ℹ️ About Codex in GitHub

\\n
\\n\\n[Your team has set up Codex to review pull requests in this repo](https://chatgpt.com/codex/cloud/settings/general). Reviews are triggered when you\\n- Open a pull request for review\\n- Mark a draft as ready\\n- Comment \\\"@codex review\\\".\\n\\nIf Codex has suggestions, it will comment; otherwise it will react with 👍.\\n\\n\\n\\n\\nCodex can also answer questions or update the PR. Try commenting \\\"@codex address that feedback\\\".\\n \\n

\",\"path\":null,\"side\":null,\"line\":null}{\"type\":\"pull_request_comment\",\"body\":\"## Independent adversarial review #2 — security / governance / tests\\n\\n**Exact head reviewed:** `1ec17437a1a6c04de2feba95b456baf3e1af8fd3`\\n\\nI first inspected the PR conversation, reviews, and review threads, plus linked issue #1228 and its existing maintainer comment. At posting time the PR has the `@codex review` request and one Codex DCO thread; no other PR comments/reviews were present.\\n\\n### MEDIUM\\n\\n1. **The retained “manual approval” is not an active gate, so the workflow and canonical docs would report an approval that never occurred.**\\n\\n The promotion job merely references `environment: production` and then unconditionally writes “Manual approval: granted” ([workflow lines 188–205](https://github.com/Chris0Jeky/Taskdeck/blob/1ec17437a1a6c04de2feba95b456baf3e1af8fd3/.github/workflows/cd-staging-gate.yml#L188-L205)). A live `GET /repos/Chris0Jeky/Taskdeck/environments` immediately before this review returned only `copilot` and `github-pages`; there is no `production` environment or required-reviewer rule. GitHub documents that a workflow reference to a missing environment creates it **without protection rules or secrets**, so this job will not wait for approval ([GitHub environment documentation](https://docs.github.com/en/actions/how-tos/deploy/configure-and-manage-deployments/manage-environments#creating-an-environment)).\\n\\n This contradicts the new Masterplan claim that manual approval “remain[s] available” ([line 15](https://github.com/Chris0Jeky/Taskdeck/blob/1ec17437a1a6c04de2feba95b456baf3e1af8fd3/docs/IMPLEMENTATION_MASTERPLAN.md#L15)), the deployment guide’s “Requires manual approval” statement ([line 298](https://github.com/Chris0Jeky/Taskdeck/blob/1ec17437a1a6c04de2feba95b456baf3e1af8fd3/docs/ops/DEPLOYMENT_WORKFLOW.md#L298)), and the PR summary. The job does not itself deploy, which limits immediate blast radius, but it emits a false production-approval record. Either configure and prove a protected `production` environment with required reviewers (and record that external prerequisite), or make the job, PR body, and canonical docs truthful about the current unprotected environment reference.\\n\\n2. **The verification does not prove #1228’s requested negative-trigger behavior.**\\n\\n The existing maintainer comment on #1228 explicitly asks to confirm that a test tag/release event triggers nothing waiting on `production`. The PR’s Not verified section confirms no release event was emitted. Exact-head [Workflow Lint](https://github.com/Chris0Jeky/Taskdeck/actions/runs/30232985065/job/89875215961) proves Actions syntax, while [Docs Governance](https://github.com/Chris0Jeky/Taskdeck/actions/runs/30232973727/job/89875176488) proves the repository’s mechanical documentation rules; neither emits a `release` event nor asserts this workflow’s trigger set. The diff is persuasive manual evidence that `release: published` was deleted, but the linked verification requirement remains unproved and there is no executable regression guard. Add a deterministic trigger-contract check (Actions-aware parsing/assertion that this workflow exposes only `workflow_dispatch` with required `image_tag`) or keep #1228 open until authorized post-merge live negative-event evidence is recorded. The PR should not say hosted workflow validation will “exercise” the release-trigger change when it only lints it.\\n\\n### Existing-feedback triage\\n\\nThe Codex DCO thread is **invalid for this exact head**: it cites `2087697bf039c8ae6541a39067aad7a26ccff9e7`, which is not in the PR’s two-commit list and is not found by the repository commit API. The actual commits are `948d5705b1f9cc337382ca0a14556777f86087e9` and `1ec17437a1a6c04de2feba95b456baf3e1af8fd3`; both include matching `Signed-off-by:` trailers, and the exact-head [DCO check is green](https://github.com/Chris0Jeky/Taskdeck/actions/runs/30232973727/job/89875176413). No DCO rewrite is needed.\\n\\n### Other reviewed surfaces\\n\\n- Event syntax is valid and the head’s top-level trigger is now only `workflow_dispatch`.\\n- `image_tag` remains a required string; `skip_smoke` remains a boolean, and the build/smoke job dependency behavior is unchanged.\\n- Workflow permissions remain read-only (`contents: read`, `actions: read`); no new secret or write permission was introduced.\\n- Scope is otherwise faithful: one trigger subscription removed, existing jobs retained, and the six-file diff is limited to workflow truth and its documentation mirrors.\\n\",\"path\":null,\"side\":null,\"line\":null}","text_elements",[],{"_669":1642,"_648":649,"_671":655},{"_672":1643,"_674":-5,"_42":-5,"_676":1644,"_678":-5,"_97":507,"_93":680},[1645],{"_681":655},{"_46":1638,"_93":704},{"_669":1647,"_648":649,"_671":655},{"_672":1648,"_674":-5,"_42":-5,"_676":1649,"_678":-5,"_97":507,"_93":680},[1650,1651],{"_681":655},{"_46":1653,"_93":704},{"_46":1652,"_93":704},"\n /workspace/Taskdeck\n bash\n 2026-07-27\n Etc/UTC\n /workspace/Taskdeck\n","# AGENTS.md instructions for /workspace/Taskdeck\n\n\n# Repository Guidelines\n\nThis document is a concise contributor guide for the Taskdeck repository.\nIts scope applies to the entire repo unless overridden by more specific `AGENTS.md` files in subfolders.\n\n## Always start here (required)\n- Read `OUTSTANDING_TASKS.md` (repo root) — the maintainer's durable cross-session checklist. Surface its open items in any summary/status/handoff; only check items off when the maintainer says they are done.\n- Read `docs/STATUS.md` for Current Focus and constraints (source of truth).\n- Use `docs/IMPLEMENTATION_MASTERPLAN.md` for roadmap context.\n- Use `docs/GOLDEN_PRINCIPLES.md` for stable repository invariants and guardrails.\n- Use `docs/ISSUE_EXECUTION_GUIDE.md` for dependency-aware issue execution order.\n- For Codex routing, read `.codex/README.md` and `.codex/memories/00_ACTIVE.md`.\n- For Claude Code routing, read `.claude/README.md` and `CLAUDE.md`.\n- For test operations, see `docs/TESTING_GUIDE.md`.\n- Precedence when instructions conflict: `docs/STATUS.md` > this file > subfolder `AGENTS.md`.\n\n## MCP tools (agent tooling)\n- See `docs/MCP_TOOLING_GUIDE.md` for tool selection rules and safe usage.\n- For high-autonomy Codex issue/PR/CI batches, see `docs/tooling/CODEX_AUTONOMY_RUNBOOK.md`.\n- For low-context agent orientation, use `autodoc/AGENT_INDEX.md`.\n- For blocker questions, unresolved failures, guide updates, and skill routing, use `docs/agentic/`.\n- MCP-first default: when an MCP tool can perform a task, use MCP before shell/CLI alternatives.\n- Prefer MCP tools over guessing:\n - OpenAI/Codex/API docs -> openaiDeveloperDocs MCP\n - Third-party library docs -> Context7 MCP\n - UI reproduction/regression -> Playwright MCP\n - Repo search -> native `rg` (ripgrep MCP unreliable on Windows; fallback to GitHub search_code)\n - Issues/PRs/workflows -> GitHub MCP (write actions only when required)\n- Fallback rule:\n - if MCP is unavailable, failing, or lacks required capability, use shell/CLI fallback and state that fallback briefly in handoff notes.\n\n## Multi-Agent / Parallel Execution (required)\n- When the Codex runtime exposes spawned subagents, use them without asking for extra permission when they are efficient for safely parallelizable work — but right-size the fan-out (start inline; a few agents, not a reflexive fleet), and keep one coordinator for synthesis and final verification.\n- Split only when work can be separated by clear ownership and can proceed without blocking the coordinator's immediate next step.\n- If spawned agents are unavailable, use explicit git worktrees plus separate Codex/Claude sessions or GitHub coding-agent tasks; do not claim subagent execution unless it actually happened.\n- Split ownership by file/module/concern so concurrent work does not overlap.\n- Keep one coordinator responsible for issue selection, synthesis, conflict resolution, docs rehydration, project status/priority sync, and final verification.\n- Do not delegate final synthesis, ownership decisions, or broad vague cleanup.\n- For batch issue execution, PR review loops, CI recovery, and docs reconciliation, follow `docs/tooling/CODEX_AUTONOMY_RUNBOOK.md`.\n\n## Project Operations Automation (required)\n- Read `docs/GITHUB_PROJECT_AUTOMATION.md` before changing project operations, issue templates, or workflow conventions.\n- Canonical project status model is: `Pending`, `Now`, `Next`, `Blocked`, `Review`, `Done`.\n- Do not introduce labels in issue templates that are not in the required label set documented in `docs/GITHUB_PROJECT_AUTOMATION.md`.\n- Priority sync is mandatory:\n - For issue project items, set project `Priority` to match the issue's single priority label (`Priority I` to `Priority V`).\n - For PR project items, derive `Priority` from linked/referenced issues; if multiple priorities exist, choose highest urgency (`I` highest); if none can be derived, set `Priority V`.\n - Before handoff, verify no issue/PR project item has empty `Priority`.\n- If workflow/status conventions change, update both:\n - `docs/GITHUB_PROJECT_AUTOMATION.md`\n - this `AGENTS.md` (only if contributor behavior expectations changed)\n\n## Local skill packs\n- Repo-local Codex skills live under `.codex/skills/` and supplement `AGENTS.md`; they do not override it. Start with `.codex/skills/README.md`.\n- Repo-local Claude Code skills live under `.claude/skills/` and mirror the same Taskdeck workflows for Claude sessions. Start with `.claude/skills/README.md`.\n- Use `.codex/skills/taskdeck-issue-batch-orchestrator` when asked to take care of many issues, pick issues, coordinate worktrees/subagents, open PRs, run review loops, or reconcile a high-autonomy batch.\n- Use `.codex/skills/taskdeck-worktree-issue-worker` when implementing a single assigned issue in an isolated worktree.\n- Use `.codex/skills/taskdeck-pr-review-loop` when reviewing PRs, spinning fresh adversarial reviewers, posting findings, or addressing review/bot comments.\n- Use `.codex/skills/taskdeck-ci-conflict-recovery` when checking failing CI, resolving PR conflicts, inspecting bot comments, or recovering blocked PRs.\n- Use `.codex/skills/taskdeck-repo-onramp` when the request is broad, the repo area is unfamiliar, or current Taskdeck reality must be reconciled before planning.\n- Use `.codex/skills/taskdeck-backend-slice` for backend/API/application/infrastructure/worker/auth behavior changes.\n- Use `.codex/skills/taskdeck-frontend-workspace-slice` for frontend shell, workspace, route, help-state, and novice-legibility work outside the core capture-review semantics.\n- Use `.codex/skills/taskdeck-capture-review-loop` when capture, inbox, proposal review, execute flow, provenance, or board handoff semantics are involved.\n- Use `.codex/skills/taskdeck-demo-regression` when a task needs the right evidence path, seeded demo state, Playwright proof, or stakeholder-facing walkthrough validation.\n- Use `.codex/skills/taskdeck-verification-doc-sync` at the end of implementation to choose the right checks, update only the right docs, and prepare the required Taskdeck handoff summary.\n- Use `.codex/skills/taskdeck-question-batch` when ambiguity needs a blocker/assumption decision instead of context-expensive question loops.\n- Use `.codex/skills/taskdeck-failure-capture` when failed tools, tests, CI, MCP, docs checks, or workarounds must be classified and surfaced.\n- Use `.codex/skills/taskdeck-interface-map` when adding, splitting, or documenting complex seams that should be findable through `autodoc/AGENT_INDEX.md`.\n\n## Work protocol (required)\n- Before edits: write a short plan (files, approach, risks, tests).\n- Keep diffs small and scoped; avoid large mixed refactors.\n- Ask only for true blockers; otherwise proceed with explicit assumptions. Use `docs/agentic/QUESTION_PROTOCOL.md`.\n- Do not silently bury failed commands or tool workarounds. Use `docs/agentic/FAILURE_LEDGER.md` when unresolved failures matter for future agents or handoff confidence.\n- Prefer incremental execution with incremental, file-scoped commits when the work spans multiple files or concerns.\n- After edits: run required checks and report results.\n- If you cannot run checks, state exactly why and what you would run.\n- In this Windows PowerShell environment, do not chain commands with `&&`; use `;` and check `$LASTEXITCODE` when failure handling matters.\n- For product-facing slices, ensure issue scope and acceptance criteria explicitly align with the current thesis (reduce maintenance overhead/capture friction and preserve review-first trust).\n\n### Windows Git Reliability Fallback\n- Run `bash scripts/check-git-env.sh` at the start of a session to validate git resolution and index.lock state.\n- In PowerShell/Codex-native sessions, prefer `powershell -File scripts/check-git-env.ps1`; the Bash script remains available for Bash shells.\n- If `git` resolves to Cygwin or produces signal/pipe-style failures, use `C:\\Program Files\\Git\\cmd\\git.exe` explicitly for repo operations (or add `C:\\Program Files\\Git\\cmd` to the front of `PATH`).\n- Every new commit you create or submit to a pull request, including a locally created merge commit, must include a `Signed-off-by:` trailer. In automated/background terminals, use `git commit -s --no-gpg-sign` for ordinary commits, `git merge --signoff --no-gpg-sign BRANCH_NAME` for a clean commit-producing merge (replace `BRANCH_NAME` with the source ref), and `git commit -s --no-gpg-sign --no-edit` after staging conflict resolutions; `-s`/`--signoff` adds the DCO trailer while `--no-gpg-sign` avoids hidden GPG pinentry. GitHub's server-generated merge commit is outside the pull-request commit set; do not rewrite shared history to add a trailer to it. Never use `--no-verify`; hooks must run, and failures must be investigated.\n- If a commit fails because `.git/index.lock` cannot be created, first check for active `git` processes; remove `.git/index.lock` only when no git process is running. The `check-git-env.sh` script automates this detection.\n- For stacked branches with small conflict surfaces, prefer `merge` over `rebase` when branch reconciliation starts stalling (for example long-running interactive/conflict loops). Start a commit-producing reconciliation with `git merge --signoff --no-gpg-sign BRANCH_NAME` after replacing `BRANCH_NAME` with the source ref. If it conflicts, resolve and stage the files, then finish with `git commit -s --no-gpg-sign --no-edit` instead of `git merge --continue`.\n\n### Codex Worktree Safety\n- Use `scripts/git/New-CodexIssueWorktree.ps1` to create isolated issue worktrees under `.worktrees/`.\n- First command in a Codex worktree worker session must be `powershell -File scripts/worktree_guard.ps1` (or `source scripts/worktree_guard.sh` in Bash).\n- Do not pass absolute main-checkout paths to worktree workers; derive paths from `$env:WT_PROJECT_DIR` or `git rev-parse --show-toplevel`.\n- Only the coordinator should update canonical batch docs such as `docs/STATUS.md`, `docs/IMPLEMENTATION_MASTERPLAN.md`, and `docs/TESTING_GUIDE.md` unless a worker explicitly owns a docs-only issue.\n\n### Small Mainline Exception\n- If a change is very small and low-risk (especially minor docs wording/checklist updates), do not automatically create a branch/PR.\n- If the user already asked for the change directly, it may be applied on the current branch after checking git status and keeping the diff narrow.\n- If the user did not clearly ask for the change, prompt first and offer to let the user apply it directly on `main`.\n- Only proceed with branch/PR flow for these tiny changes when the user explicitly asks for it.\n\n## Review Policy (non-negotiable)\n\nEvery code review — self-review, adversarial review, subagent review — follows these rules:\n\n1. **Post findings on the PR.** Unless the user explicitly says otherwise, when a review targets a PR, post a comment with all findings organized by severity. This is the default, not optional.\n2. **Fix everything found.** Every finding at every severity (CRITICAL, HIGH, MEDIUM, LOW) must be addressed with a fix, commit, and verification. There is no \"non-blocking\" category that gets ignored. Do not skip lower-priority findings.\n3. **Out-of-scope findings get tracked, not buried.** If a finding is real but drifts outside the PR's scope, document it and seed a GitHub issue (or add to an existing tracking issue). Never silently drop it. Tech debt from reviews must be zero.\n4. **Inspect all existing PR comments.** Before posting findings, read ALL comments on the PR — human reviews, bot comments (Dependabot, CodeQL, CI bots), and previous adversarial review threads. Address anything unaddressed: fix it, reply with invalidation evidence, or seed a tracked follow-up.\n5. **Post fix evidence.** After fixing findings, post a follow-up comment mapping each finding to its fix commit and verification result.\n\nThese rules apply equally to Claude and Codex agents, subagents, and worktree workers.\n\n## Definition of Done (non-negotiable)\n- Behavior changes ship with tests (unit/integration/E2E as appropriate).\n- Handle error cases explicitly; do not swallow failures.\n- Update docs when reality changes:\n - `docs/STATUS.md` (what is true now)\n - `docs/IMPLEMENTATION_MASTERPLAN.md` (roadmap impact / next steps)\n\n## Security baseline (always on)\n- Never trust client input for identity/authority.\n- Enforce authn/authz consistently for protected resources.\n- Validate inputs server-side; fail safely.\n- Do not log secrets, tokens, or sensitive user data.\n\n## Project Structure & Modules\n- Backend (.NET): `backend/Taskdeck.sln` with layered projects under `backend/src`\n (`Taskdeck.Api`, `Taskdeck.Application`, `Taskdeck.Domain`, `Taskdeck.Infrastructure`, `Taskdeck.Cli`).\n- Backend tests: `backend/tests` with project-per-layer test suites.\n- Frontend (Vue 3 + Vite): `frontend/taskdeck-web` with app source in `src`, static assets in `public`.\n- Docs and planning: Start with `docs/STATUS.md` (source of truth),\n `docs/IMPLEMENTATION_MASTERPLAN.md` (active roadmap), `docs/GOLDEN_PRINCIPLES.md` (stable invariants), and `docs/TESTING_GUIDE.md` (test operations).\n Historical context lives under `docs/archive/`.\n\n## Build, Test & Run\n- Backend restore/build: `dotnet restore backend/Taskdeck.sln` and `dotnet build backend/Taskdeck.sln -c Release`.\n- Backend tests (required): `dotnet test backend/Taskdeck.sln -c Release -m:1`.\n- Backend API (local): from `backend/src/Taskdeck.Api`, run `dotnet run`.\n- Frontend dev server: from `frontend/taskdeck-web`, run `npm install` once, then `npm run dev`.\n- Frontend checks (required when frontend touched): from `frontend/taskdeck-web`,\n `npm run typecheck; if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }; npm run build; if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }; npx vitest --run` (PowerShell fail-fast; do not use `&&`).\n\n## Coding Style & Naming\n- Backend: C# conventions, 4-space indentation, PascalCase for classes and public members,\n camelCase for locals and parameters. Keep layers pure (e.g., `Domain` has no infrastructure dependencies).\n- Frontend: TypeScript + Vue SFCs in `PascalCase.vue`. Use script setup and composition APIs where existing code does.\n Prefer meaningful names over abbreviations.\n- Keep formatting consistent with existing files; do not introduce new style tools without discussion.\n\n## Testing Guidelines\n- Prefer unit tests close to the corresponding project (e.g., `Taskdeck.Application.Tests` for application logic).\n- Mirror production namespaces in test namespaces and file names (e.g., `FooServiceTests.cs` for `FooService`).\n- Add coverage for new branches and error paths, especially in application services and HTTP endpoints.\n- For frontend, add tests following the existing tooling (or document gaps clearly if tests are not yet present).\n\n## Commit & Pull Request Guidelines\n- Commits: Use clear, present-tense messages (e.g., `Add booking validation to application layer`).\n Default to small focused incremental commits, often one commit per changed file with a short file-specific description.\n Keep commits small and focused; avoid large mixed-topic commits.\n If a single logical change must touch multiple files, keep the smallest practical commit set and explain why.\n Exception: for pure file move/rename batches (no content changes), one grouped commit is acceptable and preferred.\n- Pull requests: Provide a short summary, key implementation notes, and testing evidence\n (commands run, screenshots for UI changes). Link related issues/tasks where applicable.\n- Keep PRs focused and small when possible; prefer follow-up PRs for refactors or additional cleanup.\n- PRs touching CI workflows (`.github/workflows/`), infrastructure (`deploy/`, `scripts/`), or project files (`*.csproj`) auto-trigger CI Extended. Ensure CI Extended is green before merging these PRs.\n- For issue execution unless the user explicitly says otherwise: open the PR after verification is complete, then perform a deliberate reviewer-style pass on the PR diff/comments before handoff. Follow the Review Policy: post findings, fix everything, address all existing comments, and seed issues for out-of-scope items. Follow the Review Policy: post findings, fix everything, address all existing comments, and seed issues for out-of-scope items.\n\n## Output expectations (after work)\nProvide:\n- Summary of changes\n- Files touched\n- Tests added/updated\n- Commands run + results\n- Docs updated (`STATUS` / `MASTERPLAN`)\n- Notable risks or follow-ups (if any)\n\nSee `docs/tooling/FUTURE_HARNESS_BACKLOG.md` for deferred harness/MCP upgrades.\n\nSee `docs/tooling/DEVTOOLS_OBSERVABILITY_ADDON.md` for Playwright vs DevTools vs logs decision rules.\n\n",{"_669":1655,"_648":649,"_671":655},{"_672":1656,"_674":-5,"_42":-5,"_676":1657,"_678":-5,"_97":1658,"_93":680},[1659],{"_681":655},"developer",{"_46":1660,"_93":704},"Do not spawn sub-agents unless the user or applicable AGENTS.md/skill instructions explicitly ask for sub-agents, delegation, or parallel agent work.",{"_669":1662,"_648":649,"_671":655},{"_672":1663,"_674":-5,"_42":-5,"_676":1664,"_678":-5,"_97":1658,"_93":680},[1665],{"_681":655},{"_46":1666,"_93":704},"You are `/root`, the primary agent in a team of agents collaborating to fulfill the user's goals.\n\nAt the start of your turn, you are the active agent.\nYou can spawn sub-agents to handle subtasks, and those sub-agents can spawn their own sub-agents.\nAll agents in the team, including the agents that you can assign tasks to, are equally intelligent and capable, and have access to the same set of tools.\n\nYou can use `spawn_agent` to create a new agent, `followup_task` to give an existing agent a new task and trigger a turn, and `send_message` to pass a message to a running agent without triggering a turn.\nChild agents can also spawn their own sub-agents.\nYou can decide how much context you want to propagate to your sub-agents with the `fork_turns` parameter.\n\nYou will receive messages in the analysis channel in the form:\n```\nMessage Type: MESSAGE | FINAL_ANSWER\nTask name: \nSender: \nPayload:\n\n```\nThey may be addressed as to=/root\n\nNote that collaboration tools cannot be called from inside `functions.exec`. Call `spawn_agent`, `send_message`, `followup_task`, `wait_agent`, `interrupt_agent`, and `list_agents` only as direct tool calls using the recipient shown in their tool definitions, such as `to=functions.collaboration.spawn_agent`, since they are intentionally absent from the `functions.exec` `tools.*` namespace. Available tools in `functions.exec` are explicitly described with a `tools` namespace in the developer message.\n\nAll agents share the same directory. In detail:\n- All agents have access to the same container and filesystem as you.\n- All agents use the same current working directory.\n- As a result, edits made by one agent are immediately visible to all other agents.\n\nThere are 4 available concurrency slots, meaning that up to 4 agents can be active at once, including you.",{"_669":1668,"_648":649,"_671":655},{"_672":1669,"_674":-5,"_42":-5,"_676":1670,"_678":-5,"_97":1658,"_93":680},[1671,1672],{"_681":655},{"_46":1674,"_93":704},{"_46":1673,"_93":704},"\n## Skills\nA skill is a set of instructions provided through a `SKILL.md` source. Below is the list of skills that can be used. Each entry includes a name, description, and source locator. `file` locators are on the host filesystem, `environment resource` locators are owned by an execution environment, `orchestrator resource` locators are opaque non-filesystem resources, and `custom resource` locators use their provider's access mechanism.