the de-scoped hosted / multi-instance track. _(Historical: it is no longer a mandatory process.)_ With the 2026-06-13 archive pivot, the personal run path is the self-contained exe plus the `release-desktop.yml` release smoke — this staged staging-to-production workflow no longer governs releases.","## Overview","Taskdeck uses a **blue/green deployment model with canary verification gates**. Two identical environments (blue and green) exist behind a traffic router. New releases are deployed to the idle environment, verified through automated and manual gates, then promoted by switching traffic. The previous environment remains available for instant rollback.","```","┌─────────────┐ ┌──────────────┐ ┌───────────────┐ ┌─────────────┐","│ CI Build │────>│ Staging │────>│ Canary │────>│ Production │","│ & Test │ │ Deployment │ │ Verification │ │ Promotion │","└─────────────┘ └──────────────┘ └───────────────┘ └─────────────┘"," │ │ │ │"," ci-release.yml Deploy to idle 10% traffic for Switch 100%"," SBOM/provenance environment 15 min window traffic","## Prerequisites","- Docker Engine with `docker compose` support on the target host","- SSH access to the target host (key-based, no password auth)","- AWS CLI configured with permissions for SSM parameter access (if using Terraform topology)","- `scripts/deploy/smoke-test.sh` available on the deployment host","- Release owner identified and available for the duration of the deployment","## Environments","| Environment | Purpose | Traffic | Lifecycle |","|---|---|---|---|","| **Staging** | Pre-production validation | Internal only | Receives every release candidate |","| **Blue** | Production slot A | 0% or 100% | Alternates between live and idle |","| **Green** | Production slot B | 0% or 100% | Alternates between live and idle |","The staging environment is a separate instance (Terraform environment `staging`) used for integration testing before any production slot receives the release.","## Phase 1: Build and Artifact Preparation","**Owner**: CI automation (triggered by tag push or release event)","1. Tag the release commit: `git tag v..`","2. Push the tag: `git push origin v..`","3. CI triggers automatically:"," - `ci-release.yml` runs release build verification"," - `reusable-sbom-provenance.yml` generates SBOM and provenance attestation"," - `reusable-container-images.yml` builds and exports container image artifacts","4. Verify all CI jobs pass before proceeding.","**Artifacts produced**:","- `taskdeck-api:` container image","- `taskdeck-web:` container image","- SBOM (CycloneDX JSON)","- Provenance attestation (SHA256 checksums)","**Gate**: All CI jobs must be green. Any failure blocks proceeding to Phase 2.","## Phase 2: Staging Deployment","**Owner**: Release owner","1. Identify the staging host from Terraform outputs:"," ```bash"," cd deploy/terraform/aws/environments/staging"," terraform output ssh_command"," ```","2. SSH to the staging host and pull the new images:"," docker pull /taskdeck-api:"," docker pull /taskdeck-web:","3. Update the compose configuration to use the new image tags:"," # On staging host at /opt/taskdeck"," sed -i \"s|image: .*taskdeck-api:.*|image: /taskdeck-api:|\" docker-compose.yml"," sed -i \"s|image: .*taskdeck-web:.*|image: /taskdeck-web:|\" docker-compose.yml","4. Deploy to staging:"," cd /opt/taskdeck"," docker compose --env-file .env up -d","5. Run the staging smoke test:"," bash scripts/deploy/smoke-test.sh http://localhost:","6. Perform manual exploratory testing against the staging URL (see `docs/ops/RELEASE_CHECKLIST.md` for the full checklist).","**Gate**: All smoke tests pass AND manual validation confirms no regressions. Any failure blocks proceeding to Phase 3.","## Phase 3: Production Canary Deployment","### Single-Node Topology (nginx upstream switching)","The single-node topology runs blue and green as separate Docker Compose projects on the same host, with nginx upstream groups controlling traffic distribution.","1. Identify the currently live slot:"," # On production host"," cat /opt/taskdeck/active-slot"," # Returns \"blue\" or \"green\"","2. Determine the idle slot:"," ACTIVE=$(cat /opt/taskdeck/active-slot)"," IDLE=$([[ \"$ACTIVE\" == \"blue\" ]] && echo \"green\" || echo \"blue\")"," echo \"Deploying to idle slot: $IDLE\"","3. Deploy the new release to the idle slot:"," cd /opt/taskdeck/$IDLE"," docker compose --env-file ../.env pull"," docker compose --env-file ../.env up -d","4. Verify the idle slot is healthy:"," bash scripts/deploy/smoke-test.sh http://localhost:","5. Enable canary traffic (10% to new slot):"," # Update nginx upstream weights"," cat > /opt/taskdeck/nginx/upstream.conf < /opt/taskdeck/active-slot","3. Run the full smoke test against the production URL:"," bash scripts/deploy/smoke-test.sh https://","4. Keep the previous slot running for at least 1 hour as a rollback target.","5. Record the deployment in the release log:"," echo \"$(date -u +%Y-%m-%dT%H:%M:%SZ) v deployed to $IDLE by \" >> /opt/taskdeck/release-log.txt","**Gate**: Full smoke test passes against production. If it fails, execute immediate rollback.","## Rollback Procedure","Rollback can be triggered at any phase. The procedure depends on which phase the deployment has reached.","### Rollback from Canary (Phase 3)","Remove the canary traffic split and restore 100% to the active slot:","```bash","ACTIVE=$(cat /opt/taskdeck/active-slot)","cat > /opt/taskdeck/nginx/upstream.conf < /opt/taskdeck/active-slot","echo \"$(date -u +%Y-%m-%dT%H:%M:%SZ) ROLLBACK from $CURRENT to $PREVIOUS by \" >> /opt/taskdeck/release-log.txt","### Rollback Time Targets","| Phase | Target Rollback Time | Method |","|---|---|---|","| Canary (Phase 3) | < 30 seconds | Remove canary upstream weight |","| Production (Phase 4) | < 30 seconds | Switch upstream to previous slot |","| Staging (Phase 2) | N/A | Staging is non-user-facing; redeploy previous version |","## Rollback Criteria","Any of the following triggers an immediate rollback:","| Criterion | Threshold | Detection |","| Health check failure | 3 consecutive non-200 responses from `/health/ready` | Automated polling (30s interval) |","| Error rate | > 5% of requests return 5xx | Application logs or metrics |","| Response latency | P95 > 2x baseline from live environment | Smoke test comparison |","| Smoke test failure | Any assertion fails | `scripts/deploy/smoke-test.sh` |","| Manual abort | Release owner or on-call decision | Human judgment |","| Database migration failure | Migration throws or leaves schema inconsistent | Startup logs |","## Database Migration Safety","Taskdeck uses EF Core auto-migration on API startup. When blue and green slots share the same SQLite database volume, migrations must be **forward-compatible**:","- **Additive-only migrations**: Add new columns with defaults, add new tables. Never remove or rename columns that the current live version depends on.","- **Two-phase migration pattern**: If a breaking schema change is required, split it across two releases: (1) add the new schema alongside the old, (2) remove the old schema after the previous version is fully retired.","- **Migration order**: The idle slot starts first and applies any pending migrations. If the migration fails, the idle slot will not become healthy and the deployment is blocked at Phase 3 step 4 (health check).","- **Shared database risk**: During the canary window, both slots read/write the same database. If the new migration alters behavior for existing data, ensure the active slot can still function with the migrated schema.","If blue and green are deployed on separate hosts with separate databases (e.g., in a hypothetical multi-node topology; not planned — single-instance is permanent per the 2026-06-13 archive pivot), migration safety is simplified since each slot has its own schema lifecycle.","## Emergency Hotfix Override","For critical production incidents where the standard workflow would take too long:","1. The release owner or on-call responder can skip the canary phase.","2. Deploy directly to the idle slot and immediately switch traffic.","3. Document the override reason in the release log.","4. Run the full smoke test immediately after traffic switch.","5. File a post-incident review within 24 hours.","Emergency overrides must still pass Phase 1 (CI build) and Phase 2 (staging smoke). Skipping CI entirely is never permitted.","## GitHub Actions Integration","The `cd-staging-gate.yml` workflow automates Phase 1 and Phase 2 gates:","> ⚠️ _(Parked by the 2026-06-13 archive pivot — staged cloud deployment de-scoped. After **#1228**, the workflow is manual-dispatch-only, so release publication cannot invoke its parked `production` environment gate. See `docs/ops/README.md`.)_","- Triggers only on manual dispatch with an explicit image tag","- Builds and verifies container images","- Runs the smoke test suite against a CI-hosted staging environment","- References the `production` GitHub environment before the Phase 3 checkpoint. This is **not currently a manual approval guarantee**: repository maintainers must first configure required-reviewer protection on that environment; an unprotected or newly created environment does not wait for approval.","- See `.github/workflows/cd-staging-gate.yml` for the workflow definition","## Ownership and Escalation","| Role | Responsibility |","|---|---|","| **Release owner** | Initiates deployment, monitors canary, approves promotion or triggers rollback |","| **On-call responder** | Fallback authority for rollback if release owner is unavailable |","| **Platform team** | Maintains deployment tooling, scripts, and Terraform modules |","Escalation path: Release owner (15 min) -> On-call responder (30 min) -> Platform team lead.","## References","- ADR-0028: Staged Deployment — Blue/Green with Canary Verification","- `docs/ops/RELEASE_CHECKLIST.md` — smoke verification checklist","- `docs/ops/DEPLOYMENT_CONTAINERS.md` — container baseline","- `docs/ops/DEPLOYMENT_TERRAFORM_BASELINE.md` — Terraform baseline","- `docs/ops/DISASTER_RECOVERY_RUNBOOK.md` — disaster recovery procedures","- `docs/ops/INCIDENT_REHEARSAL_CADENCE.md` — incident rehearsal schedule","- `.github/workflows/cd-staging-gate.yml` — staging gate workflow","- `scripts/deploy/smoke-test.sh` — portable smoke test script","docs/STATUS.md",[1274],{"_1074":1075,"_1076":1275,"_435":1276,"_1079":59},1458,[1277,205,1278,205,1279,1280,205,1281,1282,205,1283,205,1284,1285,205,1286,1287,205,1288,1289,1290,205,1291,1292,1293,1294,1295,1296,1297,1298,1299,1300,1301,205,1302,1303,1304,1305,1306,1307,1308,1309,205,1310,205,1311,1312,1313,1314,1315,1316,205,1317,1318,1319,1320,1321,1322,1323,205,1324,1325,1326,1327,1328,1329,1330,1331,1332,205,1333,1334,1335,1336,1337,1338,1339,1340,1341,1342,1343,1344,1345,205,1346,1347,1348,1349,1350,1351,1352,1353,1354,1355,1356,1357,1358,205,1359,1360,1361,1362,1363,1364,205,1365,1366,1367,205,1368,1369,1370,1371,1372,1373,1374,1375,1376,1377,1378,205,1379,205,1380,1381,1382,1383,1384,205,1385,1386,1387,1388,205,1389,1390,1391,1392,1393,1394,205,1395,1396,1397,1398,1399,1400,1401,1402,1403,1404,1405,1406,1407,1408,1409,205,1410,205,1411,1412,205,1413,1414,1415,1416,205,1417,1418,1419,1420,1421,1422,1423,1424,1425,205,1426,1427,1428,1429,1430,1431,1432,205,1433,1434,1435,1436,1437,1438,205,1439,1440,1441,1442,1443,1444,1445,1446,1447,1448,1449,1450,1451,1452,1453,1454,205,1455,1456,1457,1458,1459,1460,1461,1462,205,1463,1464,1465,1466,1467,1468,1469,1470,1471,1472,1473,1474,1475,1476,1477,1478,1479,1480,1481,1482,1483,1484,1485,1486,1487,1488,1489,1490,1491,1492,1493,1494,1495,1496,1497,1498,1499,1500,1501,1502,1503,1504,1505,1506,1507,1508,1509,1510,1511,1512,1513,1514,1515,1516,1517,1518,1519,1520,1521,1522,1523,1524,1525,1526,1527,1528,1529,1530,1531,1532,1533,1534,1535,1536,1537,1538,1539,1540,205,1541,1542,1543,1544,1545,1546,1547,1548,1549,205,1550,1551,1552,1553,1554,1555,1556,1557,1558,205,1559,205,1560,1561,1562,1563,1564,1565,1566,205,1567,1568,1569,1570,1571,1572,1573,205,1574,1575,1576,205,1577,1578,1579,1580,1581,1582,1583,1584,1585,1586,1587,1588,1589,205,1590,1591,1592,1593,1594,1595,1596,1597,1598,1599,1600,1601,1602,1603,1604,1605,1606,1607,1608,1609,1610,1611,1612,1613,1614,205,1615,1616,1617,1618,1619,205,1620,1621,1622,1623,1624,1625,1626,1627,1628,1629,1630,205,1631,1632,1633,205,1634,1635,1636,1637,205,1638,205,1639,205,1640,1641,1642,1643,1644,1645,1646,1647,1648,1649,1650,1651,1652,1653,1654,1655,1656,1657,1658,1659,1660,1661,1662,1663,1664,1665,1666,1667,1668,1669,1670,1671,1672,1673,1674,1675,1676,1677,1678,1679,1680,1681,1682,205,1683,205,1684,1685,1686,1687,1688,1689,1690,1691,1692,1693,1694,1695,1696,1697,1698,1699,1700,1701,1702,1703,1704,1705,1706,1707,1708,1709,1710,1711,1712,1713,1714,1715,1716,1717,1718,1719,1720,1721,1722,1723,1724,1725,1726,1727,1728,1729,1730,1731,1732,1733,1734,1735,1736,1737,1738,1739,1740,1741,1742,1743,1744,1745,1746,1747,1748,1749,1750,1751,1752,1753,1754,1755,1756,1757,1758,1759,1760,1761,1762,1763,1764,1765,1766,1767,1768,1769,1770,1771,205,1772,205,1773,205,1774,1775,1776,1777,205,1778,1779,1780,1781,1782,205,1783,1784,205,1785,1786,1787,205,1788,205,1789,205,1790,205,1791,1792,1793,1794,1795,205,1796,1797,1798,205,1799,1800,1801,205,1802,205,1803,1804,1805,1806,1807,1808,1809,1810,205,1811,205,1812,205,1813,205,1814,205,1815,1816,1817,1818,205,1819,1820,1821,1822,1823,1824,1825,1826,1827,1828,1829,1830,1831,1832,1833,1834,1835,1836,1837,1838,1839,1840,1841,1842,1843,1844,1845,1846,205,1847,1848,1849,205,1850,205,1851,205,1852,205,1853,1854,1855,1856,1857,1858,1859,1860,205,1861,1862,1863,205,1864,205,1865,1866,1867,1868,1869,205,1870,1871,1872,1873,1874,205,1875,1876,1877,205,1878,205,1879,205,1880,1881,1882,205,1883,1884,1885,1886,1887,205,1888,1889,1890,1891,1892,1893,205,1894,205,1895,205,1896,1897,1898,1899,1900,205,1901,1902,1903,1904,205,1905,1906,1907,1908,1909,1910,205,1911,205,1912,205,1913,1914,205,1880,1915,1916,1917,1918,1919,1920,1921,205,1922,1923,205,1924,205,1925,205,1875,1926,205,1927,1928,1929,1930,205,1931,1932,1933,1934,1935,205,1936,205,1937,1938,1939,205,1940,1941,1942,205,1943,1944,1945,1946,205,1947,1948,1949,205,1950,205,1951,1952,1953,1954,205,1955,1956,1957,1958,1959,205,1960,1961,1962,1963,1964,1965,205,1966,1967,1968,1969,1970,1971,205,1972,1973,1974,1975,1976,1977,1978,205,1979,205,1980,1981,1982,1983,1984,205,1985,1986,1987,1988,205,1989,1990,1991,1992,1993,205,1994,1995,1996,1997,1998,205,1999,2000,2001,2002,205,2003,2004,2005,2006,2007,205,2008,2009,2010,2011,2012,2013,205,2014,2015,2016,2017,2018,205,2019,2020,2021,2022,2023,205,2024,2025,2026,2027,2028,205,2029,2030,2031,2032,205,2033,2034,2035,2036,2037,205,2038,2039,2040,2041,2042,2043,2044,2045,205,2046,2047,2048,2049,205,2050,205,2051,205,2052,2053,205,2054,205,2055,2056,2057,2058,2059,2060,2061,2062,205,2063,205,2064,2065,2066,2067,2068,2069,2070,2071,2072,2073,2074,2075,2076,2077,2078,205,2079,205,2080,2081,2082,2083,2084,205,2085,2086,2087,2088,2089,2090,2091,205,2092,2093,2094,2095,2096,2097,2098,2099,2100,2101,2102,2103,2104,2105,2106,2107,2108,2109,2110,2111,2112,2113,2114,2115,2116,2117,2118,2119,2120,2121,2122,2123,2124,2125,2126,2127,2128,2129,2130,2131,2132,2133,2134,2135,2136,2137,2138,2139,2140,2141,2142,2143,2144,2145,2146,2147,2148,2149,2150,2151,2152,2153,2154,2155,205,2156,2157,2158,2159,205,2160,2161,2162,2163,205,2164,205,2165,205,2166,2167,2168,2169,205,2170,205,2171,2172,2173,2174,205,2175,205,2176,205,2177,205,2178,205,2179,2180,2181,2182,2183,2184,205,2185,205,2186,205,2187,2188,205,2189,205,2190,2191,2192,205,2193,205,2194,2195,2196,205,2160,205,2197,205,2198,205,2199,205,2200,205,2189,205,2201,2202,2203,2204,2205,2206,2207,205,2208,205,2209,2210,2211,2212,205,2160,205,2213,205,2214,2215,2216,2217,2218,2219,2220,2221,2222,2223,2224,2225,205,2226,205,2227,205,2228,205,2189,205,2229,2230,2231,205,2193,205,2232,2233,2234,205,2160,205,2235,205,2236,205,2237,205,2238,205,2239,205,2240,2241,205,2242,2243,2244,2245,2246,2247,2248,2249,205,2250,205,2251,2252,2253,2254,2255,205,2242,2256,2257,2258,205,2259,205,2240,2260,205,2242,2261,2262,2263,2264,2265,2266,2267,2268,2269,2270,2271,205,2272,205,2240,2273,205,2242,2274,2275,205,2276,205,2277,2278,205,2279,205,2280,205,2281,2282,2283,2284,2285,2286,2287,2288,205,2289,205,2290,2291,2292,2293,2294,2295,2296,2297,2298,205,2299,205,2300,2301,2302,205,2303,205,2304,205,2305,2306,205,2307,205,2308,2309,205,2310,205,2311,205,2312,205,2313,2314,2315,2316,2317,205,2318,205,2319,2320,2321,2322,205,2323,205,2324,2325,2326,205,2327,205,2328,2329,2330,205,2331,2332,205,2333,205,2334,2335,2336,2337,2338,205,2339,2340,2341,2342,2343,2344,2345,2346,2347,2348,205,2349,2350,2351,2352,2353,2354,2355,2356,2357,2358,2359,2360,2361,2362,2363,2364,2365,2366,2367,2368,2369,205,2370,2371,2372,2373,2374,2375,205,2376,205,2377,2378,2379,2380,2381,2382,2383,2384,2385,2386,2387,2388,2389,2390,2391,2392,2393,2394,2395,2396,2397,2398,2399,2400,2401,2402,2403,2404,2405,2406,2407,2408,2409,2410,2411,2412,2413,2414,2415,2416,2417,2418,2419,2420,2421,2422,2423,2424,2425,2426,2427,2428,2429,2430,2431,2432,2433,2434,2435,2436,2437,2438,2439,2440,2441,2442,2443,2444,2445,2446,2447,2448,2449,2450,2451,2452,2453,2454,2455,2456,2457,2458,2459,2460,2461,2462,2463,2464,2465,2466,2467,2468,2469,2470,2471,2472,2473,2474,2475,2476,2477,2478,2479,205,2480,205,2481,1405,1406,1407,1408,205,2482,2483,2484,2485,205,2486,2487,205,2488,2489],"# Taskdeck Status (Source of Truth)","Last Updated: 2026-07-27","Required Docs Governance hardening (2026-07-26, `#1492`):","- **Required CI now enforces failure-ledger projection synchronization.** The reusable Docs Governance job pins Python 3.12 and runs the existing `failure_ledger.jsonl` ↔ `FAILURE_LEDGER.md` synchronization unittest before its governance checks, so a stale checked-in projection fails without any renderer masking it. Local agentic update workflows intentionally render first and then test so a valid hook-appended JSONL entry can be projected; the smoke contract keeps that distinction from drifting.","Windows agent-utility launcher hardening (2026-07-26, `#1487`):","- **Configured Python-backed agent handlers no longer depend on the unusable Microsoft Store `python` aliases on native Windows.