\n### Available skills\n- imagegen: Generate or edit raster images when the task benefits from AI-created bitmap visuals such as photos, illustrations, textures, sprites, mockups, or transparent-background cutouts. Use when Codex should create a brand-new image, transform an existing image, or derive visual variants from references, and the output should be a bitmap asset rather than repo-native code or vector. Do not use when the task is better handled by editing existing SVG/vector/code-native assets, extending an established icon or logo system, or building the visual directly in HTML/CSS/canvas. (file: /opt/codex/skills/.system/imagegen/SKILL.md)\n- openai-docs: Use when the user asks how to build with OpenAI products or APIs, asks about Codex itself or choosing Codex surfaces, needs up-to-date official documentation with citations, help choosing the latest model for a use case, or model upgrade and prompt-upgrade guidance; use OpenAI docs MCP tools for non-Codex docs questions, use the Codex manual helper first for broad Codex self-knowledge, and restrict fallback browsing to official OpenAI domains. (file: /opt/codex/skills/.system/openai-docs/SKILL.md)\n- plugin-creator: Create and scaffold plugin directories for Codex with a required `.codex-plugin/plugin.json`, optional plugin folders/files, valid manifest defaults, and personal-marketplace entries by default. Use when Codex needs to create a new personal plugin, add optional plugin structure, generate or update marketplace entries for plugin ordering and availability metadata, or update an existing local plugin during development with the CLI-driven cachebuster and reinstall flow. (file: /opt/codex/skills/.system/plugin-creator/SKILL.md)\n- skill-creator: Guide for creating effective skills. This skill should be used when users want to create a new skill (or update an existing skill) that extends Codex's capabilities with specialized knowledge, workflows, or tool integrations. (file: /opt/codex/skills/.system/skill-creator/SKILL.md)\n- skill-installer: Install Codex skills into $CODEX_HOME/skills from a curated list or a GitHub repo path. Use when a user asks to list installable skills, install a curated skill, or install a skill from another repo (including private repos). (file: /opt/codex/skills/.system/skill-installer/SKILL.md)\n- taskdeck-backend-slice: Implement Taskdeck backend changes safely. Use when changing .NET API, application, domain, infrastructure, worker, auth, provider-runtime, import-export, notification, archive, or persistence behavior. (file: /workspace/Taskdeck/.codex/skills/taskdeck-backend-slice/SKILL.md)\n- taskdeck-capture-review-loop: Protect Taskdeck's core capture-review-apply-board loop. Use when touching Inbox, capture, triage, automation proposals, proposal summaries, approve-reject-execute behavior, provenance, or board handoff semantics across backend or frontend. (file: /workspace/Taskdeck/.codex/skills/taskdeck-capture-review-loop/SKILL.md)\n- taskdeck-ci-conflict-recovery: Triage and fix Taskdeck PR failures involving CI, GitHub bot comments, merge conflicts, stale branches, flaky tests, or blocked checks. Use when the user asks Codex to check failing CI, inspect PR comments, fix conflicts, monitor runs, rerun checks, or recover PRs after review automation reports errors. (file: /workspace/Taskdeck/.codex/skills/taskdeck-ci-conflict-recovery/SKILL.md)\n- taskdeck-demo-regression: Validate Taskdeck with the smallest evidence path that proves the change. Use when a task needs seeded demo state, Playwright proof, screenshots, or stakeholder walkthrough evidence. (file: /workspace/Taskdeck/.codex/skills/taskdeck-demo-regression/SKILL.md)\n- taskdeck-failure-capture: Classify and record Taskdeck agent failures, failed commands, flaky or blocked checks, MCP/tool problems, CI failures, docs-governance warnings, and workarounds. Use whenever unresolved friction should be visible in handoff or promoted into guidance. (file: /workspace/Taskdeck/.codex/skills/taskdeck-failure-capture/SKILL.md)\n- taskdeck-frontend-workspace-slice: Implement Taskdeck frontend shell and workspace changes. Use when changing Vue routes, stores, components, Home, Today, Boards, workspace-mode flows, keyboard behavior, help states, or novice-first product legibility outside the core capture-review semantics. (file: /workspace/Taskdeck/.codex/skills/taskdeck-frontend-workspace-slice/SKILL.md)\n- taskdeck-interface-map: Maintain Taskdeck's agent-facing interface maps. Use when adding, splitting, refactoring, or documenting complex domains so future agents can find entry points, invariants, edit seams, traps, and verification commands without bulk-reading the repo. (file: /workspace/Taskdeck/.codex/skills/taskdeck-interface-map/SKILL.md)\n- taskdeck-issue-batch-orchestrator: Coordinate high-autonomy Taskdeck issue batches from selection through PR review and handoff. Use when the user asks Codex to take care of many issues, pick next issues, run a batch, coordinate subagents/worktrees, seed follow-ups, reconcile GitHub project status, or automate issue-to-PR execution across multiple independent workstreams. (file: /workspace/Taskdeck/.codex/skills/taskdeck-issue-batch-orchestrator/SKILL.md)\n- taskdeck-pr-review-loop: Perform Taskdeck PR self-review or fresh adversarial review, post review findings, address review comments and bot comments, verify fixes, and re-review. Use when the user asks to review PRs, spin fresh reviewers, check comments, address feedback, or run another adversarial pass on sensitive or failing work. (file: /workspace/Taskdeck/.codex/skills/taskdeck-pr-review-loop/SKILL.md)\n- taskdeck-question-batch: Decide whether a Taskdeck agent should ask the user, proceed with a documented assumption, or stop for safety. Use when a task is broad, underspecified, has possible product/security/schema ambiguity, or risks context-expensive question loops. (file: /workspace/Taskdeck/.codex/skills/taskdeck-question-batch/SKILL.md)\n- taskdeck-repo-onramp: Orient to the Taskdeck repo before editing. Use when starting a session, entering an unfamiliar area, reconciling a broad request against current reality, or turning a vague task into a scoped plan. (file: /workspace/Taskdeck/.codex/skills/taskdeck-repo-onramp/SKILL.md)\n- taskdeck-verification-doc-sync: Finish a Taskdeck change with the right checks and doc updates. Use at the end of implementation to choose verification scope, decide whether canonical docs changed, and prepare the required handoff summary. (file: /workspace/Taskdeck/.codex/skills/taskdeck-verification-doc-sync/SKILL.md)\n- taskdeck-worktree-issue-worker: Implement one Taskdeck GitHub issue in an isolated worktree with focused ownership, small commits, tests, PR creation, and handoff. Use when a coordinator assigns Codex a single issue, asks for issue-to-PR execution, or launches a worker/subagent for backend, frontend, docs, or testing implementation. (file: /workspace/Taskdeck/.codex/skills/taskdeck-worktree-issue-worker/SKILL.md)\n","\nFilesystem sandboxing defines which files can be read or written. `sandbox_mode` is `danger-full-access`: No filesystem sandboxing - all commands are permitted. Network access is enabled.\nApproval policy is currently never. Do not provide the `sandbox_permissions` for any reason, commands will be rejected.\n","turn/started",{"_648":649,"_88":1677},{"_104":-5,"_42":655,"_656":1678,"_658":659,"_660":661,"_662":1679},[],"inProgress",{"_662":1681,"_648":649},{"_1682":1683,"_93":1684},"activeFlags",[],"active","thread/started",{"_1687":1688},"thread",{"_1689":-5,"_1690":-5,"_1691":1692,"_1693":661,"_714":715,"_1694":15,"_1695":-5,"_1696":-5,"_1697":-5,"_1698":1699,"_42":649,"_1700":1701,"_367":-5,"_1702":-5,"_256":1703,"_1704":381,"_1705":661,"_1706":649,"_721":1707,"_662":1708,"_1709":-5,"_78":1710,"_1711":661},"agentNickname","agentRole","cliVersion","0.144.0-alpha.4","createdAt","ephemeral","extra","forkedFromId","gitInfo","historyMode","legacy","modelProvider","openai","parentThreadId","/opt/codex/sessions/2026/07/27/rollout-2026-07-27T02-59-00-019fa182-ee77-7f81-b747-7259692b74af.jsonl","preview","recencyAt","sessionId","vscode",{"_93":666},"threadSource",[],"updatedAt",[],"messages",[1715],{"_42":1716,"_1717":1718,"_1719":1720,"_1721":1720,"_672":1722,"_662":1723,"_674":-5,"_1724":32,"_1725":1726,"_1727":481,"_1728":-5},"9643d580-1d7c-40bf-86a9-68aca1b72813","author",{"_97":507,"_367":-5,"_1725":1737},"create_time",1785121139.588829,"update_time",{"_1733":46,"_1734":1735},"finished_successfully","weight","metadata",{"_1729":1730},"recipient","channel","l1239dk1",{"_1731":1732},"inline_comments",[],"content_type","parts",[1736],"## Independent adversarial review #1 — correctness / operational semantics\n\nReviewed exact head `1ec17437a1a6c04de2feba95b456baf3e1af8fd3` against base `2f62c8ca82a66c5417abd03688e9dbbd219319d4`.\n\nInspected: the PR body; linked issue #1228 and its existing comment; every current PR conversation comment, review submission, and inline thread; the complete six-file patch; the full staging workflow; adjacent `release-desktop.yml`, `ci-release.yml`, and `release-security.yml` trigger surfaces; ADR-0028 and the changed current-state/roadmap/ops/packaging docs; live repository environment and workflow-run state; and exact-blob `actionlint:1.7.12`.\n\n### CRITICAL\n\nNone.\n\n### HIGH\n\nNone.\n\n### MEDIUM\n\n1. **The retained “manual approval gate” is not enforced and currently records approval without a reviewer.** \n Locations: `.github/workflows/cd-staging-gate.yml:188-208`, `docs/IMPLEMENTATION_MASTERPLAN.md:15`, `docs/STATUS.md:585`, and `docs/ops/DEPLOYMENT_WORKFLOW.md:298`.\n\n The workflow only declares `environment: production`. The live environments API reports exactly `copilot` and `github-pages`; there is no `production` environment or required-reviewer rule. GitHub documents that a workflow referencing a missing environment creates it **without protection rules or secrets** ([GitHub environment documentation](https://docs.github.com/en/actions/deployment/targeting-different-environments/managing-environments-for-deployment)). A manual dispatch after merge can therefore create an unprotected `production` environment and immediately write “Promotion Gate -- APPROVED” / “Manual approval: granted” without human review.\n\n **Risk:** the trigger deletion correctly prevents release publication from starting this workflow, but the PR body and updated canonical docs falsely preserve an approval control and a trustworthy approval record for the remaining manual path. The promotion job is summary-only, so I found no direct production mutation or data-loss path, but the operator/audit semantics are fail-open.\n\n **Required fix/evidence:** either configure and API-verify a `production` environment with the intended required reviewer before claiming this control exists, or change the workflow and docs so the parked manual path fails closed / accurately states that no environment approval is configured. Verification should prove the live required-reviewer rule or prove the revised no-approval behavior; syntax lint alone cannot establish repository environment protection.\n\n### LOW\n\n1. **The changed packaging document still presents the superseded archive plan as current.** \n Location: `docs/strategy/02_PACKAGING_DISTRIBUTION_STRATEGY.md:7`.\n\n This PR edits the banner paragraph but still calls `v0.1.0` an “optional archival” release and ends with “Current scope … then archive.” That conflicts with `OUTSTANDING_TASKS.md:38,62` and source-of-truth `docs/STATUS.md:13`, where the archive pivot is superseded and `v0.1.0` is a required free-beta ship gate.\n\n **Risk:** an actively synchronized packaging page can route operators/agents to the opposite release decision despite canonical-doc precedence.\n\n **Required fix:** update this touched banner so the archive language is explicitly historical/checkpoint-only and the required revival/beta release is current; retain only the genuinely parked multi-channel/store/GTM scope.\n\n### Existing feedback disposition\n\n- The `@codex review` conversation comment is an informational review trigger.\n- The current Codex P1 DCO inline finding is **invalid at this exact head**. GitHub’s PR-commits endpoint lists only `948d5705b1f9cc337382ca0a14556777f86087e9` and `1ec17437a1a6c04de2feba95b456baf3e1af8fd3`; both commit messages contain a matching `Signed-off-by:` trailer, and the exact-head **DCO (advisory)** check is passing. The cited `2087697bf039c8ae6541a39067aad7a26ccff9e7` is not in the PR commit set, so it should be replied to/dismissed as a false positive rather than prompting history changes.\n\n### Trigger and regression conclusion\n\nRemoving the `release` stanza fully removes automatic `release.published` subscription once this head reaches the default branch. No `workflow_call` or indirect workflow caller exists, and exact-head `actionlint:1.7.12` passes. The changed trigger reduces automatic execution exposure; I found no security or data-loss regression in the patch. Hosted CI/CI Extended completion and an actual release/manual event were not part of this review proof.\nDisable automatic staging gate release trigger\n\nCloses #1228\n\n## Summary\n- remove the `release: published` subscription from the parked staging gate\n- retain explicit manual dispatch, required image-tag input, jobs, permissions, and environment approval\n- synchronize current-state, roadmap, deployment, and packaging documentation with the manual-only trigger\n\n## Verification\n- `node scripts/check-docs-governance.mjs`\n- `node scripts/check-golden-principles.mjs`\n- `node scripts/check-github-ops-governance.mjs`\n- `docker run --rm -v \"${PWD}:/repo\" -w /repo rhysd/actionlint:1.7.12 .github/workflows/cd-staging-gate.yml`\n- `git diff --check origin/main...HEAD`\n\n## Not verified\n- no release event was emitted; the workflow trigger change is proved statically and will be exercised by hosted workflow validation\n- no manual staging deployment was run because the staged cloud path remains parked\r\n\n@codex review\n**_{_{![P1 Badge](https://img.shields.io/badge/P1-orange?style=flat)}} Add the mandatory DCO sign-off**\n\nWhen this changeset is submitted, commit `2087697bf039c8ae6541a39067aad7a26ccff9e7` has no parsed trailers, so it violates the repository's mandatory DCO requirement and will leave the DCO signal red. Recreate the commit with `git commit -s --no-gpg-sign`, or otherwise add the matching `Signed-off-by:` trailer, before it enters shared history.\n\nAGENTS.md reference: [AGENTS.md:L85-L85](https://github.com/Chris0Jeky/Taskdeck/blob/1ec17437a1a6c04de2feba95b456baf3e1af8fd3/AGENTS.md#L85-L85)\n\nUseful? React with 👍 / 👎.\n\n### 💡 Codex Review\n\nHere are some automated review suggestions for this pull request.\n\n**Reviewed commit:** `1ec17437a1`\n \n\n

ℹ️ About Codex in GitHub

\n
\n\n[Your team has set up Codex to review pull requests in this repo](https://chatgpt.com/codex/cloud/settings/general). Reviews are triggered when you\n- Open a pull request for review\n- Mark a draft as ready\n- Comment \"@codex review\".\n\nIf Codex has suggestions, it will comment; otherwise it will react with 👍.\n\n\n\n\nCodex can also answer questions or update the PR. Try commenting \"@codex address that feedback\".\n \n

\n## Independent adversarial review #2 — security / governance / tests\n\n**Exact head reviewed:** `1ec17437a1a6c04de2feba95b456baf3e1af8fd3`\n\nI first inspected the PR conversation, reviews, and review threads, plus linked issue #1228 and its existing maintainer comment. At posting time the PR has the `@codex review` request and one Codex DCO thread; no other PR comments/reviews were present.\n\n### MEDIUM\n\n1. **The retained “manual approval” is not an active gate, so the workflow and canonical docs would report an approval that never occurred.**\n\n The promotion job merely references `environment: production` and then unconditionally writes “Manual approval: granted” ([workflow lines 188–205](https://github.com/Chris0Jeky/Taskdeck/blob/1ec17437a1a6c04de2feba95b456baf3e1af8fd3/.github/workflows/cd-staging-gate.yml#L188-L205)). A live `GET /repos/Chris0Jeky/Taskdeck/environments` immediately before this review returned only `copilot` and `github-pages`; there is no `production` environment or required-reviewer rule. GitHub documents that a workflow reference to a missing environment creates it **without protection rules or secrets**, so this job will not wait for approval ([GitHub environment documentation](https://docs.github.com/en/actions/how-tos/deploy/configure-and-manage-deployments/manage-environments#creating-an-environment)).\n\n This contradicts the new Masterplan claim that manual approval “remain[s] available” ([line 15](https://github.com/Chris0Jeky/Taskdeck/blob/1ec17437a1a6c04de2feba95b456baf3e1af8fd3/docs/IMPLEMENTATION_MASTERPLAN.md#L15)), the deployment guide’s “Requires manual approval” statement ([line 298](https://github.com/Chris0Jeky/Taskdeck/blob/1ec17437a1a6c04de2feba95b456baf3e1af8fd3/docs/ops/DEPLOYMENT_WORKFLOW.md#L298)), and the PR summary. The job does not itself deploy, which limits immediate blast radius, but it emits a false production-approval record. Either configure and prove a protected `production` environment with required reviewers (and record that external prerequisite), or make the job, PR body, and canonical docs truthful about the current unprotected environment reference.\n\n2. **The verification does not prove #1228’s requested negative-trigger behavior.**\n\n The existing maintainer comment on #1228 explicitly asks to confirm that a test tag/release event triggers nothing waiting on `production`. The PR’s Not verified section confirms no release event was emitted. Exact-head [Workflow Lint](https://github.com/Chris0Jeky/Taskdeck/actions/runs/30232985065/job/89875215961) proves Actions syntax, while [Docs Governance](https://github.com/Chris0Jeky/Taskdeck/actions/runs/30232973727/job/89875176488) proves the repository’s mechanical documentation rules; neither emits a `release` event nor asserts this workflow’s trigger set. The diff is persuasive manual evidence that `release: published` was deleted, but the linked verification requirement remains unproved and there is no executable regression guard. Add a deterministic trigger-contract check (Actions-aware parsing/assertion that this workflow exposes only `workflow_dispatch` with required `image_tag`) or keep #1228 open until authorized post-merge live negative-event evidence is recorded. The PR should not say hosted workflow validation will “exercise” the release-trigger change when it only lints it.\n\n### Existing-feedback triage\n\nThe Codex DCO thread is **invalid for this exact head**: it cites `2087697bf039c8ae6541a39067aad7a26ccff9e7`, which is not in the PR’s two-commit list and is not found by the repository commit API. The actual commits are `948d5705b1f9cc337382ca0a14556777f86087e9` and `1ec17437a1a6c04de2feba95b456baf3e1af8fd3`; both include matching `Signed-off-by:` trailers, and the exact-head [DCO check is green](https://github.com/Chris0Jeky/Taskdeck/actions/runs/30232973727/job/89875176413). No DCO rewrite is needed.\n\n### Other reviewed surfaces\n\n- Event syntax is valid and the head’s top-level trigger is now only `workflow_dispatch`.\n- `image_tag` remains a required string; `skip_smoke` remains a boolean, and the build/smoke job dependency behavior is unchanged.\n- Workflow permissions remain read-only (`contents: read`, `actions: read`); no new secret or write permission was introduced.\n- Scope is otherwise faithful: one trigger subscription removed, existing jobs retained, and the six-file diff is limited to workflow truth and its documentation mirrors.\n",{},"created",1785121435.3464465,"Completing the task","event_type","info",{"_93":680,"_97":94,"_672":6532},{"_93":1771,"_1772":1773},{"_93":1746,"_1747":1748,"_1749":1750,"_1751":1752,"_1753":-5},"pr","pr_title","Fail-closed parked staging gate: remove unprotected production approval and add governance check","pr_message","### Motivation\n\n- Prevent the parked staging workflow from emitting a false “manual approval” record when no protected `production` environment exists. \n- Provide deterministic, repository-side evidence that the workflow is manual-only and requires an `image_tag` input, addressing the adversarial review’s trigger-contract gap. \n- Keep ADR-0028 design intent while making current automation and docs truthful about the parked/manual-only state. \n\n### Description\n\n- Remove the Phase 3 promotion job and its unprotected `production` environment approval from `/.github/workflows/cd-staging-gate.yml` and simplify tag resolution to use the required dispatch `image_tag` input only. \n- Add a governance assertion in `scripts/check-github-ops-governance.mjs` that validates the staged gate exposes only `workflow_dispatch`, that `workflow_dispatch.image_tag` is a required string, and that the workflow declares no `environment:` until protection is configured. \n- Update canonical documentation to reflect the fail-closed reality and ADR-0044 revival scope in `docs/IMPLEMENTATION_MASTERPLAN.md`, `docs/STATUS.md`, `docs/ops/DEPLOYMENT_WORKFLOW.md`, `docs/ops/README.md`, `docs/strategy/02_PACKAGING_DISTRIBUTION_STRATEGY.md`, and `docs/TESTING_GUIDE.md`. \n- Add the governance contract to the testing guidance so Required CI will assert the trigger/input/no-environment contract going forward. \n\n### Testing\n\n- Ran `node scripts/check-github-ops-governance.mjs` and it passed against the updated contract. \n- Ran `node scripts/check-docs-governance.mjs` and `node scripts/check-golden-principles.mjs` and both passed. \n- Ran Actionlint via `go run github.com/rhysd/actionlint/cmd/actionlint@v1.7.12 .github/workflows/cd-staging-gate.yml` (Go-based actionlint run) and it passed; Docker-based `rhysd/actionlint` was not available in this environment. \n- Ran `git diff --check` and repository hygiene checks and they passed; no live workflow dispatch or release event was executed because the staging path is intentionally parked.","output_diff",{"_93":1751,"_1754":715,"_129":130,"_1755":-5,"_506":1756,"_1757":1758,"_1759":801,"_1760":1761,"_1762":1763,"_1764":1765,"_1766":1767},"pre_apply_patch","repo_id","preapply_patch_base_commit_sha","diff --git a/.github/workflows/cd-staging-gate.yml b/.github/workflows/cd-staging-gate.yml\nindex 8c6dc4e397d0002c9f5522103ed3ea9da3569842..e887c6fd132ee0a83a08f5f2b99d58d5e18cfd95 100644\n--- a/.github/workflows/cd-staging-gate.yml\n+++ b/.github/workflows/cd-staging-gate.yml\n@@ -1,29 +1,29 @@\n # =============================================================================\n-# CD Staging Gate — Automated staging deployment verification and production\n-# promotion gate. Implements Phase 1-2 of the staged deployment workflow\n-# (docs/ops/DEPLOYMENT_WORKFLOW.md) with a manual approval gate for Phase 3.\n+# CD Staging Gate — On-demand staging deployment verification. Implements\n+# Phase 1-2 of the staged deployment workflow (docs/ops/DEPLOYMENT_WORKFLOW.md).\n+# Phase 3 remains parked until a protected production environment is configured.\n #\n # Triggers:\n # - Manual workflow dispatch (for re-runs or pre-release validation)\n #\n # ADR: ADR-0028 (Staged Deployment — Blue/Green with Canary Verification)\n # Issue: #101 (OPS-09)\n # =============================================================================\n \n name: CD Staging Gate\n \n on:\n workflow_dispatch:\n inputs:\n image_tag:\n description: \"Container image tag to deploy (e.g., v0.2.0)\"\n required: true\n type: string\n skip_smoke:\n description: \"Skip smoke tests (emergency only)\"\n required: false\n type: boolean\n default: false\n \n permissions:\n contents: read\n@@ -32,60 +32,52 @@ permissions:\n concurrency:\n group: cd-staging-${{ github.ref }}\n cancel-in-progress: false\n \n env:\n NUGET_PACKAGES: ${{ github.workspace }}/.nuget/packages\n \n jobs:\n # -----------------------------------------------------------------------\n # Phase 1: Build Verification\n # -----------------------------------------------------------------------\n build-verification:\n name: \"Phase 1: Build Verification\"\n runs-on: ubuntu-latest\n timeout-minutes: 20\n outputs:\n image_tag: ${{ steps.resolve-tag.outputs.tag }}\n steps:\n - name: Checkout\n uses: actions/checkout@v7\n \n - name: Resolve image tag\n id: resolve-tag\n env:\n INPUT_TAG: ${{ inputs.image_tag }}\n- EVENT_NAME: ${{ github.event_name }}\n- RELEASE_TAG: ${{ github.event.release.tag_name }}\n run: |\n- if [[ -n \"$INPUT_TAG\" ]]; then\n- TAG=\"$INPUT_TAG\"\n- elif [[ \"$EVENT_NAME\" == \"release\" ]]; then\n- TAG=\"$RELEASE_TAG\"\n- else\n- TAG=\"$(git describe --tags --always)\"\n- fi\n+ TAG=\"$INPUT_TAG\"\n echo \"tag=$TAG\" >> \"$GITHUB_OUTPUT\"\n echo \"Resolved image tag: $TAG\"\n \n - name: Setup .NET\n uses: actions/setup-dotnet@v6\n with:\n dotnet-version: 8.0.x\n cache: true\n cache-dependency-path: |\n backend/Taskdeck.sln\n backend/**/*.csproj\n backend/Directory.Packages.props\n \n - name: Setup Node\n uses: actions/setup-node@v7\n with:\n node-version: 24.13.1\n cache: npm\n cache-dependency-path: frontend/taskdeck-web/package-lock.json\n \n - name: Restore and build backend\n run: |\n dotnet restore backend/Taskdeck.sln\n dotnet build backend/Taskdeck.sln -c Release --no-restore\n \n@@ -161,49 +153,25 @@ jobs:\n bash scripts/deploy/smoke-test.sh http://localhost:8080\n \n - name: Collect logs on failure\n if: failure()\n run: |\n echo \"--- Container status ---\"\n docker compose -f deploy/docker-compose.yml --profile baseline ps\n echo \"\"\n echo \"--- Container logs ---\"\n docker compose -f deploy/docker-compose.yml --profile baseline logs --tail=100\n \n - name: Stop stack\n if: always()\n run: |\n docker compose -f deploy/docker-compose.yml --profile baseline down -v\n \n - name: Write Phase 2 summary\n run: |\n cat <> \"$GITHUB_STEP_SUMMARY\"\n ## Phase 2: Staging Smoke Tests -- PASSED\n \n - **Image tag**: \\`${{ needs.build-verification.outputs.image_tag }}\\`\n - All S1-S9 smoke checks passed\n - Stack started, verified, and cleaned up\n EOF\n-\n- # -----------------------------------------------------------------------\n- # Production Promotion Gate (manual approval)\n- # -----------------------------------------------------------------------\n- promotion-gate:\n- name: \"Phase 3: Production Promotion Gate\"\n- needs: [build-verification, staging-smoke]\n- if: always() && needs.build-verification.result == 'success' && (needs.staging-smoke.result == 'success' || needs.staging-smoke.result == 'skipped')\n- runs-on: ubuntu-latest\n- environment: production\n- steps:\n- - name: Promotion approved\n- run: |\n- cat <> \"$GITHUB_STEP_SUMMARY\"\n- ## Phase 3: Production Promotion Gate -- APPROVED\n-\n- - **Image tag**: \\`${{ needs.build-verification.outputs.image_tag }}\\`\n- - Build verification: passed\n- - Staging smoke: ${{ needs.staging-smoke.result }}\n- - Manual approval: granted\n- - **Next step**: Execute Phase 3 (canary deployment) and Phase 4 (promotion) per \\`docs/ops/DEPLOYMENT_WORKFLOW.md\\`\n- EOF\n- echo \"Production promotion approved for tag: ${{ needs.build-verification.outputs.image_tag }}\"\n- echo \"Follow the deployment workflow in docs/ops/DEPLOYMENT_WORKFLOW.md for Phases 3-4.\"\ndiff --git a/docs/IMPLEMENTATION_MASTERPLAN.md b/docs/IMPLEMENTATION_MASTERPLAN.md\nindex 43c799816125c0863d5b10bfad0ac94aee5517a2..3c2cfb2fc6226e31e4d56496c32cfdf67ca2e542 100644\n--- a/docs/IMPLEMENTATION_MASTERPLAN.md\n+++ b/docs/IMPLEMENTATION_MASTERPLAN.md\n@@ -1,40 +1,40 @@\n # Taskdeck Implementation Masterplan\n \n Last Updated: 2026-07-27\n
\n Planning Horizon: the revival waves in `docs/REVIVAL_PLAN.md` (truth + safety → transcript engine → open-beta launch → generalist expansion [Phase 4, ADR-0046 Accepted]), then a maintainer checkpoint on beta traction — _(historical: 2026-06-13→2026-07-10 this was the finite archive-pivot waves; before that an open \"Next 8 to 12 weeks\" release horizon)_\n Companion Active Docs:\n - `docs/STATUS.md`\n - `docs/IMPLEMENTATION_MASTERPLAN.md`\n - `docs/TESTING_GUIDE.md`\n - `docs/MANUAL_TEST_CHECKLIST.md`\n - `docs/GOLDEN_PRINCIPLES.md`\n \n ## Delivery update (2026-07-27, release workflow truth)\n \n-- **Manual-only parked staging gate (`#1228`):** `.github/workflows/cd-staging-gate.yml` no longer subscribes to `release: published`; its required-input `workflow_dispatch` path, jobs, permissions, and manual `production` environment approval remain available for deliberate operator runs. Active beta release lanes (`release-desktop.yml`, `ci-release.yml`, and `release-security.yml`) are unchanged, so publishing a release cannot accidentally strand a staging run on a nonexistent environment.\n+- **Manual-only parked staging verification (`#1228`):** `.github/workflows/cd-staging-gate.yml` no longer subscribes to `release: published`; its required-input `workflow_dispatch` path retains only Phase 1 build verification and Phase 2 smoke tests for deliberate operator runs. No protected `production` environment is configured, so the workflow does not declare an environment, claim approval, or expose a Phase 3 promotion gate. Active beta release lanes (`release-desktop.yml`, `ci-release.yml`, and `release-security.yml`) are unchanged. Required governance now asserts the manual-only trigger, required string `image_tag`, and absence of an environment declaration.\n \n ## Delivery update (2026-07-26, agentic governance)\n \n - **Failure-ledger projection gate (`#1492`):** Required Docs Governance now pins Python 3.12 and runs the existing JSONL↔Markdown synchronization unittest before the governance checks, so a JSONL-only change with stale generated Markdown fails Required CI without regeneration masking it. Local agentic update workflows use the distinct render-then-test order so hook-appended JSONL can be projected, and the smoke contract pins both sides of that distinction.\n - **Cross-platform agent-hook launchers (`#1487`):** native-Windows handlers and PowerShell-scoped agent-utility commands use the verified `py -3 -B` launcher instead of the unusable Microsoft Store aliases, while POSIX Bash guidance keeps `python3 -B`. The smoke harness uses its active `sys.executable -B` for child scripts, rejects drift in the exact configured-handler inventory and the five-utilities-plus-renderer-test permission surface, and proves that missing PreToolUse launchers or policies fail closed with exit 2. The smoke payloads identify `Bash`; native PowerShell-tool deny coverage is separate T4 work tracked by [#1497](https://github.com/Chris0Jeky/Taskdeck/issues/1497). No interpreter install, PATH mutation, resolver wrapper, or product-runtime change is added.\n \n ## Delivery update (2026-07-26, security runway)\n \n - **SQLite native security floor (`#1345`):** centrally pin `SQLitePCLRaw.bundle_e_sqlite3` 2.1.12 and make Infrastructure's dependency direct, which moves the matched bundle/core/provider/native family from 2.1.6 to 2.1.12 without enabling global transitive pinning. A runtime regression enforces SQLite >= 3.50.2 (2.1.12 loads 3.53.3); the NuGet vulnerability audit is clean, EF reports no pending model changes after a fresh update, and a self-contained `win-x64` binary reaches `/health/ready` with SQLite loaded.\n - **Project priority completeness (`#1458`, delivered by PR #1488):** the helper now replaces the capped ProjectV2 sample with cursor-complete stable snapshots and fail-closed checks for saturation, identity, nested truncation, source/plan drift, invalid Issue labels, typed references, option drift, partial writes, and stale post-state reporting. External Issue references remain visible but non-authoritative: their labels never rank, external-only PRs derive `Priority V`, and an external closing Issue permits same-repository body fallback. The authentication-free 64-check suite runs in Required CI. All 130 formerly unlabeled Taskdeck Issues were classified and verified; the reviewed Apply then succeeded 141/141. Its built-in audit, two fresh pre-merge audits, and the final post-merge handoff audit each proved 1,472/1,472 items, 12 ignored external references, and zero remaining drift. Issue #1458 and both project items are `Done / Priority I`.\n \n ## Delivery update (2026-07-25, PR-queue clearing wave)\n \n **8 PRs merged; the open-PR queue is down to a single human-gated draft.** Per-PR gate: independent adversarial review, all-severity findings fixed with posted evidence, required CI green on the exact head, every thread triaged.\n \n - **`#1469` (`#1462`)** — frontend `Proposal.approvedRevisionId`, declared **required** (the key is always on the wire), contract-only per `#1298`, guarded against a dead-code sweep by an exported type alias.\n - **`#1337` (`#1299`) — REVIVAL-03 licensing pack shipped.** `LICENSING.md` (MIT-forever, never-gated free boundary, additive-only commercial posture), reserved `ee/`, DCO guidance + SHA-pinned advisory CI job, MIT metadata across npm and 11 `.csproj`. Root `LICENSE` untouched. Name availability researched and recorded on `#1299` with filing costs and a **do-not-file-now** recommendation; pre-commercial legal residuals → **`#1482`**.\n - **`#1477` + `#1481` (`#1123`)** — the release pipeline can now be **rehearsed without pushing a tag**, which is what makes `#1303`'s tag push verifiable in advance rather than a first-run. Rehearsed live (run `30160400273`): four platforms built, **three smoke-tested**, `create-release` skipped, zero tags/releases created. `osx-x64` is built, packaged, checksummed and uploaded **without ever being launched** — it is cross-arch on the arm64 `macos-latest` runner (`if: matrix.rid != 'osx-x64'`), so that one archive carries less release evidence than the other three. Worth knowing before the `#1303` tag push.\n - **`#1478` (`#1271`) — dogfooding instrumented**, and the baseline measured: sustained use has **not** started (8 active days, three months stale, most boards fixtures), though the core loop works (**17/20 proposals reached Apply**, counted by `AppliedAt` — a status-based count reads 1/20 because `Dismiss()` overwrites an `Applied` status). Residual accuracy questions → **`#1480`**.\n - **`#1471`, `#1472`, `#1479`** — canonical-doc reconciliation, human-action tracking for `#1457`'s trust gate and the recurring worktree prune, and two record-only check-offs taken on explicit maintainer instruction.\n - **`#1295` closed as superseded** (13/13 bypass failures; targeted floor v1.3.0 vs installed 1.6.5). The overlay is still *needed* — 11 rule-classes are `allow` at every tier including T4 — so the salvage plan and acceptance criteria live on **`#1293`**.\n - **Repo hardening:** force-push and deletion blocked on `main` (otherwise deliberately relaxed); a 1,444-item snapshot synced 288 truncation-hidden project-priority mismatches (`#1474`), while `#1458` owns the durable complete-audit and remaining data-cleanup gate.\n - **`#1270` backlog triage:** 12 issues closed with dated notes; an adversarial pass bounced **13 of 25** proposed closures, including the `#1123` ship-gate item. `#1270` stays open — two of its own ACs are obsolete against ADR-0044 / REVIVAL_PLAN §6.\n - **Seeded:** `#1470` `#1473` `#1474` `#1475` `#1476` `#1480` `#1482`, plus upstream `agent-harness#56`.\n - **Remaining T4 hold:** `#1457` only — do not run the published canaries yet. Its current head has red DCO, stale review evidence, and material main-branch drift; the 2026-07-26 audit also found its v1.6.5 pin behind the installed/producer v1.6.12 floor while root/common-directory hook discovery remains unresolved. Repair those prerequisites and regenerate exact-head CI/reviews before the maintainer-only `/hooks` trust and live-canary step.\ndiff --git a/docs/STATUS.md b/docs/STATUS.md\nindex bbd43cefa7a1d00f13523aaf4493559ee8e2abd3..65fa9bb2c244277f56ac2e2801f9df8a83bcb557 100644\n--- a/docs/STATUS.md\n+++ b/docs/STATUS.md\n@@ -560,51 +560,51 @@ Ten parallel worktree agents delivered platform hardening, testing infrastructur\n \n **PWA & Offline:**\n - **UX-09 PWA/offline readiness** (`#95`/`#802`): VitePWA integration with `prompt` registerType, `navigateFallback` with `/api/`+`/mcp` denylist, `NetworkFirst` API caching + `CacheFirst` static assets; `useOnlineStatus` composable with reactive `navigator.onLine` tracking; `OfflineBanner` component with ARIA `role=\"status\"`; `SwUpdatePrompt` component via `virtual:pwa-register` for controlled SW update lifecycle; offline behavior doc at `docs/platform/PWA_OFFLINE_BEHAVIOR.md`; 18 tests (11 composable + 7 component); adversarial review eliminated duplicate SW lifecycle handlers (double-reload race), fixed misleading sync text, corrected opaque response caching and SVG icon sizes\n \n **Ops & Architecture Documentation:**\n - **OPS-12 Cloud cost observability** (`#104`/`#798`): ADR-0026 documents proactive cost observability decision; framework at `docs/ops/CLOUD_COST_OBSERVABILITY.md` (6 cost dimensions, 3-tier alerts at 70/90/100%, monthly review workflow, Terraform budget template); hotspot registry at `docs/ops/COST_HOTSPOT_REGISTRY.md` (6 features with per-request LLM costs, monthly projections at 4 usage levels); breach runbook at `docs/ops/BUDGET_BREACH_RUNBOOK.md` (5-phase playbook); adversarial review fixed phantom config keys, wrong API endpoint, incorrect JSON payload, compute instance types\n - **OPS-14 Cloud topology ADR** (`#111`/`#799`): ADR-0027 documents container-based ECS Fargate topology; autoscaling policy (CPU 65%/25%, 1000 req/min, 500 WS connections); health checks (liveness/readiness/startup); SLO targets (99.5% availability, p95 read <300ms, write <800ms); cost estimate ~$147-152/month; reference architecture at `docs/ops/CLOUD_REFERENCE_ARCHITECTURE.md` (VPC layout, ECS tasks, CI/CD pipeline, DR strategy); adversarial review fixed cost inconsistency, missing worker service, latency alarm gap, health check endpoint accuracy, connection pooling risk\n \n **ADR numbering note**: All 5 PRs that created ADRs originally used ADR-0023. The canonical numbering is ADR-0023 (SQLite migration) through ADR-0027 (cloud topology). PR branches need ADR file renames during merge to match this index.\n \n ## Feature, Security, and Ops Expansion Wave (2026-04-09, PRs `#806`–`#813`, 8 issues)\n \n Eight parallel worktree agents delivered new features, security infrastructure, ops tooling, and developer experience improvements across 8 PRs. Each PR received two rounds of adversarial review (original self-review + independent cold review). The independent round caught 9 CRITICAL and 11 HIGH findings — all resolved before merge.\n \n **Features:**\n - **UX-08 Calendar/timeline views** (`#94`/`#810`): `WorkspaceService.GetCalendarAsync` with board-access-scoped date-range card query (90-day cap, 500-result limit); `CardRepository.GetByDueDateRangeAsync`; `GET /api/workspace/calendar?from=&to=` endpoint defaulting to current month; frontend `CalendarView.vue` with grid mode (monthly calendar, color-coded due-date cards, overflow \"+N more\") and timeline mode (chronological date-grouped list); month navigation, status indicators (on-track/overdue/blocked), drill-down to board/card; loading/error/empty states; ARIA grid roles; sidebar nav item; 8 backend + 20+ frontend tests; adversarial review fixed UTC timezone mismatch, overdue logic inconsistency, and unbounded query results\n - **INT-05 Note-style import and web clip intake** (`#334`/`#809`): `NoteImportService` with markdown heading-based section splitting and web clip metadata intake; `CaptureSource.MarkdownImport` and `CaptureSource.WebClip` enum values; `NoteImportController` with `POST /api/import/notes/markdown` and `POST /api/import/notes/webclip` (auth + rate limiting); all imported content routes through `ICaptureService.CreateAsync` (GP-06 compliant — no silent board mutations); provenance via `ExternalRef` (filename/URL) and `TitleHint`; frontend markdown upload and web clip paste tabs in `ExportImportView`; security: path traversal validation, URL scheme restriction (http/https only), no outbound requests (no SSRF), content as plain text (no XSS); 38 backend + 6 frontend tests; adversarial review fixed silent success on all-sections-fail and ExternalRef overflow\n - **AGT-03 Agents/Runs surfaces** (`#338`/`#808`): `AgentsView.vue` (profile list with status badges), `AgentRunsView.vue` (run list per agent with proposal linkage), `AgentRunDetailView.vue` (vertical event timeline with human-readable labels, JSON payload display, proposal navigation); `agentStore` Pinia store with 3 data slices; `agentApi` HTTP client with enum normalization for backend integer serialization; 3 lazy-loaded routes under `/workspace/agents` gated to `agent` workspace mode; sidebar nav item with `primaryModes: ['agent']`; loading/error/empty states throughout; 42 frontend tests; adversarial review confirmed clean (no CRITICAL/HIGH)\n - **UI-12 Storybook baseline** (`#251`/`#807`): Storybook 10.3.5 (`@storybook/vue3-vite`) configured for Vue 3 + Vite 8; stories for all 17 Td* UI primitives (TdButton, TdIconButton, TdInput, TdTextarea, TdSelect, TdFieldWrapper, TdDialog, TdDropdown, TdPopover, TdTooltip, TdToast, TdInlineAlert, TdSpinner, TdSkeleton, TdBadge, TdTag, TdEmptyState) showing key state variants; design token CSS import + obsidian theme background; `viteFinal` hook strips PWA plugin for storybook builds; `npm run storybook` (dev server :6006) and `npm run storybook:build` scripts; adversarial review confirmed clean\n \n **Security & Auth:**\n - **SEC-07 SSO/OIDC with MFA** (`#82`/`#813`): configurable OIDC provider support (Microsoft Entra ID, Google, generic OIDC) via `IOidcProviderFactory` with pluggable registration; OIDC is config-gated and disabled by default; OIDC login/callback/exchange endpoints with open-redirect protection and short-lived single-use authorization codes; TOTP-based MFA (RFC 6238) with setup (secret + QR URI + 8 recovery codes), confirm, verify, and disable endpoints; recovery codes bcrypt-hashed at rest; constant-time comparison and replay protection; `MfaPolicy` configuration (`EnableMfaSetup`, `RequireMfaForSensitiveActions`) gating password change and account deletion; frontend OIDC login buttons on LoginView (config-gated), `MfaSetup.vue` settings component, `MfaChallengeModal.vue` for protected actions; no auto-linking by email (prevents account takeover); ADR-0029 documents design decisions; 30+ backend tests; adversarial review fixed dead MFA enforcement code, permanent user lockout via DisableAsync, and OIDC endpoint routing\n - **CLD-03 OAuth PKCE and account linking** (`#676`/`#812`): DB-backed auth code store replacing in-memory `ConcurrentDictionary` — `OAuthAuthCode` entity with EF migration, `IOAuthAuthCodeRepository` with atomic `TryConsumeAtomicAsync` (raw SQL `UPDATE WHERE IsConsumed = 0 AND ExpiresAt > now`); PKCE support via `UsePkce = true` in ASP.NET Core 8 OAuth middleware; account linking endpoints (`POST /api/auth/github/link`, `DELETE /api/auth/github/link`, `GET /api/auth/linked-accounts`) with conflict detection and session verification; frontend Linked Accounts section in `ProfileSettingsView` with Link/Unlink buttons and avatar display; 24+ backend tests; adversarial review fixed CSRF on account linking, TOCTOU in expiry check, JWT plaintext in DB, DoS via full-table load, and unbounded table growth\n \n **Ops & Observability:**\n-- **OPS-09 Staged deployment workflow** (`#101`/`#806`): ADR-0028 documents blue/green + canary deployment strategy with rollback criteria; `docs/ops/DEPLOYMENT_WORKFLOW.md` canonical 4-phase workflow (build verification → staging → production canary → production promotion) with rollback procedures, database migration safety, emergency hotfix override, and ownership/escalation model; `docs/ops/RELEASE_CHECKLIST.md` versioned smoke verification (7 pre-deploy + 9 automated staging + 7 manual staging + 7 canary + 6 post-promotion + 5 post-release checks) with failure response matrix; `scripts/deploy/smoke-test.sh` portable smoke test (9 automated checks: health, API, auth, board auth gate, frontend, SignalR, static assets, security headers, container restart detection); `.github/workflows/cd-staging-gate.yml` with `production` environment manual approval gate; adversarial review fixed script injection in CI workflow and unscoped container checks. _(⚠️ Parked by the 2026-06-13 archive pivot — staged cloud rollout de-scoped, see the parked-cloud note below. The workflow is manual-dispatch-only after **#1228**, so publishing a beta release no longer invokes the nonexistent `production` environment gate.)_\n+- **OPS-09 Staged deployment workflow** (`#101`/`#806`): ADR-0028 documents the intended blue/green + canary deployment strategy with rollback criteria; `docs/ops/DEPLOYMENT_WORKFLOW.md` retains the canonical 4-phase design (build verification → staging → production canary → production promotion) with rollback procedures, database migration safety, emergency hotfix override, and ownership/escalation model; `docs/ops/RELEASE_CHECKLIST.md` retains its versioned checks; `scripts/deploy/smoke-test.sh` provides 9 automated smoke checks. The parked `.github/workflows/cd-staging-gate.yml` now exposes only manual Phase 1 build verification and Phase 2 smoke tests: no protected `production` environment exists, so it declares no environment and records no Phase 3 approval. Required governance pins that fail-closed contract. _(⚠️ Parked by the 2026-06-13 archive pivot — staged cloud rollout remains de-scoped, see the parked-cloud note below. After **#1228**, publishing a beta release neither invokes this workflow nor creates/waits on an environment.)_\n - **OBS-02 Error tracking and product analytics** (`#549`/`#811`): config-gated Sentry SDK for backend (`Sentry.AspNetCore` with `BeforeSend` PII scrubbing for emails/JWTs, `ServerName` blanked) and frontend; opt-in product telemetry service (`TelemetryEventService`) aligned with `docs/product/TELEMETRY_TAXONOMY.md` — property key allowlist (15 safe keys), max 10 properties, 200-char value truncation; `TelemetryController` with anonymous config endpoint and authenticated events endpoint; Plausible/Umami analytics script injection (`useAnalyticsScript`) with HTTPS-only URL validation; Pinia `telemetryStore` with consent management, event buffering, and flush; DNT/GPC privacy signal detection prevents auto-restore of consent; telemetry consent toggle in `ProfileSettingsView`; `docs/ops/OBSERVABILITY_SETUP.md` configuration guide; all telemetry opt-in and disabled by default; 38 backend + 25 frontend tests; adversarial review fixed Sentry PII leak, arbitrary properties injection, XSS via script URL, and DNT non-compliance\n \n ## Post-Merge Housekeeping (2026-04-12)\n \n Batch merge of 7 PRs (`#800`, `#805`, `#811`, `#813`, `#815`, `#819`, `#820`) with conflict resolution and documentation sweep. All features are now on `main`:\n - Resilience and degraded-mode behavior tests (PR `#820`, 34 tests across 6 files)\n - OAuth auth code store and token lifecycle tests (PR `#815`, 19+ integration tests)\n - Cross-browser E2E matrix (PR `#800`, Chromium/Firefox/WebKit/mobile-chrome/mobile-safari)\n - Error tracking and product analytics with Sentry integration (PR `#811`, telemetry events, consent management)\n - MCP HTTP transport and API key authentication (PR `#819`, CLI commands, HTTP endpoint, rate limiting)\n - SSO/OIDC integration with optional TOTP MFA (PR `#813`, MfaController, recovery codes, OIDC login)\n - Distributed caching with ICacheService (PR `#805`, InMemory/Redis/NoOp implementations, cache-aside pattern)\n \n Test suite recertified: backend 4,279 tests, frontend 2,245 tests, combined ~6,500+ passing (2026-04-12). Latest recertification (2026-04-25): backend 5,060, frontend 2,805, combined 7,865+.\n \n Estimated totals after PRs `#821`–`#826` supplementary wave + PRs `#837`–`#841` validation/integrations wave: backend ~4,530+, frontend ~2,463+, E2E 61+ new scenarios, combined ~7,070+ passing. Actuals after PRs `#960`–`#969` audit remediation wave: backend 5,060, frontend 2,805, combined 7,865+.\n \n ## Phase Progress (Reconciled)\n \n Progress is tracked against `filesAndResources/taskdeck_technical_design_document.md`.\n \n 1. Phase 1 - Core Data Model and API: COMPLETE (100%)\n 2. Phase 2 - Basic Web UI: COMPLETE (100%)\n 3. Phase 3 - UX Improvements: COMPLETE (100%)\n 4. Phase 4 - Advanced Features: IN PROGRESS (97%)\ndiff --git a/docs/TESTING_GUIDE.md b/docs/TESTING_GUIDE.md\nindex f1e111d224257d8ebf924365761e0efdffe0dcc5..33849c1fe6a60041059c497a7930fa869f593431 100644\n--- a/docs/TESTING_GUIDE.md\n+++ b/docs/TESTING_GUIDE.md\n@@ -84,50 +84,52 @@ py -3 -B -m unittest discover -s scripts/agent_hooks -p \"test_render_failure_led\n node scripts\\check-docs-governance.mjs; if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }\n node scripts\\check-golden-principles.mjs; if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }\n node scripts\\check-github-ops-governance.mjs; if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }\n ```\n \n On POSIX, use `python3 -B` for direct utilities and fail fast. Do not run the full configured-handler smoke there: `.claude/settings.json` declares those handlers with `shell: powershell`, so `smoke_test.py` is native-Windows-host proof until that shell contract is redesigned.\n \n ```sh\n set -eu\n python3 -B -m json.tool .mcp.json >/dev/null\n python3 -B -m json.tool .claude/settings.json >/dev/null\n python3 -B \"$HOME/.codex/skills/.system/skill-creator/scripts/quick_validate.py\" .codex/skills/taskdeck-question-batch\n python3 -B \"$HOME/.codex/skills/.system/skill-creator/scripts/quick_validate.py\" .codex/skills/taskdeck-failure-capture\n python3 -B \"$HOME/.codex/skills/.system/skill-creator/scripts/quick_validate.py\" .codex/skills/taskdeck-interface-map\n python3 -B \"$HOME/.codex/skills/.system/skill-creator/scripts/quick_validate.py\" .claude/skills/taskdeck-question-batch\n python3 -B \"$HOME/.codex/skills/.system/skill-creator/scripts/quick_validate.py\" .claude/skills/taskdeck-failure-capture\n python3 -B \"$HOME/.codex/skills/.system/skill-creator/scripts/quick_validate.py\" .claude/skills/taskdeck-interface-map\n for file in scripts/agent_hooks/*.py; do python3 -B -c 'import pathlib, sys; source = pathlib.Path(sys.argv[1]); compile(source.read_text(encoding=\"utf-8\"), str(source), \"exec\")' \"$file\" || exit $?; done\n python3 -B scripts/agent_hooks/render_failure_ledger.py\n python3 -B -m unittest discover -s scripts/agent_hooks -p 'test_render_failure_ledger.py'\n node scripts/check-docs-governance.mjs\n node scripts/check-golden-principles.mjs\n node scripts/check-github-ops-governance.mjs\n ```\n \n+The GitHub operations governance check also pins the parked staging workflow contract: `.github/workflows/cd-staging-gate.yml` may expose only `workflow_dispatch`, must require a string `image_tag`, and must not declare an environment until a protected production environment is configured and verified.\n+\n The native-Windows hook smoke test executes the configured `.claude/settings.json` command handlers with `CLAUDE_PROJECT_DIR` set, including PowerShell-hosted handlers, representative dangerous Bash-command denials, missing-launcher and missing-policy fail-closed probes, failure-ledger redaction, and pre-commit no-op behavior. Its payloads identify the `Bash` tool; it does not prove native PowerShell-tool interception. That T4 policy gap is tracked by [#1497](https://github.com/Chris0Jeky/Taskdeck/issues/1497).\n \n When MCP availability itself is part of the change, also run the active runtime's MCP listing/auth command if available. Do not claim remote MCP connectivity unless the current session actually verified it.\n \n When `.claude/settings.json` changes outside the agentic smoke path, also parse it with PowerShell:\n \n ```powershell\n Get-Content -Raw .claude\\settings.json | ConvertFrom-Json | Out-Null\n ```\n \n ## GitHub Project Priority Audit Checks\n \n For changes to `scripts/github/Sync-TaskdeckProjectPriority.ps1`, run the offline parser and regression checks first:\n \n ```powershell\n $script = \"scripts\\github\\Sync-TaskdeckProjectPriority.ps1\"\n $tokens = $null\n $parseErrors = $null\n [System.Management.Automation.Language.Parser]::ParseFile((Resolve-Path $script).Path, [ref]$tokens, [ref]$parseErrors) | Out-Null\n if ($parseErrors.Count -ne 0) { $parseErrors | Format-List; exit 1 }\n \n powershell -NoProfile -File $script -SelfTest\n if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }\n ```\n \ndiff --git a/docs/ops/DEPLOYMENT_WORKFLOW.md b/docs/ops/DEPLOYMENT_WORKFLOW.md\nindex 97e0a3c1723b4e309c9761d155ea64d09dea10e2..a0c362870091e06c9a7062542245772d4acb9757 100644\n--- a/docs/ops/DEPLOYMENT_WORKFLOW.md\n+++ b/docs/ops/DEPLOYMENT_WORKFLOW.md\n@@ -268,53 +268,53 @@ Any of the following triggers an immediate rollback:\n Taskdeck uses EF Core auto-migration on API startup. When blue and green slots share the same SQLite database volume, migrations must be **forward-compatible**:\n \n - **Additive-only migrations**: Add new columns with defaults, add new tables. Never remove or rename columns that the current live version depends on.\n - **Two-phase migration pattern**: If a breaking schema change is required, split it across two releases: (1) add the new schema alongside the old, (2) remove the old schema after the previous version is fully retired.\n - **Migration order**: The idle slot starts first and applies any pending migrations. If the migration fails, the idle slot will not become healthy and the deployment is blocked at Phase 3 step 4 (health check).\n - **Shared database risk**: During the canary window, both slots read/write the same database. If the new migration alters behavior for existing data, ensure the active slot can still function with the migrated schema.\n \n If blue and green are deployed on separate hosts with separate databases (e.g., in a hypothetical multi-node topology; not planned — single-instance is permanent per the 2026-06-13 archive pivot), migration safety is simplified since each slot has its own schema lifecycle.\n \n ## Emergency Hotfix Override\n \n For critical production incidents where the standard workflow would take too long:\n \n 1. The release owner or on-call responder can skip the canary phase.\n 2. Deploy directly to the idle slot and immediately switch traffic.\n 3. Document the override reason in the release log.\n 4. Run the full smoke test immediately after traffic switch.\n 5. File a post-incident review within 24 hours.\n \n Emergency overrides must still pass Phase 1 (CI build) and Phase 2 (staging smoke). Skipping CI entirely is never permitted.\n \n ## GitHub Actions Integration\n \n The `cd-staging-gate.yml` workflow automates Phase 1 and Phase 2 gates:\n \n-> ⚠️ _(Parked by the 2026-06-13 archive pivot — staged cloud deployment de-scoped. After **#1228**, the workflow is manual-dispatch-only, so release publication cannot invoke its parked `production` environment gate. See `docs/ops/README.md`.)_\n+> ⚠️ _(Parked by the 2026-06-13 archive pivot — staged cloud deployment de-scoped. After **#1228**, the workflow is manual-dispatch-only and implements Phase 1-2 verification only. The repository has no protected `production` environment, so the workflow deliberately declares no environment and cannot record a Phase 3 approval. See `docs/ops/README.md`.)_\n \n - Triggers only on manual dispatch with an explicit image tag\n - Builds and verifies container images\n - Runs the smoke test suite against a CI-hosted staging environment\n-- Requires manual approval (GitHub environment protection) before Phase 3 can proceed\n+- Stops after Phase 2; Phase 3 requires separately configuring and verifying a protected GitHub `production` environment before this automation can be restored\n - See `.github/workflows/cd-staging-gate.yml` for the workflow definition\n \n ## Ownership and Escalation\n \n | Role | Responsibility |\n |---|---|\n | **Release owner** | Initiates deployment, monitors canary, approves promotion or triggers rollback |\n | **On-call responder** | Fallback authority for rollback if release owner is unavailable |\n | **Platform team** | Maintains deployment tooling, scripts, and Terraform modules |\n \n Escalation path: Release owner (15 min) -> On-call responder (30 min) -> Platform team lead.