** Configured PowerShell handlers and PowerShell-scoped utility allow-rules use the verified `py -3 -B` launcher; POSIX Bash allow-rules and guidance retain `python3 -B`; and the smoke harness runs child hook scripts through its active `sys.executable -B`. The permission contract asserts five direct utilities plus the renderer synchronization unittest on each platform's actual tool surface. PreToolUse maps a missing launcher or failed policy process to fail-closed exit 2. The native-Windows smoke feeds `Bash` payloads through PowerShell-hosted handlers; it does not prove native PowerShell-tool interception, which remains the T4 gap tracked by [#1497](https://github.com/Chris0Jeky/Taskdeck/issues/1497). No Python installation, global PATH change, or product-runtime packaging is introduced.","Paper-default regression alignment (2026-07-14, `#1274`): authenticated E2E sessions now follow the production Paper default unless a frozen Legacy-selector suite opts out explicitly. The refreshed core lane proves the real capture → Accept → Review → approve/apply → board path and runs the full axe WCAG 2.1 A/AA ruleset against settled Paper Home, Today, Inbox, Review, and a seeded Board, plus Login and functional skip-link keyboard coverage. The global Vitest Legacy pin remains intentional because those component tests assert the frozen Legacy DOM directly. Focused Chromium verification is 37/37 across `accessibility`, `onboarding`, `capture-loop`, `review-proposals`, `first-run`, and `smoke`.","Direction change (2026-07-10, maintainer-decided, **ADR-0044**): **the 2026-06-13 archive pivot is superseded — Taskdeck is being revived** and shipped as a **free open beta** (adoption/feedback/exposure first; the commercial side is developed in parallel by the maintainer). Positioning: the local-first, review-first **action-item engine** — transcripts/notes in, evidence-linked proposals out, applied to a board only on human approval — with the write-gated MCP server as the developer-facing second act. Everything shipped under MIT stays MIT (no retroactive relicensing). The active planning spine is **`docs/REVIVAL_PLAN.md`** (Phase 1 \"truth + safety before strangers\" repurposes the #1278 archive exit criteria as the v0.1 ship gate; Phase 2 is the LLM transcript-triage engine — the largest authorized new-backend-surface slice; Phase 3 is the beta launch; other scoped exceptions include registration gating, feedback/telemetry, and MCP key/identity hardening as enumerated in §7; then a ~8-week traction checkpoint with the archive plan as the documented fallback). New backend surface is authorized only by REVIVAL_PLAN §7 — the Phase-2 transcript-engine grants (ADR-0044) plus the Phase-4 generalist-expansion grants (**ADR-0046, Accepted 2026-07-13**: artefact intake, dossier read model, mode-scoped navigation; tracker `#1327`; the twin generalist app is explicitly deferred behind the GEN-12 `#1326` evidence gate). Evidence base: `docs/analysis/2026-07-10_revival_assessment.md` (7 code-review dimensions, ~25 adversarially verified claims, live-verified market data). Archive-closeout issues #1269–#1278 are re-scoped in place (same work, new purpose); dogfooding (#1271) remains the acceptance test for either path. **Dogfooding is now instrumented (2026-07-25):** `docs/dogfooding/README.md` holds the protocol — a dedicated `TASKDECK_DOGFOOD_DB` so dev/demo/E2E traffic cannot contaminate the signal, `scripts/dogfooding/dogfood-snapshot.py` (read-only; counts and dates only) for objective metrics, `docs/dogfooding/LOG.md` for friction, and a checkpoint rubric fixed before any real usage data existed. Read it before collecting checkpoint evidence, or the evidence will not be comparable. The measured pre-dogfooding baseline is recorded in `LOG.md`: **8 active days, none in the last 28, last activity 2026-04-23, 10 of 13 boards demo/test residue** — sustained use has not started, though the loop itself works (**17 of 20 proposals reached Apply**, counted by `AppliedAt`; a status-based count reads 1/20 because `Dismiss()` overwrites an `Applied` status).","","Security runway slice (2026-07-26, `#1345`):","- **The inherited HIGH SQLite native advisory is remediated without bypassing Central Package Management.** `Taskdeck.Infrastructure` now directly references the centrally pinned `SQLitePCLRaw.bundle_e_sqlite3` 2.1.12, so bundle, core, provider, and native library resolve as one 2.1.12 family instead of mixing a new native leaf with 2.1.6 managed components. The loaded SQLite runtime is 3.53.3, above the advisory's 3.50.2 security floor; a host-native integration test opens an in-memory database and enforces that floor. The solution vulnerability audit is clean, a fresh database update reports no pending model changes, and a self-contained `win-x64` published API booted against SQLite and returned `/health/ready` HTTP 200.","Project-automation runway slice (2026-07-26, `#1458`):","- **The ProjectV2 priority helper now establishes completeness instead of trusting a capped sample.** It follows cursor pages to a stable item-count/project-stamp snapshot, uses ordinal identity for GitHub node IDs and cursors, rejects truncated nested connections, treats a positive `-Limit` as a fail-closed ceiling, and derives PR priority from complete repository-aware closing links/body references. Before `-Apply`, it validates all option mappings and rebuilds the complete source-derived plan; any drift aborts before the first write, and a complete post-apply audit remains mandatory. Its authentication-free self-test covers the >1,000-item and failure boundaries.","- **The live project-priority cleanup is complete.** On 2026-07-27, the 130 previously unlabeled Taskdeck Issues were classified and verified 130/130 with exactly one Priority label (`I=5`, `II=9`, `III=2`, `IV=18`, `V=96`). External Issue references are visible non-authority: their labels never rank, external-only PRs derive `Priority V`, and an external closing Issue still permits same-repository body fallback. After the closing link reduced the plan to 141 real field drifts, the reviewed Apply succeeded 141/141; its built-in audit, two fresh pre-merge audits, and the final post-merge handoff audit each proved 1,472/1,472 items, 12 ignored external references, and zero remaining drift. PR #1488 merged as `84674979`, and issue #1458 plus both project items are `Done / Priority I`.","PR-queue clearing wave (2026-07-25, **8 PRs merged**, and the open-PR queue is down to one human-gated draft):","- **`#1469` (`#1462`) — the frontend `Proposal` type exposes `approvedRevisionId`,** declared **required** rather than optional because `MapToDto` always assigns it and the API serializes with default options, so an unpinned proposal arrives as an explicit `null` and never an absent key — which also turns a field-by-field rebuild that drops the pin into a compile error. Contract exposure only; no UI claim, per `#1298`. Held against a dead-code sweep by an exported type alias, because `tsconfig.app.json` excludes `src/tests/**` from typecheck (`#1468`, measured at **415** pre-existing errors when the exclusion is lifted).","- **`#1337` (`#1299`) — the permanent licensing posture is published.** `LICENSING.md` states the MIT-forever commitment for everything already shipped, the never-gated free boundary, and an additive-only posture for any future commercial module; `ee/` is reserved with a separately-licensed placeholder; DCO sign-offs are required in contributor guidance behind a SHA-pinned advisory CI job; MIT is declared in npm and all 11 `.csproj` files. The root `LICENSE` is deliberately unchanged. Name/trademark availability was researched and recorded on `#1299` (**no registered TASKDECK mark found in any register that could be queried** — USPTO, TMview and WIPO, each null result control-validated against a known-hit term; UKIPO's own register hard-blocked automated access, so GB coverage is indirect via TMview, which EUIPO states is not an official register. The real risk is **registrability**, not collision). Pre-commercial legal residuals — attorney registrability/TASKADE opinion, the UKIPO/EUIPO coverage gaps, perishable namespace reservations, and the keep-or-rename decision before `v0.1.0` — are tracked as **`#1482`**.","- **`#1477` + `#1481` (`#1123`) — the release pipeline is rehearsable without pushing a tag.** `create-release` had no condition and a bare `workflow_dispatch` resolved the version to the literal `refs/heads/main`, whose slashes broke packaging — so the pipeline could not be exercised at all before the one irreversible action `#1303` reserves to the maintainer. A blank-tag dispatch from a **branch** is now an explicit rehearsal (`v0.0.0-dryrun+`, builds, smoke-tests, uploads artifacts, publishes nothing); a tag push, a dispatch naming a tag, **or a dispatch whose ref is itself a tag** publishes. Rehearsed for real: all four platforms green, `create-release` skipped, **0 tags and 0 releases created**. Note the smoke test covers the **three runner-native RIDs** only — `osx-x64` is cross-arch on the arm64 macOS runner and ships with less release evidence than the other three.","- **`#1478` (`#1271`) — dogfooding is instrumented.** A dedicated `TASKDECK_DOGFOOD_DB` so dev/demo/E2E traffic cannot contaminate the signal, a read-only snapshot script (counts and dates only; safe to paste into an issue), a friction log, and a checkpoint rubric fixed before any real usage data existed. **The measured pre-dogfooding baseline is the finding:** 8 active days, none in the last 28, last activity 2026-04-23, 10 of 13 boards demo/test residue — sustained use has not started. But the loop itself works: **17 of 20 proposals reached Apply**, counted by `AppliedAt`. A status-based count reads 1/20, because `Dismiss()` accepts an already-`Applied` proposal and overwrites `Status` — so filing away a finished item erases the evidence it applied. Seven adversarial review rounds; residual activity-source accuracy questions consolidated on **`#1480`**.","- **`#1471`, `#1472`, `#1479` — canonical-doc and human-action hygiene:** the `#1462` residual list reconciled across both canonical docs (and a wrong measurement of my own corrected, 383 → **415**); `#1457`'s `/hooks` trust gate and the recurring merged-worktree prune recorded as human-only items, which no file previously tracked; `#1273`/`#1235` checked off on explicit maintainer instruction (a recorded rule-3 exception).","- **`#1295` CLOSED as superseded, not merged.** The deny-floor overlay failed **13 of 13 of its own bypass tests** and targeted global floor v1.3.0 against an installed 1.6.5. A repo-local overlay is still needed — **11 rule-classes are `allow` at every tier including T4** — so the full salvage plan, with acceptance criteria and the branch's 16 review threads retained as the successor's regression corpus, is recorded on **`#1293`**.","- **Repository hardening:** `main` previously permitted **force-pushes and deletions**; both are now blocked (deliberately relaxed otherwise — no required checks, no required approvals). The old project-priority helper silently truncated at 1,000 items; a one-off 1,444-item snapshot repaired 288 mismatched fields (`#1474`), but that was not durable proof of a clean project. The complete, fail-closed contract and the remaining label/data gate are tracked by `#1458`.","- **Backlog triage (`#1270`):** 12 already-decided issues closed with dated pivot notes, after an adversarial pass **bounced 13 of 25 proposed closures** — including `#1123`, the v0.1 ship-gate item. `#1270` itself stays open: two of its own acceptance criteria are obsolete against ADR-0044 and REVIVAL_PLAN §6 and must not be executed as written.","- **Seeded this wave:** `#1470`, `#1473`, `#1474`, `#1475` (the repo hook denies 6 of 8 *benign* commands), `#1476` (the configured-handler `smoke_test.py` / deny-floor matrix remains ungated; failure-ledger renderer synchronization now runs in Required Docs Governance), `#1480`, `#1482`, plus upstream `agent-harness#56` (`docker exec` is not unwrapped by the global floor at any tier).","- **Still open — producer/runtime-gated:** `#1457` is ready-for-review but cannot be salvaged in place: all four shared commits lack DCO sign-off, its v1.6.5 dispatcher pin is obsolete, five current Codex threads are unresolved, and no reviewed producer floor is both canonical and deployed. Rebuild a signed replacement from final `main` only after the agent-harness producer/deployment gate converges; then require exact-head automation/reviews followed by a fresh interactive `/hooks` trust session and handler-attributed allow/deny canaries.","Overnight wave (2026-07-23/24, **6 PRs merged** + 3 dependabot PRs — the four feature/substrate PRs below plus `#1447`, the docs sync that recorded the maintainer-merged `#1414` (its content is the 2026-07-18 post-merge comment further down), and `#1448` below; per-PR gate: two independent adversarial review lenses, all-severity findings fixed with posted evidence, full backend suite on the exact head where code changed, required CI green, bot window honored with a content sweep). The wave's own delivery sweep was `#1454`; `#1448`, `#1427`, and dependabot `#1441` merged *after* that sweep ran, so their entries below were added on 2026-07-25:","- **`#1439` (`#1428`, `#1424`) — the approved revision is pinned at approve time and Apply executes exactly it.** Approve reads the latest saved revision, validates it through the approve-time gates, and persists its id as `AutomationProposal.ApprovedRevisionId` (null pin = approved the original operations; a post-approval raced revision can no longer change what Apply executes — closes the `#1428` race). The migration backfills Approved proposals to their latest revision saved **at or before `DecidedAt`** (an explicit, reviewed reversal of latest-revision parity: the invariant is \"Apply executes exactly what the approver saw\", so a raced post-decision revision is never backfilled; empirically-proven SQLite text-format comparison). Single-proposal read/decide paths return the EFFECTIVE operation set with `Presentation` rebuilt from it (`#1424`); Rejected proposals freeze to the latest revision saved at or before decision time; the MCP terminal stored preview is suppressed whenever an effective revision applies (one payload can no longer carry revision operations beside an original-operations `DiffPreview`). Full suite on head: 7430/0/1. **`#1444` closed this residual:** the review-queue **list** endpoint now returns the same EFFECTIVE operations and rebuilt `Presentation` the single reads do, so a queue card can no longer disagree with the detail view, the diff and Apply. The former \"list maps originals\" boundary existed only to avoid a per-proposal revision query; a two-phase batched read (payload-free metadata for the page, then payloads for the winning revisions only) removes that cost without loading revision payloads the reader will not use, and both read shapes now select through one shared dispatcher. **`#1462` closed the frontend half** (PR `#1469`, merged 2026-07-25): the `Proposal` type in `types/automation.ts` now exposes `approvedRevisionId` (contract only — no UI claim, per `#1298`), declared **required rather than optional** because `MapToDto` always assigns it and the API serializes with default options (bare `AddControllers()`, no `DefaultIgnoreCondition`), so an unpinned proposal arrives as an explicit `null` and never an absent key — which also turns a field-by-field rebuild that drops the pin into a compile error. It is held against a dead-code sweep by an exported type alias because `tsconfig.app.json` excludes `src/tests/**` from typecheck. Remaining tracked residuals: `#1453` (reject-time pin: the `RevisedAt <= DecidedAt` heuristic is not commit-visibility; display-only), `#1464` (the review surfaces' \"recorded operations show the original submission\" caveat is inverted now that list reads are effective-set-aware; terminal proposals only — now unblocked by `#1462`), `#1465` (dismissing a rejected proposal drops its decision-time frozen revision back to the originals), `#1467` (the list resolution is bounded in bytes but not in row count, and reads proposal state and revision rows from two snapshots; display-only), `#1468` (frontend specs are never type-checked — lifting `src/tests/**` from `tsconfig.app.json` and running `npm run typecheck` surfaces **415** pre-existing errors, all of them under `src/tests/`, against a clean baseline of 0), `#1470` (`docs/architecture/DATA_MODEL.md` omits `ApprovedRevisionId` and `DeferredUntil`, and the \"855 lines, 37 entities\" figure describing it is stale — the file is 897 lines, and the figure lives in three historical delivery-ledger entries rather than in the document itself; find them with `grep -rn \"855 lines, 37 entities\" docs/`).","- **`#1449` (`#1445`) — the nightly k6 Performance Regression Gate is recalibrated to same-code runner variance.** The gate had gone red 3 of 5 nights on an identical main SHA (board-write p95 observed 2.0–3.0 s either side of the old 2200 ms threshold; 2 of the 5 nights passed, and even a passing night cleared the gate by only ~10%). Tail gates moved to global p99 < 5000 ms / board-write p95 < 4500 ms (~1.5–1.7× worst observed-good; calibration evidence inline in the script comment), the 2000 ms measured-capacity warning retained, warning-band edges now pinned by tests (7/7), and every doc/contract mirror synced. The write tail itself (median ~12 ms, p90 1–2 s at 20 VUs — SQLite write convoy) is tracked as `#1446`, including the sub-order-of-magnitude masking window this calibration accepts. **Confirmed on the first post-recalibration night:** the 2026-07-24 06:06Z nightly (run `30071303816`, on `36d563d7`) passed the Performance Regression Gate, against 3 reds in the 5 nights before it. One passing night is not yet a trend — a fresh red is now real signal and should be read from the k6 numbers before any threshold is touched again.","- **`#1451` (`#1438`) — `AuditLogRepositoryIntegrationTests` moved onto the workerless factory** (`#1391` family): the live `AuditRetentionWorker` startup pass can no longer race the ordering test's backdated seeds in full-suite runs; 6× consecutive class runs green. Seeded `#1452`: no test anywhere exercises the retention worker's real `ExecuteAsync` startup path (pre-existing gap a flake had been masquerading as).","- **`#1427` (`#1313`) — the LLM quota-reservation lifecycle is hardened, and a client can no longer erase its own billed usage.** The security half (M1): the streaming and non-streaming `ChatService` surfaces plus the extractor now finalize with `CancellationToken.None` and settle in `finally`, so a client that aborts mid-stream after tokens are billed — including the read-one-token-and-disconnect variant — can no longer discard its own usage record (previously client-controllable). Alongside it: a TTL-swept reservation's real billed tokens are recovered into a committed row instead of being silently dropped (F1, idempotent, warns); `ReservationEstimatedTokens` is floored at 1 so a reservation can never be invisible to the token/global budget sums (F2); the capture-triage reservation settles in `finally` (F4); the release paths are pinned by tests (M2) — provider-throw, zero-token, no-LLM bootstrap, board-context-build throw, and a provider yielding only an error event all **release** the reservation, while cancel-after-billed-tokens is pinned to the **opposite** invariant (`StreamResponseAsync_CancelledAfterBilledTokens_ShouldCommitNotRelease`): once tokens are billed, cancellation must commit and must never release, because releasing there is precisely the bypass M1 closes; and reservation cleanup now wraps request/board-context construction, so a setup failure releases instead of leaking until TTL (Codex P2). **The check-then-insert atomicity guarantee is explicitly NOT closed here** — it was proven not closeable in-process (the reservation over-admits even under a global full-span lock, because of cold-start WAL `-shm` read-visibility), so the redesign it needs (eager `-shm` warm-up, or non-snapshot enforcement) is deferred to `#1435` and routed to the maintainer; the concurrency-guarantee tests are skipped pending that issue, which is why this hardening ships green. Merged on the maintainer's explicit merge-with-tracked ruling; residual review P2s tracked as `#1431`.","- **`#1448` — FRUGALITY MODE is now *in* the Fable overnight manual** (`docs/agentic/OVERNIGHT_LOOP.fable.md`) instead of being re-pasted into each launch prompt, per the enforcement-ladder rule that an amendment surviving two runs belongs in the manual. Its review round also produced a reusable structural lesson: Codex found sampling-exemption classes one at a time across three rounds, and a single allowlist inversion — only pure mechanical-motion packets are sampleable, while suite/CI verdicts and reviewer/settlement packets never are — closed the whole class at once.","- **Dependabot:** `#1443` (.NET 8.0.28 → 8.0.29 patch train + Test.Sdk 18.8.1) and `#1440` (npm minor-patch group incl. vue 3.5.40) merged green. `#1441` (actions group) was staged green and then **merged on explicit maintainer authorization** — workflow-file PRs remain maintainer-merge-only. `#1442` (pinia 3→4 MAJOR) was genuinely red and is **closed to snooze**; the migration slice it actually needs is tracked as `#1455` rather than rubber-stamped.","- **Review-bot estate note:** the consumer Gemini Code Assist GitHub integration is sunset (its farewell notice now posts on every PR) and Copilot review is quota-exhausted — Codex is currently the only live external review bot; the in-house two-lens adversarial pass carries correspondingly more weight.","","Frugal wave (2026-07-18, wave #2 — the follow-on to the approve == apply trust-class closure wave below; **2 PRs merged** — per-PR gate: independent adversarial review, all-severity findings fixed, required CI green):","- **`#1430` (split from `#1379`) — artefact extraction is now bounded by a permit/concurrency gate.