\n \n ## References\n \n - ADR-0028: Staged Deployment — Blue/Green with Canary Verification\n - `docs/ops/RELEASE_CHECKLIST.md` — smoke verification checklist\n - `docs/ops/DEPLOYMENT_CONTAINERS.md` — container baseline\n - `docs/ops/DEPLOYMENT_TERRAFORM_BASELINE.md` — Terraform baseline\n - `docs/ops/DISASTER_RECOVERY_RUNBOOK.md` — disaster recovery procedures\n - `docs/ops/INCIDENT_REHEARSAL_CADENCE.md` — incident rehearsal schedule\n - `.github/workflows/cd-staging-gate.yml` — staging gate workflow\n - `scripts/deploy/smoke-test.sh` — portable smoke test script\ndiff --git a/docs/ops/README.md b/docs/ops/README.md\nindex d33d83fa90cc86c93f7d292832d8fc8f17f36c2b..200c427020103052fd8f7cd02ac1b4fc95600a95 100644\n--- a/docs/ops/README.md\n+++ b/docs/ops/README.md\n@@ -1,32 +1,32 @@\n # Ops Docs\n \n This folder contains deployment, observability, and human-operator runbooks.\n \n ## Deployment\n \n-- `DEPLOYMENT_WORKFLOW.md` — Staged blue/green + canary workflow (ADR-0028) — **parked by the archive pivot** (hosted/multi-instance; not the personal run path). The beta release path is the self-contained executable build + smoke in `.github/workflows/release-desktop.yml`. The implementing `.github/workflows/cd-staging-gate.yml` is manual-dispatch-only after **#1228**; release publication no longer invokes its parked `production` environment gate.\n+- `DEPLOYMENT_WORKFLOW.md` — Staged blue/green + canary workflow (ADR-0028) — **parked by the archive pivot** (hosted/multi-instance; not the personal run path). The beta release path is the self-contained executable build + smoke in `.github/workflows/release-desktop.yml`. After **#1228**, `.github/workflows/cd-staging-gate.yml` is manual-dispatch-only and stops after build/smoke verification; it declares no `production` environment and records no approval because no protected environment is configured.\n - `RELEASE_CHECKLIST.md` — Smoke checklist for the OPS-09 staged (blue/green/canary) deployment — **parked by the archive pivot** (hosted/multi-instance; requires staging/prod URLs, container images, rollback slots — not the personal run path).\n - `DEPLOYMENT_CONTAINERS.md` — Container baseline (Dockerfiles, compose, nginx)\n - `DEPLOYMENT_HARDENING_MATRIX.md` — Container hardening verification matrix\n - `DEPLOYMENT_TERRAFORM_BASELINE.md` — Terraform IaC baseline for AWS — **parked by the archive pivot** (cloud/multi-instance IaC; reference-only, not the personal run path)\n \n ## Operations\n \n - `OBSERVABILITY_BASELINE.md`\n - `OBSERVABILITY_SETUP.md`\n - `ALERTING_RULES.md` — monitoring thresholds, alert priorities, escalation paths — the hosted/cloud thresholds (CloudWatch/PagerDuty) and its dependency on `CLOUD_REFERENCE_ARCHITECTURE.md` are **reference-only** under the archive pivot; only local/single-instance signals apply\n - `SESSION_START_CHECKLIST.md`\n - `TASKDECK_HUMAN_OPERATIONS.md`\n - `GITHUB_LABEL_TAXONOMY.md`\n - `DISASTER_RECOVERY_RUNBOOK.md`\n - `INCIDENT_REHEARSAL_CADENCE.md`\n - `SBOM_RELEASE_PROVENANCE.md`\n \n ## Cloud / Cost (parked by the archive pivot)\n \n These document the de-scoped cloud / multi-instance track and are **reference-only** — Taskdeck is single-instance, SQLite, personal-use (never hosted/scaled out). Each file carries its own de-scope banner.\n \n - `CLOUD_REFERENCE_ARCHITECTURE.md` — cloud target topology + autoscaling reference architecture — **parked** (reference-only)\n - `CLOUD_COST_OBSERVABILITY.md` — cloud cost observability (ADR-0026 companion) — **parked** (reference-only)\n - `BUDGET_BREACH_RUNBOOK.md` — cloud budget-breach response (ADR-0026 companion) — **parked** (reference-only)\n - `COST_HOTSPOT_REGISTRY.md` — cloud cost hotspot registry (ADR-0026 companion) — **parked** (reference-only)\ndiff --git a/docs/strategy/02_PACKAGING_DISTRIBUTION_STRATEGY.md b/docs/strategy/02_PACKAGING_DISTRIBUTION_STRATEGY.md\nindex af54b3e8c80e517e9a05c597cef2d673ff4aaff6..d547ffab263ec2645b70b940a6a23649b366ee95 100644\n--- a/docs/strategy/02_PACKAGING_DISTRIBUTION_STRATEGY.md\n+++ b/docs/strategy/02_PACKAGING_DISTRIBUTION_STRATEGY.md\n@@ -1,32 +1,32 @@\n # Packaging and Distribution Strategy\n \n **Date:** 2026-03-29\n **Scope:** Single-executable packaging, installer creation, cross-platform distribution, and first-run experience\n-**Status:** PARTIALLY SUPERSEDED (2026-06-13 archive pivot) — installer / cross-platform distribution / cloud / mobile de-scoped; only the **single self-contained executable + first-run path** below remains the canonical *personal* run goal.\n+**Status:** HISTORICAL STRATEGY / PARTIALLY ACTIVE — ADR-0044 superseded the 2026-06-13 archive pivot; the required `v0.1.0` free-beta ship gate and its self-contained executable are current, while installer stores, broader multi-channel distribution, cloud, mobile, and GTM remain parked.\n \n-> **⚠️ PARTIALLY SUPERSEDED — 2026-06-13 archive pivot.** This document predates the maintainer's decision to finish Taskdeck for personal use and then archive it. The **installer-creation, cross-platform-distribution, cloud, mobile, and GTM** tracks it describes are **permanently de-scoped** and are retained here only as a historical record of parked plans. **Still active, however:** only the **local build of the single self-contained executable** (`dotnet publish --self-contained … -p:PublishSingleFile=true`) + its first-run experience remains the canonical *personal* run path (see `README.md` and `OUTSTANDING_TASKS.md`). **The *multi-channel distribution* steps in the section below — winget/Homebrew/Snap/Flathub, public download/landing pages, and the \"download and run\" marketing flow — are the parked distribution framing; do NOT action them.** Nuance on the GitHub Release: cutting a `v0.1.0` tag **auto-fires `release-desktop.yml`**, which builds the self-contained exes and publishes a GitHub Release with SHA256 checksums — that single archival Release **is the retained *optional archival* mechanism** (per `OUTSTANDING_TASKS.md`), not de-scoped; it is just not a distribution *roadmap* (no stores, no marketing). The parked `cd-staging-gate.yml` is manual-dispatch-only after `#1228`, so publishing that release no longer starts its unavailable production-environment gate. Current scope: finish + activate the Paper UI (canonical per ADR-0038), make local one-command run trivial (incl. the self-contained exe), general quality, then archive. See `docs/STATUS.md` and the Direction section of `docs/IMPLEMENTATION_MASTERPLAN.md`.\n+> **⚠️ HISTORICAL STRATEGY — current scope is the ADR-0044 revival.** The 2026-06-13 finish-for-personal-use-and-archive decision is retained only as checkpoint history; it no longer directs current work. `v0.1.0` is a **required free-beta ship gate**, including rehearsal of `release-desktop.yml`, runner-native smoke evidence, the self-contained executables, checksums, and the maintainer-authorized tag/release. The broader **installer-store, multi-channel distribution, cloud, mobile, and GTM** tracks below remain parked unless the active revival plan explicitly reauthorizes them. The parked `cd-staging-gate.yml` is manual-dispatch-only after `#1228` and stops after build/smoke verification; release publication cannot invoke it, and it claims no production approval because no protected `production` environment is configured. See `OUTSTANDING_TASKS.md`, `docs/STATUS.md`, `docs/REVIVAL_PLAN.md`, and the Direction section of `docs/IMPLEMENTATION_MASTERPLAN.md` for current authority.\n \n ---\n \n ## 1. Current State\n \n Taskdeck currently requires manual setup of multiple components:\n \n ```\n # Backend (.NET 8)\n dotnet run --project backend/src/Taskdeck.Api/Taskdeck.Api.csproj\n \n # Frontend (Vue 3 + Vite)\n cd frontend/taskdeck-web && npm install && npm run dev\n ```\n \n Or via Docker Compose:\n ```\n docker compose -f deploy/docker-compose.yml --env-file deploy/.env --profile baseline up -d --build\n ```\n \n **The problem:** This is acceptable for developers during evaluation, but it's a significant barrier to adoption. Every step a user must take before seeing value is a potential drop-off point. The current setup requires:\n - .NET 8 SDK or Docker installed\n - Node.js 24 for frontend dev\n - Git to clone the repo\n - Manual env configuration\n@@ -308,51 +308,51 @@ Unsigned executables trigger security warnings:\n - Windows SmartScreen: \"Windows protected your PC\"\n - macOS Gatekeeper: \"cannot be opened because the developer cannot be verified\"\n - These warnings kill conversion. Many users won't click through.\n \n ### 7.2 Cost and Effort\n \n | Platform | Certificate Type | Cost | Effort |\n |----------|-----------------|------|--------|\n | Windows | EV code signing cert | $200-400/year (or free via SignPath for OSS) | Medium |\n | macOS | Apple Developer cert | $99/year (Apple Developer Program) | Medium |\n | Linux | GPG signing | Free | Low |\n \n ### 7.3 Recommendation\n \n - Start without code signing (accept the warnings for early beta)\n - Add Windows/macOS signing once you have 100+ users\n - Apply for SignPath OSS program (free EV signing for open source)\n - Apple Developer Program is worth the $99/year if you have macOS users\n \n ---\n \n ## 8. Build and Release Pipeline\n \n ### 8.1 CI/CD Pipeline (already built — `release-desktop.yml`)\n \n-_(This is no longer \"to be added\" — `.github/workflows/release-desktop.yml` and `scripts/build-release.sh` **already exist and are wired** (see line 69). The workflow **auto-fires on any `v*` tag push** and on `workflow_dispatch`, building the matrix `win-x64`/`linux-x64`/`osx-x64`/`osx-arm64` self-contained exes with SHA256 checksums + a `#1123` smoke test of the **three runner-native RIDs** (`win-x64`, `linux-x64`, `osx-arm64`). `osx-x64` is built and shipped but **not** smoke-tested — it is cross-arch on the arm64 `macos-latest` runner and cannot launch there (`if: matrix.rid != 'osx-x64'`), so that one archive carries less release evidence than the other three. **Publishing depends on how it is triggered:** a `v*` tag push, a dispatch naming an existing tag, **or a dispatch whose ref is itself a tag**, creates the GitHub Release; a dispatch **from a branch** with the tag input left blank is a rehearsal — it builds, smoke-tests and uploads artifacts, then stops without creating a Release (`create-release` is skipped). That rehearsal path exists so the pipeline can be exercised before the irreversible tag push that `#1303` reserves to the maintainer. Under the archive pivot this is the **optional archival exe-release** path — cutting a `v0.1.0` tag auto-publishes that archival Release; the *broader* distribution (stores, download pages, marketing) below is parked.)_\n+_(This is no longer \"to be added\" — `.github/workflows/release-desktop.yml` and `scripts/build-release.sh` **already exist and are wired** (see line 69). The workflow **auto-fires on any `v*` tag push** and on `workflow_dispatch`, building the matrix `win-x64`/`linux-x64`/`osx-x64`/`osx-arm64` self-contained exes with SHA256 checksums + a `#1123` smoke test of the **three runner-native RIDs** (`win-x64`, `linux-x64`, `osx-arm64`). `osx-x64` is built and shipped but **not** smoke-tested — it is cross-arch on the arm64 `macos-latest` runner and cannot launch there (`if: matrix.rid != 'osx-x64'`), so that artifact carries less release evidence than the other three. **Publishing depends on how it is triggered:** a `v*` tag push, a dispatch naming an existing tag, **or a dispatch whose ref is itself a tag**, creates the GitHub Release; a dispatch **from a branch** with the tag input left blank is a rehearsal — it builds, smoke-tests and uploads artifacts, then stops without creating a Release (`create-release` is skipped). That rehearsal path exists so the pipeline can be exercised before the irreversible tag push that `#1303` reserves to the maintainer. Under ADR-0044 this is the **required v0.1.0 free-beta release path**; the *broader* distribution (stores, download pages, marketing) below remains parked.)_\n \n ```yaml\n # Existing GitHub Actions workflow: release-desktop.yml (auto-fires on v* tags)\n on:\n push:\n tags: ['v*']\n \n jobs:\n build-frontend:\n # npm ci && npm run build → artifact\n \n build-desktop:\n needs: build-frontend\n strategy:\n matrix:\n include:\n - os: windows-latest\n rid: win-x64\n artifact: taskdeck-win-x64.zip\n - os: ubuntu-latest\n rid: linux-x64\n artifact: taskdeck-linux-x64.tar.gz\n - os: macos-latest\n rid: osx-x64\n artifact: taskdeck-osx-x64.tar.gz\ndiff --git a/scripts/check-github-ops-governance.mjs b/scripts/check-github-ops-governance.mjs\nindex b996bb91c36081a2a4d11500d19549332b2c7111..0ee293e667ed2d72e259b0ae4ed975e8a45ebe28 100644\n--- a/scripts/check-github-ops-governance.mjs\n+++ b/scripts/check-github-ops-governance.mjs\n@@ -1,70 +1,117 @@\n #!/usr/bin/env node\n \n import { access, readFile } from 'node:fs/promises'\n import { constants as fsConstants } from 'node:fs'\n import { resolve } from 'node:path'\n \n const errors = []\n \n+const stagingGateWorkflowPath = '.github/workflows/cd-staging-gate.yml'\n+\n const requiredIssueTemplateFiles = [\n '.github/ISSUE_TEMPLATE/bug_report.md',\n '.github/ISSUE_TEMPLATE/feature.md',\n '.github/ISSUE_TEMPLATE/security_hardening.md',\n '.github/ISSUE_TEMPLATE/tech_debt_refactor.md',\n ]\n \n const allowedTemplateLabels = new Set([\n 'bug',\n 'security',\n 'hardening',\n 'backend',\n 'frontend',\n 'ux',\n 'testing',\n 'docs',\n 'refactor',\n 'tech-debt',\n 'starter-packs',\n 'llm',\n 'feature',\n 'automation',\n 'worker',\n 'performance',\n ])\n \n const deprecatedTemplateLabels = new Set([])\n \n async function fileExists(path) {\n try {\n await access(resolve(path), fsConstants.F_OK)\n return true\n } catch {\n return false\n }\n }\n \n+function getIndentedYamlBlock(text, key, indentation = 0) {\n+ const lines = text.split(/\\r?\\n/)\n+ const prefix = ' '.repeat(indentation)\n+ const start = lines.findIndex((line) => line === `${prefix}${key}:`)\n+ if (start === -1) return null\n+\n+ let end = start + 1\n+ while (end < lines.length) {\n+ const line = lines[end]\n+ if (line.trim() !== '' && line.length - line.trimStart().length <= indentation) break\n+ end += 1\n+ }\n+\n+ return lines.slice(start + 1, end).join('\\n')\n+}\n+\n+async function validateStagingGateContract() {\n+ if (!(await fileExists(stagingGateWorkflowPath))) {\n+ errors.push(`Missing required workflow: ${stagingGateWorkflowPath}`)\n+ return\n+ }\n+\n+ const workflow = await readFile(resolve(stagingGateWorkflowPath), 'utf8')\n+ const triggers = getIndentedYamlBlock(workflow, 'on')\n+ if (triggers === null) {\n+ errors.push(`${stagingGateWorkflowPath} is missing its top-level on block`)\n+ return\n+ }\n+\n+ const topLevelTriggers = [...triggers.matchAll(/^ {2}([A-Za-z_][\\w-]*):/gm)].map((match) => match[1])\n+ if (topLevelTriggers.length !== 1 || topLevelTriggers[0] !== 'workflow_dispatch') {\n+ errors.push(`${stagingGateWorkflowPath} must expose only the workflow_dispatch trigger`)\n+ }\n+\n+ const dispatch = getIndentedYamlBlock(workflow, 'workflow_dispatch', 2)\n+ const imageTag = dispatch === null ? null : getIndentedYamlBlock(dispatch, 'image_tag', 6)\n+ if (imageTag === null || !/^ {8}required:\\s*true\\s*$/m.test(imageTag) || !/^ {8}type:\\s*string\\s*$/m.test(imageTag)) {\n+ errors.push(`${stagingGateWorkflowPath} workflow_dispatch.image_tag must be a required string`)\n+ }\n+\n+ if (/^\\s*environment:/m.test(workflow)) {\n+ errors.push(`${stagingGateWorkflowPath} must not claim an environment gate until repository protection is configured`)\n+ }\n+}\n+\n function parseLabelsFromFrontMatter(markdown, path) {\n const frontMatterMatch = markdown.match(/^---\\r?\\n([\\s\\S]*?)\\r?\\n---/)\n if (!frontMatterMatch) {\n errors.push(`${path} is missing YAML front matter`)\n return []\n }\n \n const frontMatter = frontMatterMatch[1]\n const labelsLine = frontMatter.match(/^\\s*labels:\\s*\\[(.*)\\]\\s*$/m)\n if (!labelsLine) {\n errors.push(`${path} is missing a labels array in front matter`)\n return []\n }\n \n return labelsLine[1]\n .split(',')\n .map((value) => value.trim().replace(/^['\"]|['\"]$/g, ''))\n .filter((value) => value.length > 0)\n }\n \n async function validateIssueTemplates() {\n for (const path of requiredIssueTemplateFiles) {\n if (!(await fileExists(path))) {\n errors.push(`Missing required issue template: ${path}`)\n continue\n@@ -119,44 +166,45 @@ async function validateProjectAutomationDocs() {\n '`Item reopened`',\n '`Item closed`',\n '`Pull request linked to issue`',\n '`Pull request merged`',\n ]\n \n for (const token of requiredTokens) {\n if (!automationText.includes(token)) {\n errors.push(`docs/GITHUB_PROJECT_AUTOMATION.md is missing required token: ${token}`)\n }\n }\n }\n \n if (!(await fileExists('AGENTS.md'))) {\n errors.push('Missing AGENTS.md at repository root')\n return\n }\n \n const agentsText = await readFile(resolve('AGENTS.md'), 'utf8')\n if (!agentsText.includes('docs/GITHUB_PROJECT_AUTOMATION.md')) {\n errors.push('AGENTS.md must reference docs/GITHUB_PROJECT_AUTOMATION.md')\n }\n }\n \n async function main() {\n+ await validateStagingGateContract()\n await validateIssueTemplates()\n await validateIssueTemplateConfig()\n await validateProjectAutomationDocs()\n \n if (errors.length > 0) {\n console.error('GitHub operations governance check failed:')\n for (const error of errors) {\n console.error(`- ${error}`)\n }\n process.exit(1)\n }\n \n console.log('GitHub operations governance check passed.')\n }\n \n main().catch((error) => {\n console.error('GitHub operations governance check crashed:', error)\n process.exit(1)\n })\n","external_storage_diff",{"_1768":1769,"_1770":-5},"files_modified","lines_added",62,"lines_removed",44,"commit_message","Make parked staging verification fail closed\n\nSigned-off-by: Codex ","additional_parent_commit_shas",[],"file_id","file_00000000a28c81f7a5ee533cd9fb1bd7","ttl","partial_repo_snapshot","files",[1774,1775,1776,1777,1778,1779,1780,1781],{"_256":6403,"_1782":-5,"_1783":6404,"_1785":-5},{"_256":6255,"_1782":-5,"_1783":6256,"_1785":-5},{"_256":4779,"_1782":-5,"_1783":4780,"_1785":-5},{"_256":3574,"_1782":-5,"_1783":3575,"_1785":-5},{"_256":2409,"_1782":-5,"_1783":2410,"_1785":-5},{"_256":2213,"_1782":-5,"_1783":2214,"_1785":-5},{"_256":1900,"_1782":-5,"_1783":1901,"_1785":-5},{"_256":733,"_1782":-5,"_1783":1784,"_1785":-5},"contents","line_range_contents",[1786],"missing_reason",{"_1787":716,"_1788":1789,"_672":1790,"_1791":59},"line_range_start","line_range_end",137,[1792,381,1793,381,1794,1795,1796,1797,1798,1799,381,1800,381,1801,381,1802,381,1803,1804,1805,1806,1807,1808,1809,381,1810,381,1811,381,1812,381,1813,1814,1815,381,1816,381,1817,1818,1819,1820,1821,1822,1823,1824,1825,1826,1827,1828,381,1829,381,1830,381,1831,381,1832,1833,381,1834,381,1835,381,1836,1837,1838,1839,1840,1841,381,1842,381,1843,381,1844,1845,1846,1847,1848,1849,1850,1851,1852,1853,1854,1855,1856,381,1857,381,1858,1859,1860,1861,1862,1863,1864,1865,1866,1867,1868,1869,1870,1871,381,1872,1873,1874,1875,1876,1877,1878,1879,381,1880,1881,381,1801,381,1882,1883,1884,1885,1886,1887,1888,1889,1890,1891,1892,1893,1894,1895,1896,1897,1898,1899],"contains_end_of_file","# Outstanding Tasks","**Purpose:** a durable, human-owned checklist of work the maintainer (Chris) wants to keep visible across sessions and agents, so nothing is forgotten between context resets.","**Rules for agents (Claude, Codex, etc.):**","1. **Read this file at the start of every session** (it is referenced from `CLAUDE.md` and `AGENTS.md` and the SessionStart hook).","2. **Surface the open items** whenever you give a summary, status update, handoff, or \"what's next\" — list the open (`[ ]`) tasks with their IDs so the maintainer is reminded.","3. **Only clear/check a task when the maintainer explicitly says it's done.** Do not auto-complete items just because a related PR was opened or you think it's finished. When told an item is complete, change `[ ]`→`[x]` (or remove it) and note the date in the changelog at the bottom.","4. **Add new outstanding tasks here** when the maintainer asks you to remember something, or when substantial work is deferred. Keep entries short with a one-line \"how\" and a link to the GitHub issue/PR that holds the detail.","5. Keep this file lean and scannable. Detail lives in the linked issues, not here.","Last reviewed: 2026-07-13","---","## A. Merged PRs (confirmed by post-audit sweep 2026-05-31)","- [x] **PR #1143** — Test loop: `npm test`→`vitest run` + stabilize the MetricsView flake. *(merged 2026-05-31)*","- [x] **PR #1144** — Docs truth: STATUS↔TESTING_GUIDE contradiction, RFAI spine, broken links. *(merged 2026-05-31)*","- [x] **PR #1145** — Release scripts aligned with CI flags + stale PKG-01 warning removed. *(merged 2026-05-31)*","- [x] **PR #1146** — Proposal create returns 409 (not 500) on duplicate idempotency key. *(merged 2026-05-31, closes #1125)*","- [x] **PR #1147** — `AsSplitQuery` on the multi-collection board read. *(merged 2026-05-31)*","- [x] **#1126** — Un-skip INV-10/11/12 roadmap-invariant tests with real service assertions. *(PR #1153, merged 2026-05-31)*","- [x] **#1134** (first slice) — Surface swallowed audit-log failures via shared `AuditLogWriter`. *(PR #1155, merged 2026-05-31)*","## B. Next easy wins (seeded, not yet started)","- [ ] **#1133** (rest) — Bound `NotificationRepository` paging (push ORDER BY+LIMIT to SQL), incremental SignalR board patch instead of full 3-call refetch, FTS-backed card search.","## B2. Surfaced by post-audit correctness sweep (2026-05-31)","- [ ] **Cohort metrics stub** — `AutomationMetricsController.GetCohortMetrics` returns empty data; `CohortDashboard` frontend is wired but always shows \"No cohort data available.\" *How:* build `ICohortMetricsService` with real cohort aggregation once learning-loop data layer design is decided. Tracked in #1142.","- [ ] **Ollama real streaming** — `OllamaLlmProvider.StreamAsync` does pseudo-streaming (complete-then-drip-by-word). *How:* consume Ollama's `stream:true` API for genuine token streaming when Ollama provider goes beyond prototype.","- [ ] **#1134 remaining acceptance criteria** — first slice (AuditLogWriter) shipped; 6 remaining criteria still open on the issue.","## C. Strategic / larger tracks (seeded under tracker #1142)","- [ ] **#1123** — v0.1.0 release: a **required revival Phase-1 ship-gate item** under ADR-0044/REVIVAL-07. Exercise the release pipeline, smoke-run the self-contained exe, publish the GHCR image, and fix the documented release-path breakage before strangers are invited. The release smoke step already landed in `release-desktop.yml`. *(Optional-archive framing from 2026-06-13 is superseded.)*","- [ ] **#1132** — Make the required PR gate enforce security: gitleaks/SAST/dependency scan + CORS fail-closed + single ≥32 JWT floor + global `FallbackPolicy` + bundle-size in the required lane.","- [x] **#1130** — SQLite local concurrency: enable WAL + `busy_timeout`, fix per-process `Migrate()` race (UI + MCP + CLI share one DB → `SQLITE_BUSY`). *(closed 2026-06-05; ACs 1+3 shipped in PR #1165 / da764b92. AC2 cross-process `Migrate()` serialization → #1164; export/import redesign → #1166.)*","- [ ] **#1131** — CLI hardening: fresh-machine bootstrap (it crashes without `Connectors:EncryptionKey`) + route CLI mutations through board-access authorization.","- [x] **#1124** — Core-loop polish: false-green expiry regression test (now asserts a real 409) + #678 dismiss gap (Approved+expired) + #680 provenance-404 console noise. *(closed 2026-06-05; all three fixed in PR #1162 / 77162b2d. Paper-view dismiss affordance → #1161.)*","- [x] **#1161** — Paper review dismiss affordance (carries #1124's Paper remainder; maintainer 2026-06-05: take it, design-first — propose the affordance before building). *(Maintainer check-off 2026-06-19; delivered via PR #1219, **merged 2026-06-19**; issue #1161 closed.)*","- [x] **#1164** — Serialize cross-process `Database.Migrate()` (advisory/single-owner lock; carries #1130 AC2). *(Maintainer check-off 2026-06-19; closed on GitHub via PR #1186 / SerializedMigrator.)*","- [ ] **#1166** — Harden dev-sandbox export/import via the SQLite backup API (carries #1130's export/import follow-up).","- [ ] **#1138** (rest) — Split the 1300+ line `STATUS.md` into a lean current-reality head + `docs/archive/status-history/`; add a rotation rule; recertify TESTING_GUIDE totals from a green CI run; add a markdown link-checker to nightly.","- [ ] **#1136** (remainder) — ADR decision **delivered** (ADR-0038, Paper canonical / Legacy frozen; STATUS states the canonical stack) via PR #1207. **Still open:** remove/quarantine the dead paper composables (AC3) — scheduled for the Paper polish wave.","- [ ] **#1137** — Refocus strategy/roadmap. ADR-0044 + `docs/REVIVAL_PLAN.md` now provide the revival direction and finite wave; pending maintainer check-off after the canonical-doc sync is merged. The 2026-06-13 archive framing is retained only as the checkpoint fallback.","- [ ] **#1135 / #1140 / #1141 / #1139** — Code-health guardrails + oversized-view decomposition; workspace hygiene + one-command dev-up; i18n/a11y ADR; deployment docs (docker quickstart secret, desktop run docs). *(2026-06-19: **#1135 partial** — paper-night straggler tokens (PR #1216) — checked off by maintainer; guardrail/decomposition half + #1140/#1141/#1139 remain open.)*","> Full audit context and the complete gap inventory: **GitHub issue #1142** (master tracker).","## F. Generalist expansion wave (2026-07-13, ADR-0046 Proposed — extends §E as REVIVAL_PLAN Phase 4)","Decision under ratification: **extend the single app** (artefact intake beyond transcripts, project dossiers, generalist legibility, friends-family channel); the twin generalist app is **deferred behind the GEN-12 evidence gate**, not built. Wave label `generalist`; strictly subordinate to the v0.1 ship gate.","- [ ] **GEN-00 tracker (#1327)** — ratify ADR-0046 + Phase-4 placement + the tracker's decision checklist (SQLite blob storage, consent-gated vision MVP, twin-app deferral). Child issues: #1315–#1326 (GEN-01..12).","- [ ] **Maintainer at checkpoint:** review GEN-12 (#1326) twin-app gate against friends-family signal (GEN-11 #1325) — recorded decision required, silence is not a close.","## E. Revival wave (2026-07-10 pivot, ADR-0044 — supersedes the archive framing of §D)","Direction: **free open beta → commercial horizon** (`docs/REVIVAL_PLAN.md` is the planning spine; `docs/analysis/2026-07-10_revival_assessment.md` is the evidence base). §D items are re-scoped in place — same work, new purpose (v0.1 ship gate instead of archive gate). Issue IDs below are seeded as the REVIVAL wave; see the tracker for the authoritative list.","- [ ] **REVIVAL-00 tracker (#1311)** — charter + v0.1 ship-gate ratification (amends #1278); wave sequencing. Child issues: #1297–#1310 (REVIVAL-01..14); docs PR: #1296.","- [ ] **Phase 0 — dogfooding starts now** (#1271, unchanged): real personal use including WhisperX transcripts through the existing transcript capture tab.","- [ ] **Phase 1 — truth + safety before strangers**: registration gating flag; remove the fake undo timeline; de-stub Today dossier (#1272); Paper fonts + favicon; Paper onboarding/first-board path; README revival rewrite + demo GIF + MCP section; v0.1.0 tag → exercise release pipeline → GHCR image; fix render.yaml; branch protection (#1173); CI keep/kill (#1275); Paper E2E/axe re-point (#1274).","- [ ] **Phase 2 — transcript engine** (authorized new-surface exception): LLM triage strategy behind `ICaptureTriageService` for transcript sources; chunking + cap raise; triage schema v2 (type/assignee/due + model-derived confidence); Transcript entity + evidence spans; OpenAICompatible provider + true SSE streaming; risk-tiered review prioritization and batch-confirm ergonomics (**never auto-apply or bypass ADR-0003's approve-then-execute gate**); (2b, gated on dogfooding value) audio upload + WhisperX sidecar.","- [ ] **Phase 3 — slim + launch**: dead-surface amputation (#1276 expanded); MCP packaging + scoped keys + hash-pin wiring (#1154) + explicit multi-user-safe stdio identity (#1309); privacy-respecting beta feedback channel; launch checklist (r/selfhosted, Show HN, awesome-selfhosted, hosted demo).","- [ ] **Checkpoint (~8 weeks)**: fall back to the §D archive plan only if there is no organic traction **and** dogfooding has not stuck; any mixed outcome requires an explicit maintainer assessment/plan amendment.","## D. Historical archive closeout wave — re-scoped by ADR-0044","Analysis docs: `docs/PROJECT_TRAJECTORY.md` (strengths + path) and `docs/COURSE_CORRECTION.md` (what must change + ordered plan). These issue titles retain their ARCHIVE-* history, but **nothing in this section independently authorizes archival**: ADR-0044 re-scopes the still-useful work into the revival ship gate and keeps archive only as the checkpoint fallback. Wave source: **#1278** (originally ARCHIVE-00; amended by REVIVAL-00/#1311).","- [ ] **#1278** — originally ARCHIVE-00; now the **v0.1 ship-gate source** amended by REVIVAL-00/#1311: ratify the repurposed exit criteria and revival additions, then use archive only if ADR-0044's checkpoint condition is met. *(Maintainer decision.)*","- [ ] **#1269** — ARCHIVE-01: codify the two-tier review gate (LIGHT/FULL), issue-intake severity bar, no-new-backend-surface rule.","- [ ] **#1270** — ARCHIVE-02: backlog triage hour — close ~16 already-decided issues with dated pivot notes. *(Maintainer sign-off on the list.)*","- [ ] **#1271** — ARCHIVE-03: dogfooding sprint — ≥10 days of real personal use (the pivot's acceptance test; cannot be delegated).","- [ ] **#1272** — ARCHIVE-04: Today dossier truth — de-stub the fabricated default daily surface (`useTodayDossier.ts` buildStubDossier).","- [x] **#1273** — capture-triage provenance names the deterministic extractor, delivered by #1283; the v0.1 ship-gate item is done. *(Checked off 2026-07-25 on the maintainer's explicit instruction — see the rule-3 note in the changelog. GitHub issue #1273 was already closed 2026-07-03.)*","- [ ] **#1274** — ARCHIVE-06: re-point E2E + axe coverage at the Paper UI (currently the least-tested UI).","- [ ] **#1275** — ARCHIVE-07: CI estate right-sizing — keep/kill/gate per lane + short ADR (nightly red 28 days; mutation red 10+ weeks).","- [ ] **#1276** — ARCHIVE-08: dead-surface removal — ink-bleed decision, orphaned Paper code, cohorts stub, voice capture, Ollama marking.","- [ ] **#1277** — originally ARCHIVE-09; now the revival checkpoint/fallback record. Beta-facing README, release tag, and ship-gate checks live in REVIVAL-06/07/14; archive-only edits wait unless ADR-0044's checkpoint condition is met.","- [x] **#1235** — revision-aware proposal diff (preview equals what Apply executes) was delivered by #1280 with regression coverage; the v0.1 ship-gate item is done. *(Checked off 2026-07-25 on the maintainer's explicit instruction — see the rule-3 note in the changelog. GitHub issue #1235 was already closed 2026-07-03.)*","- [ ] **#1291** — Adopt agent-harness T3 profile: one-home policy collapse, .codex mirror retirement, skill read-first diet, region maps, review-twin merge, ledger triage cadence. *(Blueprint: sibling checkout `C:/Users/jekyt/source/agent-harness/BLUEPRINT.md` — outside this repo; complements #1138/#1269/#1275/#1276, no duplication.)*","- *(Record, already done 2026-07-02:)* re-scope comments posted on #996, #1123/#1139, #1128, #1134 (+#1154 decision), #1135, #1138, #1173, #1175 (+#1174), #1210, #1215, #1222 (+#1227), #1228 — each carries updated finish-or-close ACs.","## E. Revival overnight deferrals (added 2026-07-13)","- [ ] **#1173** — Apply and verify the required branch-protection settings in GitHub. This is repository-settings work and remains maintainer-only.","- [ ] **#1303** — Push the `v0.1.0` release tag only after the maintainer accepts the release deck and its pipeline evidence. Agents may repair the pipeline but must not push the tag.","- [ ] **#1482 — Taskdeck name, pre-commercial legal residuals.** *(Supersedes the old \"#1299 trademark check\" line: #1299 shipped with PR #1337 on 2026-07-25 and its AC4 search + cost + recommendation are recorded on the issue.)* What remains is genuinely legal and none of it blocks the free beta: an **attorney registrability opinion** for Classes 9/42 asking about *descriptiveness* (not just conflict), a read on **TASKADE** (live, incontestable US Cl. 42 mark covering task management), the UKIPO/EUIPO coverage gaps (UKIPO hard-blocked automated access, so all GB data is indirect), perishable namespace reservations, and the **keep-or-rename decision before `v0.1.0` (#1303)** — renaming is nearly free pre-tag and expensive after.","- [ ] **#1458 project-priority data cleanup — delivered; maintainer record check-off pending.** All 130 formerly unlabeled Taskdeck Issues were classified and verified, the reviewed project-field Apply succeeded 141/141, and the built-in plus three fresh complete audits proved 1,472/1,472 items with zero remaining Priority drift. PR #1488 merged; issue #1458 and both project items are `Done / Priority I`. The checkbox remains open because only the maintainer checks off this file.","- [ ] **#1330** — Repair the CI Extended reusable-workflow permission contract; affected PRs remain ineligible while the workflow startup failure is red.","- [ ] **#1282 / #1332 / #1335** — Stabilize the required full-suite harness: SQLite concurrency, Redis connect/dispose, and hosted-worker/presence lifecycle isolation. Narrow passes do not clear the recorded full-suite failures.","- [ ] **#1338** — Map HTTP MCP and its API-key middleware to the same `/mcp` route before documenting or exposing HTTP transport; the current parameterless mapping serves MCP at an unintended unauthenticated root route.","- [ ] **#1343** — Prevent late Home/Today summary responses from overwriting a newer local workspace-mode choice; add deterministic ordering tests and repeated error-recovery E2E proof.","- [ ] **#1345 maintainer record check-off** — The code now centrally pins the matched SQLitePCLRaw 2.1.12 family, loads SQLite 3.53.3, enforces the advisory's >= 3.50.2 runtime floor, clears the solution vulnerability audit, preserves the EF model, and passes a self-contained `win-x64` health smoke. The implementation is complete; this checkbox remains human-owned.","- [ ] **#1274 / `origin/issue-1274/paper-e2e-axe` at `993f188f`** — Resume the parked Paper E2E/axe re-point from the pushed WIP branch; fix tracked Paper Review blockers #1347/#1348, finish the named first-run/onboarding/smoke and axe coverage, then run the full frontend/E2E gates before opening a PR.","- [ ] **#1347 / #1348** — Repair the Paper deep-review enum wire-contract crash and the SQLite-backed similar-past HTTP 500; both were reproduced by the real Paper capture/review path and must not be hidden by frontend fallbacks.","- [ ] **#1323 prompt-rail remainder** — Bind the hostile transcript/PDF/image and malformed-response fixtures from PR #1340 to PR #1312's effective prompt/parser path before GEN-04; prove grounded-task-or-empty verdicts and deterministic fallback for schema escapes.","- [ ] **#1456 / PR #1457 — Codex deny-floor adapter T4 gate.** **Do not run the posted `/hooks` canaries yet.** The 2026-07-26 audit found red DCO on all four commits, no substantive review of the current head, material drift behind `main`, a v1.6.5 pin behind the installed/producer v1.6.12 floor, and unresolved root/common-directory hook discovery. First repair and synchronize the branch, settle the exact reviewed dispatcher bytes and authoritative hook source, then rerun exact-head CI and two adversarial reviews. Only after those prerequisites may the maintainer trust the project hook in a fresh interactive `/hooks` session and record allow/deny canaries; no agent can perform or substitute for that final gate.","- [ ] **Prune the merged agent worktrees.** `git worktree remove` is blocked by the deny floor, so this is human-only and recurs after every wave (upstream: [agent-harness#41](https://github.com/Chris0Jeky/agent-harness/issues/41)). *(Added 2026-07-25.)*"," ```bash"," cd /c/Users/jekyt/source/Taskdeck"," git worktree remove .worktrees/claude-model-routing-canon # docs/model-routing-canonical-pointer"," git worktree remove .worktrees/claude-sweep-0725 # docs/sweep-2026-07-25"," git worktree remove .worktrees/codex-1299-licensing-pack # issue-1299/licensing-pack — merged as PR #1337"," git worktree remove .worktrees/codex-1345-sqlite-native-patch # issue-1345/sqlite-native-patch — merged as PR #1486"," git branch -d docs/model-routing-canonical-pointer docs/sweep-2026-07-25 issue-1299/licensing-pack issue-1345/sqlite-native-patch"," ```"," All four are clean and fully merged into `main`. **Keep** `.worktrees/codex-1456-codex-deny-floor-adapter` (PR #1457 is still open) and `.worktrees/codex-1458-project-priority-pagination` (active #1458 work).","- [ ] **Branch from an explicit base.** PR #1477 was closed-as-merged without anyone merging it. Root cause: `feat/1271-dogfooding-instrumentation` (PR #1478) was created with a bare `git checkout -b` **while standing on `fix/1123-release-dry-run`**, so it silently inherited `#1477`'s commit `0ebbf330`. Merging #1478 carried that commit onto `main`, GitHub detected `#1477`'s branch as fully merged and auto-closed it two seconds later, attributing the event to the acting token. The single-parent \"rebase\" appearance was GitHub recording the already-landed commit, not a rebase anyone performed. *How:* always name the base — `git checkout -b main` — and verify with `git log --oneline main..` before pushing. *(Added 2026-07-25. Supersedes an earlier item on this list that wrongly framed this as an unidentified autonomous merger — that alert was mine and it was wrong; caught by Codex on PR #1483.)*","## Changelog","- 2026-07-27 (later): **#1458 shipped and the live project is Priority-clean.** The reviewed Apply succeeded 141/141; its built-in audit, two pre-merge fresh audits, and the final post-merge handoff audit each proved 1,472/1,472 items, 12 visible/non-authoritative external references, and zero remaining drift. PR #1488 merged as `84674979`; issue #1458 and both project items are Done/Priority I. The human-owned checkbox remains unchecked pending maintainer record review.","- 2026-07-27: **#1458 label remediation and external-reference policy supersede the prior checkpoint below.** The 130 missing Taskdeck Issue labels were classified and verified, and a stable 1,472-item audit found 142 remaining project-field drifts. External Issues are now recorded as visible non-authority rather than rejected: their labels never rank, external-only PRs derive `Priority V`, and canonical body fallback remains available after an external closing reference. No project-field `-Apply` had run at this checkpoint; the unchecked item remains pending a reviewed Apply and separate zero-drift audit.","- 2026-07-26: **#1458 corrected the project-priority record and the resumable cleanup path.** The old 1,000-item helper could not prove a project-wide clean result; the complete read-only snapshot reached 1,458/1,458 items and correctly stopped on 130 issues without a Priority label. A preliminary pass saw six PR fallback candidates; the next pass falsely treated merged PR #123 as an unlabeled issue, which re-review caught. The typed rerun ignores that PR and then reaches external Issue `dotnet/efcore#35983`, which GitHub exposes as a closing reference for 12 historical Taskdeck Dependabot PRs because their release-note text links it. The safe default now rejects all cross-repository Issue authority pending any explicit future opt-in; the preliminary PR plan remains retracted pending truthful project-issue labels. No `-Apply` or audit remediation write ran; only PR #1488's own `Review` / `Priority I` project metadata was populated after opening. Added the merged #1345 worktree to the human-prunable block and retained the active #1457/#1458 worktrees. No checkbox was checked in this pass.","- 2026-07-25 (latest): **PR queue cleared — 8 PRs merged, 1 draft left.** `#1469` (`#1462` frontend pin), `#1471`, `#1472`, `#1477`+`#1481` (`#1123` release rehearsal), `#1478` (`#1271` dogfooding instrumentation), `#1479`, and `#1337` (`#1299` licensing pack — **`#1299` closed by that merge**, residuals → `#1482`). `#1295` **closed as superseded**, with the salvage plan and acceptance criteria recorded on `#1293`. Only `#1457` remains, and its step-by-step human procedure is now on the PR. Repo hardening: force-push and deletion blocked on `main`; 288 truncation-hidden project-priority mismatches synced. Under `#1270`, 12 already-decided issues closed with dated notes — but **`#1270` stays open**, because two of its own acceptance criteria are obsolete against ADR-0044 and REVIVAL_PLAN §6 and must not be run as written. Seeded `#1470` `#1473` `#1474` `#1475` `#1476` `#1480` `#1482` and upstream `agent-harness#56`. Dogfooding baseline measured for the first time and recorded in `docs/dogfooding/LOG.md`: **sustained use has not started**, though the core loop works (17/20 proposals reached Apply). No item below was checked off in this pass.","- 2026-07-25 (later): **#1273 and #1235 checked off — rule-3 exception, on the maintainer's explicit instruction.** During a guided walkthrough the maintainer reviewed both record-only items and said \"please tick them yourself\". Recorded here because rule 3 reserves check-offs to the maintainer, so the authorization — not the agent's judgement — is what permits these two. Both were delivered long ago (#1273 by #1283, #1235 by #1280 with regression coverage) and **both GitHub issues were already closed on 2026-07-03**; only the checkboxes lagged. No other item was touched, and rule 3 continues to apply to every remaining `[ ]`.","- 2026-07-25: **Two human-only items added to §E** (no items checked off — rule 3). PR `#1469` closed `#1462` (frontend `approvedRevisionId`, now declared *required*) and the follow-up sweep `#1471` re-hydrated the canonical docs; both merged with green CI. Of the four open PRs, only `#1469` was agent-actionable — `#1295`, `#1337`, and `#1457` are all human-gated, and `#1457`'s `/hooks` trust gate plus the recurring merged-worktree pruning were the two that no file tracked, so they are recorded above. Seeded `#1470` (`DATA_MODEL.md` omits `ApprovedRevisionId`/`DeferredUntil`; stale snapshot figure). Correction on the record: `#1469`'s review comment reported 383 pre-existing spec typecheck errors for `#1468`; the figure by the documented method is **415**, and `#1468`, `#1470`, `#1469` and both canonical docs were corrected.","- 2026-07-13 (later): **Revival + generalist-expansion wave SHIPPED — 15 PRs merged to `main`** under the maintainer's ratify-and-merge directive. **ADR-0044 / ADR-0045 / ADR-0046 all ratified to Accepted.** Merged: direction docs `#1296` (revival) + `#1328` (generalist); transcript engine `#1312` (REVIVAL-08 M1); GEN wave `#1341`→`#1346` (artefact storage + local text extraction), `#1339` (due-date/label apply — also fixed a latent silent WIP-limit-clear on reorder), `#1340` (threat model), `#1342` (guided nav); REVIVAL wave `#1334`→`#1344` (registration gating + Paper onboarding), `#1329` (fonts), `#1331` (README), `#1333` (Today dossier `#1272`); harness `#1294`; ops `#1336` (overnight human-action + failure-ledger record, `#1327`). Linchpin `#1352` (CI-Extended reusable-workflow permission fix, `#1330`) + dependabot `#1351`/`#1349` were merged first by the maintainer to unblock the deck. Real merge conflicts resolved (workspaceStore latest-request guard, AGENT_INDEX seam-map union, EF migration-snapshot verified clean via `has-pending-model-changes`). Seeded `#1355` (buffered-export blob batching, LOW). **NOT merged — human-gated (still open):** `#1295` (deny-floor overlay — 16 unresolved review threads incl. a CRITICAL, needs remediation) and `#1337` (licensing pack — blocked on trademark clearance). `docs/STATUS.md` + `IMPLEMENTATION_MASTERPLAN.md` synced. Items above are left unchecked pending maintainer sign-off (rule 3), even where a related PR shipped (e.g. `#1272` via `#1333`).","- 2026-07-13: **Generalist expansion wave seeded (ADR-0046 Proposed).** Maintainer evaluated the artefact-intake research handoff + his twin-generalist-app idea; decision (pending ratification): extend the single app, defer the twin behind an evidence gate. Seeded GEN-00..12 (#1315–#1327, label `generalist`) as REVIVAL_PLAN Phase 4 (\"Every Artefact, Everyone\", v0.4); coordination comments posted on #1304 (dueDateHint apply gap → GEN-05) and #1305 (artefact/Transcript one-home constraint). Added §F above. Capability recon findings: no artefact/blob model exists; inert drop zone already shipped in PaperCaptureComposer; no operation applies due dates; prompt injection undefended beyond schema+review gate; guided/workbench/agent mode scaffold ready for generalist nav.","- 2026-07-10: **Revival pivot decided (ADR-0044) — archive pivot superseded.** Maintainer decision after the WhisperX prototype + two-track revival analysis (`docs/analysis/2026-07-10_revival_assessment.md`). Direction: free open beta (adoption/feedback/exposure) → commercial horizon; positioning: local-first review-first action-item engine + write-gated MCP gateway; MIT stays MIT. Added §E (revival wave); §D items re-scoped in place as the v0.1 ship gate. Planning spine: `docs/REVIVAL_PLAN.md`. Seeded the REVIVAL issue wave on GitHub.","- 2026-07-06: **Agent-harness blueprint adopted (step 1).** Estate-wide tiered blueprint landed at `source/agent-harness/`; Taskdeck declared T3 (`.claude/tier.json`). Footgun PR opened: committed `bypassPermissions` → settings.local.json, history-rewriter script fenced human-only. Remaining T3 diet seeded as #1291 (added to §D). Global layer shipped: `~/.claude/CLAUDE.md` laws, argv-aware deny floor (49-case tested), ESTATE.md registry, `~/.claude` now versioned (private repo claude-config).","- 2026-07-02: **Whole-project analysis delivered + archive closeout wave seeded.** Multi-agent analysis (6 dimensions, 15 claims adversarially verified: 5 confirmed / 10 adjusted / 0 refuted) produced `docs/PROJECT_TRAJECTORY.md` + `docs/COURSE_CORRECTION.md`. Seeded issues #1269–#1278 (ARCHIVE-00..09, new `archive-closeout` label) and posted re-scope comments on 14 existing issues. Added §D above. Central findings: no checkable definition of done existed in the tracked repo; zero organic personal-usage data; the default Paper UI is the least-tested UI; the \"canonical\" exe run path has never been built; ~31% of open issues already decided-closed by the pivot but still open.","- 2026-06-19 (later): **Merge hold lifted — deck merged.** The maintainer lifted the hold and all four PRs shipped to `main`: **#1220** (canonical-docs reconciliation; 14 Codex rounds + 3 drift sweeps), **#1219** (Paper File-away dismiss, closes #1161), **#1221** (reachable in-app Appearance theme toggle — a Paper-activation prerequisite), **#1225** (StackExchange.Redis + SignalR-backplane semver-major caps). Post-merge STATUS/masterplan sync in PR #1233. Seeded during this work: #1226 (net8.0 upgrade), #1227 (dated-snapshot staleness), #1228 (cd-staging-gate auto-trigger), + the #1195 GDPR caller-audit. Next: the Paper-review de-stubs (last Wave-2 blocker before the default-theme flip) — `onPreviewDiff` in PR #1234.","- 2026-06-19: **Maintainer check-offs confirmed** — **#1161** (Paper File-away dismiss, PR #1219), **#1164** (cross-process Migrate, PR #1186), **#1189** (Redis lock starvation, PR #1213), **#1198** (dead `ProposalGeneratorV1` removed, PR #1214), and **#1135 partial** (paper-night straggler tokens, PR #1216) marked done. Also: PR #1223 (npm group) merged; PR #1224 (nuget) closed (framework-major bumps rejected per ADR-0039 net8.0 pin); PR #1225 opened (StackExchange.Redis major cap). PRs #1219/#1220/#1221 fully reviewed + green + aged but **merges held by maintainer**. Maintainer decision: revisit net8.0 framework-major upgrade later (issue seeded). ADR-0004 stays \"Accepted\" with the never-implemented note (TenantId never built; isolation is per-UserId/board-access).","- 2026-06-13: **Archive-pivot wave (Waves 0–2) merged — 17 PRs** (see STATUS.md \"Archive-pivot delivery wave\"). Direction is now **finish-for-personal-use → archive** (supersedes ship-first); distribution tracks (#1167 code-signing, #544/#546/#550 GTM, #537/#548 cloud, #540 mobile) are de-scoped and will be closed not-planned in archive closeout. **Maintainer check-off pending** for items this wave appears to deliver: **#1140** (dev-up + clean-workspace scripts, PR #1208), **#1139** AC1 (compose-secret quickstart docs, PR #1205), **#1135** partial (paper-night straggler tokens, PR #1216 — guardrail/decomposition half still open), **#1189** (Redis lock starvation, PR #1213), **#1198** (dead `ProposalGeneratorV1` removed, PR #1214 — follow-up #1215 seeded). Not auto-checked per rule 3. **#1161** (Paper \"File away\" dismiss) built on the #1217 shared-actionability foundation and is in review as PR #1219 (awaiting CI/aging). New issues seeded: #1209, #1215, #1218.","- 2026-06-05: Maintainer directive — **ship-first**: prioritise the v0.1.0 release-blockers (#1123, #1131, #1132) ahead of #1154 (deferred). Closed #1124 and #1130 as substantially delivered (PRs #1162/#1165); remainders carried by #1161/#1164/#1166. Merge autonomy retained (full adversarial-review + green-CI + aging gate). #1161 to be taken design-first.","- 2026-05-31 (post-audit): Checked off §A (PRs #1143–#1147 confirmed merged), §B #1126/#1134-first-slice (PRs #1153/#1155 merged). Added §B2 with correctness-sweep findings (cohort stub, Ollama pseudo-streaming, #1134 remaining). Correctness sweep: 31 PRs audited, 0 corruption, 2 issues + 9 nitpicks fixed.","- 2026-05-31: File created. Seeded from the 2026-05-31 deep audit (tracker #1142). #972 (RFAI tracker) closed; PR #1122 merged; PRs #1143–#1147 opened.","docs/strategy/02_PACKAGING_DISTRIBUTION_STRATEGY.md",[1902],{"_1787":716,"_1788":1903,"_672":1904,"_1791":59},451,[1905,381,1906,1907,1908,381,1909,381,1801,381,1910,381,1911,381,1912,1913,1914,381,1915,1916,1912,381,1917,1912,1918,1912,381,1919,1920,1921,1922,1923,1924,381,1925,381,1801,381,1926,381,1927,381,1928,381,1929,381,1912,1930,1931,1932,1933,1912,381,1934,381,1801,381,1935,381,1936,381,1937,1938,1939,1940,1941,1942,381,1943,381,1944,1945,1946,1947,1948,1949,1950,1951,381,1952,1953,1954,1955,1956,381,1957,1958,381,1959,381,1937,1960,1961,1962,381,1944,1963,1964,1965,1966,381,1952,1967,1968,1969,1970,1971,381,1972,1973,381,1974,381,1937,1975,1976,1977,381,1944,1978,1979,1980,1981,1982,1983,381,1952,1984,1985,1986,1987,1988,381,1989,1990,381,1991,381,1937,1992,1993,381,1944,1994,1995,1996,1997,381,1952,1998,1999,2000,2001,2002,381,2003,2004,381,2005,381,2006,2007,2008,2009,2010,2011,2012,2013,2014,2015,2016,381,1801,381,2017,381,2018,381,2019,381,2020,2021,2022,2023,2024,2025,2026,381,2027,2028,2029,2030,2031,2032,381,2033,381,2034,381,2035,2036,2037,2038,2039,381,2040,381,2041,381,2042,2043,2044,2045,381,2046,381,2047,2048,2049,2050,2051,2052,2053,2054,2055,381,1801,381,2056,381,2057,381,2058,381,1912,2059,2060,2061,2060,2062,2063,2064,2060,2065,2066,2067,2060,2068,2069,2070,2060,2071,2060,2072,1912,381,2073,381,2074,2075,2076,2077,2078,2079,2080,381,2081,381,2082,2083,2084,2085,2086,2087,381,1801,381,2088,381,2089,381,2090,2091,2092,381,2093,381,2094,381,2095,2096,2097,381,2098,381,2099,2100,2101,2102,381,1801,381,2103,381,2104,381,2105,2106,2107,2108,381,2109,381,2110,2111,2112,2113,2114,381,2115,381,2116,2117,2118,2119,381,1801,381,2120,381,2121,381,2122,381,2123,2124,2125,2126,2127,381,2128,2129,2130,381,2131,2132,2133,2134,2135,2136,2137,2138,2139,2140,2141,2142,2143,2144,2142,2145,2146,2147,2148,2149,2150,2151,2152,2153,2154,381,2155,2156,2157,1912,381,2158,381,2159,381,2160,381,2161,2162,2163,2164,2165,2166,2167,2168,381,1801,381,2169,381,2170,381,2171,2172,2173,2174,2175,2176,381,2177,381,2178,2179,2180,2181,2182,2183,381,2184,381,2185,381,2186,2187,2188,2189,2190,381,1801,381,2191,381,2192,2193,2194,2195,2196,2197,2198,2199,2200,2201,2202,2203,2204,2205,2206,381,1801,381,2207,381,2208,2209,2210,2211,2212],"# Packaging and Distribution Strategy","**Date:** 2026-03-29","**Scope:** Single-executable packaging, installer creation, cross-platform distribution, and first-run experience","**Status:** HISTORICAL STRATEGY / PARTIALLY ACTIVE — ADR-0044 superseded the 2026-06-13 archive pivot; the required `v0.1.0` free-beta ship gate and its self-contained executable are current, while installer stores, broader multi-channel distribution, cloud, mobile, and GTM remain parked.","> **⚠️ HISTORICAL STRATEGY — current scope is the ADR-0044 revival.** The 2026-06-13 finish-for-personal-use-and-archive decision is retained only as checkpoint history; it no longer directs current work. `v0.1.0` is a **required free-beta ship gate**, including rehearsal of `release-desktop.yml`, runner-native smoke evidence, the self-contained executables, checksums, and the maintainer-authorized tag/release. The broader **installer-store, multi-channel distribution, cloud, mobile, and GTM** tracks below remain parked unless the active revival plan explicitly reauthorizes them. The parked `cd-staging-gate.yml` is manual-dispatch-only after `#1228` and stops after build/smoke verification; release publication cannot invoke it, and it claims no production approval because no protected `production` environment is configured. See `OUTSTANDING_TASKS.md`, `docs/STATUS.md`, `docs/REVIVAL_PLAN.md`, and the Direction section of `docs/IMPLEMENTATION_MASTERPLAN.md` for current authority.","## 1. Current State","Taskdeck currently requires manual setup of multiple components:","```","# Backend (.NET 8)","dotnet run --project backend/src/Taskdeck.Api/Taskdeck.Api.csproj","# Frontend (Vue 3 + Vite)","cd frontend/taskdeck-web && npm install && npm run dev","Or via Docker Compose:","docker compose -f deploy/docker-compose.yml --env-file deploy/.env --profile baseline up -d --build","**The problem:** This is acceptable for developers during evaluation, but it's a significant barrier to adoption. Every step a user must take before seeing value is a potential drop-off point. The current setup requires:","- .NET 8 SDK or Docker installed","- Node.js 24 for frontend dev","- Git to clone the repo","- Manual env configuration","- Running multiple processes","**The goal:** Download one thing, double-click, use Taskdeck.","## 2. Architecture Advantage: ASP.NET Core Can Serve Everything","The single most important technical insight for packaging:","**ASP.NET Core's Kestrel server can serve the Vue SPA as static files alongside the API.