** A new `ArtefactExtractionGate` (Application singleton) takes a non-blocking permit before the parse worker spawns and releases it on both the completed and abandoned paths (a runaway parse holds its permit for its full lifetime); saturation ⇒ a pre-parse `TooManyRequests` with no history row and no new thread. The bound is `ExtractionMaxConcurrency` (`int`, default 2, `[Range(1, 64)]`, startup-validated). This is the verified-sound permit half split out of the parked `#1417` extraction-resource-ceiling work; the decompression-bomb containment half is deliberately **not** here — PdfPig 0.1.15 decodes xref streams with a hard-coded provider before any injected ceiling exists, so a provider-injection ceiling is bypassed (proven on `#1417`) — and continues under `#1429`. Adds **ADR-0047** (artefact-extraction resource bounding: permit gate + provider-injection ceiling as ObjStm-covering defense-in-depth with the documented xref gap) and **ADR-0048** (decompression-bomb containment boundary: a memory-capped extraction worker process — Job Object on Windows / cgroup under Docker — reversing the earlier sidecar rejection on the new evidence).","- **`#1432` (`#1426`) — `ValidatePermissionsAsync` always gates board access, even for an empty operation list.** The engine previously short-circuited an empty operation list to `Result.Success()` with the board half of the access gate skipped (`boardId` forced to `null`), silently treating an operation-less proposal as permitted and forcing every new consumer to bolt on its own board-access fallback (the `#1415`/`#1425` trap). Now the full requester/board access gate always runs; only the per-operation contract validator is skipped when the list is empty. Emptiness itself is still **not** rejected here by design (a legitimate transient shape for revise-into-validity, `#1423`) — the \"at least one operation\" rejection stays with the structure gate, which runs before permissions in every approve/apply/diff/executor chain, so **approve == apply is unchanged** and the change is strictly additive restriction (a previously-`Success` empty-op result can only become a denial). Chosen over forbidding zero-op proposals at create, which would break the create-empty-then-revise flow `#1423` pins.","- **Nightly k6 confirmed GREEN:** the first nightly run after the `#1359` repair (run `29632619187` on `326b6b5b`) passed, and the `#1359` failure-ledger row was flipped to resolved (commit `4fdae133`).","- **Seeded this wave:** `#1429` (memory-capped extraction worker process — the ADR-0048 containment boundary), `#1431`, `#1433`, `#1434`, `#1435`, `#1436`. `#1427` (LLM quota-reservation robustness hardening, `#1313`) sat in the final review gate at the close of this wave and **has since shipped** — see the 2026-07-23/24 wave above; its atomicity redesign remains open as `#1435`.","- **Standing human-gated holds:** `#1337` (licensing pack — blocked on human-only trademark/name clearance) and `#1295` (deny-floor overlay). On 2026-07-25 the maintainer dispositioned `#1295` explicitly: **keep the evidence, return the PR to draft, retain the human gate, and do not revive it in place.** The branch is conflicting and hundreds of commits behind `main`, all 16 review threads remain unresolved (11 still current, including command-wrapper, root-delete, SQL/container, npm-executor, and Windows parsing bypasses), and its delegation model targets a global floor version the installed floor has long since moved past — so its old green checks establish nothing about current behavior. If `#1293` proceeds, the smallest Taskdeck-specific overlay is to be rebuilt from current `main` once the chosen agent-harness floor is itself reviewed and stable; conflict churn on the ancient branch is not the path.","Approve == apply trust-class closure wave (2026-07-18, **6 PRs merged** — per-PR gate: independent adversarial review, all-severity findings fixed, required CI green): closes the \"a user approves or previews something the executor will then refuse\" (preview == apply) trust-violation class on the server, across the diff, approve, and MCP surfaces (the `#1370`→`#1374`, `#1376`→`#1395`, `#1398` chain).","- **`#1413` (`#1398`) — the proposal diff now runs Apply's permission/existence gates.** `GetProposalDiffAsync` (both the revised-payload and original-operations paths, before the cached-`DiffPreview` fast-path return) now calls the same `ValidatePermissionsAsync` Apply calls: requester-exists → `404`, board-exists → `404`, board-access → `403`, then the operation-contract validator. Closes the third and last asymmetry from the `#1395` parity round — a reviewer whose board access was revoked (or whose board/requester was deleted) mid-review previewed a clean `200` then failed at Apply. Status-agnostic on purpose: terminal proposals no longer disclose stored board-derived content on preview — access errors (`403`/`404`) surface once the earlier structure/expiry gates pass (a preview denial, stricter than Apply's idempotent short-circuit); an expired, access-revoked proposal still reports expiry first (pinned by `GetProposalDiffAsync_ShouldReportExpiry_NotForbidden_WhenExpiredAndAccessRevoked`).","- **`#1423` (`#1416`) — Approve runs Apply's structure + permission/contract gates before committing the transition.** `ApproveProposalAsync` validates the effective (revision-aware) operation set: structure → `400`, expiry → `409` (the existing domain-transition contract, deliberately not the diff path's `400` shape), permissions/contract → `400`/`403`/`404`. A zero-op or access-revoked proposal that used to approve `200` and only fail at Apply now fails at approve. Gate ordering (structure → expiry → permissions) mirrors diff/apply; only `PendingReview` runs the gates. Seeded `#1424` (approve/get DTO returns original ops even when a revision exists).","- **`#1425` (`#1415`) — the MCP `proposal_detail` preview is gated through the diff path.** It no longer emits the raw stored `DiffPreview`: open proposals route through the fully-gated `GetProposalDiffAsync`; decided/terminal proposals serve the stored preview but re-check requester/board access via a new `GetTerminalProposalStoredPreviewAsync` seam, so a reviewer who lost board access is denied the stored preview instead of reading stale board contents through it. The payload gains a `diffPreviewSource` provenance marker (`\"live\"` vs `\"stored\"`).","- **`#1421` (`#1403`) — SQLite timestamp bounds are parameterized so zero-fraction boundary rows compare correctly.** EF trims trailing fraction zeros (a whole-second instant stores as `...00:00:00+00:00`, no `.`), so the old fixed-width `.fffffff` bound strings mis-sorted at the exact boundary tick. `AuditLogRepository` (`CountByDateAsync`/`DeleteOldEntriesAsync`/`BuildSqliteQueryAsync`) and `OAuthAuthCodeRepository` (`DeleteExpiredAsync`/`TryConsumeAtomicAsync`) now pass `DateTimeOffset` predicates, UTC-normalized (`.ToUniversalTime()`) so the offset-preserving mapping can't mis-compare non-UTC bounds. Seeded `#1422` (repo-wide sweep of remaining timestamp seams).","- **`#1420` (`#1409`) — removed the dead `ApiKeyService.ValidateKeyAsync` usage-recording path** and its `ApiKey.RecordUsage()` domain helper (zero production callers; a dual-writer trap — MCP auth records usage via `ApiKeyMiddleware`'s `ExecuteUpdateAsync`). `LastUsedAt` is untouched.","- **`#1419` (`#1418`) — test isolation:** `WorkspaceApiTests` moved onto `HostedWorkerDisabledTestWebApplicationFactory` so the live capture-lane worker can't claim a seeded `Processing` row mid-test (the `#1335` boundary). Test-only.","Overnight correctness + test-reliability wave #2 (2026-07-17, **7 PRs merged** — per-PR gate: independent adversarial review, all-severity findings fixed, required CI green; the late-evening/overnight follow-on to the 11-PR sweep below):","- **`#1394` (`#1335`) — hosted-worker test-isolation factory.** A new `HostedWorkerDisabledTestWebApplicationFactory` strips app-assembly hosted services from the test host via a shared predicate (also asserted by a dedicated guard test); adopted by `LlmQueueRepositoryIntegrationTests`, `OutboundWebhookDeliveryRepositoryTests`, `AutomationProposalRepositoryIntegrationTests`, and a new `ProcessNextClaimRaceTests` (split out from `QueueClaimRaceTests`, whose CaptureTriage cases need live workers). Kills the hosted-worker pre-emption flake family in full-suite runs.","- **`#1391` (`#1383`) — AuditRetention integration determinism.** `AuditRetentionRepositoryIntegrationTests` adopts the workerless factory and is hardened (`BackdateEntryAsync` asserts affected==1, InvariantCulture, `ReloadAsync` read-back) — root cause was the live `AuditRetentionWorker` startup pass (90-day cutoff) racing 100/200-day backdated seeds. Empirically pinned the EF SQLite `DateTimeOffset` storage format: `yyyy-MM-dd HH:mm:ss.FFFFFFFzzz` (trailing zeros trimmed).","- **`#1392` (`#1332`) — deterministic Redis dispose-vs-connect seam.** `RedisCacheServiceTests` now reaches the connect seam through a dedicated named background `Thread` instead of `Task.Run` (eliminates the thread-pool-saturation flake) and disposes its `ManualResetEventSlim`s. Test-only.","- **`#1395` (`#1376`) — proposal diff now runs apply's structure and expiry gates on every path.** `AutomationProposalService.GetProposalDiffAsync` runs the same gates apply runs (structure, then expiry) on all diff paths including the cached-`DiffPreview` fast path — expired → `400` \"Proposal has expired\", zero-op → `400` \"Proposal must contain at least one operation\" (was `200`/`404`). Extends the `#1374` preview==apply parity contract for the structure/expiry/cached-preview paths; full parity still excludes apply's `ValidatePermissionsAsync` access/existence gates (tracked below). Seeded `#1397` (frontend expired/zero-op preview UX + coverage) and `#1398` (fold `ValidatePermissionsAsync` access/existence gates into diff — the third asymmetry).","- **`#1396` (`#1387`) — buffered account-export extraction-history N+1 removed.** A new `IArtefactExtractionRepository.GetByArtefactsForUserAsync` batch method (user-scoped IN query, 900-id cap, SQLite TEXT-ordering parity with the old paged path) is fed by the export's 500-id chunks. Seeded `#1399` (the streaming-path N+1, which needs a streaming-safe design).","- **`#1400` (`#1393`) — production timestamp culture-invariance.** InvariantCulture on 5 hand-built SQLite timestamp string sites (`AuditLogRepository` CountByDateAsync/DeleteOldEntriesAsync + `DateOnly.Parse`; `OAuthAuthCodeRepository` TryConsumeAtomicAsync/DeleteExpiredAsync, now also `.UtcDateTime`-normalized; `KnowledgeFtsSearchService` CreatedAt parse) with hostile-culture regression tests. Seeded `#1403` (the fixed-digit vs EF-trimmed boundary residual).","- **`#1401` (`#1384`) — MCP per-key rate budget charged once, at the right point.** The 60/min per-key budget is now spent inside `ApiKeyMiddleware` immediately after key resolution, BEFORE the Users lookup + `UpdateLastUsedAsync`, so valid over-quota keys no longer drive auth-stage DB work; the endpoint-stage policy is removed (one budget, checked once) across both co-hosted and standalone pipelines; the `#1381` pre-auth-IP-budget semantics and the `429` contract are preserved. Seeded `#1402` (`UpdateLastUsedAsync` silently never persists — a swallowed EF translation failure) and `#1404` (stale-owner-key IP-budget escape).","- **Seeded this wave:** `#1397`, `#1398`, `#1399`, `#1402`, `#1403`, `#1404`. **Still open — NOT shipped:** `#1386` (wave-1 final review round) plus the standing human-gated holds `#1295` (deny-floor overlay), `#1337` (licensing pack), and `#1359`.","Overnight substrate + correctness wave (2026-07-17, **11 PRs merged** — per-PR gate: independent adversarial review, all-severity findings fixed, required CI green; full backend suite reported 7223 passed / 0 failed / 1 skipped post-`#1373`):","- **`#1373` (`#1282`) — the API test factory now mirrors production SQLite settings.** A new shared `UseTaskdeckSqlite` registration helper in Infrastructure is used by BOTH production DI and the integration test factory, so WAL/busy-timeout drift between them is now structurally impossible; retires the `test/sqlite-concurrency` ledger flake.","- **`#1375` (`#1298`, REVIVAL-02 Phase-1 ship gate) — removed the fake Paper review undo timeline** and replaced the reversibility copy with factual apply-risk guidance (\"Apply considerations\"), while the confidence label now renders \"Operation safety\"; the stable side-effect wire shapes are preserved for GP-03. Full contract detail is in the 2026-07-17 REVIVAL-02 note directly above — not duplicated here.","- **`#1374` (`#1370`; seeded `#1376`) — proposal preview aligned with apply for reorder/collision/structure.** The clamped reorder position is surfaced in the diff, create-card id collisions fail at validation with a stable `409`, and a shared `ProposalOperationStructureValidator` runs before original-proposal diffs (one source of truth with Apply). A true preview==apply parity contract test was added.","- **`#1372` (`#1367`) — the standalone MCP host-security guard now mirrors `HostFilteringMiddleware` exactly.** It fails closed on all zero-host `AllowedHosts` shapes (`\";\"`, `\";;\"`, blank) while preserving port-suffixed / whitespace-bearing literals; a new in-process standalone-host integration test carries a mutation proof.","- **`#1377` (`#1357`) — the concurrent-migrator test asserts final schema state** (any-`SqliteException` collision signature, at most one fault, exact `__EFMigrationsHistory` equivalence) instead of no-throw; adds a deterministic fail-open collision test and an `AcquireLock` exclusivity contract test (internal seam). Retires the windows-latest migrator flake.","- **`#1378` (`#1369`; `#1379` expanded to a hard wiring gate) — artefact extraction is bounded by a wall-clock budget** (`Artefacts:ExtractionTimeoutSeconds`, default 30s) with warning-bearing `extraction-timeout` history rows and abandoned-task handling; real PdfPig / plain-text extractors are exercised through the budgeted path.","- **`#1362` (`#1274`, P-I ship gate; seeded `#1363` earlier, `#1380`, `#1382`) — core E2E is re-pointed at Paper-default sessions** with explicit frozen-Legacy opt-outs (builds on the 2026-07-14 Paper-default alignment paragraph above, which it does not restate). Adds full axe WCAG 2.1 A/AA on Home/Today/Inbox/Review/seeded Board/Login, a real capture → review → apply lane with a hard-asserted confirmation dialog, a `PaperBoardCard` nested-interactive fix + focus-follows-selection, `--faint` token contrast floors, and a Boards shortcut ledger.","- **`#1366` (`#1365`, `#1371`) — the presence stress test proves join/leave broadcast delivery** (not just tracker membership) with fail-closed controls; 15/15 consecutive runs post-`#1373` parity.","- **`#1385` (`#1355`) — buffered account-export artefact blob loads are now batched.** A new `SourceArtefactRepository` batch blob-load feeds the buffered GDPR export in bounded chunks (idiomatic `Chunk()`), with a batch-id-count guard against the SQLite parameter limit (pass-side boundary pinned at 900 ids) and export-JSON round-trip + missing-blob contract tests. Closes the LOW efficiency finding seeded from the `#1341` security review.","- **`#1381` (`#1368`) — the MCP pre-auth per-IP limiter is now a failure budget with admission control.** Budget is spent only on authentication failures (successful auth never consumes, so multiple keys behind one egress address keep independent per-key budgets); an exhausted address is rejected before the API-key lookup via non-consuming inspection; a per-IP concurrency gate (`RateLimiting:McpAuthenticationPerIpConcurrency`, default 16) caps in-flight pre-auth work; consumption is abort-proof (an auth-failed marker set before the 401 write is consumed in a `finally`, so abort-storms still spend budget); trusted forwarded headers now also apply to the standalone MCP host (default OFF — XFF is never trusted from an unknown peer).","- **`#1390` — same-night hotfix of the `#1377` fail-open collision test.** The barrier design flaked an unrelated PR in the opposite direction of the flake it covered (run 29552875836: fast runners let the winner finish the whole chain before the loser applied anything, failing the required-collision assertion). The test now stages the interception structurally — migrator A runs alone until `__EFMigrationsHistory` polling proves it mid-chain, then B is released — and a pathological staging miss passes gracefully with a loud `WARNING: STAGING MISSED` diagnostic, so the test can never flake an unrelated PR again.","- **Seeded follow-ups:** `#1376`, `#1379`, `#1380`, `#1382`, `#1383` (AuditRetention flake), `#1384`, `#1387`, `#1388`. **Still open — NOT shipped:** `#1386` (final review round in flight), plus the standing human-gated holds `#1295` (deny-floor overlay), `#1337` (licensing pack), and `#1359`.","Revival + generalist-expansion wave delivery (2026-07-13, **15 PRs merged** — the revival/GEN direction is now live on `main`; per-PR review gate: independent adversarial reviews, all-severity findings fixed, real merge conflicts resolved, required CI green after the `#1352` CI-Extended fix):","- **Direction ratified:** `#1296` (ADR-0044 revival pivot — open-beta direction + REVIVAL_PLAN spine + canonical doc sync), `#1328` (ADR-0046 generalist expansion — artefact intake + dossiers, Phase 4; the twin generalist app stays deferred behind the GEN-12 `#1326` evidence gate), `#1312` (ADR-0045 LLM transcript-triage engine, REVIVAL-08 M1). **ADR-0044 / ADR-0045 / ADR-0046 are all now Accepted.**","- **Generalist expansion (GEN wave, ADR-0046):** `#1341` GEN-01 artefact-storage foundation (immutable user-owned `SourceArtefact` + blobs; claims-scoped, IDOR-safe upload/download/delete with a race-safe in-transaction board-access recheck; streaming size caps preserving HTTP 413; magic-byte content validation; FK cascade + GDPR export/delete — independently security-reviewed, no CRITICAL/HIGH) → `#1346` GEN-02 bounded local text extraction (plain-text / Markdown / PdfPig, immutable warning-bearing extraction history); `#1339` GEN-05 apply due dates + labels from proposals (closes the extract-but-unappliable gap — also fixed a latent bug where a tautological guard silently cleared a column's WIP limit on *every* reorder, and made proposal reorder atomic/lossless with the destination position shown in the approval diff); `#1340` GEN-09 untrusted-artefact threat model + injection canaries; `#1342` GEN-10 generalist-friendly guided navigation.","- **Revival (ADR-0044):** `#1334` REVIVAL-01 registration gating by deployment mode (Open / InviteOnly / Closed; operator-minted bootstrap invite; new `AddRegistrationGating` migration) → `#1344` REVIVAL-05 Paper first-run onboarding (real capture → reviewed proposal → board-apply milestone; fail-closed registration availability; theme-aware on-ember CTA contrast + restored Legacy focus ring); `#1329` REVIVAL-04 self-hosted Paper fonts + branding metadata; `#1331` README rewrite for the revival beta; `#1333` de-stubbed the fabricated Today dossier (`#1272`, latest-request-wins guard).","- **Infra / harness / ops:** the maintainer first merged the linchpin `#1352` (systemic CI-Extended reusable-workflow permission `startup_failure`, `#1330`) plus dependabot `#1351` / `#1349` to unblock the deck; this session then merged `#1294` (harness T3 region maps + skill read-first diet, `#1291`) and `#1336` (overnight human-action + failure-ledger record, `#1327`).","- **MCP HTTP security boundary (`#1338`):** standalone and co-hosted Streamable HTTP now share the only `MapMcp(\"/mcp\")` registration; API-key auth, telemetry, user-scoped resources, pre-authentication IP throttling, and opaque-key-ID rate limiting run on that exact route, while `/` is no longer an alternate MCP endpoint. The route explicitly disables browser CORS. Standalone defaults to loopback and replaces blank or any-host configuration (`*`, `0.0.0.0`, `[::]`, including mixed lists) with an exact loopback allowlist; remote binds require explicit host configuration and TLS termination.","- **Seeded follow-up:** `#1355` (batch the buffered-export artefact blob loads — LOW efficiency finding from the `#1341` security review). **Human-gated, NOT merged:** `#1295` (deny-floor overlay — 16 unresolved review threads including a CRITICAL, needs remediation) and `#1337` (licensing pack — blocked on human trademark clearance).","","","","","","","Wave-6 backend + run-story delivery (2026-06-26, **3 PRs merged**; full review gate per PR — independent adversarial reviews, all-severity findings fixed, Codex bot threads resolved, fresh green CI + aging):","- **`#1236` (`#1195`) — bounded the `LlmQueueToProposalWorker` status reads at the database.** Replaced the unbounded `GetByStatusAsync` worker reads with **type-aware in-query bounded reads** (`GetOldestPendingNonCaptureAsync` / `GetOldestProcessingCaptureAsync` + `CountPendingNonCaptureAsync` / `CountProcessingCaptureAsync` for true backlog telemetry). Two adversarial reviews + Codex independently caught a **HIGH starvation regression** in the original generic-limit design (bounding raw status before the request-type filter lets older untriaged capture rows starve non-capture automation work) → re-architected to predicate-in-query bounded reads (SQLite raw-SQL `ORDER BY CreatedAt ASC LIMIT` + in-memory re-sort). The unbounded `GetByStatusAsync` is kept for full-set callers (health gauge, OpsCli) and is **GDPR-safe** (delete/export use `GetByUserAsync`). Seeded `#1237` (remaining unbounded Pending reads in `LlmQueueService`/`OpsCliService`).","- **`#1238` (`#1193`) — paged `CaptureService.ListAsync` from the database.** New capture-only `GetCapturesByUserAsync(userId, limit, offset)` (newest-first `ORDER BY CreatedAt DESC, Id`, SQLite raw + EF) replaces loading the user's entire `LlmRequest` history then filtering/paging in memory; a fetch-until-enough loop with a `seenIds` dedup guard keeps filtered queries correctly filled across OFFSET page boundaries. `GetByUserAsync` untouched → GDPR-safe. Seeded `#1239` (push board/status filters into SQL).","- **`#1240` (`#1131`) — made the self-contained desktop exe runnable without manually supplying a connector key.** `ShouldAutoGenerateConnectorKey(isProd, isHeadless) => !isProd || !isHeadless`: a desktop install (Production, not headless) auto-generates + persists the connector encryption key to `appsettings.local.json`; **headless Production (CI / container / Terraform) still hard-fails** without a supplied stable key (`backend.Dockerfile` sets `TASKDECK_HEADLESS=true` so every container image is classified headless). The AWS single-node Terraform `user_data` generates+persists the key onto the durable EBS data volume (refusing to regenerate when a DB already exists without a key), `scripts/backup.sh`/`restore.sh`/`restore.ps1` keep the key paired with the database, and a deep review loop hardened the persistence path against silent key loss (reuse a masked persisted key instead of overwriting it; self-heal a corrupt local config; case-insensitive + provider-lenient reads; read-vs-parse error separation; owner-only ACL on the restored key). **`ADR-0041`** records the decision. ~15 distinct review findings (1 HIGH + many P2) across 6 Codex rounds + a 2-lens adversarial sweep, all fixed with tests.","- **ADR added on main:** `ADR-0041` (desktop connector-key auto-generation; headless Production excluded).","- **Seeded follow-ups:** `#1237` (bound remaining unbounded Pending reads) **— shipped (`#1250`)**; `#1239` (push capture board/status filters into SQL) **— board pre-filter shipped 2026-06-30 (`#1254`); the status filter stays in-service (provenance-derived), so `#1239` remains open for that portion**. Shipped from earlier: `#1241` (Windows ACL on the desktop key file) **— 2026-07-02 (`#1263`)**. Still open from earlier: `#1242` (relocate persisted secrets to the durable app-data location).","Canonical UI + historical archive period (2026-06-13; direction superseded 2026-07-10):","- **Historical direction only:** from 2026-06-13 until ADR-0044 on 2026-07-10, the project direction was finish-for-personal-use, then archive, with no distribution. **That posture no longer controls execution.** The revival direction at the top of this file and `docs/REVIVAL_PLAN.md` are authoritative; previously de-scoped distribution work is re-triaged only where the ratified REVIVAL wave admits it.","- **Paper is the canonical UI AND now the DEFAULT theme** per **ADR-0038** — the **Wave-3 default-theme flip shipped 2026-06-27**: `paperThemeStore` defaults to `'paper'` (was `'off'`), the storage key is bumped to `td.paper.mode.v2` with a one-time migration (a deliberate pre-flip `paper`/`paper-night`/`auto` choice carries over; a stored `'off'` — the old default / never-opted-in — and absent/invalid fall through to the new `'paper'` default), and the legacy `.td-*`-selector E2E specs pin Legacy via `authSession` (`td.paper.mode.v2='off'`). Legacy stays reachable through the Appearance toggle. **Activation prerequisites shipped earlier (2026-06-19):** the `#1161` \"File away\" dismiss affordance (`#1219`), the shared review-actionability composable (`#1217`), light-theme straggler tokenization (`#1216`), and a **real in-app Appearance theme toggle** (`#1221`, `AppearanceSettingsView` at `/workspace/settings/appearance` — off / paper / paper-night / auto) which replaces the unlinked `/styleguide/paper` route as the reachable Legacy escape hatch. **Paper-review de-stubs now shipped (2026-06-27):** `onPreviewDiff` (`#1234`), plus `onDefer` (snooze 1h — net-new `DeferredUntil` timing field + `POST /api/automation/proposals/{id}/defer`, the proposal leaves the queue and resurfaces without expiring, **ADR-0042**) and `onReportBadSuggestion` (net-new content-free `ProposalFeedback` table + `POST /api/automation/proposals/{id}/feedback`, orthogonal feedback that never changes status, **ADR-0043**) — **which unblocked the Wave-3 default-theme flip, now shipped (see above).** **All new frontend UX work targets the Paper views; Legacy is frozen** (no new fixes). The ~26 routes without Paper variants keep rendering Legacy views inside the Paper shell after a contrast pass.","Archive-pivot delivery wave (2026-06-13, **17 PRs merged** across Waves 0–2, including 2 follow-on dependabot bumps `#1211`/`#1212`; **plus 4 follow-on PRs merged 2026-06-19** — `#1219`/`#1220`/`#1221`/`#1225`, see the \"Merged 2026-06-19\" sub-section below — for **21 total**; full review gate per PR — 2 independent adversarial reviews, all-severity findings fixed, Gemini/Codex/Copilot bot threads resolved, fresh green CI + aging):","- **Wave 0 — PR deck cleared (7 PRs):** dependabot npm `#1202` + nuget `#1203` group bumps; automation-chat composable cleanup `#1199` (isDisposed guard on the unguarded `loadBoardOptions().then()` continuation); false-green E2E re-enabled on real Paper selectors `#1197` (the 7 `fixme`'d specs cover features that exist under Paper — paper-night class, dark-Paper toggle, PaperShortcutsOverlay, workspace-mode selector); queue-claim race fix `#1200` (the raw-SQL claim now `Reload()`s so the returned DTO shows Processing instead of a stale Pending identity-map entity — seeded `#1209` for the remaining non-capture stuck-in-Processing sweeper gap); **SDK pin + Central Package Management `#1196` (ADR-0039)** — carried the `#1203` NuGet bumps into `Directory.Packages.props` and copied `global.json` into the backend Dockerfile; **ExpiresAt UTC convention `#1201` (ADR-0040)** — global `ConfigureConventions` DateTimeOffset materialization so SQLite reads come back UTC.","- **Wave 1 — decision + cheap foundations (3 PRs):** **ADR-0038 ratified — Paper is the canonical UI, Legacy frozen `#1207`** (STATUS + masterplan now state the canonical stack; storage-key migration deferred to the Wave-3 flip); `#1139` AC1 compose-secret quickstart docs `#1205` (README + `docs/ops/DEPLOYMENT_CONTAINERS.md` now name BOTH required secrets, since compose aborts on a missing `TASKDECK_CONNECTORS_ENCRYPTION_KEY`); `*.migrate.lock` gitignored + `.dockerignore` mirror `#1204` (the SerializedMigrator sidecar no longer dirties `git status` on every startup).","- **Wave 2/6 — Paper activation prerequisites + backend quality (5 PRs):** paper-night straggler tokenization `#1216` (`#1135` — KeyboardShortcutsHelp border + full-opacity WCAG focus ring; seeded `#1218` for the repo-wide `focus:ring-primary/50` contrast sweep); **shared review-actionability composable `#1217`** — extracted `isProposalApplyActionable` / `isProposalRejectActionable` / `isProposalApproveActionable` / `isProposalDismissable` / `isProposalStale` as pure functions in `useReviewProposals` so Paper and Legacy can never drift at the 24h-stale or Approved+expired boundaries (the `#1124` bug class is now fixed once, not twice), and de-stubbed the fabricated `4s · 1.2k tokens` author metadata in favour of the real `/confidence` value; dead-code removal `#1198`/`#1214` (see below); Redis lock-starvation fix `#1213` (`#1189` — dropped the in-lock retry loop and the 3s blocking Connect inside the lock; single attempt per throttle window → null/no-cache fallthrough, proven by deterministic regression guards); **one-command dev-up + clean-workspace scripts `#1208` (`#1140`)** — `dev-up.ps1/.sh` (dependency check, `%LOCALAPPDATA%` DB path to fix the CWD-dependent `taskdeck.db`, port-bound API via `--no-launch-profile --urls`, `/health/ready` poll, npm dev, optional `-Seed demo/demo123`) and `clean-workspace.ps1/.sh` (stray DBs/migrate-locks/logs, process-held-DB refusal), with recursive process-tree kill, live-PID-file refusal, and a `.migrate.lock` guard against deletion during an active migration; the dev-up DB-pinning path was live-smoke-verified before merge.","- **ADRs added on main:** `ADR-0038` (Paper UI canonical / Legacy frozen), `ADR-0039` (Central Package Management, SDK pin, 8.x dependency alignment), `ADR-0040` (global UTC DateTime materialization for SQLite).","- **Seeded follow-ups:** `#1209` (no sweeper recovers non-capture `LlmRequests` stuck in Processing) **— shipped 2026-06-30 (`#1256`)**; `#1215` (`FieldVerifier`/`DeterministicPreExtractor` registered-but-unconsumed after V1 removal) **— removed as dead code 2026-07-04 (V2 generator cancelled by the archive pivot; the transitively-orphaned `FuzzyTextMatcher`, `FieldVerificationResult`, `ExtractedEntity`, and the `Microsoft.Recognizers.Text` packages were swept with it)**, `#1218` (repo-wide focus-ring contrast sweep) **— shipped 2026-07-02 (`#1265`)**.","- **Merged 2026-06-19** (maintainer lifted the merge hold; all four shipped to `main` after 2 independent adversarial reviews, all-severity findings fixed, fresh green CI):"," - `#1219` (`#1161`) — Paper review \"File away\" dismiss affordance built on the `#1217` shared-actionability foundation (per-proposal filing rail in terminal states + bulk \"File away N settled\" + dual-purpose ⌫). Closes `#1161`."," - `#1221` — reachable in-app **Appearance** theme toggle (`AppearanceSettingsView` at `/workspace/settings/appearance`; off / paper / paper-night / auto), the reachable Legacy escape hatch that replaces the unlinked `/styleguide/paper` route — a Paper-activation prerequisite."," - `#1220` — canonical-docs reconciliation with the archive-pivot direction (14 Codex review rounds + 3 multi-agent drift sweeps; ~70 banner-vs-reality edges fixed)."," - `#1225` — `StackExchange.Redis` + `Microsoft.AspNetCore.SignalR.StackExchangeRedis` semver-major caps (dormant Redis under the archive pivot).","Dead-code removal (2026-06-13, `#1198`): deleted the unused `ProposalGeneratorV1` — the `IProposalGenerator` interface (incl. its V1-only `ProposalGenerationResult`/`GeneratedProposal` result DTOs), its sole DI registration, and its test class — after confirming **zero consumers** inject `IProposalGenerator` (the only non-definition reference was the DI line). This resolves the tracked partial-entity-tracking bug in `#1198` by removing the unreachable code path rather than patching it. The shared `FieldVerifier`/`IFieldVerifier` and `DeterministicPreExtractor`/`IDeterministicPreExtractor` utilities (V1 was their only consumer but each has standalone tests and DI registration) are retained for a future V2 generator. Build clean, Proposal-filtered backend tests green.","Security gate + hardening epic (2026-06-05/06, 5 PRs merged; **2 independent adversarial reviews per PR** plus Gemini/Codex bot reviews, all findings of every severity fixed or tracked, merges gated on green CI + aging):","- **#1132 (security gate + config hardening) delivered across 4 PRs**: a single ≥32-char JWT secret floor (`JwtSettings.MinSecretKeyLength`) with **fail-fast** registration (throws instead of silently no-op'ing auth) + CORS that **fails closed** in Production when no origins are configured (`#1169`, AC2/AC3); required **secret/dependency/SAST scans + the bundle-size budget promoted into the PR merge gate** (`#1170`, AC1/AC5), with **phased enforcement** per **ADR-0035** (gitleaks + bundle enforcing; dependency + SAST advisory pending baseline remediation) and the pre-existing Semgrep `pkg_resources`/`setuptools-82` crash fixed; a global default-deny `AuthorizationOptions.FallbackPolicy = RequireAuthenticatedUser` with an explicit `[AllowAnonymous]` audit (SPA fallback opt-out; the API-key MCP path now sets an authenticated principal in `ApiKeyMiddleware`) per **ADR-0036** (`#1176`, AC4).","- **#1133 (backend query perf, first slices — `#1171`)**: `NotificationRepository.GetByUserIdAsync` now pushes ORDER BY + LIMIT/OFFSET into SQL (SQLite raw-SQL path for `DateTimeOffset` ordering, fully parameterized, negative-clamp guard) instead of materializing every row; `.AsSplitQuery()` on `CardRepository` collection reads. SignalR-incremental-refetch and FTS card-search remain open on `#1133`.","- **#1131 AC1 (CLI hardening — `#1177`)**: the CLI provisions a connector encryption key on first run (CSPRNG 256-bit, atomic merge-preserving write under a cross-process mutex, `0600` perms, stderr-only diagnostics) so `taskdeck boards list` works on a clean machine; guarded the `Mutex` ctor against locked-down hosts and honored the documented `TASKDECK_CONNECTORS__ENCRYPTIONKEY` override. CLI authorization routing is **#1131 AC2** (deferred).","- **New ADRs**: `ADR-0035` (required security-scan merge gate), `ADR-0036` (default-deny authorization fallback). **Seeded follow-ups**: `#1172` (AccountDeletion notification paging), `#1173` (branch-protection registration of the new check contexts — a repo-settings action), `#1174` (per-advisory dependency allowlist / break-glass), `#1175` (security-baseline remediation incl. the `NuGet.CommandLine`-via-Recognizers.Text transitive, then flip dependency/SAST to enforcing), `#1178` (apply the CLI's `0600` + guarded-mutex hardening to the API `FirstRunBootstrapper`).","Post-audit correctness sweep (analysis 2026-05-31; landed as reviewed PR 2026-06-04): audited all 31 PRs merged since 2026-05-28 for CC 2.1.154–2.1.158 tool-channel corruption fallout. Results: **0 SUSPECT, 0 NO-OP, 31 CLEAN** — no corruption artifacts. Full build/test suite green (6,735 BE + 3,662 FE tests). Fan-out correctness review (4 agents, 219 tool calls) found 2 issues + 9 nitpicks, all addressed:","- **Fixes applied**: `useGlobalSearch` dispose-race guard on the success, catch, and finally branches (no reactive writes after teardown); `useCaptureQueueSync` fire-and-forget replays switched to `void replayQueue()` (replayQueue wraps its body in try/catch/finally and logs internally, so the prior empty `.catch(() => {})` was dead code); Ollama `appsettings.json` BaseUrl changed from empty string to `null` with a clearer validation message pointing at the real `Llm:Ollama:BaseUrl` section; `RoadmapInvariantTests` placed in a named xUnit `[Collection]` so any future TelemetryGuard-mutating test class in the same assembly stays serialized with INV-11; `AutomationMetricsController` TODO comment replaced with honest stub note referencing `#1142`.","- **PR #1160 review fixes**: two independent adversarial passes plus Gemini/Codex/Copilot bot reviews refined the sweep — the dispose-race guard was extended to the catch paths, the dead replay `.catch` became `void`, and the Ollama hint was corrected from the non-existent `LlmProviders:` path to `Llm:Ollama:BaseUrl`.","- **Documented**: `AutomationMetricsController.GetCohortMetrics` is a stub returning empty data — `CohortDashboard` frontend works but will show \"No cohort data available\" until `ICohortMetricsService` ships (tracked in `#1142`). `OllamaLlmProvider.StreamAsync` uses pseudo-streaming (complete-then-drip), not Ollama's native streaming API.","Cleanup/hardening wave (2026-05-31, 8 PRs merged, 2 issues closed; 2 adversarial review passes per PR with all findings of every severity fixed and all bot threads resolved):","- **Open-PR backlog cleared** (`#1143`–`#1147`): non-watch `vitest run` + MetricsView flake fix (`#1143`), docs-truth corrections (`#1144`), CI-aligned release scripts + stale PKG-01 warning removed (`#1145`), duplicate operation idempotency-key now returns **409 not 500** (`#1146`), `AsSplitQuery` on the multi-collection board read (`#1147`).","- **Proposal endpoint hardened** (`#1125`/`#1151`): new `ProposalOperationInputValidator` rejects malformed operation input (markup/binary `actionType`/`targetType`, non-JSON / oversized / over-nested `parameters`) with **400** at the shared create path, using a permissive identifier-format check so it never rejects legitimate planner/chat/capture/MCP operations. Adversarial review caught a self-introduced HIGH (a null `operations` element → 500) which was fixed before merge.","- **Roadmap invariants enforced** (`#1126`/`#1153`): INV-10 (MCP hash-pin), INV-11 (TelemetryGuard), INV-12 (provenance source spans) un-skipped with real assertions against the shipped services; only INV-09 (DataFlowRegistry, genuinely unbuilt) remains skipped. Surfaced that `McpToolDefinitionHashService` is registered but **not wired into the MCP runtime** (tracked `#1154`).","- **Swallowed audit failures surfaced** (`#1134` first slice / `#1155`): the 4 copy-pasted empty-catch `SafeLogAsync` (Board/Card/Column/Label) now route through a shared `AuditLogWriter` that logs at **Warning** on a thrown exception or a returned failed `Result`, keeping the never-crash intent.","- Seeded follow-ups: `#1149` (idempotency-key contract ADR), `#1150` (packaging-doc trim drift), `#1152` (Queue/V1 validator bypass), `#1154` (MCP hash wiring). `#1134` stays open for its remaining 6 acceptance criteria.","Continuous-cycle wave (2026-05-29, 19 PRs merged, zero open PRs): cleared the entire open-PR backlog with two adversarial reviews per PR and all findings (all severities, including bot comments) addressed.","- **RFAI roadmap complete**: RFAI-11 (`#983`/`#1079`, ambient channel — VS Code extension + voice prototype; voice composable is tested but not yet wired into any UI component) and RFAI-12 (`#984`/`#1080`, Ollama provider, ProvenanceDrawer, cohort dashboard shell) delivered. All 12 RFAI issues now shipped. **Note:** `CohortDashboard` frontend is wired but backend returns empty data (stub); `OllamaLlmProvider.StreamAsync` uses pseudo-streaming; `useVoiceCapture` has no UI integration yet. These are tracked in `OUTSTANDING_TASKS.md`.","- **Composable hardening**: unhandled promise rejections (`#1093`/`#1095`), cleanup/memory-leak fixes with `onScopeDispose` (`#1094`/`#1104`), FilterPanel aria-labels (`#1097`/`#1098`).","- **Identity/authz hardening**: an audit confirmed all 42 API controllers are claims-first with zero bypass risk; migrated `TelemetryController`/`EgressDisclosureController` onto `AuthenticatedControllerBase` (`#1109`/`#1111`) and added architecture guards enforcing per-action `[Authorize]`/`[AllowAnonymous]` (`#1110`/`#1116`).","- **Dependency wave**: nuget/npm minor-patch groups, YamlDotNet 18, and a dotnet group (EF8/9 split fixed) merged; FluentAssertions moved to the free **7.x** line (`#1088`) instead of paid v8; durable dependabot `ignore` rules added for EF Core and FluentAssertions majors (`#1112`, `#1118`) so those churns stop recurring.","- **Housekeeping** (`#1092`): STATUS.md contradiction fixed; v-for key stability (`#1107`/`#1108`); 112 stale stashes cleared and stale branches pruned.","