**","This means the entire application — backend API, frontend SPA, and SQLite database — can run as a single process:","[Kestrel HTTP Server]"," ├── /api/* → ASP.NET Core controllers"," ├── /hubs/* → SignalR hubs"," └── /* → Vue SPA static files (index.html + assets)","This architecture is the foundation for every packaging approach below.","## 3. Packaging Options Compared","### 3.1 Option A: .NET Self-Contained Single-File Executable (Recommended for V1)","**How it works:**","1. Build Vue frontend: `npm run build` → produces `dist/` folder","2. Copy `dist/` into ASP.NET Core's `wwwroot/`","3. Configure ASP.NET Core to serve SPA static files with fallback routing","4. Publish: `dotnet publish --self-contained -r win-x64 -p:PublishSingleFile=true -p:PublishTrimmed=false -p:IncludeNativeLibrariesForSelfExtract=true`","5. Result: **single .exe file** (~60-80MB) that runs everything","> **Why `PublishTrimmed=false`?** IL trimming silently breaks EF Core migrations, ASP.NET DI conventions, reflection-based System.Text.Json serialization, and SignalR -- all of which rely on runtime reflection. CI (`release-desktop.yml`) and build scripts (`build-release.sh`) enforce `PublishTrimmed=false` for this reason.","**Pros:**","- Single file, no dependencies (runtime is embedded)","- Native performance (no Electron overhead)","- Small-ish download (~60-80MB, ~25-40MB compressed)","- Cross-platform (produce for win-x64, linux-x64, osx-x64, osx-arm64)","- Opens a browser tab automatically on launch","- SQLite database created on first run in user's app data folder","- Can be distributed via GitHub Releases","**Cons:**","- No native window chrome (runs in user's browser)","- Separate build per platform","- No system tray icon without additional work","- Auto-update requires custom implementation","**Implementation effort:** 1-2 weeks","**User experience:** Download → double-click → browser opens → use Taskdeck","### 3.2 Option B: Electron Wrapper","- Electron app wraps the Vue frontend in a Chromium window","- Backend .NET process runs as a sidecar (spawned by Electron)","- IPC between Electron and .NET for lifecycle management","- Native-feeling window (title bar, system tray, window management)","- Auto-update via Electron's update framework (electron-updater)","- Can publish to Microsoft Store, Snap Store","- Rich OS integration (notifications, file associations, deep links)","- Large download (~150-250MB with Chromium + .NET runtime)","- Memory-heavy (~200-400MB RAM at idle)","- Complex build pipeline (Electron + .NET cross-compilation)","- Two processes to manage (Electron + .NET backend)","- Slow startup (Chromium initialization)","**Implementation effort:** 3-5 weeks","**User experience:** Download installer → install → launch app → native window","### 3.3 Option C: Tauri 2.0 Wrapper","- Tauri uses the OS's native webview (Edge WebView2 on Windows, WebKit on macOS/Linux)","- Vue frontend runs in the webview","- .NET backend runs as a sidecar process (Tauri supports sidecar binaries)","- Much smaller than Electron (~10-30MB for the Tauri shell + .NET sidecar)","- Native webview = less memory than Chromium","- Tauri 2.0 has mature sidecar support","- Auto-update built-in","- Can target mobile (Tauri 2.0 supports iOS/Android)","- Rust-based security advantages","- Webview behavior varies across platforms (Edge vs WebKit vs WebKitGTK)","- Newer ecosystem, smaller community than Electron","- Debugging cross-platform webview issues can be harder","- Still requires .NET sidecar (~60MB) plus Tauri shell","- Total download: ~70-100MB","**Implementation effort:** 3-4 weeks","**User experience:** Download installer → install → launch app → native window (lightweight)","### 3.4 Option D: Docker Desktop (Current Approach, Enhanced)","- Ship a one-command Docker Compose setup","- Possibly via Docker Extensions marketplace","- Already works today","- Familiar to developers","- Identical environment everywhere","- Easy updates (docker pull)","- Requires Docker Desktop installed (heavy dependency)","- Not suitable for non-developer users","- Docker Desktop licensing ($5/user/month for businesses)","- Extra layer of complexity for debugging","- No native OS integration","**Implementation effort:** Already done (minor polish needed)","**User experience:** Install Docker → run command → open browser","### 3.5 Comparison Matrix","| Criterion | .NET Self-Contained | Electron | Tauri 2.0 | Docker |","|-----------|-------------------|----------|-----------|--------|","| Download size | ~60-80MB | ~150-250MB | ~70-100MB | ~200MB+ |","| Memory usage | ~80-150MB | ~200-400MB | ~100-200MB | ~300-500MB |","| Startup time | 1-3 seconds | 3-8 seconds | 2-4 seconds | 10-30 seconds |","| Install friction | Very low (single file) | Low (installer) | Low (installer) | High (Docker req.) |","| Native feel | Browser tab | Full native | Native window | Browser tab |","| Auto-update | Custom needed | Built-in | Built-in | docker pull |","| Mobile potential | No | No | Yes (Tauri 2.0) | No |","| Implementation effort | 1-2 weeks | 3-5 weeks | 3-4 weeks | Done |","| Solo dev maintainability | High | Medium | Medium | High |","## 4. Recommended Approach: Phased Packaging","### Phase 1: Self-Contained Executable (Ship in 1-2 weeks)","**This is the minimum viable package.** It gets the \"download and run\" experience with the least effort.","Implementation steps:","1. Add SPA static file serving to ASP.NET Core startup","2. Add build script that: `npm run build` → copy to `wwwroot/` → `dotnet publish --self-contained`","3. Set up GitHub Actions to build for win-x64, linux-x64, osx-x64, osx-arm64","4. Publish as GitHub Releases with checksums","5. Add auto-launch browser on startup","6. SQLite DB auto-creates in `%APPDATA%/Taskdeck/` (Windows) or `~/.local/share/taskdeck/` (Linux/macOS)","**What the user sees:**","1. Go to GitHub Releases","2. Download `taskdeck-win-x64.zip` (or .tar.gz for Linux/macOS)","3. Unzip, double-click `Taskdeck.exe`","4. Browser opens to `http://localhost:5000`","5. Register, start using","### Phase 2: Platform Installers (Month 2-3)","Add proper installers for discoverability and polish:","| Platform | Installer | Distribution |","|----------|-----------|--------------|","| Windows | Inno Setup or MSIX | GitHub Releases, winget |","| macOS | .dmg with .app bundle | GitHub Releases, Homebrew cask |","| Linux | AppImage + .deb + .rpm | GitHub Releases, Snap Store, Flathub |","**Linux packaging shortcut:** [PupNet Deploy](https://github.com/kuiperzone/PupNet-Deploy) (`dotnet tool install -g KuiperZone.PupNet`) — purpose-built for .NET apps, generates AppImage, deb, and rpm from a single command and config file.","### Phase 3: Native Desktop Shell (Month 4-6, if justified by demand)","If users ask for native window experience, system tray, or native notifications:","- **Tauri 2.0 wrapper** around the self-contained backend","- Adds: native window, system tray, global hotkey, auto-update","- Bonus: opens the path to mobile (Tauri 2.0 mobile targets)","### Phase 4: Package Manager Distribution (Month 6+)","| Manager | Command | Audience |","|---------|---------|----------|","| winget | `winget install Taskdeck` | Windows developers |","| Homebrew | `brew install --cask taskdeck` | macOS developers |","| Snap | `snap install taskdeck` | Linux (Ubuntu) |","| Flatpak | `flatpak install taskdeck` | Linux (general) |","| Chocolatey | `choco install taskdeck` | Windows (sysadmin) |","| npm (global) | `npx taskdeck` | Node.js developers |","| Docker Hub | `docker run taskdeck` | Container-native users |","## 5. First-Run Experience Design","The packaging isn't just about installation — it's about the first 60 seconds.","### 5.1 First-Run Flow","User launches Taskdeck"," ↓","Browser opens to http://localhost:5000","Welcome screen: \"Welcome to Taskdeck\""," - \"Create your account\" (local auth, data stays on device)"," - Takes: display name + password (email optional)","Guided first-board creation"," - \"What kind of work do you track?\" → starter pack selection"," - Or \"Start blank\" for power users","Quick capture tutorial"," - \"Try capturing something right now\" → pre-filled example"," - Hotkey hint: Ctrl+Shift+C for quick capture","Show the result: proposal generated, review and apply","Board updated — \"You're ready to go!\"","### 5.2 Time-to-Value Targets","| Step | Target Time | Current Reality |","|------|-------------|-----------------|","| Download to running | <60 seconds | 5-15 minutes (manual setup) |","| Running to registered | <30 seconds | ~30 seconds (acceptable) |","| Registered to first capture | <30 seconds | ~30 seconds (acceptable) |","| First capture to proposal | <30 seconds | Depends on LLM provider |","| Total: download to first value | <3 minutes | 15-30 minutes |","### 5.3 Default Configuration","The packaged app should work with zero configuration:","- Mock LLM provider by default (instant, deterministic, no API keys needed)","- SQLite database auto-created in platform-appropriate location","- JWT secret auto-generated on first run","- Default port: 5000 (with auto-fallback if occupied)","- Optional: \"Connect your own AI\" setup in Settings for live LLM providers","## 6. Auto-Update Strategy","### 6.1 Phase 1: Manual Updates (Release Downloads)","- GitHub Releases with version-tagged downloads","- In-app notification: \"A new version is available\" with download link","- Check for updates on launch (opt-in, privacy-respecting)","### 6.2 Phase 2: Semi-Automatic Updates (Velopack)","**Recommended framework: [Velopack](https://velopack.io/)** — successor to Squirrel.Windows, cross-platform (Windows/macOS/Linux), delta updates that apply in ~2 seconds, no UAC prompt. Install via NuGet: `Velopack`. Handles download, delta patching, and restart seamlessly. Preferred over rolling a custom update mechanism.","- Check version endpoint: `GET /api/health/version` returns current + latest","- Download and apply in-app (requires restart)","- Differential updates if download size is a concern","### 6.3 Phase 3: Automatic Updates (Tauri/Electron)","- Background download of updates","- Apply on next restart","- Rollback capability","- Update channels: stable, beta, nightly","## 7. Code Signing and Security","### 7.1 Why It Matters","Unsigned executables trigger security warnings:","- Windows SmartScreen: \"Windows protected your PC\"","- macOS Gatekeeper: \"cannot be opened because the developer cannot be verified\"","- These warnings kill conversion. Many users won't click through.","### 7.2 Cost and Effort","| Platform | Certificate Type | Cost | Effort |","|----------|-----------------|------|--------|","| Windows | EV code signing cert | $200-400/year (or free via SignPath for OSS) | Medium |","| macOS | Apple Developer cert | $99/year (Apple Developer Program) | Medium |","| Linux | GPG signing | Free | Low |","### 7.3 Recommendation","- Start without code signing (accept the warnings for early beta)","- Add Windows/macOS signing once you have 100+ users","- Apply for SignPath OSS program (free EV signing for open source)","- Apple Developer Program is worth the $99/year if you have macOS users","## 8. Build and Release Pipeline","### 8.1 CI/CD Pipeline (already built — `release-desktop.yml`)","_(This is no longer \"to be added\" — `.github/workflows/release-desktop.yml` and `scripts/build-release.sh` **already exist and are wired** (see line 69). The workflow **auto-fires on any `v*` tag push** and on `workflow_dispatch`, building the matrix `win-x64`/`linux-x64`/`osx-x64`/`osx-arm64` self-contained exes with SHA256 checksums + a `#1123` smoke test of the **three runner-native RIDs** (`win-x64`, `linux-x64`, `osx-arm64`). `osx-x64` is built and shipped but **not** smoke-tested — it is cross-arch on the arm64 `macos-latest` runner and cannot launch there (`if: matrix.rid != 'osx-x64'`), so that artifact carries less release evidence than the other three. **Publishing depends on how it is triggered:** a `v*` tag push, a dispatch naming an existing tag, **or a dispatch whose ref is itself a tag**, creates the GitHub Release; a dispatch **from a branch** with the tag input left blank is a rehearsal — it builds, smoke-tests and uploads artifacts, then stops without creating a Release (`create-release` is skipped). That rehearsal path exists so the pipeline can be exercised before the irreversible tag push that `#1303` reserves to the maintainer. Under ADR-0044 this is the **required v0.1.0 free-beta release path**; the *broader* distribution (stores, download pages, marketing) below remains parked.)_","```yaml","# Existing GitHub Actions workflow: release-desktop.yml (auto-fires on v* tags)","on:"," push:"," tags: ['v*']","jobs:"," build-frontend:"," # npm ci && npm run build → artifact"," build-desktop:"," needs: build-frontend"," strategy:"," matrix:"," include:"," - os: windows-latest"," rid: win-x64"," artifact: taskdeck-win-x64.zip"," - os: ubuntu-latest"," rid: linux-x64"," artifact: taskdeck-linux-x64.tar.gz"," - os: macos-latest"," rid: osx-x64"," artifact: taskdeck-osx-x64.tar.gz"," rid: osx-arm64"," artifact: taskdeck-osx-arm64.tar.gz"," steps:"," # PublishTrimmed=false: trimming breaks EF Core, DI, System.Text.Json, SignalR"," - dotnet publish --self-contained -r ${{ matrix.rid }}"," -p:PublishSingleFile=true"," -p:PublishTrimmed=false"," -p:IncludeNativeLibrariesForSelfExtract=true"," -c Release"," - Upload release artifacts"," create-release:"," needs: build-desktop"," # Create GitHub Release with all platform artifacts + checksums","### 8.2 Versioning Strategy","Use semantic versioning aligned with release milestones:","> **⚠️ PARKED (2026-06-13 archive pivot).** Only the **0.1.0** row (self-contained executable) survives the pivot as the canonical personal run goal. The 0.2.0–1.0.0 rows below (installers, cloud, mobile, Tauri, all-platforms GA) are **de-scoped** and describe the abandoned pre-pivot plan only — do not action.","| Version | Meaning |","|---------|---------|","| 0.1.0 | First packaged beta (self-contained executable) — _survives the pivot (canonical personal run goal)_ |","| 0.2.0 | Platform installers — _**de-scoped** (parked by the archive pivot)_ |","| 0.3.0 | Cloud/hosted option — _**de-scoped** (parked by the archive pivot)_ |","| 0.4.0 | Mobile PWA — _**de-scoped** (parked by the archive pivot)_ |","| 0.5.0 | Native desktop shell (Tauri) — _**de-scoped** (parked by the archive pivot)_ |","| 1.0.0 | First stable release (all platforms, polished UX) — _**de-scoped** (parked by the archive pivot)_ |","## 9. Size Optimization","### 9.1 .NET Self-Contained Size Reduction","| Technique | Size Impact | Complexity |","|-----------|-------------|------------|","| `PublishTrimmed=true` | -30-50% | **Not viable for Taskdeck** -- breaks EF Core migrations, ASP.NET DI, System.Text.Json, and SignalR (reflection-dependent). CI enforces `=false`. |","| `PublishReadyToRun=true` | +10-20% but faster startup | Low |","| Compression (zip/tar.gz) | -40-60% | Trivial |","| NativeAOT (ahead-of-time) | -60-70% + faster startup | High (not all .NET features supported) |","**Estimated final sizes:**","| Platform | Uncompressed | Compressed |","|----------|-------------|------------|","| win-x64 | ~70MB | ~30-40MB |","| linux-x64 | ~65MB | ~25-35MB |","| osx-x64 | ~65MB | ~25-35MB |","| osx-arm64 | ~60MB | ~25-30MB |","These are well within acceptable ranges for 2026 desktop applications (Obsidian is ~180MB, VS Code is ~300MB, Notion is ~400MB).","### 9.2 Frontend Build Size","The current Vite build should produce:","- ~1-3MB of JS (gzipped: ~300-800KB)","- ~200-500KB of CSS","- Static assets (fonts, icons)","- Total: ~2-5MB uncompressed","## 10. Implementation Priority","| Priority | Task | Effort | Impact |","|----------|------|--------|--------|","| **P0** | Fix P0 blockers (#508, #509) before any packaging work | 1-2 days | Critical |","| **P1** | Add SPA static file serving to ASP.NET Core | 2-3 hours | Foundation |","| **P1** | Build script (frontend build + dotnet publish) | 4-6 hours | Foundation |","| **P1** | GitHub Actions release workflow | 4-8 hours | Distribution |","| **P1** | First-run auto-config (JWT, DB path, browser launch) | 4-6 hours | UX |","| **P2** | Windows Inno Setup installer | 4-8 hours | Polish |","| **P2** | macOS .app bundle + DMG | 4-8 hours | Polish |","| **P2** | Linux AppImage | 2-4 hours | Polish |","| **P2** | Update check mechanism | 4-8 hours | Retention |","| **P3** | Tauri 2.0 wrapper | 2-3 weeks | Native feel |","| **P3** | Package manager submissions | 1-2 days each | Discovery |","| **P4** | Code signing (Windows + macOS) | 1-2 days | Trust |","| **P4** | NativeAOT investigation | 1-2 weeks | Performance |","## Related Documents","- `deploy/docker-compose.yml` — Current Docker deployment","- `deploy/docker/backend.Dockerfile` — Backend container build","- `deploy/docker/frontend.Dockerfile` — Frontend container build","- `.github/workflows/ci-release.yml` — Existing release CI","- `docs/strategy/00_MASTER_STRATEGY.md` — Master strategy document","docs/ops/DEPLOYMENT_WORKFLOW.md",[2215],{"_1787":716,"_1788":2216,"_672":2217,"_1791":59},320,[2218,381,2219,2220,2221,381,2222,381,2223,381,2224,381,2225,381,1912,2226,2227,2228,2229,2230,2231,2232,1912,381,2233,381,2234,2235,2236,2237,2238,381,2239,381,2240,2241,2242,2243,2244,381,2245,381,2246,381,2247,381,2248,2249,2250,2251,2252,2253,2254,381,2255,2256,2257,2258,2259,381,2260,381,2261,381,2262,381,2263,2264,2265,2266,2267,381,2268,2264,2269,2270,2267,381,2271,2264,2272,2273,2274,2267,381,2275,2264,2276,2277,2267,381,2278,2264,2279,2267,381,2280,381,2281,381,2282,381,2262,381,2283,381,2284,381,2285,2264,2286,2287,2288,2267,381,2289,2264,2290,2291,2292,2267,381,2293,2264,2294,2295,2296,2267,381,2297,2264,2298,2267,381,2299,2264,2300,2301,2302,2303,2304,2305,2306,2307,2308,2305,2309,2310,2267,381,2311,2312,2313,2314,381,2315,381,2316,381,2317,381,2318,2264,2301,2302,2319,2305,2306,2320,2305,2309,2310,2267,381,2321,2264,2322,2267,381,2323,2264,2324,2267,381,2325,381,2326,2264,2327,2267,381,2328,381,2329,381,2330,381,2331,381,2332,381,2333,2334,2335,2336,2337,2338,2339,2340,2338,2341,2342,1912,381,2343,381,2333,2344,2345,2346,1912,381,2347,381,2348,381,2333,2349,2350,381,2335,2336,2351,2338,2339,2352,2338,2341,2342,381,2353,2354,1912,381,2355,381,2356,2357,2358,2359,2360,381,2361,381,2362,381,2363,2357,2364,2365,2366,2367,2368,2369,381,2370,381,2371,381,2372,2373,2374,2375,381,2376,381,2377,381,2378,381,2379,2380,2381,2382,2383,381,2384,381,2385,381,2386,381,2387,381,2388,2389,2390,2391,2392,381,2393,381,2394,2395,2396,2397,2398,381,2399,381,2400,381,2401,2402,2403,2404,2405,2406,2407,2408],"# Staged Deployment Workflow","Last Updated: 2026-04-09","Issue: `#101` OPS-09 staged deployment with blue/green and canary release policy","ADR: `ADR-0028`","> **⚠️ Reference-only — parked by the 2026-06-13 archive pivot.** This blue/green + canary workflow implements **ADR-0028**, whose multi-instance / hosted-deployment premise is de-scoped. Taskdeck's personal run path is the self-contained exe plus the `release-desktop.yml` release smoke — **not** this staged cloud workflow. Retained as a historical record, not a mandatory process. See `docs/STATUS.md`.","This document **was** the canonical reference for Taskdeck's staging-to-production deployment workflow on the de-scoped hosted / multi-instance track. _(Historical: it is no longer a mandatory process.)_ With the 2026-06-13 archive pivot, the personal run path is the self-contained exe plus the `release-desktop.yml` release smoke — this staged staging-to-production workflow no longer governs releases.","## Overview","Taskdeck uses a **blue/green deployment model with canary verification gates**. Two identical environments (blue and green) exist behind a traffic router. New releases are deployed to the idle environment, verified through automated and manual gates, then promoted by switching traffic. The previous environment remains available for instant rollback.","┌─────────────┐ ┌──────────────┐ ┌───────────────┐ ┌─────────────┐","│ CI Build │────>│ Staging │────>│ Canary │────>│ Production │","│ & Test │ │ Deployment │ │ Verification │ │ Promotion │","└─────────────┘ └──────────────┘ └───────────────┘ └─────────────┘"," │ │ │ │"," ci-release.yml Deploy to idle 10% traffic for Switch 100%"," SBOM/provenance environment 15 min window traffic","## Prerequisites","- Docker Engine with `docker compose` support on the target host","- SSH access to the target host (key-based, no password auth)","- AWS CLI configured with permissions for SSM parameter access (if using Terraform topology)","- `scripts/deploy/smoke-test.sh` available on the deployment host","- Release owner identified and available for the duration of the deployment","## Environments","| Environment | Purpose | Traffic | Lifecycle |","|---|---|---|---|","| **Staging** | Pre-production validation | Internal only | Receives every release candidate |","| **Blue** | Production slot A | 0% or 100% | Alternates between live and idle |","| **Green** | Production slot B | 0% or 100% | Alternates between live and idle |","The staging environment is a separate instance (Terraform environment `staging`) used for integration testing before any production slot receives the release.","## Phase 1: Build and Artifact Preparation","**Owner**: CI automation (triggered by tag push or release event)","1. Tag the release commit: `git tag v..`","2. Push the tag: `git push origin v..`","3. CI triggers automatically:"," - `ci-release.yml` runs release build verification"," - `reusable-sbom-provenance.yml` generates SBOM and provenance attestation"," - `reusable-container-images.yml` builds and exports container image artifacts","4. Verify all CI jobs pass before proceeding.","**Artifacts produced**:","- `taskdeck-api:` container image","- `taskdeck-web:` container image","- SBOM (CycloneDX JSON)","- Provenance attestation (SHA256 checksums)","**Gate**: All CI jobs must be green. Any failure blocks proceeding to Phase 2.","## Phase 2: Staging Deployment","**Owner**: Release owner","1. Identify the staging host from Terraform outputs:"," ```bash"," cd deploy/terraform/aws/environments/staging"," terraform output ssh_command"," ```","2. SSH to the staging host and pull the new images:"," docker pull /taskdeck-api:"," docker pull /taskdeck-web:","3. Update the compose configuration to use the new image tags:"," # On staging host at /opt/taskdeck"," sed -i \"s|image: .*taskdeck-api:.*|image: /taskdeck-api:|\" docker-compose.yml"," sed -i \"s|image: .*taskdeck-web:.*|image: /taskdeck-web:|\" docker-compose.yml","4. Deploy to staging:"," cd /opt/taskdeck"," docker compose --env-file .env up -d","5. Run the staging smoke test:"," bash scripts/deploy/smoke-test.sh http://localhost:","6. Perform manual exploratory testing against the staging URL (see `docs/ops/RELEASE_CHECKLIST.md` for the full checklist).","**Gate**: All smoke tests pass AND manual validation confirms no regressions. Any failure blocks proceeding to Phase 3.","## Phase 3: Production Canary Deployment","### Single-Node Topology (nginx upstream switching)","The single-node topology runs blue and green as separate Docker Compose projects on the same host, with nginx upstream groups controlling traffic distribution.","1. Identify the currently live slot:"," # On production host"," cat /opt/taskdeck/active-slot"," # Returns \"blue\" or \"green\"","2. Determine the idle slot:"," ACTIVE=$(cat /opt/taskdeck/active-slot)"," IDLE=$([[ \"$ACTIVE\" == \"blue\" ]] && echo \"green\" || echo \"blue\")"," echo \"Deploying to idle slot: $IDLE\"","3. Deploy the new release to the idle slot:"," cd /opt/taskdeck/$IDLE"," docker compose --env-file ../.env pull"," docker compose --env-file ../.env up -d","4. Verify the idle slot is healthy:"," bash scripts/deploy/smoke-test.sh http://localhost:","5. Enable canary traffic (10% to new slot):"," # Update nginx upstream weights"," cat > /opt/taskdeck/nginx/upstream.conf < /opt/taskdeck/active-slot","3. Run the full smoke test against the production URL:"," bash scripts/deploy/smoke-test.sh https://","4. Keep the previous slot running for at least 1 hour as a rollback target.","5. Record the deployment in the release log:"," echo \"$(date -u +%Y-%m-%dT%H:%M:%SZ) v deployed to $IDLE by \" >> /opt/taskdeck/release-log.txt","**Gate**: Full smoke test passes against production. If it fails, execute immediate rollback.","## Rollback Procedure","Rollback can be triggered at any phase. The procedure depends on which phase the deployment has reached.","### Rollback from Canary (Phase 3)","Remove the canary traffic split and restore 100% to the active slot:","```bash","ACTIVE=$(cat /opt/taskdeck/active-slot)","cat > /opt/taskdeck/nginx/upstream.conf < /opt/taskdeck/active-slot","echo \"$(date -u +%Y-%m-%dT%H:%M:%SZ) ROLLBACK from $CURRENT to $PREVIOUS by \" >> /opt/taskdeck/release-log.txt","### Rollback Time Targets","| Phase | Target Rollback Time | Method |","|---|---|---|","| Canary (Phase 3) | < 30 seconds | Remove canary upstream weight |","| Production (Phase 4) | < 30 seconds | Switch upstream to previous slot |","| Staging (Phase 2) | N/A | Staging is non-user-facing; redeploy previous version |","## Rollback Criteria","Any of the following triggers an immediate rollback:","| Criterion | Threshold | Detection |","| Health check failure | 3 consecutive non-200 responses from `/health/ready` | Automated polling (30s interval) |","| Error rate | > 5% of requests return 5xx | Application logs or metrics |","| Response latency | P95 > 2x baseline from live environment | Smoke test comparison |","| Smoke test failure | Any assertion fails | `scripts/deploy/smoke-test.sh` |","| Manual abort | Release owner or on-call decision | Human judgment |","| Database migration failure | Migration throws or leaves schema inconsistent | Startup logs |","## Database Migration Safety","Taskdeck uses EF Core auto-migration on API startup. When blue and green slots share the same SQLite database volume, migrations must be **forward-compatible**:","- **Additive-only migrations**: Add new columns with defaults, add new tables. Never remove or rename columns that the current live version depends on.","- **Two-phase migration pattern**: If a breaking schema change is required, split it across two releases: (1) add the new schema alongside the old, (2) remove the old schema after the previous version is fully retired.","- **Migration order**: The idle slot starts first and applies any pending migrations. If the migration fails, the idle slot will not become healthy and the deployment is blocked at Phase 3 step 4 (health check).","- **Shared database risk**: During the canary window, both slots read/write the same database. If the new migration alters behavior for existing data, ensure the active slot can still function with the migrated schema.","If blue and green are deployed on separate hosts with separate databases (e.g., in a hypothetical multi-node topology; not planned — single-instance is permanent per the 2026-06-13 archive pivot), migration safety is simplified since each slot has its own schema lifecycle.","## Emergency Hotfix Override","For critical production incidents where the standard workflow would take too long:","1. The release owner or on-call responder can skip the canary phase.","2. Deploy directly to the idle slot and immediately switch traffic.","3. Document the override reason in the release log.","4. Run the full smoke test immediately after traffic switch.","5. File a post-incident review within 24 hours.","Emergency overrides must still pass Phase 1 (CI build) and Phase 2 (staging smoke). Skipping CI entirely is never permitted.","## GitHub Actions Integration","The `cd-staging-gate.yml` workflow automates Phase 1 and Phase 2 gates:","> ⚠️ _(Parked by the 2026-06-13 archive pivot — staged cloud deployment de-scoped. After **#1228**, the workflow is manual-dispatch-only and implements Phase 1-2 verification only. The repository has no protected `production` environment, so the workflow deliberately declares no environment and cannot record a Phase 3 approval. See `docs/ops/README.md`.)