","Status Owner: Repository maintainers","Authoritative Scope: Current implementation, verified test execution, and active phase progress","Companion Active Docs:","- `docs/STATUS.md`","- `docs/IMPLEMENTATION_MASTERPLAN.md`","- `docs/TESTING_GUIDE.md`","- `docs/MANUAL_TEST_CHECKLIST.md`","- `docs/GOLDEN_PRINCIPLES.md`","## Project Summary","Taskdeck is a local-first execution system for developers, built with a .NET 8 backend and a Vue 3 frontend.","Core board workflows are stable, and advanced slices are implemented for automation proposals, chat, ops/log querying, archive recovery, and worker health reporting.","Rebranding thesis (2026-02-23):","- capture should be near-zero friction","- automation should remain review-first and provenance-visible","- product value is reducing maintenance overhead, not maximizing opaque autonomy","Bulk merge wave (2026-05-16, PRs `#1055`–`#1074`, 15 PRs, all with 2+ rounds of adversarial review):","- **Security hardening** (3 PRs): redirect handler buffer/header filtering (`#1055`), hardcoded encryption key removal + RBAC on abuse endpoints (`#1067`, SEC-31/SEC-32), health endpoint exception detail suppression (`#1068`, SEC-33)","- **Test coverage** (2 PRs): MFA, API Keys, Board Access controller tests (`#1069`, TST-62), ConnectorProviders API + useAutomationChat composable tests (`#1072`)","- **RFAI feature delivery** (5 PRs): `IProposalGenerator`/`FieldVerifier`/`ProposalGeneratorV1` (`#1071`, RFAI-03), revision endpoints + edit-before-approve flow (`#1058`, RFAI-04), Paper Review deep-dive frontend wiring (`#1062`, RFAI-05), egress disclosure API endpoint (`#1073`, RFAI-08), privacy insights API for proposal outcome cohorts (`#1074`, RFAI-08)","- **PAPER frontend** (2 PRs): Today dossier real backend API wiring (`#1056`, PAPER-08), narrow companions with sidebar variants + board snap scroll (`#1057`, PAPER-11)","- **Dependency updates** (3 PRs): `actions/dependency-review-action` 4→5 (`#1059`), npm minor/patch group 11 updates (`#1060`), NuGet minor/patch group 4 updates (`#1061`)","- Post-merge verification: 6,532 backend tests pass (0 failures), 3,267 frontend tests pass (0 failures), both builds clean","- Roadmap v4 RFAI progress: RFAI-01 through RFAI-09 now fully delivered (9 of 12 issues); remaining: RFAI-10 (PWA share-target), RFAI-11 (ambient channel), RFAI-12 (learning loop UI + beta gate)","- PAPER progress: PAPER-03 (shell), PAPER-08 (today dossier), PAPER-11 (narrow companions) now delivered; remaining: PAPER-05 (board/kanban surface)","Post-merge follow-up (2026-05-17, PRs `#1076`–`#1078` and `#1082`–`#1084`, 6 PRs merged after the bulk wave; `#1079`/`#1080` remain open):","- **RFAI-10** (`#982`/`#1078`): PWA share-target quick capture with offline queue, browser extension prototype, share captures preserved after auth rejection, ambiguous POST provenance fail-closed; issue closed","- **PAPER-05** (`#1001`/`#1083`): Paper board card drag E2E test with audit-log assertion","- **Bug fix** (`#1077`): Encoding artifact in PaperBoardCard drag handle","- **Test coverage** (`#1076`, `#1082`, `#1084`): MFA setup 409-Conflict integration test (`#1076`, TST-63), composable unit tests for inkBleed, reviewKeymap, useInboxOrchestrator, useReviewProposals","- Roadmap RFAI progress: 10 of 12 delivered; 2 remaining (RFAI-11 `#1079`, RFAI-12 `#1080`)","- PAPER progress: all 4 PAPER issues now delivered (PAPER-03, PAPER-05, PAPER-08, PAPER-11)","Agentic operating layer expansion (2026-05-11):","- Taskdeck now has a shared agentic protocol layer under `docs/agentic/` for blocker-question batching, failure/workaround capture, guide-update promotion rules, and skill routing.","- `autodoc/AGENT_INDEX.md` is the fast agent seam map for low-context orientation, context traps, and verification hints; it is a pointer layer, not canonical product truth.","- Codex and Claude skill mirrors now include `taskdeck-question-batch`, `taskdeck-failure-capture`, and `taskdeck-interface-map`.","- Claude project hooks now route dangerous shell-command checks and failed-tool capture through `scripts/agent_hooks/`, while preserving existing Taskdeck-specific pre-commit and PR-review reminders.","- Codex and Claude tool parity is explicit in `docs/agentic/AGENT_TOOL_PARITY.md`; Claude `.mcp.json` now mirrors the shared MCP baseline with OpenAI docs, GitHub, Context7, Playwright, Chrome DevTools, and Docker gateway access.","Paper backend gap delivery (2026-05-05, PRs `#1031`--`#1040`, 10 of 10 issues `#1015`--`#1024`):","- 10 Paper backend gaps delivered or merge-ready with two rounds of adversarial review per PR; ~480 new backend tests across the delivered set; bot review findings (Gemini Code Assist + Codex connector) addressed on delivered PRs","- **Today dossier backends** (4 endpoints on `TodayController`, required by PAPER-08 `#1004`):"," - Cadence aggregation (`#1015`/`#1031`): `GET /api/today/cadence?date=` returns 24-hour activity buckets with first/peak/last action timestamps; `CadenceBucket` and `CadenceSnapshot` value objects with cached `Empty()` singleton; queries `IAuditLogRepository`; 26 tests"," - Streak query (`#1016`/`#1032`): `GET /api/today/streak?days=90` returns 90-day streak with intensity buckets (quartile-based) and current/longest streak lengths; `StreakDay`/`StreakResult` value objects; server-side `GROUP BY` via `CountByDateAsync` (replaced 100k entity load after review); 61 tests"," - Seal day action (`#1017`/`#1037`): `POST /api/today/seal` and `GET /api/today/seal?date=` for idempotent day-sealing with `DailySnapshot` entity; EF Core migration with unique index on `(UserId, Date)`; `UnitOfWork` unique constraint handler for concurrent seals; CancellationToken threaded through all layers after review; 28 tests"," - Line for tomorrow (`#1018`/`#1035`): `GET /api/today/tomorrow-note?date=` and `PUT /api/today/tomorrow-note` for autosave-friendly upsert; `TomorrowNote` entity (500 char max); 204 NoContent for missing notes; concurrent upsert race-condition handling via `UnitOfWork`; 25 tests","- **Review deep-dive backends** (6 endpoints on `AutomationProposalsController`, required by PAPER-06 `#1002`):"," - Provenance rows (`#1019`/`#1039`): `GET /api/automation/proposals/{id}/provenance` returns `ProvenanceRowDto[]` with icon/key/value/weight; 26-entry icon map; weight bucketing from `ProvenanceField` confidence; FK migration added after review; `Math.Round` for confidence display; 41 tests"," - Side-effect analysis (`#1020`/`#1033`): `GET /api/automation/proposals/{id}/side-effects` returns 7-category breakdown (Cards/Subtasks/Comments/Activity/Notifications/Webhooks/Calendar) with active/passive tone and risk-based reversibility window (6h default, 3h for Critical); review fixed target-type checks and webhook-without-operations logic; 66 tests *[2026-07-17: the `windowMs` field is legacy review-attention metadata, not an undo capability — no revert endpoint exists; copy/semantics reframed to apply-risk guidance by REVIVAL-02 `#1298`, wire shape unchanged]*"," - Confidence breakdown (`#1021`/`#1036`): `GET /api/automation/proposals/{id}/confidence` returns 4-component weighted breakdown (Pattern match 0.30, Reach 0.20, Reversibility 0.35, Recency 0.15) with threshold and explanatory note; review fixed reach formula, promoted weights to static field, removed unused userId; 63 tests"," - Conflict detection (`#1022`/`#1040`): `GET /api/automation/proposals/{id}/conflicts` returns tone-classified Warn/Info/Ok rows for stale data, missing targets, projected WIP overflow, duplicate pending proposals, high-risk operations, outbound webhooks, active comments, multi-op card conflicts, and positive capacity/fresh-data signals; review fixed create-card false positives, JSON ValueKind guards, projected WIP accounting, missing-column detection, webhook event mapping, soft-deleted comment counts, and entity caching; 78 tests"," - Card history ledger (`#1023`/`#1034`): `GET /api/automation/proposals/{id}/history` returns per-card touch history with serial/event/age/status; bounded at 200 entries/card and 500 total; review fixed duplicate dedup, JSON property parsing, GUID single-pass, `InvariantCulture` formatting; 42 tests"," - Similar past decisions (`#1024`/`#1038`): `GET /api/automation/proposals/{id}/similar-past` returns 3 nearest-neighbour prior decisions with apply rate; board-scoped query (review fixed userId filter that excluded non-caller proposals); 200-proposal lookback limit; UTC week formatting; 50 tests","- New EF Core migrations: `AddDailySnapshots`, `AddTomorrowNotes`, `AddProvenanceEntities`, `AddProposalProvenanceForeignKey`, `ExtendProposalOutcomesForMetrics`","- New repository methods: `IAuditLogRepository.CountByDateAsync`, `IAutomationProposalRepository.GetTerminalByActionTypeAsync`, `IAutomationProposalRepository.GetPendingByOperationTargetAsync`, `ICardCommentRepository.CountByCardIdAsync`","Roadmap v4 second-wave delivery (2026-04-25, PRs `#989`--`#994` + `#995`):","- RFAI-02 (`#974`/`#989`): `IntentEnvelopeV1` domain spine with `SourceBlock`/`SourceSpan`, `IntentCandidate`, `EvidenceLink`, `TaskdeckProposalBatch`, `IIntentEnvelopeFactory` application interface, `IChatClient` adapter spike, handwritten `proposal-batch.v1.schema.json`; 117 tests; adversarial review fixed partial-write status transition bug, span length consistency, evidence fabrication prevention, nullable schema fields","- RFAI-06 (`#978`/`#990`): `IVectorIndex` and `IEmbeddingGenerator` application interfaces, `InMemoryVectorIndex` (cosine similarity + SIMD), `InMemoryEmbeddingGenerator` (FNV-1a hash), `EmbeddingBackfillService` with batch processing and stale vector pruning, `FallbackSemanticSearchService`, `EmbeddingBackfillWorker`; 61 tests; adversarial review fixed batch API usage, stale vector cleanup, unbounded memory growth","- RFAI-05 (`#977`/`#991`): `ConfidenceScore` value object, `FieldConfidence`, `SelfConsistencyQuota`, `SelfConsistencyPolicy`, `ConfidenceBucket`/`ConfidenceSource` enums, `ConfidenceAggregator`, `BrierScoreCalculator`; 136 tests; adversarial review fixed hash/equality contract violations, non-finite value rejection, BrierScore input validation","- RFAI-08 (`#980`/`#992`): `TelemetryGuard` with allowlist-based metric validation and ReDoS-safe regex, `EgressRegistry` with wildcard host matching and thread safety, `InsightMetric`/`InsightCohort` content-free records, eval harness framework (`IEvalCase`, `EvalRunner`, 12 seed cases); 108 tests; adversarial review fixed wildcard matching, thread safety, volatile field, unsupported type rejection; CI failure was pre-existing flaky test (fixed in `#995`)","- RFAI-03 (`#975`/`#993`): `ProposalProvenance`, `ProvenanceField` (extractive/inferred with confidence), `FieldVerificationResult`, `ProposalOutcome` (content-free decision ledger), `FuzzyTextMatcher` (Levenshtein sliding-window), `DeterministicPreExtractor` (Microsoft.Recognizers.Text), EF Core migration for `ProposalOutcomes`; 139 tests; adversarial review fixed verification-status/confidence consistency, provenance parent-ID validation, unbounded query limit","- RFAI-04 (`#976`/`#994`): `ProposalRevision` entity (immutable revision chain), `IProposalCompiler` interface, `CompilerValidationResult`, `OperationRisk` value object, `OutcomeType` enum, `UnsupportedOperationFailure`, `IProposalRevisionService`, EF Core migration for `ProposalRevisions` and `ProposalOutcomes`; 70 tests; adversarial review fixed DateTime→DateTimeOffset alignment, redundant cast, documented TOCTOU race","- Flaky CI test fix (`#995`): `Presence_RapidJoinLeave_EventuallyConsistent` replaced exact-count polling with stabilization-based assertions and range checks; timeout increased from 20s to 30s","Current constraints are mostly hardening and consistency:","- _(Historical — superseded first by the 2026-06-13 archive pivot and then by the 2026-07-10 revival pivot; the active execution order is `docs/REVIVAL_PLAN.md`, not `#972`.)_ `taskdeck-12-week-roadmap-v4.md` had been promoted from research input into the near-horizon planning spine via tracker `#972` and child issues `#973`--`#984` (RFAI complete 2026-05-29). The product framing it carried remains valid and unchanged: automation-originated board writes must stay proposal-first, manual board UI writes stay direct and auditable as user-manual activity, and outbound data flow must be guarded separately through the EgressEnvelope/disclosure/MCP-hash/telemetry controls.","- Roadmap v4 execution progress: **RFAI-01 through RFAI-12 fully delivered (12 of 12 issues — roadmap complete)**; RFAI-10 PWA share-target merged in `#1078`, RFAI-11 ambient channel in `#1079`, RFAI-12 learning loop in `#1080` (2026-05-29).","- Codex and Claude high-autonomy issue execution now have first-class local guidance: `.codex/README.md`, `.codex/memories/00_ACTIVE.md`, `.codex/skills/README.md`, `.claude/README.md`, `.claude/skills/README.md`, `docs/tooling/CODEX_AUTONOMY_RUNBOOK.md`, generalized worktree protocol, PowerShell git/worktree guards, GitHub helper scripts, Project v2 priority audit/sync support, and dedicated skills for batch orchestration, worktree issue workers, PR review loops, CI/conflict recovery, question batching, failure capture, and interface-map maintenance. A reusable Gitleaks workflow syntax issue in the summary heredoc has been corrected after the workflow began failing before job creation.","- ~~**security bug discovered 2026-04-03**: `#722` (SEC-20) — `ChangePassword` endpoint does not verify caller identity~~ **RESOLVED** (`#722`/`#732`, 2026-04-04): `ChangePassword` now derives userId exclusively from JWT claims; `[Authorize]` enforced; `UserId` removed from request body; `AuthController` inherits `AuthenticatedControllerBase`; 5 integration tests proving the fix","- security and identity behavior is converging but still not uniform across all controller families","- some UX/operator surfaces are functional but not yet keyboard-first or discoverability-first","- LLM flow now supports config-gated `OpenAI` and `Gemini` providers with deterministic `Mock` fallback for safe local/test posture; degraded provider responses are now structurally distinct (`messageType: \"degraded\"` + `degradedReason`) and the health endpoint supports opt-in probe verification (`?probe=true`); chat-to-proposal pipeline improvements delivered: `LlmIntentClassifier` now uses compiled regex patterns with word-distance matching, stemming/plurals, broader verb coverage, and negative context filtering for negations and other-tool questions (`#571`); parse failures now return structured hint payloads with closest-match suggestions and a frontend hint card with \"try this instead\" pre-fill (`#572`); dedicated classifier and chat-to-proposal integration test coverage added (`#577`); LLM-assisted instruction extraction now delivered (`#573`): OpenAI and Gemini providers request structured JSON output with a system prompt describing supported instruction patterns, parse the response into `LlmCompletionResult.Instructions`, and fall back to the static `LlmIntentClassifier` when structured parsing fails; `ChatService` iterates LLM-extracted instructions (supporting multiple proposals from a single message) and falls back to raw user message parsing when no instructions are extracted; Mock provider unchanged for deterministic test behavior; multi-instruction batch parsing now delivered (`#574`): `ParseBatchInstructionAsync` splits multiple natural-language instructions into individual planner calls, `ChatService` routes multi-instruction messages through batch parsing to generate multiple proposals from a single chat message; board-context LLM prompting now delivered (`#575`, expanded in `#617`): `BoardContextBuilder` constructs bounded board context (columns, card IDs, titles, labels) grouped per column and appends it to system prompts across OpenAI and Gemini providers via `LlmSystemPromptBuilder`; card IDs are included as first-8 hex chars so the LLM can generate `move card ` instructions; context budget increased to 4000 chars with single-query card fetch; **remaining gap**: conversational refinement (`#576`) remains undelivered; analysis at `docs/analysis/2026-03-29_chat_nlp_proposal_gap.md`","- managed-key shared-token abuse-control strategy is now explicitly seeded in `#235` to `#240` before broad external exposure","- testing-harness guardrail expansion from `#254` to `#260` is shipped; remaining work is normal follow-up hardening rather than the original wave","- rigorous test expansion wave seeded 2026-04-03 (`#721` tracker, 22 issues `#699`–`#726`): systematic codebase audit identified 25+ untested infrastructure repositories, zero tests on the central worker, 6 controllers with untested HTTP surfaces, and no golden-path integration test for the capture → proposal → board pipeline; execution is tracked in `docs/TESTING_GUIDE.md`; first delivery: infrastructure repository integration tests (`#699`/`#730` — 77 tests across 7 repo classes against real SQLite); **major wave delivery 2026-04-04** (PRs `#732`–`#739`, 8 issues, ~300 new tests): SEC-20 ChangePassword fix (`#722`/`#732`), golden-path capture→board integration test (`#703`/`#735` — 7 tests proving full pipeline), cross-user data isolation tests (`#704`/`#733` — 38 tests across all major API boundaries), LlmQueueToProposalWorker integration tests (`#700`/`#734` — 24 tests, previously zero coverage), controller HTTP integration tests (`#702`/`#738` — 67 tests covering 6 untested controllers, found 2 pre-existing bugs), proposal lifecycle edge cases (`#708`/`#736` — 74 tests for state machine/expiry/race conditions), OAuth/auth edge cases (`#707`/`#737` — 44 tests, found and fixed `Substring` overflow bug in `ExternalLoginAsync`), MCP full resource/tool inventory (`#653`/`#739` — 9 resources + 11 tools with 42 tests, GP-06 compliant, user-scoping gap fixed during review); **second wave delivery 2026-04-04** (PRs `#740`–`#755`, 8 issues, ~586 new tests with two rounds of adversarial review, 47 review-fix commits): domain entity state machine exhaustive tests (`#701`/`#740` — 174 tests across 7 entities: CommandRun, ArchiveItem, ChatSession, UserPreference, NotificationPreference, CardLabel, CardCommentMention), SignalR hub and realtime integration tests (`#706`/`#751` — 19 tests covering auth, presence lifecycle, multi-user, authorization, edge cases), LLM provider abstraction and tool-calling edge cases (`#709`/`#747` — 101 tests across orchestrator, provider, classifier, registry), data export/import round-trip integrity tests (`#713`/`#752` — 64 tests covering JSON, CSV, GDPR, database, cross-format validation), API error contract regression and boundary validation (`#714`/`#753` — 57 tests across 7 endpoint families with GP-03 contract enforcement), archive and restore lifecycle integration tests (`#715`/`#755` — 74 tests: 45 domain + 29 API covering state machine, cross-user isolation, conflict detection, audit trail), board metrics and analytics accuracy verification (`#718`/`#749` — 61 tests: 51 service + 10 controller covering throughput, cycle time, WIP, blocked cards, done-column heuristic), notification delivery, deduplication, and preference filtering (`#719`/`#746` — 36 tests covering all 5 notification types, deduplication, preference filtering, cross-user isolation, batch operations)","- MVP dogfooding flow now supports canonical checklist bootstrap in chat (proposal-first, board-scoped); broader template coverage remains future work","- collaborative editing now includes board/card presence visibility and conflict-hinting guardrails for stale card writes","- card collaboration now includes threaded comments with mention-linked notifications and moderation-aware edit/delete guardrails","- capture/inbox realignment is now shipped for the CAP MVP loop (`#200` to `#211`); logging redaction guardrails are delivered in `#212`, and long-list virtualization for inbox/activity views is delivered in `#213`","- frontend interaction latency budgets and instrumentation are delivered in `#250`: performance mark composable, route-transition/board/inbox/review/home/diff instrumentation, lazy route splitting, and documented thresholds in `docs/PERFORMANCE_BUDGETS.md`","- post-demo-expansion planning is now explicitly biased toward product legibility before new surface breadth: novice-first entry, board-context continuity, readable review flows, and stronger in-app guidance take precedence over broad autonomy work","- cold first-run now has launch-criteria proofing beyond route teaching; guided `Home`, durable workspace modes, review-first automation routing, the recoverable `Today` onboarding path, board-centered review/capture handoff, key-route contextual help, and the novice-first docs/help-center stack (root entry docs, chaptered manual, and page-level help/workflow guides) are now shipped, and the dedicated first-run smoke plus launch-criteria guardrail is delivered in `#328`","- Saul-facing demo reconciliation is now explicit: the core `Home -> Inbox/Capture -> Review -> Board` proof is shipped, the business-facing substrate/trust-cue/hero-path slices are delivered through `#354` plus demo-critical follow-through from `#326` and `#330`; the rehearsal contract is now codified in `docs/product/SAUL_DEMO_REHEARSAL_CONTRACT.md` (`#355`), and the GTM baseline was delivered in `#216` with a timed demo script (`docs/product/DEMO_SCRIPT.md`), thesis-aligned landing copy (`docs/product/LANDING_COPY.md`), and beta intake workflow/cadence (`docs/product/BETA_INTAKE_WORKFLOW.md`) _(caveat — landing copy + beta intake are now **not-in-use per the 2026-06-13 archive pivot** (GTM retired); `DEMO_SCRIPT.md` stays a live demo asset)_","- demo rehearsal walkthrough (2026-03-27) confirmed the core loop is visually correct but surfaced 9 runtime issues in seed tooling, scenario runner, and DX ergonomics; two are blockers for one-command deterministic rehearsal: seed re-run 409 conflicts (`#387`) and `--skip-llm` proposal alias resolution failure (`#389`); tracked in `#395` with analysis in `docs/analysis/2026-03-27_demo-rehearsal-runtime-issues.md`","- fresh-registration manual test (2026-03-29) surfaced 2 P0 blockers and 16 additional bugs/observations spanning data isolation, board stability, dark-mode theming, chat utility, and UX polish; full findings at `docs/analysis/2026-03-29_manual_testing_consolidated_findings.md`; P0 blockers: queue data not scoped to the authenticated user (`#508`), board auto-switching on multi-board accounts (`#509`); P1 issues tracked in `#510` through `#515`; P2/P3 in `#516` through `#524`; **no external user onboarding should occur until `#508` is resolved**; two bugs from this session now resolved: activity audit trail not recording board mutations (`#521`, fixed — audit logging wired for all board/card/column/label mutations with `SafeLogAsync` resilience wrapper), archive board 30-second freeze (`#519`, fixed — navigation before reactive state teardown prevents cascading re-renders)","- _(**Superseded 2026-06-13** by the archive pivot — the cloud/mobile/distribution pillars and the `v0.1.0`→`v1.0.0` GA versioning plan below are **de-scoped**; see the Direction note at the top of this file. Kept as a historical record.)_ platform expansion strategy (2026-03-29) covered four strategic pillars: market adoption (`#544`), packaging/distribution (`#532`), cloud/collaboration (`#537`), and mobile platform (`#540`); master strategy tracker at `#531`; strategy documents at `docs/strategy/`; release versioning plan: `v0.1.0` (self-contained exe) → `v0.2.0` (hosted cloud) → `v0.3.0` (PWA/mobile) → `v0.4.0` (collaboration) → `v0.5.0` (platform maturity) → `v1.0.0` (GA)","- hands-on UX testing (2026-03-31) surfaced 8 areas of feedback spanning review, inbox, today, home, board, notifications, and LLM chat; 2 P1 issues (capture triage fails on natural-language text `#614`, chat response truncation showing raw JSON `#616`), 11 P2 usability/visual-coherence issues (`#611`–`#613`, `#615`, `#617`, `#620`, `#622`, `#624`–`#627`), and 4 P3 polish/strategic items (`#618`–`#619`, `#621`, `#623`); tracker at `#628`; full analysis at `docs/analysis/2026-03-31_manual_testing_ux_feedback.md`; cross-cutting themes: progressive disclosure needed across review/today/notifications, semantic color vocabulary for status tags, capture pipeline needs LLM-assisted extraction, and chat needs tool-calling/function-calling architecture; LLM tool-calling spike (`#618`) and MCP server spike (`#619`) seeded for strategic planning","- UX feedback wave 1 delivered (2026-03-31): 6 of 17 issues from `#628` resolved — sidebar footer pinned (`#623`), card drag layout shift eliminated (`#621`), starter-pack modal migrated to design tokens (`#612`), capture triage error messages surfaced with retry hint (`#615`), board context expanded with card IDs for LLM chat (`#617`, N+1 query fixed), review proposal cards now use collapsible detail sections with risk color-coding and keyboard-accessible links dropdown (`#626`)","- UX feedback wave 2 delivered (2026-03-31): 5 additional issues resolved — both P1 blockers closed: capture triage now handles dash-separated (` - `) and semicolon-delimited text with first-segment context hints and single-sentence fallback (`#614`), chat JSON array truncation detection extended to `[`-started responses with degraded message UX (`#616`); P2: notification list now has type-colored left borders, type badges, smart same-type grouping, time-based section headers, and batch \"Mark all read\" with board-scoped optimistic update (`#625`); P4: global search endpoint now supports `maxResults`/`offset` pagination with `hasMore`/`totalCardCount` response fields and frontend \"Load more\" in command palette (`#610`); ops: `ci-extended.yml` now auto-triggers on `.csproj`/workflow/deploy/script changes, PR template and AGENTS.md updated (`#608`); remaining open from `#628`: 0 P2 (~~`#613`~~ delivered in `#665`), 2 P3 strategic spikes (`#618`, `#619`) both completed with implementation waves delivered (Phase 1+2 for tool-calling `#647`, Phase 1 for MCP `#648`)","- LLM tool-calling spike (`#618`) completed (2026-04-01): architecture document at `docs/spikes/SPIKE_618_COMPLETED.md`; decided on custom implementation over Semantic Kernel (~800 LOC, zero new dependencies), extending `ILlmProvider` with `CompleteWithToolsAsync`, 11 tools (5 read + 6 write, writes always produce proposals per GP-06), new `ToolCallingChatOrchestrator` with multi-turn loop (max 5 rounds, 60s timeout), Mock provider with pattern-based dispatch, ~$0.00088 per 3-round conversation on GPT-4o-mini; implementation tracker at `#647` with phase issues `#649` (read tools + orchestrator — delivered), `#650` (write tools + proposals — delivered), `#651` (Phase 3 refinements — delivered, PR `#773`)","- LLM tool-calling Phase 1 delivered (`#649`, 2026-04-01): `CompleteWithToolsAsync` added to `ILlmProvider` with OpenAI, Gemini, and Mock implementations; 5 read tool executors (`list_board_columns`, `list_cards_in_column`, `get_card_details`, `search_cards`, `get_board_labels`) in Application layer; `ToolCallingChatOrchestrator` with multi-turn loop (max 5 rounds, 30s/round, 60s total timeout) and graceful degradation to single-turn on failure; Mock provider uses pattern-matching dispatch table for deterministic simulation; SignalR `ToolStatusEvent` integration for intermediate state streaming; `ChatService` delegates to orchestrator for board-scoped sessions with automatic single-turn fallback; 67 new tests","- LLM tool-calling Phase 2 delivered (`#650`/`#731`, 2026-04-03): 6 write tool executors (`propose_create`, `propose_move`, `propose_archive`, `propose_update`, `propose_bulk_move`, `propose_create_column`) in Application layer; EF migration adds `ToolCallMetadataJson` for provenance; orchestrator now serves 11 tools (5 read + 6 write); writes always produce proposals per GP-06; frontend tool-status indicators show write-tool progress via SignalR","- Double LLM call eliminated (`#672`/`#727`, 2026-04-03): `ChatService` reuses the orchestrator's text response when no tools are called instead of making a second LLM call; halves latency for non-tool chat messages; remaining follow-up items: argument replay (`#673`)","- MCP server spike (`#619`) completed (2026-04-01): architecture document at `docs/spikes/SPIKE_619_COMPLETED.md`; decided on official MCP C# SDK (`ModelContextProtocol` v1.2.0), embedded in API process with `--mcp` startup flag, stdio transport first (Claude Code/Cursor), 9 resources under `taskdeck://` URI scheme, 9 tools (2 read + 5 write + 2 proposal management, `approve_proposal` intentionally excluded), API key auth (`tdsk_` prefix) for remote HTTP transport, write tools return proposal IDs for review-first compliance; implementation tracker at `#648` with phase issues `#652` (minimal prototype), `#653` (full inventory), `#654` (HTTP + auth), `#655` (production hardening, deferred)","- MCP minimal prototype delivered (`#652`/`#664`, 2026-04-01): `ModelContextProtocol` NuGet v1.2.0 added; `IUserContextProvider` interface in Application layer with `StdioUserContextProvider` implementation; `BoardResources` class with `[McpServerResource]` for `taskdeck://boards` resource returning compact JSON (id, name, columnCount, cardCount, isArchived, updatedAt); `--mcp` startup flag in `Program.cs` selects stdio host builder skipping web server overhead; 11 integration tests covering shape, archived exclusion, counts, empty results, and multi-user scoping","- UX feedback wave 3 delivered (2026-04-01): review proposal card UX improved (`#613`/`#665`) — sticky action footer with `position: sticky; bottom: 0` keeps action buttons visible regardless of card content length, cards constrained to `max-height: 70vh` (80vh mobile) with internal scrolling, detail section heights capped at `12rem`","- GDPR data portability delivered (`#83`/`#666`, 2026-04-01): `DataExportService` exports all user-scoped data as versioned JSON package (boards, notifications, captures, proposals, chat sessions, audit trail, preferences); `AccountDeletionService` with password re-authentication + confirmation phrase safeguard, PII anonymization (username/email/password), `BoardAccess` cleanup, sole-owner guard, transactional rollback on partial failure; `DataPortabilityController` with `[Authorize]` + `[ResponseCache(NoStore = true)]`; PII-free audit logging at request and completion stages; 32 tests; follow-up items: export streaming for large datasets (`#670`); JWT invalidation after deletion delivered (`#671`/`#698`+`#728`)","- Board metrics dashboard delivered (`#77`/`#667`, 2026-04-01): `BoardMetricsService` computes throughput (audit-log-based card completion), cycle time (creation-to-done via audit), WIP (cards per column), and blocked card count/duration; `MetricsController` with date range, board, and label filters; done column resolved by name heuristic (done/complete/finished/shipped/etc.) with positional fallback; frontend dashboard at `/workspace/metrics` with CSS bar charts, summary cards, tables, board selector, date picker, loading/error/empty states; lazy-loaded route + sidebar nav link; 24 backend + 22 frontend tests; SQL-level filtering follow-up delivered (`#675`/`#724`)","- GitHub OAuth frontend integration delivered (`#539`/`#668`, 2026-04-01): conditional \"Sign in with GitHub\" button in LoginView based on `/api/auth/providers` response; OAuth code exchange flow with demo-mode gating, array-safe query param extraction, and awaited URL cleanup; session store action with error handling and toast notifications; open redirect prevention on both backend (`Url.IsLocalUrl`) and frontend (`sanitizeInternalRedirect`); follow-up: distributed auth code store, PKCE, account linking (`#676`)","- Hardening and UX wave delivered (2026-04-03, PRs `#691`–`#698`): 9 issues resolved across 8 PRs with adversarial review follow-through:"," - **P1 bug fixed** (`#681`/`#691`): Archive, Activity, Ops, and Access workspace routes no longer silently redirect to Home — feature flags for shipped surfaces now default to `true`; 5 new router guard tests"," - **Expired proposal handling** (`#678`+`#690`/`#696`): Review no longer presents expired proposals as \"Approved, ready to apply\"; expired proposals show distinct status badge with dismiss/clear action; client-side expiry detection with 60-second reactive clock covers proposals the housekeeping worker hasn't transitioned yet; 9 new tests"," - **Chat card ID continuity** (`#677`/`#695`): new `CardIdPrefixResolver` resolves 8-char hex prefixes to full GUIDs via board-scoped prefix matching; wired into `AutomationPlannerService` (6 call sites) and `NaturalLanguageInstructionExtractor`; full GUIDs pass through without DB hits; 15 new tests"," - **Human-readable proposal diffs** (`#682`/`#697`): `GetProposalDiffAsync` now batch-loads cards and columns (2 queries) and resolves operation targets to names; falls back to raw GUID when resolution fails; frontend diff panel with ARIA label and word-wrapping; 4 new tests"," - **Dark theme label manager** (`#684`/`#692`): 22 light-theme Tailwind classes replaced with design-token equivalents following ColumnEditModal pattern; 2 new tests"," - **Chat health banner three-state** (`#679`/`#693`): `verificationStatus` field (`unverified`/`verified`/`failed`) added to health DTO; banner shows amber for configured-but-unverified, green for verified, red for failed; 6 new tests"," - **OpenAI strict mode + loop detection** (`#674`/`#694`): `strict: true` added to OpenAI tool schemas; SHA256-based loop detection in orchestrator aborts when consecutive rounds have identical tool-call fingerprints (with error-retry bypass for transient failures); 10 new tests"," - **JWT invalidation after account deletion** (`#671`/`#698`): `TokenInvalidatedAt` field on User entity with EF migration; `TokenValidationMiddleware` checks `IsActive` and compares token `iat` against invalidation timestamp on every authenticated request; `AccountDeletionService` sets invalidation timestamp during deletion; whole-second precision truncation matches JWT `iat` granularity; ADR-0021 documents the design decision; 9 new tests","- Post-hardening delivery wave (2026-04-03, PRs `#724`–`#731`): 6 issues resolved across 6 PRs:"," - **SQL-level board metrics filtering** (`#675`/`#724`): `BoardMetricsService` now uses SQL-level filtering via new repository methods (`GetForMetricsAsync`, `CountCardsByColumnAsync`, `GetBlockedByBoardIdAsync`) instead of in-memory filtering; frontend `Math.max(...spread)` replaced with `reduce` for empty-array safety"," - **Double LLM call elimination** (`#672`/`#727`): `ChatService` reuses the orchestrator's text response when no tools are called, halving latency for non-tool chat messages"," - **JWT invalidation hardening** (`#671`/`#728`): `ActiveUserValidationMiddleware` checks user active status on every authenticated request with 30-second in-memory cache; cache invalidated on deletion/deactivation"," - **Expired proposal review UX** (`#678`+`#690`/`#729`): `IsExpired` flag on `ProposalDto`, domain `CanBeDismissed` method, expired proposals rendered distinctly in Review with dismiss action and disabled apply/approve buttons"," - **Infrastructure repository integration tests** (`#699`/`#730`): 77 new tests across 7 repository classes against real SQLite; found and fixed a real `LlmQueueRepository` ordering bug"," - **LLM write tools and proposal integration** (`#650`/`#731`): 6 write tool executors (`propose_create`, `propose_move`, `propose_archive`, `propose_update`, `propose_bulk_move`, `propose_create_column`), EF migration for `ToolCallMetadataJson`, orchestrator now serves 11 tools total (5 read + 6 write), frontend tool-status indicators for write operations","- Security + testing + MCP delivery wave (2026-04-04, PRs `#732`–`#739`): 8 issues resolved across 8 PRs with two rounds of adversarial review:"," - **SEC-20 ChangePassword identity bypass fixed** (`#722`/`#732`): userId now derived exclusively from JWT claims; `[Authorize]` enforced; `UserId` removed from request body; `AuthController` refactored to inherit `AuthenticatedControllerBase`; 5 new integration tests"," - **Golden-path integration test** (`#703`/`#735`): 7 tests exercising full capture → triage → proposal → review → board pipeline; validates card title, column placement, provenance chain, multi-operation atomicity, cross-user isolation, audit trail, and triage failure determinism"," - **Cross-user data isolation tests** (`#704`/`#733`): 38 integration tests across all major API boundaries (boards, columns, cards, captures, proposals, notifications, audit trails, chat sessions, knowledge docs, webhooks, board exports, labels, board access controls); includes shared-board grant/scope/revocation tests; adversarial review caught and fixed 3 false-positive tests and missing precondition assertions"," - **LlmQueueToProposalWorker integration tests** (`#700`/`#734`): 24 tests covering happy path, empty queue, transient/permanent error, retry/backoff, cancellation, fair-batch interleaving, already-claimed items, and capture triage paths; adversarial review fixed fake repository status-tracking and race condition simulation"," - **Controller HTTP integration tests** (`#702`/`#738`): 67 tests covering 6 previously-untested controllers (DataPortability, AbuseContainment, Metrics, Search, AgentProfiles, AgentRuns) + 17 new authz regression matrix entries; discovered 2 pre-existing bugs (agent list 500, empty board export); adversarial review fixed weak assertions and resource leaks"," - **Proposal lifecycle edge cases** (`#708`/`#736`): 74 tests (42 domain + 25 application + 7 api) covering expiry timing boundaries, double-apply prevention, comprehensive state machine violations, dismissal edge cases, operation mutation guards, batch expiry, worker-vs-manual race conditions; adversarial review fixed clock-resolution flakiness and added 5 new edge case tests"," - **OAuth/auth edge case tests** (`#707`/`#737`): 44 tests covering login/registration edge cases, token validation (malformed/expired/wrong-key/missing-claims), OAuth code exchange, open redirect prevention, middleware enforcement; **found and fixed production bug**: `ExternalLoginAsync` `Substring(0, 50)` overflow for short usernames"," - **MCP full resource and tool inventory** (`#653`/`#739`): 9 resources under `taskdeck://` URI scheme + 11 tools (2 read + 6 write + 3 proposal management); all write tools produce proposals per GP-06; `approve_proposal` intentionally excluded; 42 MCP-specific tests; **adversarial review found and fixed user-scoping gap** on proposal resources/tools","- Post-adversarial-review hardening and test expansion wave (2026-04-04, PRs `#741`–`#756`, 9 issues):"," - **Product telemetry taxonomy** (`#341`/`#741`): `docs/product/TELEMETRY_TAXONOMY.md` defines 35+ named events across 7 categories (Capture, Proposal/Review, Board, Auth, Navigation, Agent, Error) with `noun.verb` naming convention, universal envelope, privacy guardrails (bucketed counts, no PII), and R1/R2/R3 launch gate anchors. The recording surface **is implemented** (`TelemetryController` `POST /api/telemetry/events` + `GET /api/telemetry/config`, backed by `TelemetryEventService` with event-name **format** validation (the `noun.verb` regex — not membership in the taxonomy registry) and a property-key allowlist) but is **opt-in and OFF by default** (`TelemetrySettings.Enabled = false`); recorded events are currently logged rather than persisted/forwarded. _(The R1/R2/R3 launch-gate anchors are de-scoped by the archive pivot; syncing the backend allowlist/registry to the full taxonomy remains open — see `docs/product/TELEMETRY_TAXONOMY.md`.)