_","- Triggers only on manual dispatch with an explicit image tag","- Builds and verifies container images","- Runs the smoke test suite against a CI-hosted staging environment","- Stops after Phase 2; Phase 3 requires separately configuring and verifying a protected GitHub `production` environment before this automation can be restored","- See `.github/workflows/cd-staging-gate.yml` for the workflow definition","## Ownership and Escalation","| Role | Responsibility |","|---|---|","| **Release owner** | Initiates deployment, monitors canary, approves promotion or triggers rollback |","| **On-call responder** | Fallback authority for rollback if release owner is unavailable |","| **Platform team** | Maintains deployment tooling, scripts, and Terraform modules |","Escalation path: Release owner (15 min) -> On-call responder (30 min) -> Platform team lead.","## References","- ADR-0028: Staged Deployment — Blue/Green with Canary Verification","- `docs/ops/RELEASE_CHECKLIST.md` — smoke verification checklist","- `docs/ops/DEPLOYMENT_CONTAINERS.md` — container baseline","- `docs/ops/DEPLOYMENT_TERRAFORM_BASELINE.md` — Terraform baseline","- `docs/ops/DISASTER_RECOVERY_RUNBOOK.md` — disaster recovery procedures","- `docs/ops/INCIDENT_REHEARSAL_CADENCE.md` — incident rehearsal schedule","- `.github/workflows/cd-staging-gate.yml` — staging gate workflow","- `scripts/deploy/smoke-test.sh` — portable smoke test script","docs/TESTING_GUIDE.md",[2411],{"_1787":716,"_1788":2412,"_672":2413,"_1791":59},1834,[2414,381,2415,381,2416,2417,2418,2419,2420,2421,2422,381,2423,381,2424,2425,2426,2427,2428,2429,2430,2431,2432,2433,381,2434,2435,2436,2437,2438,381,2439,381,2440,381,2441,2442,2443,2444,2445,2446,2447,2448,381,2449,381,2450,381,2451,2452,2453,2454,2455,2456,2457,2458,1912,381,2459,381,2460,381,2451,2461,2462,2463,2464,2465,2466,2467,2468,2469,2338,2470,2471,2472,2473,2474,2475,2476,2477,2478,2479,2480,2481,2482,1912,381,2483,381,2484,2485,2486,2487,2488,2489,2490,2491,2492,2493,2494,2495,2496,2497,2498,2499,1912,381,2500,381,2501,381,2502,381,2503,381,2451,2504,1912,381,2505,381,2506,381,2451,2507,2508,2509,2510,2511,381,2512,2513,1912,381,2514,381,2515,381,2451,2516,2517,2518,381,2519,2520,1912,381,2521,381,2522,381,2523,381,2524,381,2525,2526,2527,2528,381,2529,2333,2530,1912,381,2531,381,2532,2533,2534,2535,381,2529,2333,2536,1912,381,2537,381,2538,2539,2540,2541,381,2529,2333,2542,1912,381,2543,381,2544,2545,2546,2547,381,2529,2333,2548,1912,381,2549,381,2550,2551,2552,2553,2554,2555,381,2529,2333,2556,1912,381,2557,381,2558,2559,2560,2561,381,2529,2333,2562,1912,381,2563,381,2564,2565,2566,2567,381,2529,2333,2568,1912,381,2569,381,2570,381,2571,2572,2573,2574,381,2529,2333,2575,2576,2577,1912,381,2578,381,2579,2580,2581,381,2529,2333,2582,1912,381,2583,381,2584,2585,2586,2587,381,2529,2333,2588,1912,381,2589,381,2590,381,2591,381,2592,2593,2594,2595,2596,381,2529,2333,2597,1912,381,2598,381,2599,2600,2601,2602,2603,381,2529,2333,2604,1912,381,2605,381,2606,2607,2608,2609,2610,2611,381,2529,2333,2612,1912,381,2613,381,2614,2615,2616,2617,2618,381,2529,2333,2619,1912,381,2620,381,2621,2622,2623,2624,381,2625,381,2529,2333,2626,1912,381,2627,381,2628,2629,2630,2631,2632,2633,381,2529,2333,2634,1912,381,2635,381,2636,381,2637,381,2638,2639,2640,2641,381,2642,381,2643,381,2644,2645,381,2646,381,2647,381,2648,381,2649,381,2650,381,2651,2652,2653,2654,2655,2656,2657,381,2658,381,2529,2333,2659,1912,381,2660,381,2661,2662,2663,2664,2665,2666,2667,2668,381,2529,2333,2669,1912,381,2670,381,2671,2672,2673,2674,2675,2676,381,2677,381,2529,2333,2678,1912,381,2679,381,2680,381,2529,2333,2681,1912,381,2682,381,2683,381,2684,381,2685,381,2686,2687,2688,2689,2690,2691,2692,2693,2694,2695,2696,2697,381,2698,381,2529,2333,2699,1912,381,2700,381,2701,2702,381,2703,381,2704,381,2705,2706,2707,2708,2709,2710,2711,2712,381,2713,381,2714,381,2715,381,2716,381,2717,2718,2719,2720,2721,2722,381,2723,2333,2724,1912,381,2725,381,2726,2727,2728,2729,381,2730,381,2731,2732,2733,2734,2735,2736,381,2737,381,2738,2739,2740,381,2741,381,2742,2743,2744,2745,381,2746,381,2747,2748,2749,2750,381,2751,381,2752,381,2753,381,2754,2755,2756,381,2757,381,2758,381,2759,2333,2760,2761,1912,381,2762,381,2763,2764,2765,381,2766,381,2767,381,2768,381,2769,381,2770,381,2771,381,2772,381,2451,2773,1912,381,2774,381,2775,381,2776,381,2777,381,2778,381,2779,2780,2781,381,2782,381,2783,381,2784,381,2785,381,2786,2333,2787,2788,2789,2790,2791,1912,381,2792,381,2793,381,2794,381,2795,381,2786,2333,2787,2796,2797,1912,381,2798,381,2799,381,2800,381,2801,2802,381,2786,2333,2803,2804,2805,2806,1912,381,2807,381,2808,381,2809,381,2786,2333,2810,2811,2812,2813,1912,381,2814,381,2815,381,2816,381,2817,381,2818,381,2819,2820,2821,2822,381,2823,381,2824,2825,2826,2827,2828,2829,381,2830,381,2831,2832,2833,2834,2835,2836,381,2837,381,2838,381,2839,381,2840,2841,2842,2843,2844,2845,2846,381,2847,2848,2849,381,2850,381,2851,381,2852,2853,2854,2855,2856,381,2857,381,2858,381,2859,381,2852,2860,381,2861,381,2862,381,2863,381,2852,2864,2865,381,2866,381,2867,381,2852,2868,2869,381,2870,381,2871,381,2852,2872,2873,381,2874,381,2875,381,2876,381,2877,381,2878,381,2879,2880,2881,2882,2883,2884,381,2885,381,2886,381,2887,2888,2889,2890,2891,2892,2893,2894,2895,2896,2897,2898,2899,2900,2901,381,2902,381,2903,381,2904,381,2905,2906,381,2907,381,2333,2908,2909,2910,381,2805,2787,2911,1912,381,2912,381,2913,381,2914,381,2915,381,2916,381,2917,2918,2919,2920,2921,381,2922,381,2923,381,2924,2925,2926,2927,381,2928,2929,2930,381,2931,2932,2933,381,2934,381,2935,381,2936,381,2937,381,2938,2939,2940,2941,2942,2943,2944,2945,381,2946,381,2947,2948,2949,2950,381,2951,381,2952,2953,2954,2955,2956,381,2957,381,2958,2959,2960,2961,381,2962,381,2963,2964,2965,2966,381,2967,381,2968,2969,2970,2971,2972,2973,381,2974,381,2975,2976,2977,2978,2979,381,2980,381,2981,2982,2983,2984,2985,2986,2987,2988,2989,381,2990,381,2991,2992,2993,2994,2995,2996,2997,381,2998,381,2999,3000,3001,3002,3003,3004,381,3005,381,3006,3007,3008,3009,3010,3011,3012,381,3013,381,3014,3015,3016,3017,381,3018,381,3019,3020,3021,3022,381,3023,381,3024,3025,3026,3027,3028,3029,3030,3031,381,3032,381,3033,3034,3035,3036,3037,3038,3039,3040,3041,3042,3043,381,3044,381,3045,381,2333,2813,1912,381,3046,381,2333,3047,3048,3049,2699,3050,1912,381,3051,3052,3053,3054,381,3055,381,3056,381,2333,3057,1912,381,3058,381,2333,3059,1912,381,3051,3060,3061,3062,3063,381,3064,381,2333,2787,3065,3066,3067,3068,1912,381,3069,3070,3071,3072,381,3073,3074,3075,3076,3077,3078,381,3079,381,2333,2787,3080,1912,381,3081,3082,3083,3084,3085,3086,381,3087,381,3088,381,2333,2787,3089,1912,381,3090,381,2333,2787,3091,1912,381,3092,381,3093,381,2451,2787,3094,3091,1912,381,3095,381,2333,2787,3096,1912,381,3097,3098,3099,3100,3101,3102,3103,381,3104,3105,3106,3107,381,3108,3109,3110,3111,3112,3113,381,3114,381,2333,2787,3115,1912,381,3116,381,3093,381,2451,2787,3117,3118,1912,381,3119,381,2451,2787,3120,1912,381,3121,381,3122,381,3123,381,3124,3125,3126,3127,3128,3129,3130,381,3131,381,3132,381,3133,3134,3135,3136,381,3137,381,3138,381,2333,2787,3139,1912,381,3140,381,2333,3141,3142,1912,381,3143,381,2333,3091,1912,381,3144,381,2333,3145,1912,381,3146,381,2333,3147,1912,381,3148,381,3149,3150,3151,381,3152,381,3153,3154,3155,3156,381,3157,381,3158,381,3159,381,3160,381,3161,381,3162,381,3163,381,3164,381,3165,381,2333,2787,3166,1912,381,3167,381,2333,2787,3168,1912,381,3169,381,3170,381,3171,381,3172,381,3173,3174,3175,3176,381,3177,381,2333,2787,3178,1912,381,3179,381,3180,3181,3182,3183,3184,3185,3186,381,3187,381,3188,3189,381,3190,381,2333,2787,3191,3192,1912,381,3193,381,2333,2787,3194,1912,381,3195,3196,3197,3198,381,3199,381,3200,381,2333,3201,3202,3203,3204,3205,3206,3207,3208,3209,3210,3211,1912,381,3081,3212,3213,3214,3215,3216,3217,3218,381,3219,381,2333,3220,3221,3222,1912,381,3223,381,2451,3224,3225,3226,1912,381,3227,381,2451,3228,1912,381,3229,3230,381,3231,381,3232,381,2333,3233,3234,1912,381,3235,3236,3237,3238,3239,3240,381,3241,381,3242,381,3243,381,2451,3244,3245,1912,381,3246,381,2451,3247,3248,3249,3250,3251,1912,381,3081,3252,3253,3254,3255,3256,3257,381,3258,381,2451,3259,3260,1912,381,3261,381,2451,3262,1912,381,3263,381,2451,3264,1912,381,3265,381,2451,3266,3267,3268,1912,381,3269,381,3270,381,3271,3272,3273,3274,3275,3276,3277,3278,3279,3280,3281,3282,3283,3284,3285,3283,3286,3287,3283,3288,3289,3290,3291,3292,3293,3294,3295,3296,3297,3298,3299,3300,3301,3302,3303,3304,3305,3306,3307,3308,3309,381,3310,3311,3312,381,3313,381,3314,3315,3316,3317,3318,3319,3320,3321,3322,3323,3324,3325,3326,3327,3328,3329,3330,3331,3332,381,3333,381,3334,3335,3336,3337,3338,3339,3340,381,3341,381,3342,3343,3344,3345,3346,3347,3348,3349,3350,3351,381,3352,3353,3354,3355,381,3356,381,3357,3358,3359,3360,381,3361,381,3362,3363,381,3364,381,3365,3366,3367,381,3368,3369,3370,3371,381,3372,3373,3374,3375,3376,381,3377,3378,3379,3380,3381,3382,3383,381,3384,381,2333,3385,3386,3387,2498,2497,1912,381,3388,381,2451,3389,3390,1912,381,3391,381,2451,3392,3393,1912,381,3394,3395,3396,381,3397,381,3365,3398,3399,381,3400,3401,3402,3403,381,3404,3405,3406,3407,3408,381,3409,381,3410,3411,3412,3413,3414,3415,3416,3417,3418,3419,3420,3421,3422,3423,3424,3425,3426,3427,3428,3429,3430,3431,3432,3433,3434,3435,3436,3437,3438,3439,3440,3441,3442,3443,3444,3445,3446,3447,3448,3449,3450,3451,3452,3453,3454,3455,3456,3457,3458,3459,3460,3461,3462,3463,381,3464,381,3465,381,3466,3467,3468,3469,381,3470,3471,3472,3473,381,3474,381,3475,3476,3477,381,3478,3479,3480,3481,3482,3483,381,3484,3485,3486,381,3487,381,3488,381,3489,3490,3491,381,3492,3493,3494,3495,3496,381,3497,3498,3499,381,3500,381,3501,381,3466,3502,3503,3504,3505,3506,381,3507,381,3508,381,3509,3510,3511,381,3512,3513,3514,381,3515,381,3516,381,2852,3517,381,3518,381,3519,381,3520,381,3521,3522,3523,3524,3525,3526,3527,3528,3529,3530,381,3531,381,3532,381,3533,381,3534,381,3535,3536,3537,3538,3539,3540,381,3541,381,3542,381,3543,381,3544,381,3545,381,3546,3547,3548,3549,3550,3551,3552,3553,3554,3555,3556,381,3557,381,3558,3559,3560,381,3561,381,3562,3563,381,3564,381,3565,3566,3567,381,3568,381,3569,381,3570,3571,3572,381,3573],"# Testing Guide","This is the active testing guide for Taskdeck.","Last Updated: 2026-07-26","Companion Active Docs:","- `docs/STATUS.md`","- `docs/IMPLEMENTATION_MASTERPLAN.md`","- `docs/TESTING_GUIDE.md`","- `docs/MANUAL_TEST_CHECKLIST.md`","- `docs/GOLDEN_PRINCIPLES.md`","## Current Verified Totals (2026-05-16)","- Backend: **6,614 passing** (0 failed, 6 skipped; 6,620 total) -- verified 2026-05-16 via `dotnet test backend/Taskdeck.sln -c Release -m:1` on `main` after bulk merge of PRs `#1055`–`#1074`"," - Domain: 1,626 passed"," - Application: 3,185 passed"," - API integration: 1,685 passed (0 failed, 2 skipped; 1,687 total)"," - CLI contract: 82 passed"," - Architecture boundaries: 0 failed, **1 skipped** (only INV-09/DataFlowRegistry; INV-10/11/12 un-skipped with real assertions in #1126) — exact pass/total pending CI recertification (#1138)"," - Integration (Testcontainers): 20 passed","- Frontend unit: **3,267 passing** -- verified 2026-05-16 post-bulk-merge (CI)","- Frontend E2E (smoke + automation/ops + capture loop + starter-pack fixtures + concurrency harness + error recovery/multi-board/edge journeys + cross-browser matrix + onboarding/review/capture/keyboard/dark-mode + validation slices C/D/E + integrated verification): default required lane passing","- Combined automated total: **~9,881+ passing** (backend 6,614 + frontend unit 3,267 + E2E)","Verification note:","- backend total of 6,614 is locally recertified after bulk merge of 15 PRs (`#1055`–`#1074`) on 2026-05-16","- bulk merge wave (2026-05-16): security fixes (3 PRs), test coverage (2), RFAI features (5), PAPER frontend (2), dependency updates (3)","- prior recertification: backend 6,336 (2026-05-05 after Paper backend gap PR `#1040`), frontend 2,805 (2026-04-25)","- growth since last recertification: backend +278 passing tests, frontend +462 passing tests","## Roadmap v4 Verification Spine (Seeded 2026-04-25)","Tracker `#972` seeds the next review-first AI verification program. Delivered items are marked; remaining items are planned work until their implementation issues land:","- `#973`: (**delivered**, `#986`) twelve roadmap invariants covering automation-only mutation safety, proposal execution idempotency/version checks, outbound egress envelope coverage, disclosure registry coverage, MCP tool-definition hash pinning, telemetry content rejection, and proposal source-span integrity.","- `#974`: (**delivered**, `#989`) schema/provider smoke coverage for `IntentEnvelopeV1`, `TaskdeckProposalBatch`, `IChatClient` adapter viability, and the `JsonSchemaExporter` vs handwritten-schema decision. 117 tests.","- `#975`--`#977`: (**delivered**, `#993`/`#994`/`#991` + `#1071`/`#1058`/`#1062`) golden proposal dataset checks, schema validity, extractive quote/span verification, inferred evidence-link resolution, field confidence scoring, and edit-before-approve paths. Full delivery: `IProposalGenerator`/`FieldVerifier`/`ProposalGeneratorV1` (`#1071`), revision endpoints + edit-before-approve flow (`#1058`), Paper Review deep-dive wired to backend APIs (`#1062`). Combined: provenance 139 + revision 70 + confidence 136 + generator/verifier/review wiring tests. _(Update `#1198`, 2026-06-13: `ProposalGeneratorV1` + its `IProposalGenerator` interface and test class were removed as dead code (zero consumers); `FieldVerifierTests` and the provenance/confidence/revision suites are unaffected.)_","- `#978`--`#979`: (**both delivered**, `#990`/`#1050`) vector-search fallback tests, embedding backfill safety (61 tests). RFAI-07 hybrid retrieval, duplicate calibration, and memory-assisted generation delivered in `#1050`.","- `#980`: (**delivered**, `#992` + `#1073`/`#1074`) TelemetryGuard fuzz rejection, egress registry completeness (108 tests), egress disclosure API endpoint (`#1073`), privacy insights API for proposal outcome cohorts (`#1074`).","- `#981`: (**delivered**, `#1052`) agent runtime hardening — property tests for no approve/direct-mutation tools, egress handler violation tests, MCP definition re-approval, and scheduled Inbox Digest quota/coalescing.","- `#982`--`#983`: (**both delivered**, `#1078`/`#1079`) ambient capture provenance — PWA share target (RFAI-10, `#1078`; browser-extension prototype deferred — only a `CaptureSource.BrowserExtension = 10` enum placeholder exists, no MV3/WXT artifact shipped), and the VS Code extension + voice prototype ambient channel (RFAI-11, `#1079`).","- `#984`: (**delivered**, `#1080`) beta-gate work — learning loop UI, provenance drawer, Ollama flag. NOTE: the CI-visible `RoadmapInvariantTests` for INV-10 (MCP hash-pin), INV-11 (TelemetryGuard), and INV-12 (provenance source spans) are now un-skipped with real assertions against the shipped services (`#1126`). Only INV-09 (DataFlowRegistry) remains `[Fact(Skip = \"...\")]` — that registry is genuinely unbuilt.","## Windows PowerShell Command Convention","For agent-run commands on Windows, do not use `&&` directly in PowerShell. Prefer fail-fast sequences that check `$LASTEXITCODE`, for example:","```powershell","Push-Location frontend/taskdeck-web","npm run typecheck; if ($LASTEXITCODE -ne 0) { Pop-Location; exit $LASTEXITCODE }","npm run build; if ($LASTEXITCODE -ne 0) { Pop-Location; exit $LASTEXITCODE }","npx vitest --run","$code = $LASTEXITCODE","Pop-Location","if ($code -ne 0) { exit $code }","## Agentic Operating Layer Smoke Checks","For docs/skill/hook-only agentic changes, use targeted checks rather than the full product suite unless product runtime files changed. These local update-and-verify sequences render the failure ledger before testing synchronization so a valid hook-appended JSONL entry can become visible. Required CI deliberately does not render and keeps its test-before-governance order, so an unprojected JSONL change fails instead of being masked. On Windows PowerShell, use the verified Python launcher and compile hook sources in memory so verification does not leave `__pycache__` output:","$ErrorActionPreference = \"Stop\"","try {"," Get-Command py -ErrorAction Stop | Out-Null"," Get-Command node -ErrorAction Stop | Out-Null"," Get-Content -Raw .mcp.json | ConvertFrom-Json -ErrorAction Stop | Out-Null"," Get-Content -Raw .claude\\settings.json | ConvertFrom-Json -ErrorAction Stop | Out-Null","} catch {"," [Console]::Error.WriteLine($_.Exception.Message)"," exit 1","py -3 -B \"$env:USERPROFILE\\.codex\\skills\\.system\\skill-creator\\scripts\\quick_validate.py\" .codex\\skills\\taskdeck-question-batch; if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }","py -3 -B \"$env:USERPROFILE\\.codex\\skills\\.system\\skill-creator\\scripts\\quick_validate.py\" .codex\\skills\\taskdeck-failure-capture; if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }","py -3 -B \"$env:USERPROFILE\\.codex\\skills\\.system\\skill-creator\\scripts\\quick_validate.py\" .codex\\skills\\taskdeck-interface-map; if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }","py -3 -B \"$env:USERPROFILE\\.codex\\skills\\.system\\skill-creator\\scripts\\quick_validate.py\" .claude\\skills\\taskdeck-question-batch; if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }","py -3 -B \"$env:USERPROFILE\\.codex\\skills\\.system\\skill-creator\\scripts\\quick_validate.py\" .claude\\skills\\taskdeck-failure-capture; if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }","py -3 -B \"$env:USERPROFILE\\.codex\\skills\\.system\\skill-creator\\scripts\\quick_validate.py\" .claude\\skills\\taskdeck-interface-map; if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }","Get-ChildItem scripts\\agent_hooks -Filter *.py | ForEach-Object { py -3 -B -c \"import pathlib, sys; source = pathlib.Path(sys.argv[1]); compile(source.read_text(encoding='utf-8'), str(source), 'exec')\" $_.FullName; if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE } }","py -3 -B scripts/agent_hooks/smoke_test.py; if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }","py -3 -B scripts/agent_hooks/render_failure_ledger.py; if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }","py -3 -B -m unittest discover -s scripts/agent_hooks -p \"test_render_failure_ledger.py\"; if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }","node scripts\\check-docs-governance.mjs; if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }","node scripts\\check-golden-principles.mjs; if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }","node scripts\\check-github-ops-governance.mjs; if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }","On POSIX, use `python3 -B` for direct utilities and fail fast. Do not run the full configured-handler smoke there: `.claude/settings.json` declares those handlers with `shell: powershell`, so `smoke_test.py` is native-Windows-host proof until that shell contract is redesigned.","```sh","set -eu","python3 -B -m json.tool .mcp.json >/dev/null","python3 -B -m json.tool .claude/settings.json >/dev/null","python3 -B \"$HOME/.codex/skills/.system/skill-creator/scripts/quick_validate.py\" .codex/skills/taskdeck-question-batch","python3 -B \"$HOME/.codex/skills/.system/skill-creator/scripts/quick_validate.py\" .codex/skills/taskdeck-failure-capture","python3 -B \"$HOME/.codex/skills/.system/skill-creator/scripts/quick_validate.py\" .codex/skills/taskdeck-interface-map","python3 -B \"$HOME/.codex/skills/.system/skill-creator/scripts/quick_validate.py\" .claude/skills/taskdeck-question-batch","python3 -B \"$HOME/.codex/skills/.system/skill-creator/scripts/quick_validate.py\" .claude/skills/taskdeck-failure-capture","python3 -B \"$HOME/.codex/skills/.system/skill-creator/scripts/quick_validate.py\" .claude/skills/taskdeck-interface-map","for file in scripts/agent_hooks/*.py; do python3 -B -c 'import pathlib, sys; source = pathlib.Path(sys.argv[1]); compile(source.read_text(encoding=\"utf-8\"), str(source), \"exec\")' \"$file\" || exit $?; done","python3 -B scripts/agent_hooks/render_failure_ledger.py","python3 -B -m unittest discover -s scripts/agent_hooks -p 'test_render_failure_ledger.py'","node scripts/check-docs-governance.mjs","node scripts/check-golden-principles.mjs","node scripts/check-github-ops-governance.mjs","The GitHub operations governance check also pins the parked staging workflow contract: `.github/workflows/cd-staging-gate.yml` may expose only `workflow_dispatch`, must require a string `image_tag`, and must not declare an environment until a protected production environment is configured and verified.","The native-Windows hook smoke test executes the configured `.claude/settings.json` command handlers with `CLAUDE_PROJECT_DIR` set, including PowerShell-hosted handlers, representative dangerous Bash-command denials, missing-launcher and missing-policy fail-closed probes, failure-ledger redaction, and pre-commit no-op behavior. Its payloads identify the `Bash` tool; it does not prove native PowerShell-tool interception. That T4 policy gap is tracked by [#1497](https://github.com/Chris0Jeky/Taskdeck/issues/1497).","When MCP availability itself is part of the change, also run the active runtime's MCP listing/auth command if available. Do not claim remote MCP connectivity unless the current session actually verified it.","When `.claude/settings.json` changes outside the agentic smoke path, also parse it with PowerShell:","Get-Content -Raw .claude\\settings.json | ConvertFrom-Json | Out-Null","## GitHub Project Priority Audit Checks","For changes to `scripts/github/Sync-TaskdeckProjectPriority.ps1`, run the offline parser and regression checks first:","$script = \"scripts\\github\\Sync-TaskdeckProjectPriority.ps1\"","$tokens = $null","$parseErrors = $null","[System.Management.Automation.Language.Parser]::ParseFile((Resolve-Path $script).Path, [ref]$tokens, [ref]$parseErrors) | Out-Null","if ($parseErrors.Count -ne 0) { $parseErrors | Format-List; exit 1 }","powershell -NoProfile -File $script -SelfTest","if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }","`-SelfTest` is authentication-free and reports its exact check count. It includes a mocked 1,001-item project plus fail-closed cases for early termination, exact duplicate IDs, case-distinct IDs, count/stamp drift, repeated or missing cursors, truncated nested connections, a positive limit ceiling, aggregated missing/multiple same-repository Issue priority labels before PR lookups, raw REST Issue/PullRequest normalization, same-repository authority, default-off external Issue authority, mixed/external-only references, strict `Priority V` fallback, ignored-reference source drift, ordered option dispatch, zero-write option validation, partial writer failures, and verified post-apply output. The Required CI docs-governance job parses the script and runs this same authentication-free suite.","Then exercise the live read-only boundaries:","# On a project larger than 1,000 items, this must exit nonzero rather than sample.","powershell -NoProfile -File $script -Limit 1000 -Json","if ($LASTEXITCODE -eq 0) { throw \"Expected the configured ceiling to fail closed.