_"," - **Board header presence label fixed** (`#683`/`#744`): `normalizePresenceMembers()` in `BoardView.vue` now replaces current user's SignalR `displayName` with locally-known username, eliminating email/username flip on card open; 3 new tests"," - **Manual card provenance empty state** (`#680`/`#754`): `cardsApi.getCardProvenance()` now returns null only for \"Capture provenance not found\" 404s (not all 404s); CardModal shows \"No capture provenance available.\" with `loadedCaptureProvenanceCardId` guard against flash; 4 new tests; adversarial review caught and fixed 3 bugs (overly broad 404 catch, global Axios log-level regression, empty-state flash)"," - **WIP-limit duplicate toast regression** (`#686`/`#745`): 7 regression tests in `boardStore.wipLimit.spec.ts` guard against future double-toast on WIP limit violations for createCard and moveCard"," - **Auth-flow toast regression coverage** (`#685`/`#742`): 20 tests in `sessionStore.authToast.spec.ts` covering login/register/OAuth failure and success toast lifecycle, isolation, and auto-removal; adversarial review fixed timer leak, mock isolation, and inverted assertion"," - **Route and workspace-state stability** (`#687`/`#748`): `authGuard.spec.ts` (auth guard decision table) and `workspaceRouteStability.spec.ts` (mode persistence, hydration drift, resetForLogout) with 16-case exhaustive guard table; also fixed pre-existing `AuthControllerEdgeCaseTests.cs` compile error"," - **Inbox triage action visibility** (`#688`/`#743`): 21 new tests in `InboxView.spec.ts` covering single-item triage action states and bulk action bar visibility with DOM-level assertions"," - **Webhook HMAC signature verification** (`#726`/`#750`): 11 tests in `OutboundWebhookHmacDeliveryTests.cs` covering header format, HMAC round-trip, wrong-key rejection, secret rotation, large payload, and timing-safe comparison; adversarial review fixed rotation test and replaced BCL-testing stubs with real domain property tests"," - **Webhook delivery reliability and SSRF boundary** (`#710`/`#756`): 78 webhook tests across 9 files (endpoint guard, service, signature, delivery worker, HMAC delivery, API, repository, domain delivery, domain subscription); SSRF coverage via `OutboundWebhookEndpointGuardTests` includes private IPv4/IPv6 ranges; delivery reliability covers retry/backoff, dead-letter, concurrent delivery, HMAC at worker boundary; `HttpClient` resource leak fixed in tests","- Tech-debt, security, and feature hardening wave (2026-04-04, PRs `#765`–`#770`, `#776`, 7 issues, ~32 new backend tests + 33 new frontend tests, two rounds of adversarial review per PR):"," - **Agent API 500 fix** (`#758`/`#776`): root cause was `DateTimeOffset` ORDER BY failing in SQLite; `AgentProfileRepository` fixed with materialize-then-sort; `AgentRunRepository` upgraded to `IsSqlite()` + `FromSqlInterpolated` pattern for SQL-level ORDER BY + LIMIT; 2 previously-skipped tests un-skipped; round 2 review caught and fixed the load-all-before-limit performance issue in `AgentRunRepository`"," - **DataExport exception logging** (`#759`/`#766`): `ILogger` added to `DataExportService` and `AccountDeletionService` with `LogError` in previously-silent catch blocks; round 2 review added `OperationCanceledException` filter to avoid monitoring noise and changed rollback to `CancellationToken.None` for reliability; 3 new tests"," - **Streaming chat token usage** (`#763`/`#768`): `LlmTokenEvent` extended with `TokensUsed`, `Provider`, and `Model` fields; all 3 LLM providers (Mock, OpenAI, Gemini) populate usage on final stream event; `ChatService.StreamResponseAsync` now persists assistant `ChatMessage` with token usage and records quota via `ILlmQuotaService.RecordUsageAsync` (matching non-streaming path); 4 new/updated tests"," - **EF Core version alignment** (`#760`/`#767`): downgraded `Microsoft.EntityFrameworkCore`, `.Sqlite`, `.Design`, and `.Tools` from 9.0.14 to 8.0.14 across Infrastructure and Api projects; removed EF9-only `PendingModelChangesWarning` suppression; replaced stale `Microsoft.AspNetCore.Http` 2.3.9 with `FrameworkReference Include=\"Microsoft.AspNetCore.App\"`; round 2 review added `PrivateAssets=\"all\"` to Design package; migration snapshot `ProductVersion: \"9.0.14\"` is metadata-only, self-corrects on next migration"," - **Frontend HTTP interceptor and auth guard tests** (`#725`/`#765`): 33 new tests across 2 files — `http.spec.ts` (19 tests: token injection, 401 handling, demo mode, X-Request-Id, error propagation) and `routerIntegration.spec.ts` (14 tests: auth guards, feature flags, legacy redirects, expired token handling); `axios-mock-adapter` added as dev dependency; round 2 review fixed CI-breaking ESLint `no-import-assign` with `vi.hoisted` pattern, `window.location` restoration leak, and inaccurate docstring"," - **OAuth token lifecycle tests** (`#723`/`#769`): 19 integration tests covering auth code store (valid exchange, expiry, replay prevention, concurrent atomicity, cleanup), JWT lifecycle (expiry, wrong key, garbage token, deactivated user, re-issue after password change), SignalR query-string auth (3 tests), and GitHub OAuth config (2 tests); round 2 review fixed redundant ternary, `HttpClient` resource leak in concurrent test, misleading SignalR test names, and weak string-contains assertion"," - **Tool argument replay** (`#673`/`#770`): `Arguments` field (`JsonElement`) added to `ToolCallResult` with backward-compatible default; orchestrator passes original arguments through; OpenAI uses `GetRawText()` and Gemini uses inline `Arguments` object in synthetic replay messages instead of hardcoded `\"{}\"` / `new { }`; falls back to empty when `ValueKind == Undefined`; `GeminiLlmProvider.BuildToolCallingPayload` promoted to `internal` for testability; 6 new tests","- Dependency hygiene, accessibility, tool-calling refinements, streaming, and test coverage wave (2026-04-04, PRs `#771`–`#779`, 8 issues, ~258 new tests with two rounds of adversarial review per PR):"," - **Vendored dependency cleanup** (`#761`/`#771`): removed `vendor/ws-7.5.10.tgz` file and orphaned Dockerfile `COPY vendor/` line; `ws` now resolves from npm registry as `^7.5.10`; no-op `p-limit@3.0.2` override removed; adversarial review caught stale STATUS.md and MASTERPLAN docs references and updated them"," - **Accessibility lint: 105 warnings → 0** (`#762`/`#779`): form label associations (`for`/`id` pairs, `aria-label`), keyboard event companions for click handlers, `role=\"dialog\"` + `aria-modal` + Escape handler on modal backdrops, redundant-role removals; `--max-warnings 20` CI threshold enforced; adversarial review found and fixed 2 CI regressions: `TdTooltip.vue` Vue-Fragment breakage (9 failing tests) and invalid `tabindex=\"-1\"` on `role=\"option\"` items; 2 non-blocking ARIA follow-up items filed"," - **Tool-calling Phase 3 refinements** (`#651`/`#773`): `LlmToolCallingSettings` DI singleton with `Enabled` (default `true`) and `MaxToolResultBytes` (default 8 000) config keys; `ChatService` bypasses orchestrator when disabled; `TruncateToolResult` enforces UTF-8 byte budget via binary search with zero heap allocations in the search loop; cost tracking DI wiring completed; 17 new tests; adversarial review caught byte-budget contract violation when `maxBytes < marker length` and replaced O(n) loop with correct binary search"," - **Export streaming for large datasets** (`#670`/`#774`): new `GET /api/account/export/stream` endpoint streams JSON response body via `Utf8JsonWriter` — memory usage is constant regardless of dataset size; N+1 chat-message count query fixed with `CountBySessionIdsAsync` (single GROUP BY query, 500-session windows to respect SQLite 999-param limit); backward-compatible with original `/export` endpoint; 15 tests; adversarial review caught `ToErrorActionResult()` crash when called after `Response.HasStarted`; streaming HTTP 200 partial-response limitation documented in controller comment"," - **Frontend view vitest coverage** (`#716`/`#775`): 83 new tests for 6 previously-untested views (LoginView, RegisterView, BoardsListView, ExportImportView, SavedViewsView, DevToolsView) with DOM-level assertions for loading/error/empty states, user interactions, and form validation; adversarial review fixed 3 ESLint errors (CI blocker: unused vars, invalid `[key]` selector) and added 3 missing OAuth callback path tests"," - **Pinia store integration tests** (`#711`/`#777`): 91 new tests across 6 stores (boardStore, captureStore, workspaceStore, queueStore, notificationStore, sessionStore) mocking HTTP layer rather than API modules, exercising real API client code; covers boardStore auto-switch regression (`#509`), queueStore data isolation (`#508`); adversarial review fixed fake timer leak, unreliable microtask drain, and 4 `as never[]`/`as never` type bypasses defeating integration test value"," - **Resilience and degraded-mode tests** (`#720`/`#778`): 34 new tests (18 backend + 16 frontend) covering ChatService LLM provider failure/fallback, worker crash/retry/cancellation/max-retries, frontend store error states, SignalR reconnect polling fallback; adversarial review fixed unused import (CI blocker), double-invocation anti-pattern, and 150ms timing race widened to 500ms"," - **E2E error state expansion** (`#712`/`#772`): 25 new Playwright scenarios across 3 spec files (`error-recovery.spec.ts`, `multi-board.spec.ts`, `edge-journeys.spec.ts`) using `page.route()` for deterministic error injection without live backend dependency; adversarial review fixed unused import (CI blocker), route glob missing query-param suffix, 3 vacuous soft-assertion blocks replaced with unconditional assertions","- Feature, analytics, MCP, chat, testing, and UX expansion wave (2026-04-08, PRs `#787`–`#793`, 7 issues, ~390+ new tests with two rounds of adversarial review per PR):"," - **Exportable analytics CSV** (`#78`/`#787`): `MetricsExportService` with schema-versioned CSV export, CSV injection protection (leading-char and embedded-newline sanitization), UTF-8 BOM for Excel compatibility; `GET /api/metrics/boards/{boardId}/export` endpoint with date range/label filters and `Content-Disposition` attachment header; frontend \"Export CSV\" button in MetricsView with error toast; `ADR-0022` defers PDF export; 29 tests (21 unit + 8 integration); adversarial review caught and fixed embedded-newline injection vector (HIGH), missing CancellationToken forwarding, and silent frontend error swallowing"," - **Forecasting and capacity-planning service** (`#79`/`#790`): `ForecastingService` with rolling-average throughput from audit log card-move events, standard-deviation confidence bands (optimistic/expected/pessimistic), average cycle time from creation-to-done; `GET /api/forecast/board/{boardId}` endpoint with documented assumptions and data-point count; frontend forecast section in MetricsView showing estimated completion, confidence range, and caveats; 32 tests; adversarial review caught and fixed throughput double-counting when cards bounce Done→InProgress→Done (HIGH), history-window calculation using wrong denominator, and regex compiled fresh on every call"," - **MCP HTTP transport and API key authentication** (`#654`/`#792`): `ApiKey` domain entity with `tdsk_` prefix and SHA-256 hashing at rest; EF Core migration for `ApiKeys` table with unique `KeyHash` index; `ApiKeyMiddleware` for Bearer token validation on `/mcp` path; `HttpUserContextProvider` maps API key → user for claims-first identity; `ApiKeysController` REST endpoints (create/list/revoke) with JWT auth; `MapMcp()` HTTP transport alongside REST endpoints via `ModelContextProtocol.AspNetCore`; rate limiting per API key (60 req/60s); 31 tests (11 domain + 20 integration); adversarial review caught and fixed key-existence oracle via differentiated error messages (MEDIUM), modulo bias in key generation, and bare catch block"," - **Conversational refinement loop** (`#576`/`#791`): `ClarificationDetector` with strong/weak signal pattern split for ambiguity detection, max 2 clarification rounds before best-effort, skip-phrase detection (\"just do your best\"); `ChatService` integration tracking clarification state and injecting system prompt guidance; Mock provider simulates clarification for deterministic testing; frontend clarification badge and \"Skip, just do your best\" button in AutomationChatView; 41 tests (22 detector + 7 service + 6 false-positive regression + domain); adversarial review caught and fixed false-positive heuristic classifying normal LLM responses as clarification (HIGH)"," - **Concurrency and race condition stress tests** (`#705`/`#793`): 13 stress tests in `ConcurrencyRaceConditionStressTests.cs` covering queue claim races (double-triage, stale timestamp, batch concurrent), card update conflicts (concurrent moves, stale-write 409, last-writer-wins), column reorder race, proposal approval races (double-approve, approve+reject, double-execute), rate limiting under load (burst beyond limit, cross-user isolation), and multi-user board stress; uses `SemaphoreSlim` barriers with `WaitAsync` for true simultaneity and separate `HttpClient` per task; SQLite write serialization limitations documented; proposal decision losers now return `409 Conflict` via proposal `UpdatedAt` optimistic concurrency; adversarial review fixed misleading doc comments, tightened weak assertions, and replaced non-thread-safe variables with `ConcurrentDictionary`"," - **Property-based and adversarial input tests** (`#717`/`#789`): 211 tests across 5 files — 77 FsCheck domain entity tests (adversarial strings: unicode, null bytes, BOM, ZWSP, RTL override, surrogate pairs, XSS, SQL injection; boundary lengths; GUID/position validation), 29 JSON serialization round-trip fuzz tests (GUID format variations, DateTime boundaries, malformed JSON, large payloads), 80 API adversarial integration tests (no 500s from any adversarial input across board/card/column/capture/auth/search endpoints, malformed JSON, wrong content types, concurrent adversarial requests), 16 fast-check frontend input sanitization property tests, 9 store resilience property tests; `fast-check` added as frontend dev dependency; adversarial review fixed capture payload round-trip testing wrong DTO and null handling inconsistency in FsCheck generators"," - **Inbox premium primitives** (`#249`/`#788`): `InboxView.vue` reworked to use shared UI primitive components — `TdSkeleton` for loading states, `TdInlineAlert` for errors, `TdEmptyState` for empty list, `TdBadge` for status chips, `TdSpinner` for detail refresh; ~65 lines of redundant CSS removed; 7 new vitest tests; adversarial review fixed skeleton screen reader announcements (added `role=\"status\"` and sr-only labels) and redundant `role=\"alert\"` nesting","- Ephemeral integration databases via Testcontainers (`#91`): `Taskdeck.Integration.Tests` project with `Testcontainers.PostgreSql` and `Npgsql.EntityFrameworkCore.PostgreSQL` packages; `PostgresContainerFixture` manages a shared ephemeral PostgreSQL container per xUnit collection; each test method gets its own isolated database (no cross-test contamination); schema created via `EnsureCreated()` from the EF Core model for PostgreSQL provider parity; 20 integration tests across 7 test classes covering Board CRUD, Card operations, Proposal lifecycle, per-test isolation verification, and sequential operation validation; CI workflow at `reusable-container-integration.yml` in ci-extended lane (label: testing); guide at `docs/testing/TESTCONTAINERS_GUIDE.md`","- Mutation testing pilot now delivered (`#90`): Stryker.NET targeting `Taskdeck.Domain` (backend) and Stryker JS targeting `captureStore`/`boardStore` (frontend); non-blocking weekly CI lane (`.github/workflows/mutation-testing.yml`); policy and triage guidance at `docs/testing/MUTATION_TESTING_POLICY.md`; 60% low / 80% high thresholds with 0% break (triage signal, not enforcement gate); scope expansion roadmap covers Application layer and additional frontend stores","- Supplementary test depth wave (2026-04-13, PRs `#821`–`#826`, ~429 new tests with two rounds of adversarial review per PR):"," - **Frontend store integration tests** (`#711`/`#821`): 88 new tests across 6 files — chatApi integration (22), boardStore column reorder/conflict (11), queueStore polling/transitions (12), sessionStore OIDC/SSO (14), notificationStore realtime (15), workspaceStore mode persistence (14); mocks HTTP layer (not API modules) to test full store → API → HTTP chain; round 2 review fixed missing in-memory state assertions, incorrect resetForLogout test comment, and 12 weak `rejects.toBeDefined()` assertions replaced with type-specific matchers"," - **E2E scenario expansion** (`#712`/`#822`): 20 new Playwright scenarios across 5 spec files — onboarding (5), review proposals (3), capture edge cases (4), keyboard navigation (4), dark mode (4); 17 passing, 3 gracefully skipped (dark mode toggle not present in current UI); round 2 review fixed missing `baseURL` in browser context (critical), brittle CSS selectors replaced with `getByLabel`, no-op assertions, unreliable `body.click()` defocusing, and misleading header comments"," - **Resilience and degraded-mode behavior tests** (`#720`/`#823`): 30 new tests across 3 files — LLM provider resilience (13: garbage/empty/missing-choices/429/timeout for OpenAI and Gemini, probe unhealthy), queue accumulation resilience (3: accumulation without corruption, item processability, rapid concurrent captures), frontend slow-API/storage resilience (14: loading states, throttle dedup, corrupted localStorage/token handling); round 2 review fixed CI-breaking unused import, unhandled promise rejections, contradictory test name, and misleading JWT comment"," - **Property-based and adversarial input tests** (`#717`/`#824`): 162 new tests across 8 files — domain property tests (93: ChatSession, ChatMessage, Notification, KnowledgeDocument, WebhookSubscription with adversarial strings, boundary lengths, state machine exhaustion), application fuzz tests (19: JSON round-trip for chat/notification DTOs), API adversarial tests (50: raw JSON with adversarial positions, XSS/injection payloads, unicode blocks, extra unknown fields, control chars); round 2 review fixed silent 500-skip, fake `[Property]` on deterministic tests, 7× copy-pasted generators replaced with shared adversarial generator (~45 vectors), and misleading URL trim comment"," - **Concurrency and race condition stress tests** (`#705`/`#825`): 22 new tests across 7 files — queue claim races (4), card update conflicts (5), proposal approval races (4), webhook delivery concurrency (2), board presence concurrency (2), rate limiting (3), cross-user isolation stress (2); uses `SemaphoreSlim` barriers for true simultaneous execution; SQLite write serialization limitations documented; round 2 review fixed critical thread-pool deadlock (blocking `Barrier.SignalAndWait` in async lambdas), cross-user isolation race condition, silent pass on broken rate limiting, and 2 data-loss-hiding weak assertions"," - **Frontend view and component coverage gaps** (`#716`/`#826`): 107 new tests across 8 files — ArchiveView (11), MetricsView (16), BoardView (12), ReviewView (10), AutomationChatView (16), CardItem (21), BoardCanvas (12), BoardActionRail (9); covers loading/error/empty states, user interactions, ARIA attributes, drag events; round 2 review fixed CI-blocking unused import, DOM pollution (missing afterEach cleanup), incorrect generic type, and misleading test name","- Manual validation and verification program delivery (2026-04-15, PRs `#837`–`#841`):"," - **TST-09 manual validation slice C** (`#132`/`#839`): 45-scenario catalog for automation proposals, chat bootstrap, and execution safety in `docs/testing/MANUAL_VALIDATION_SLICE_C_SCENARIOS.md`; 17 Playwright E2E tests across 2 spec files (`validation-automation-proposals.spec.ts` with 8 tests, `validation-chat-bootstrap.spec.ts` with 9 tests); manual rehearsal runbook at `docs/testing/MANUAL_REHEARSAL_RUNBOOK_SLICE_C.md`"," - **TST-10 manual validation slice D** (`#133`/`#837`): 25-scenario catalog for ops CLI, log query/correlation, and health telemetry in `docs/testing/MANUAL_VALIDATION_SLICE_D_SCENARIOS.md`; 17 Playwright E2E tests in `validation-ops-logs-health.spec.ts`; operator rehearsal runbook at `docs/testing/MANUAL_REHEARSAL_RUNBOOK_SLICE_D.md`"," - **TST-11 manual validation slice E** (`#134`/`#840`): 25-scenario catalog for starter packs, archive recovery, and activity traceability in `docs/testing/MANUAL_VALIDATION_SLICE_E_SCENARIOS.md`; 23+ Playwright E2E tests across 3 spec files (`validation-starter-packs.spec.ts`, `validation-archive-recovery.spec.ts`, `validation-activity-traceability.spec.ts`); rehearsal runbook at `docs/testing/MANUAL_REHEARSAL_RUNBOOK_SLICE_E.md`"," - **TST-12 integrated verification program** (`#135`/`#838`): 18-scenario cross-component verification strategy in `docs/testing/INTEGRATED_VERIFICATION_STRATEGY.md`; 4 Playwright E2E tests in `integrated-verification.spec.ts` covering full capture-to-board pipeline, board bootstrap, workspace navigation, and auth denial; manual rehearsal template at `docs/testing/MANUAL_REHEARSAL_TEMPLATE.md`; release gating criteria documented; `docs/TESTING_GUIDE.md` updated with cross-references"," - **INT-06 integrations registry foundation** (`#340`/`#841`): full-stack integrations registry with domain entities (`IntegrationConnector`, `ConnectorEvent` with `ConnectorType`/`ConnectorDirection`/`ConnectorStatus` enums), application service (`IntegrationRegistryService` with `IIntegrationConnectorRepository`/`IConnectorEventRepository`), EF Core infrastructure (repositories + `AddIntegrationConnectorsAndEvents` migration), API (`IntegrationsController` with 7 endpoints — CRUD + enable/disable, all `[Authorize]`), frontend (`IntegrationsView.vue` at `/workspace/integrations` with `integrationStore` and `integrationsApi` with enum normalization), connector taxonomy (inbound/context/outbound per GP-06 — inbound connectors route through capture), architecture documentation at `docs/architecture/INTEGRATIONS_REGISTRY.md`; 60 new tests (24 domain + 12 application + 15 API + 9 frontend)"," - Tracker closures: 6 completed trackers closed — `#721` (TST-54 rigorous test expansion wave), `#647` (LLM-05 tool-calling), `#648` (MCP-00 server), `#329` (MVP-03 secondary follow-through), `#242` (UI-00 premium UI wave), `#235` (SEC-15 managed-key threat model)","- Post-validation documentation sweep (2026-04-16, PR `#844`):"," - **Wave index and delivery annotations sweep** (`#844`): updated `#107` wave execution index with 126/129 completed items checked; added \"(delivered)\" annotations to ~100+ items across Stages 2--5 in `ISSUE_EXECUTION_GUIDE.md`"," - Note: PRs `#822`, `#841`, `#877`--`#880`, `#882` remain open and are not yet merged; their contents will be documented here upon merge","- Production hardening wave from AUDIT.md findings (2026-04-22, PRs `#902`–`#913`, 12 PRs covering 10 tracked audit issues plus 2 CI stabilisation fixes):"," - **PERF-13 SQL-level AuditLog filtering** (`#849`/`#903`): `AuditLogRepository.QueryAsync` SQLite branch now uses `BuildSqliteQueryAsync` that pushes `userId`/`boardId`/`source`/`level` filters plus `ORDER BY`/`LIMIT` into a parameterised raw SQL query; board-scoped filter uses `EXISTS` subqueries (matching `GetByBoardAsync`) to avoid the SQLite `SQLITE_MAX_VARIABLE_NUMBER` limit and removes 3 extra round-trips from `ResolveBoardScopedEntityIdsAsync` for SQLite; non-SQLite providers continue to use in-memory pagination with `Contains()`"," - **PERF-11 WorkspaceService sync-over-async removal** (`#847`/`#904`): replaced `.Result` in `GetOnboardingForPreferenceAsync` with sequential `await`; parallel `Task.WhenAll` branches in `GetHomeAsync`/`GetTodayAsync` intentionally reverted to sequential awaits in round 2 review because all repositories share the scoped `DbContext` via `IUnitOfWork` (EF Core `DbContext` is not thread-safe)"," - **SEC-26 SSRF protection for webhook and LLM provider URLs** (`#850`/`#905`): new `SsrfProtectionService` in Application layer with `ValidateUrl`/`ValidateUrlWithDnsAsync`/`ValidateLlmProviderUrl` methods wrapping `OutboundWebhookEndpointGuard`; explicit cloud metadata hostname blocking (`metadata.goog`, `metadata.google.internal`, Alibaba Cloud `100.100.100.200`, AWS IMDSv2 IPv6 `fd00:ec2::254`); LLM provider selection policy now calls `ValidateLlmProviderUrl` for `OpenAi`/`Gemini` `BaseUrl` (rejects private IPv4/IPv6, cloud metadata, non-HTTPS) with `allowLocalhostEndpoints` toggle for Development + `AllowLiveProvidersInDevelopment` (enables Ollama/LM Studio); OpenAI + Gemini `HttpClient` registrations now use `OutboundWebhookConnectCallback` for DNS-rebinding defense and `AllowAutoRedirect = false`; 83 `SsrfProtectionServiceTests` covering private IPv4 (`127/8`, `10/8`, `172.16/12`, `192.168/16`), IPv6 ranges (`::1`, `fc00::/7`, `fe80::/10`), IPv4-mapped IPv6, decimal/hex/octal IP bypass attempts, and HTTPS enforcement"," - **TST-58 CLI test discovery + shared harness** (`#853`/`#906`): added missing `[Fact]`/`[Theory]` attributes across CLI test files; extracted shared `CliTestHarness` (replaced ~90-line duplicated harness in 5 files); `AppContext.BaseDirectory` dll lookup replaces fragile repo-tree walk; 30-second process timeout via `CancellationTokenSource`; `[Collection(\"Console Tests\")]` for `Console.Out` thread safety; `InternalsVisibleTo` added so internal CLI types can be unit-tested; CLI test suite now totals ~78 tests across 10 files (ArgParser 15, ApiKey 12, Cards 11, Columns 10, Boards 7, ConsoleOutput 7, CliActorIdentity 5, ExitCodes 4, CliJsonContract 4, CommandDispatcher 3)"," - **OPS-27 startup configuration validation** (`#863`/`#908`): data annotations (`[Required]`, `[Range]`, `[MinLength]`, `[RegularExpression]`, `[Url]`) on 15 settings classes (`JwtSettings`, `WorkerSettings`, `CacheSettings`, `RateLimitingSettings`, `LlmProviderSettings`, `OpenAiProviderSettings`, `GeminiProviderSettings`, `ObservabilitySettings`, `SentrySettings`, `SecurityHeadersSettings`, `TelemetrySettings`, `LlmQuotaSettings`, `LlmToolCallingSettings`, `AbuseDetectionSettings`, `MfaPolicySettings`); 4 cross-property `IValidateOptions` validators (`WorkerSettingsValidator` for `RetryBackoffSeconds.Length >= MaxRetries`, `JwtSettingsValidator` for secret length, `SentrySettingsValidator` for `Dsn` when `Enabled`, `RateLimitingSettingsValidator` for nested policy ranges); `ValidateDataAnnotations()` + `ValidateOnStart()` wiring via new `RegisterValidatedOptions` helper; `LlmProvider`/`CacheProvider` regex patterns use `(?i)` case-insensitive flag to match runtime comparison; `RateLimitPolicySettings` exposes range constants to prevent data-annotation/validator divergence; `JwtSettings.SecretKey` intentionally not `[Required]` because `FirstRunBootstrapper` generates it; 34 new `OptionsValidationTests`"," - **PERF-12 board list pagination** (`#848`/`#909`): new `PaginatedResult` DTO (`items`/`totalCount`/`hasMore`/`offset`/`limit`); `BoardService.ListBoardsPaginatedAsync` applies authorization filter before pagination so `totalCount` reflects only authorised boards; `BoardRepository.SearchIdsAsync` sorts by `CreatedAt DESC` with `Id` as deterministic tiebreaker so page boundaries do not overlap across calls; `GET /api/boards` accepts `offset`/`limit` query parameters (default `limit=50`, server-clamped to `[1, 200]`); frontend `boardsApi.getBoards` delegates to new `getBoardsPaginated` and unwraps `.items` for backward compatibility; archive-recovery E2E fix: unwrap `.items` from paginated response; 11 new `BoardPaginationApiTests` (default pagination, empty, offset beyond total, zero limit clamp, cross-user isolation, full-page iteration)"," - **SEC-30 file import content validation** (`#860`/`#910`): new `FileContentValidator` in Application layer with `ValidateTextContent` (binary/null-byte/C1-control detection; blocks all C1 controls including `0x91-0x94`/`0x96-0x97` because in UTF-16 they are genuine control chars, not Windows-1252 smart quotes — real smart quotes decode to `U+2018-U+201D`), `ValidateJsonContent` (BOM-aware parse + magic-byte check against SQLite `SQLite format 3\\0`), and character-based limits (renamed from `MaxMarkdownContentBytes` → `MaxMarkdownContentChars` to match `NoteImportService` CJK-safe semantics); `NoteImportController` (markdown + web clip), `ExternalImportsController` (CSV), and `ExportController` (board JSON) now validate content before it reaches the service layer; board JSON re-import passes `maxBytes: 0` to preserve round-trip portability for large exports; 52 `FileContentValidatorTests` covering text/JSON/binary/BOM/C1-control/size-limit/Unicode edge cases"," - **SEC-27 dev JWT secret removal and unconditional bootstrap** (`#851`/`#911`): removed hardcoded `Jwt:SecretKey` from `appsettings.Development.json`; `FirstRunBootstrapper.EnsureJwtSecret` now runs unconditionally in all environments (including Development and CI/headless) after round 2 review — the original headless guard caused CI auth failures because `GITHUB_ACTIONS=true` made `IsHeadlessEnvironment()` return `true` and the subsequent `AddTaskdeckAuthentication` short-circuited without registering auth services; non-JWT bootstrap checks consolidated into a single early-return; `TestWebApplicationFactory` now provides its own in-memory JWT secret so API tests are environment-independent; `IOException` fallback catches parallel-test contention on `appsettings.local.json`; `CONTRIBUTING.md` documents auto-generation, `dotnet user-secrets`, and `Jwt__SecretKey` env-var alternatives; `CONFIGURATION_REFERENCE.md` and `SECRETS_MANAGEMENT_BASELINE.md` updated to match"," - **OPS-28 EF Core migration bootstrap verification** (`#864`/`#907`): 5 `MigrationBootstrapTests` verifying fresh-database migration integrity — full chain applies cleanly, all expected tables created (verified via reflection from `DbContext` DbSets rather than hardcoded list so tests auto-adapt), `Migrate()` is idempotent, no pending migrations after full apply, `HasPendingModelChanges()` reports no drift (detects real model/snapshot divergence, not just missing migration files), and all migration timestamps are distinct; `GetUserTables()` uses `OpenConnection()`/`CloseConnection()` instead of disposing the `DbContext`-owned connection; workflow guide at `docs/platform/EF_MIGRATION_WORKFLOW.md` (add/apply/revert/script migrations, bootstrap verification, SQLite troubleshooting); round 2 review surfaced real model drift: `ExternalLoginConfiguration` declared a `HasOne` FK with cascade delete but the original `AddExternalLogins` migration did not create the FK constraint — captured in new migration `AddExternalLoginsUserForeignKey` (SQLite table-rebuild) so the snapshot and model agree; `ProductVersion` bumped `8.0.25` → `8.0.26` to match installed EF packages"," - **CI-02 Gitleaks secrets detection** (`#871`/`#902`): `.gitleaks.toml` extends default rules with project-specific allowlists (test fixture secrets, dev placeholders, CI-only config strings, JWT test keys, fake LLM API keys, OAuth test fixtures); `.gitleaksignore` for per-finding fingerprint suppression; reusable workflow `reusable-gitleaks.yml` with configurable `scan-mode` (`pr`/`full`) and `fail-on-findings` toggle, `gitleaks/gitleaks-action` pinned to commit SHA `ff98106e` (not a mutable tag) for supply-chain safety; `ci-extended.yml` runs a non-blocking advisory PR scan on every PR; `ci-release.yml` runs a blocking full-history scan via the CLI (event-agnostic, works on `release` events that the GitHub Action does not support); SARIF artefacts uploaded for review; CI topology comment in `ci-required.yml` updated"," - **CI stabilisation — ActivityView test flake on Windows** (`#912`, no issue): `ActivityView.spec.ts` `seedBoards()` previously called `new Date().toISOString()` twice in immediate succession and relied on stable sort preserving declaration order when both timestamps resolved to the same millisecond; on `windows-latest` the second call advanced past the first more often, making the component's `updatedAt DESC` sort pick `board-2` instead of `board-1` as the default selection and breaking downstream `fetchBoard` assertions; fix assigns explicit ordered ISO timestamps (`board-1 = 2025-01-02`, `board-2 = 2025-01-01`) so sort order is deterministic regardless of `Date` resolution"," - **CI stabilisation — cross-process FirstRunBootstrapper write serialisation** (`#913`, no issue): parallel xUnit test processes racing on `appsettings.local.json` read-modify-write produced invalid trailing `}` after valid JSON (`File.WriteAllText` is not atomic across processes); fix serialises the read-modify-write with a named cross-process mutex (hashed from the absolute config path) and stages new contents in a sibling temp file that is atomically moved over the destination so no partial file is ever visible to another process; surfaced by `#911` removing the headless early-return around `EnsureJwtSecret`","- CI/hardening, frontend decomposition, ops, and documentation wave (2026-04-22, PRs `#914`--`#924`, 10 issues):"," - **OPS-30 monitoring and alerting rules** (`#868`/`#914`): `docs/ops/ALERTING_RULES.md` (356 lines, 10 alert rules) with severity-tiered thresholds — P1: 5xx rate >1%, worker heartbeat >5min, DB connectivity loss, health endpoint failure; P2: p95 latency >2s, disk >80%, memory >85%, queue backlog >100, CPU >80%, SignalR/Redis degradation; integration paths for Grafana, CloudWatch, and PagerDuty documented; `docs/ops/README.md` and `docs/ops/OBSERVABILITY_BASELINE.md` updated with cross-links"," - **CI-01 SAST scanning with Semgrep** (`#870`/`#915`): `.semgrep/taskdeck-csharp.yml` (5 custom C# rules) and `.semgrep/taskdeck-typescript.yml` (5 custom TypeScript rules); `scripts/ci/summarize-sast-findings.mjs` for human-readable finding summaries; `.github/workflows/reusable-sast-scanning.yml` wired into `ci-extended` (label: `security`) and `ci-nightly`; advisory mode by default with enforceable option; ADR-0031 documents the SAST scanning decision"," - **TST-61 database migration validation in CI** (`#869`/`#916`): `scripts/ci/validate-migrations.sh` for CI migration chain validation; `.github/workflows/reusable-migration-validation.yml` wired into `ci-required` as a parallel job; `docs/platform/EF_MIGRATION_WORKFLOW.md` updated with CI validation section"," - **DOC-08 data model reference with ERD** (`#875`/`#917`): `docs/architecture/DATA_MODEL.md` (855 lines, 37 entities, Mermaid ERD) covering all domain entities with relationships, field types, and constraints; cross-linked from 5 API docs (BOARDS, CAPTURE, CHAT, WEBHOOKS, AUTHENTICATION)"," - **CI-03 performance regression gate** (`#872`/`#918`): k6 thresholds (p95 <2s, error rate <1%); `scripts/ci/check-bundle-size.mjs` and `scripts/ci/check-k6-thresholds.mjs` for deterministic threshold enforcement; `.github/workflows/reusable-performance-regression-gate.yml` wired into `ci-extended` (label: `performance`) and `ci-nightly`; `docs/PERFORMANCE_BUDGETS.md` updated with CI gate thresholds"," - **FE-20 session timeout warning** (`#861`/`#919`, backend `#933`/`#939`): `useSessionTimeout.ts` composable (245 lines) with configurable warning-before-expiry, countdown timer, and extend/logout actions; `SessionTimeoutWarning.vue` wired into `App.vue`; backend `POST /api/auth/refresh` endpoint now implemented with `[Authorize]` gate, JWT-claims-only user ID, `TokenRefreshPerUser` rate limiting (5/60s), and `TokenInvalidatedAt` enforcement; 19 frontend tests + 10 backend integration tests"," - **FE-18 decompose AutomationChatView** (`#859`/`#920`): 1,523 lines reduced to 235-line shell + 7 components (`ChatHeroHeader`, `LlmHealthStatusBar`, `ChatSessionSidebar`, `ChatMessageList`, `ChatParseHintCard`, `ChatToolCallDetails`, `ChatComposeBar`) + `useAutomationChat` composable (394 lines); all components under 400 lines"," - **FE-17 decompose InboxView** (`#858`/`#921`): 1,527 lines reduced to 222-line shell + `InboxListPanel`, `InboxDetailPanel`, `useInboxOrchestrator` composable, and `inboxUtils`; all existing tests pass without modification"," - **FE-16 decompose ReviewView** (`#856`/`#923`): 1,659 lines reduced to 148-line shell + 6 components (`ReviewHeader`, `ReviewSummaryCards`, `ReviewEmptyState`, `ReviewProposalCard`, `ReviewProposalActions`, `ReviewProposalDetails`) + 2 composables (`useReviewProposals`, `useReviewActions`); all 45 existing ReviewView tests pass without modification"," - **HARD-01 circuit breaker for external API calls** (`#876`/`#924`): Polly circuit breakers on OpenAI, Gemini HTTP clients, and OAuth backchannel; `CircuitBreakerStateTracker` singleton and `CircuitBreakerSettings` config class; health endpoint reports circuit breaker state as degraded (not 503); 23 tests; ADR-0032 documents the circuit breaker decision","- Docs, CI hardening, and bug-fix wave (2026-04-23, PRs `#936`–`#942`): 7 PRs across docs cleanup, bug fixes, and CI hardening:"," - **Docs cleanup** (`#934`/`#936`): removed legacy `TASKDECK_E2E_DB` env var prefix from Playwright commands across 5 docs; annotated duplicate `#326` follow-up relationship; removed redundant `TASKDECK_E2E_API_CORS_ORIGINS` env var from fallback commands"," - **UTF-8 mojibake fix** (`#929`/`#937`): 109 encoding fixes in `STATUS.md` — 46 em dashes, 17 en dashes, 46 right arrows replaced from CP1252→UTF-8 double-encoding artifacts"," - **Redundant migration no-op** (`#932`/`#938`): `AddExternalLoginsUserForeignKey` migration made no-op — FK was already added by earlier `AddTokenInvalidatedAt` migration"," - **Auth refresh endpoint** (`#933`/`#939`): `POST /api/auth/refresh` with `[Authorize]`, JWT-claims user ID, `TokenRefreshPerUser` rate limiting (5/60s), `TokenInvalidatedAt` enforcement; 10 integration tests; completes FE-20 session timeout backend"," - **Test count recertification** (`#930`/`#940`): TESTING_GUIDE.md updated with verified counts — backend 4,979, frontend unit 2,607, combined 7,586+ (subsequently recertified to 5,060/2,805/7,865+ in `#970`/`#987`)"," - **UserPreferences race fix** (`#931`/`#941`): replaced try-catch-retry (~105 lines) with atomic `INSERT OR IGNORE` SQLite upsert (~15 lines) in `UserPreferenceRepository`; 4 concurrency tests added"," - **Pre-existing CI fix** (`#942`): resolved 5 API Integration test failures — `Connectors:EncryptionKey` added to Production-mode test configuration; MCP telemetry test assertion index corrected","- Mobile, security, legal, and testing expansion wave (2026-04-23, PRs `#944`–`#949`):"," - **FE-19 mobile-responsive board, toolbar, and dialog** (`#860`/`#944`): board view stacks columns vertically on ≤640px viewports with page-level scroll; `TdDialog` becomes full-bleed at ≤640px with `100dvh` height and stacked footer actions (cascades to all consumers: CardModal, BoardSettingsModal, LabelManager, StarterPackCatalog, KeyboardHelp); board toolbar and action rail enforce 44×44px tap targets on mobile; `ColumnLane` uses `--td-font-lg` token for 16px font-size to prevent iOS zoom; new `@mobile` Playwright test; WCAG 2.4.3 dialog footer tab-order fix; adversarial review addressed scoped slot CSS penetration and overflow-x interaction"," - **SEC-29 CSP style-src tightening (partial)** (`#855`/`#945`): removed `'unsafe-inline'` from `style-src` in API CSP entirely; added `style-src-elem 'self'` in reverse-proxy CSP to block inline `