\" }","# Complete audit. Do not treat a nonzero exit as a clean result.","powershell -NoProfile -File $script -Json","A successful JSON audit must say `complete: true`, with `scanned == reportedTotalCount`; a clean audit additionally requires `needsUpdate: 0`. Body references that resolve to PullRequests do not contribute Issue priority. External Issue references are default-off, visible non-authority: verify `ignoredIssueReferenceCount` and every exact record in `ignoredIssueReferences`; external labels never contribute ranking, an external-only PR derives `Priority V`, and an external closing Issue permits same-repository body fallback. External Issue or PullRequest content placed directly in the project remains fatal. Missing or multiple labels on actual same-repository Issues are aggregated data-policy failures that abort before PR reference resolution or writes; fix every listed label defect first. Never add `-Apply` merely to test the helper. Only with `project` scope and reviewed updates should an operator run `-Apply`; ignored-reference identity/count participates in the pre-write drift guard, the command must perform its complete post-apply audit even after a partial writer failure, and a final separate read-only audit must prove the resulting project is complete and clean.","## Paper Backend Gap Testing (2026-05-05, PRs `#1031`–`#1040`)","The Paper backend gap wave through PR `#1040` added ~480 new backend tests across 10 delivered/merge-ready issues. Each delivered PR received adversarial review; later review rounds found and fixed issues including a 100k entity memory risk, a board-scoping error, missing FK enforcement, CancellationToken threading gaps, projected WIP false negatives, JSON parsing 500s, and conflict-detector false positives.","### Cadence Aggregation Tests (`#1015`/`#1031`)","`backend/tests/Taskdeck.Domain.Tests/Entities/CadenceSnapshotTests.cs`, `backend/tests/Taskdeck.Application.Tests/Services/CadenceServiceTests.cs` — **26 tests** covering:","- CadenceBucket hour validation (0-23), event count non-negative, equality semantics","- CadenceSnapshot: 24-bucket invariant, null guard, cached `Empty()` singleton, first/peak/last action computation","- CadenceService: empty day, single event, full day aggregation, peak hour ties, midnight boundary, date normalization","Run:","dotnet test backend/Taskdeck.sln -c Release --filter \"FullyQualifiedName~Cadence\"","### Streak Query Tests (`#1016`/`#1032`)","`backend/tests/Taskdeck.Domain.Tests/Entities/StreakDayTests.cs`, `StreakResultTests.cs`, `backend/tests/Taskdeck.Application.Tests/Services/StreakServiceTests.cs` — **61 tests** covering:","- StreakDay: intensity bucket validation (0-4), DateOnly handling, sealed flag","- StreakResult: current/longest streak invariant (current cannot exceed longest), empty days","- StreakService: empty history, single day, continuous streak, gap in streak, gap at end, intensity quartile bucketing, day count boundaries (1, 90, 365), server-side `CountByDateAsync` aggregate query","dotnet test backend/Taskdeck.sln -c Release --filter \"FullyQualifiedName~Streak\"","### Seal Day Tests (`#1017`/`#1037`)","`backend/tests/Taskdeck.Domain.Tests/Entities/DailySnapshotTests.cs`, `backend/tests/Taskdeck.Application.Tests/Services/DailySealServiceTests.cs` — **28 tests** covering:","- DailySnapshot: construction, seal idempotency (second seal is no-op preserving original timestamp), future date rejection, IsSealed property, empty userId rejection","- DailySealService: seal new day, seal existing unsealed, seal already-sealed (idempotent), validation errors, status checks for missing/sealed/unsealed snapshots, CancellationToken propagation","- UnitOfWork: DailySnapshot unique constraint violation recovery (concurrent seal race condition)","dotnet test backend/Taskdeck.sln -c Release --filter \"FullyQualifiedName~Seal or FullyQualifiedName~DailySnapshot\"","### Tomorrow Note Tests (`#1018`/`#1035`)","`backend/tests/Taskdeck.Domain.Tests/Entities/TomorrowNoteTests.cs`, `backend/tests/Taskdeck.Application.Tests/Services/TomorrowNoteServiceTests.cs` — **25 tests** covering:","- TomorrowNote: constructor validation, text max length (500 chars), date handling, UpdateText behavior and timestamp","- TomorrowNoteService: get existing/missing note, save new/update existing (upsert), empty userId rejection, null text handling, max length boundary","- UnitOfWork: TomorrowNote unique constraint violation recovery (concurrent upsert race condition)","dotnet test backend/Taskdeck.sln -c Release --filter \"FullyQualifiedName~TomorrowNote\"","### Provenance Query Tests (`#1019`/`#1039`)","`backend/tests/Taskdeck.Application.Tests/Services/ProvenanceQueryServiceTests.cs` — **41 tests** covering:","- Icon map: 26-entry case-insensitive map with fallback default icon","- Weight bucketing: extractive >= 0.7 confidence → \"primary\", < 0.7 → \"contextual\", inferred → \"inferred\"","- Human-readable value strings with quote snippet truncation, `Math.Round` for confidence display","- Empty provenance (returns empty list, not error), missing proposal, authorization","- FK enforcement via `AddProposalProvenanceForeignKey` migration","dotnet test backend/Taskdeck.sln -c Release --filter \"FullyQualifiedName~ProvenanceQuery\"","### Side-Effect Analysis Tests (`#1020`/`#1033`)","`backend/tests/Taskdeck.Domain.Tests/Entities/SideEffectTests.cs`, `backend/tests/Taskdeck.Application.Tests/Services/SideEffectAnalyzerTests.cs` — **66 tests** covering:","- SideEffectRow: value object creation, tone enum, equality/hash contract","- Reversibility: default 6h window (21,600,000ms), summary/description","- SideEffectAnalyzer: 7-category tone classification (Cards, Subtasks, Comments, Activity, Notifications, Webhooks, Calendar), target-type-aware card mutation detection, column mutation inclusion, webhook conditional on operations existing, risk-based reversibility (Critical → 3h)","dotnet test backend/Taskdeck.sln -c Release --filter \"FullyQualifiedName~SideEffect\"","### Confidence Breakdown Tests (`#1021`/`#1036`)","`backend/tests/Taskdeck.Domain.Tests/Confidence/ConfidenceComponentTests.cs`, `ConfidenceBreakdownTests.cs`, `backend/tests/Taskdeck.Application.Tests/Services/Confidence/ConfidenceBreakdownServiceTests.cs` — **63 tests** covering:","- ConfidenceComponent: value range [0..1], NaN/Infinity rejection, key validation","- ConfidenceBreakdown: overall/threshold range, MeetsThreshold computed property, defensive component list copy","- ConfidenceBreakdownService: 4-component weighted computation (Pattern match, Reach, Reversibility, Recency), reach formula `2.0 / (2.0 + log2(n))`, risk-level reversibility scoring, recency from expiry window, threshold note generation, static weight map","dotnet test backend/Taskdeck.sln -c Release --filter \"FullyQualifiedName~ConfidenceBreakdown\"","### Conflict Detection Tests (`#1022`/`#1040`)","Status: reconciled and locally verified after merge-conflict recovery.","`backend/tests/Taskdeck.Domain.Tests/Entities/ConflictRowTests.cs`, `backend/tests/Taskdeck.Application.Tests/Services/ProposalConflictDetectorTests.cs`, `backend/tests/Taskdeck.Api.Tests/AutomationProposalRepositoryIntegrationTests.cs`, `backend/tests/Taskdeck.Api.Tests/CardCommentRepositoryIntegrationTests.cs` — **78 tests** covering:","- ConflictRow: tone enum, value object creation, equality","- ProposalConflictDetector: 7 detection rules — stale data (excludes create-card ops), missing target card, WIP limit, duplicate pending proposals (all pending, not just latest), high/critical risk, outbound webhooks, active comments, multi-op on same card, positive signals (column capacity, fresh data)","- Entity caching (each card/column fetched at most once), safe JSON parsing with ValueKind checks, projected WIP accounting including departures, missing target columns, soft-deleted comment exclusion, repository aggregate methods, tone-sorted output (Warn → Info → Ok)","dotnet test backend/tests/Taskdeck.Domain.Tests/Taskdeck.Domain.Tests.csproj -c Release --filter \"FullyQualifiedName~ConflictRow\"","dotnet test backend/tests/Taskdeck.Application.Tests/Taskdeck.Application.Tests.csproj -c Release --filter \"FullyQualifiedName~ProposalConflictDetector\"","dotnet test backend/tests/Taskdeck.Api.Tests/Taskdeck.Api.Tests.csproj -c Release --filter \"FullyQualifiedName~AutomationProposalRepositoryIntegrationTests|FullyQualifiedName~CardCommentRepositoryIntegrationTests\"","### Card History Tests (`#1023`/`#1034`)","`backend/tests/Taskdeck.Domain.Tests/Entities/CardHistoryRowTests.cs`, `backend/tests/Taskdeck.Application.Tests/Services/CardHistoryServiceTests.cs` — **42 tests** covering:","- CardHistoryRow: serial formatting, status enum, validation, equality","- CardHistoryService: single/multi-card history, serial numbering, age formatting (same day, yesterday, this week, older) with `InvariantCulture`, status classification (pending/applied/past), proposal deduplication via `HashSet`, bounded output (200/card, 500 total), proper JSON property parsing for update events","dotnet test backend/Taskdeck.sln -c Release --filter \"FullyQualifiedName~CardHistory\"","### Similar Past Decisions Tests (`#1024`/`#1038`)","`backend/tests/Taskdeck.Domain.Tests/SimilarPast/SimilarPastDecisionTests.cs`, `SimilarPastResultTests.cs`, `backend/tests/Taskdeck.Application.Tests/Services/SimilarDecisionServiceTests.cs` — **50 tests** covering:","- SimilarPastDecision: value object validation, title truncation (200 chars), verdict enum","- SimilarPastResult: apply rate computation, division-by-zero safety, negative input rejection","- SimilarDecisionService: board-scoped action-class matching (review fixed userId filter), user-scoped fallback, top-3 limiting with full-population apply rate, self-exclusion, serial/date formatting (ISO week with 2-digit year), 200-proposal lookback limit, SARGable `OrderByDescending(DecidedAt)` ordering","dotnet test backend/Taskdeck.sln -c Release --filter \"FullyQualifiedName~SimilarPast or FullyQualifiedName~SimilarDecision\"","## Roadmap v4 Second-Wave Testing (2026-04-25, PRs `#989`–`#994`)","The RFAI-02 through RFAI-08 foundational slice wave (PRs `#989`–`#994`) added ~631 new backend tests across 6 PRs. Each PR received adversarial review with review-added tests fixing bot findings from Gemini and Codex connector reviews.","### IntentEnvelopeV1 Tests (RFAI-02, `#974`/`#989`)","`backend/tests/Taskdeck.Domain.Tests/Entities/IntentEnvelopeV1Tests.cs`, `IntentCandidateTests.cs`, `SourceBlockTests.cs`, `SourceSpanTests.cs`, `EvidenceLinkTests.cs`, `TaskdeckProposalBatchTests.cs`, `ProposalBatchSchemaRoundTripTests.cs` — **117 tests** covering:","- IntentEnvelopeV1 lifecycle (Created→Extracting→Processed), candidate addition, evidence linking","- SourceBlock/SourceSpan validation: offset ranges, snippet length consistency, evidence fabrication prevention","- IntentCandidate confidence bounds, evidence link construction","- ProposalBatch schema round-trip smoke tests against handwritten JSON schema","dotnet test backend/Taskdeck.sln -c Release --filter \"FullyQualifiedName~IntentEnvelope or FullyQualifiedName~SourceSpan or FullyQualifiedName~SourceBlock or FullyQualifiedName~IntentCandidate or FullyQualifiedName~EvidenceLink or FullyQualifiedName~ProposalBatch\"","### Semantic Memory Vector Index Tests (RFAI-06, `#978`/`#990`)","`backend/tests/Taskdeck.Application.Tests/Services/InMemoryVectorIndexTests.cs`, `InMemoryEmbeddingGeneratorTests.cs`, `EmbeddingBackfillServiceTests.cs`, `FallbackSemanticSearchServiceTests.cs` — **61 tests** covering:","- InMemoryVectorIndex: upsert, duplicate replacement, batch upsert, nearest-neighbor accuracy, topK limits, metadata filtering, delete, concurrent reads/writes, cosine similarity edge cases (zero/orthogonal/parallel vectors)","- InMemoryEmbeddingGenerator: dimensionality, determinism, normalization, empty/null input, batch alignment, cross-instance consistency","- EmbeddingBackfillService: generator-unavailable skip, batch processing, individual failure isolation, stale vector pruning, cancellation","- FallbackSemanticSearchService: FTS fallback, empty queries, vector search happy path, exception-triggered fallback","dotnet test backend/Taskdeck.sln -c Release --filter \"FullyQualifiedName~VectorIndex or FullyQualifiedName~EmbeddingGenerator or FullyQualifiedName~EmbeddingBackfill or FullyQualifiedName~SemanticSearch\"","### Confidence Pipeline Tests (RFAI-05, `#977`/`#991`)","`backend/tests/Taskdeck.Domain.Tests/Confidence/ConfidenceScoreTests.cs`, `FieldConfidenceTests.cs`, `SelfConsistencyQuotaTests.cs`, `SelfConsistencyPolicyTests.cs`, `ConfidenceBucketTests.cs` and `backend/tests/Taskdeck.Application.Tests/Services/Confidence/BrierScoreCalculatorTests.cs`, `ConfidenceAggregatorTests.cs` — **136 tests** covering:","- ConfidenceScore: boundary values, floating-point precision, epsilon equality, hash code consistency, CompareTo/Equals alignment, NaN/Infinity rejection","- SelfConsistencyQuota: immutability (Consume returns new instances), overflow protection, non-finite cost rejection, budget exhaustion","- ConfidenceBucket: contiguous boundaries with no gaps/overlaps, monotonic sweep verification","- BrierScoreCalculator: calibration math, skill score, division-by-zero safety, non-finite input rejection","- ConfidenceAggregator: weighted combination, missing-source handling, zero-weight safety","dotnet test backend/Taskdeck.sln -c Release --filter \"FullyQualifiedName~Confidence or FullyQualifiedName~BrierScore\"","### Eval Harness and Egress Tests (RFAI-08, `#980`/`#992`)","`backend/tests/Taskdeck.Application.Tests/Services/TelemetryGuardTests.cs`, `EgressRegistryTests.cs`, `InsightMetricTests.cs`, `Eval/EvalHarnessTests.cs` — **108 tests** covering:","- TelemetryGuard: allowlist enforcement, URL/email detection, non-finite doubles, null values, max-length strings, ReDoS adversarial input, unsupported value type rejection (dictionaries, DTOs, arrays, DateTime, Guid)","- EgressRegistry: seed entry completeness, case-insensitive host matching, wildcard pattern matching, runtime registration, host validation, thread safety","- InsightMetric: PII-freedom (reflection-based verification), structural constraints","- EvalHarness: runner execution, category coverage, summarization, seed case determinism","dotnet test backend/Taskdeck.sln -c Release --filter \"FullyQualifiedName~TelemetryGuard or FullyQualifiedName~EgressRegistry or FullyQualifiedName~InsightMetric or FullyQualifiedName~EvalHarness\"","### Proposal Provenance Tests (RFAI-03, `#975`/`#993`)","`backend/tests/Taskdeck.Domain.Tests/Entities/ProposalProvenanceTests.cs`, `ProvenanceFieldTests.cs`, `ProposalOutcomeTests.cs`, `EvidenceLinkTests.cs` covering:","- ProposalProvenance: field addition, parent-ID validation, field count tracking","- ProvenanceField: extractive quote enforcement, confidence bounds, kind validation","- ProposalOutcome: content-free decision ledger, decision type coverage","_(Update `#1215`, 2026-07-04: `FieldVerificationResultTests`, `FuzzyTextMatcherTests`, and `DeterministicPreExtractorTests` were removed with the dead-code sweep of `FieldVerifier`/`DeterministicPreExtractor`/`FuzzyTextMatcher` — see STATUS. The original RFAI-03 suite was 139 tests; the remaining provenance/outcome/evidence tests are unaffected.)_","dotnet test backend/Taskdeck.sln -c Release --filter \"FullyQualifiedName~Provenance or FullyQualifiedName~ProposalOutcome\"","### Proposal Revision Tests (RFAI-04, `#976`/`#994`)","`backend/tests/Taskdeck.Domain.Tests/Entities/ProposalRevisionTests.cs`, `ProposalRevisionChainTests.cs`, `CompilerValidationResultTests.cs`, `OperationRiskTests.cs`, `ProposalOutcomeTests.cs`, `UnsupportedOperationFailureTests.cs` — **70 tests** covering:","- ProposalRevision: creation, immutability (private setters), validation, DateTimeOffset precision","- Revision chain: latest resolution, ordering, no-revisions case, many-revisions integrity, unique constraint","- CompilerValidationResult: success/failure factory, risk aggregation","- OperationRisk: value equality semantics, risk level + reason","- OutcomeType: decision coverage (Approved/EditedThenApproved/Rejected/Ignored)","dotnet test backend/Taskdeck.sln -c Release --filter \"FullyQualifiedName~ProposalRevision or FullyQualifiedName~CompilerValidation or FullyQualifiedName~OperationRisk or FullyQualifiedName~UnsupportedOperation\"","## Audit-Finding Remediation Wave Testing (2026-04-24, PRs `#960`–`#969`)","The 2026-04-24 audit-finding remediation wave (PRs `#960`–`#969`) added ~186 new tests across 10 issues. Each PR received two rounds of adversarial review (original self-review + independent cold review); the second round found and fixed 15+ issues including 3 critical bugs (SQLite DateTimeOffset comparison, SQL Server DELETE syntax, keyboard navigation).","### Composable Tests (FE-22, FE-21)","- `frontend/taskdeck-web/src/tests/composables/useCardModal.spec.ts` — **61 tests** covering card/isOpen watchers, `formattedDueDate`/`isOverdue`/`isFormValid` computed branches, capture provenance loading, save with field deltas, delete flow, comment CRUD, reply drafts, `canEditComment`, cleanup","- `frontend/taskdeck-web/src/tests/composables/useStarterPackCatalog.spec.ts` — **40 tests** covering `loadCatalog`, `filteredPacks`, `selectedPack`, `runPreview`, `applyPack`, `extractConflictResult`, guard-clause early returns","- `frontend/taskdeck-web/src/tests/composables/useStarterPackImport.spec.ts` — **48 tests** covering `validateImportJson`, `handleFileUpload`, `runImportPreview`, `applyImportPack`, guard/error paths","- `frontend/taskdeck-web/src/tests/composables/useStarterPackResult.spec.ts` — **37 tests** covering `normalizeConflictSeverity`, `actionSummary`, `outcomeSummaryLabel`, `outcomeSummaryToneClass`","Coverage impact: `src/composables/**` branch coverage rose from 79.22% to 83.27% (threshold: 80%).","### Backend Tests (OPS-31, SEC-31)","- `backend/tests/Taskdeck.Api.Tests/Workers/AuditRetentionWorkerIntegrationTests.cs` — audit retention batch deletion with SQLite DateTimeOffset formatting","- `backend/tests/Taskdeck.Application.Tests/Services/OAuthScopeValidatorTests.cs` — scope parsing (comma/space/tab), required/expected validation, case-sensitive comparison, null safety","### Error Reporting Tests (FE-24)","- `frontend/taskdeck-web/src/tests/utils/errorReporting.logError.spec.ts` — 3 new tests for `.message`-bearing objects, variadic DEV/PROD modes","## Production Hardening Wave Testing (2026-04-22, PRs `#902`–`#913`)","The 2026-04-22 production hardening wave (PRs `#902`–`#913`) added ~210+ new tests across 10 tracked audit issues plus 2 CI stabilisation fixes. Each PR received self-review plus bot reviews; review-fix commits addressed CI failures, false-positive tests, performance bugs, and test-flake root causes.","### SSRF Protection Tests (SEC-26, `#850`/`#905`)","`backend/tests/Taskdeck.Application.Tests/Services/SsrfProtectionServiceTests.cs` — **40 `[Fact]`/`[Theory]` entries expanding to 83 test cases**:","- Private IPv4 ranges: `127.0.0.0/8`, `10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`","- IPv6 ranges: `::1`, `fc00::/7`, `fe80::/10`, IPv4-mapped IPv6","- Cloud metadata: AWS `169.254.169.254`, GCP `metadata.google.internal`, Azure `169.254.169.254`, Alibaba `100.100.100.200`, AWS IMDSv2 IPv6 `fd00:ec2::254`","- Bypass attempts: decimal (`2130706433`), hex (`0x7f000001`), octal (`0177.0.0.1`), short-form (`127.1`) — all normalised by `.NET Uri` before the IP range check","- Scheme validation: non-HTTP/HTTPS rejected; credential-bearing URLs stripped","- LLM provider URL HTTPS enforcement (except with `allowLocalhostEndpoints`)","Plus expanded `OutboundWebhookEndpointGuardTests` with cloud metadata hostname coverage and LLM provider selection policy tests for private IP, IPv6 loopback, IPv4-mapped IPv6, and cloud metadata `BaseUrl`.","dotnet test backend/Taskdeck.sln -c Release --filter \"FullyQualifiedName~SsrfProtectionService\"","### File Content Validation Tests (SEC-30, `#860`/`#910`)","`backend/tests/Taskdeck.Application.Tests/Services/FileContentValidatorTests.cs` — **52 `[Fact]`/`[Theory]` entries** covering:","- Valid/invalid text with BOM","- Binary content detection (null bytes, C1 control characters `0x80-0x9F`)","- Unicode smart quotes (`U+2018-U+201D`) and dashes (`U+2013-U+2014`) pass correctly (they are above `0x9F`)","- Character-based limits (maxChars parameter) for CJK/emoji safety","- JSON structure validation with BOM-aware parsing","- SQLite magic byte detection (`SQLite format 3\\0`)","- Size limits: `maxBytes: 0` disables the cap (used by `ExportController` for round-trip)","dotnet test backend/Taskdeck.sln -c Release --filter \"FullyQualifiedName~FileContentValidator\"","### Migration Bootstrap Tests (OPS-28, `#864`/`#907`)","`backend/tests/Taskdeck.Api.Tests/MigrationBootstrapTests.cs` — **5 tests** ensuring the EF Core migration chain remains unbroken:","- Migrations apply cleanly to a fresh SQLite database","- All expected tables are created (verified via reflection against `DbContext` DbSets, not a hardcoded list)","- Re-running `Migrate()` is idempotent","- `HasPendingModelChanges()` reports no drift (detects real model/snapshot divergence, not just missing migration files — surfaced the missing `ExternalLogins.UserId` FK)","- All migration timestamps are distinct","`GetUserTables()` uses `OpenConnection()`/`CloseConnection()` instead of disposing the `DbContext`-owned connection. Workflow guide at `docs/platform/EF_MIGRATION_WORKFLOW.md`.","dotnet test backend/Taskdeck.sln -c Release --filter \"FullyQualifiedName~MigrationBootstrap\"","### Options Validation Tests (OPS-27, `#863`/`#908`)","`backend/tests/Taskdeck.Api.Tests/Validation/OptionsValidationTests.cs` — **34 `[Fact]`/`[Theory]` entries** covering data-annotation boundaries for 15 settings classes, 4 cross-property validators (`WorkerSettings`, `JwtSettings`, `SentrySettings`, `RateLimitingSettings`), case-insensitive regex for `Llm:Provider`/`Cache:Provider`, and an integration test proving the app starts with valid defaults.","dotnet test backend/Taskdeck.sln -c Release --filter \"FullyQualifiedName~OptionsValidation\"","### Board Pagination API Tests (PERF-12, `#848`/`#909`)","`backend/tests/Taskdeck.Api.Tests/BoardPaginationApiTests.cs` — **11 integration tests** covering default pagination, empty list, limit enforcement, offset skipping, partial page, limit clamped to 200, negative offset, offset beyond total, zero limit clamped to 1, full page iteration, and cross-user isolation with pagination metadata. Existing tests that deserialised `List` from `GET /api/boards` migrated to use the new `PaginatedResult` shape via `ApiTestHarness.ListBoardsAsync`/`ListBoardsPaginatedAsync` helpers.","### CLI Tests Restored (TST-58, `#853`/`#906`)","CLI test discovery was fixed by adding missing `[Fact]`/`[Theory]` attributes and extracting a shared `CliTestHarness` (replacing ~90-line duplication across 5 files). The CLI suite totalled approximately **78 tests across 10 files** at time of this wave (see [Current Verified Totals](#current-verified-totals-2026-04-25) for latest count of 82):","| File | Tests |","|------|-------|","| `ArgParserTests.cs` | 15 |","| `ApiKeyCommandTests.cs` | 12 |","| `CardsCommandTests.cs` | 11 |","| `ColumnsCommandTests.cs` | 10 |","| `BoardsCommandTests.cs` | 7 |","| `ConsoleOutputTests.cs` | 7 |","| `CliActorIdentityTests.cs` | 5 |","| `ExitCodesTests.cs` | 4 |","| `CliJsonContractTests.cs` | 4 |","| `CommandDispatcherTests.cs` | 3 |","Harness improvements: `AppContext.BaseDirectory` dll lookup replaces the fragile repo-tree walk, 30-second process timeout via `CancellationTokenSource` prevents hang, `[Collection(\"Console Tests\")]` on `ConsoleOutputTests` for `Console.Out` thread safety when xUnit runs classes in parallel, and `InternalsVisibleTo` on `Taskdeck.Cli` lets `Cli.Tests` unit-test internal types directly.","dotnet test backend/tests/Taskdeck.Cli.Tests/Taskdeck.Cli.Tests.csproj -c Release","### CI Stabilisation Tests","- `#912` (ActivityView Windows flake): `ActivityView.spec.ts` `seedBoards()` now assigns deterministic ordered ISO timestamps so the component's `updatedAt DESC` sort is stable across platforms regardless of `Date` resolution. Verified 10/10 consecutive runs green locally.","- `#913` (FirstRunBootstrapper cross-process race): serialised via named cross-process mutex + atomic rename. Guards the parallel xUnit-process JSON-corruption race that `#911` surfaced.","## Feature/Security Expansion Wave Testing (2026-04-09, PRs `#806`–`#813`)","The feature and security expansion wave (PRs `#806`–`#813`) added ~231+ new tests across 8 PRs. Each PR received two rounds of adversarial review (self + independent cold review); the independent round caught 9 CRITICAL and 11 HIGH issues — all fixed.","New test categories:","- **Calendar endpoint**: 8 backend tests covering date range validation, board-access scoping, overdue/blocked status, empty results","- **Note import**: 38 backend unit tests for markdown section splitting, web clip intake, validation, provenance; 6 frontend API client tests","- **Agent surfaces**: 42 frontend tests across agentStore (15), AgentsView (8), AgentRunsView (8), AgentRunDetailView (11)","- **Telemetry/observability**: 25 backend unit tests (opt-in enforcement, event validation, property allowlist) + 13 backend integration tests (DI, endpoints) + 25 frontend tests (consent, store buffering, API)","- **OAuth PKCE/account linking**: 24+ backend tests covering DB-backed auth codes, atomic consumption, PKCE, account linking conflicts","- **SSO/OIDC/MFA**: 30+ backend tests covering TOTP validation, email collision, cross-provider isolation, username deduplication, MFA policy, recovery codes","- **Staged deployment**: smoke test script with 9 automated checks (health, API, auth, frontend, SignalR, static assets, security headers, container restart)","Storybook (non-test tooling): `npm run storybook` runs 17 Td* primitive stories; `npm run storybook:build` produces static output.","## Supplementary Test Depth Wave (2026-04-13, PRs `#821`–`#826`)","~429 new tests across 6 PRs. Each PR received two rounds of adversarial review (self-review + independent cold review). Key review findings and fixes:","### Concurrency and Race Condition Stress Tests (`#705`/`#825`)","22 backend tests across 7 files in `backend/tests/Taskdeck.Api.Tests/Concurrency/`:","- Queue claim races (4): double-claim prevention, stale timestamp, batch processing, two-worker different items","- Card update conflicts (5): concurrent moves, stale-write 409, last-writer-wins, column reorder, concurrent creation","- Proposal approval races (4): double-approve, approve+expire, approve+reject, double-execute","- Webhook delivery concurrency (2), board presence (2), rate limiting (3), cross-user isolation (2)","- Uses `SemaphoreSlim` barriers for true simultaneous execution; SQLite serialization limitations documented","Running:","dotnet test backend/Taskdeck.sln -c Release --filter \"FullyQualifiedName~Concurrency\"","### Frontend Store Integration Tests (`#711`/`#821`)","88 frontend tests across 6 files in `frontend/taskdeck-web/src/tests/store/`:","- chatApi integration (22), boardStore column reorder/conflict (11), queueStore polling (12)","- sessionStore OIDC/SSO (14), notificationStore realtime (15), workspaceStore mode persistence (14)","- Mocks HTTP layer (not API modules) to test full store → API → HTTP chain","### E2E Scenario Expansion (`#712`/`#822`)","20 Playwright scenarios across 5 spec files:","- `onboarding.spec.ts` (5): fresh user empty states, setup dialog, starter pack structure","- `review-proposals.spec.ts` (3): board-scoped filtering, multiple proposals, show completed toggle","- `capture-edge-cases.spec.ts` (4): empty/whitespace rejection, Escape dismiss, board-linked capture","- `keyboard-navigation.spec.ts` (4): keyboard board creation, command palette arrows, `?` help toggle","- `dark-mode.spec.ts` (4): persistence across views, toggle-off restore, system `prefers-color-scheme`","### Frontend View and Component Coverage (`#716`/`#826`)","107 tests across 8 files covering previously untested views and components:","- ArchiveView (11), MetricsView (16), BoardView (12), ReviewView (10)","- AutomationChatView (16), CardItem (21), BoardCanvas (12), BoardActionRail (9)","### Property-Based and Adversarial Input Tests (`#717`/`#824`)","162 tests across 8 files:","- Domain property tests (93): ChatSession, ChatMessage, Notification, KnowledgeDocument, WebhookSubscription","- Application fuzz tests (19): JSON round-trip for chat/notification DTOs with adversarial content","- API adversarial tests (50): raw JSON with float/overflow positions, XSS/injection payloads, unicode blocks, extra unknown fields","### Resilience and Degraded-Mode Tests (`#720`/`#823`)","30 tests across 3 files:","- LLM provider resilience (13): garbage/empty/429/timeout for OpenAI/Gemini, probe unhealthy","- Queue accumulation resilience (3): accumulation without corruption, rapid concurrent captures","- Frontend slow-API/storage resilience (14): loading states, throttle dedup, corrupted localStorage/token","## Post-Merge Batch Testing Notes (2026-04-12)","After batch-merging PRs `#800`, `#805`, `#811`, `#813`, `#815`, `#819`, `#820`, the following additional test categories are now on `main`:","### Resilience and Degraded-Mode Tests (`#720`/`#820`)","34 tests (18 backend + 16 frontend) covering:","- Backend: ChatService LLM provider failure/fallback, worker crash/retry/cancellation/max-retries","- Frontend: store error states, SignalR reconnect polling fallback","### MFA/OIDC Security Tests (`#82`/`#813`)","30+ backend tests covering TOTP validation, OIDC provider isolation, email collision prevention, username deduplication, MFA policy enforcement, and recovery code lifecycle.","Running MFA/OIDC tests:","dotnet test backend/Taskdeck.sln -c Release --filter \"FullyQualifiedName~Mfa\"","dotnet test backend/Taskdeck.sln -c Release --filter \"FullyQualifiedName~Oidc\"","### Telemetry and Analytics Tests (`#549`/`#811`)","63 tests (38 backend + 25 frontend):","- Backend: opt-in enforcement, event property validation against allowlist, value truncation, TelemetryController endpoints","- Frontend: consent management, DNT/GPC detection, store event buffering/flush, analytics script injection","### Distributed Cache Tests (`#85`/`#805`)","32 backend tests covering `ICacheService` implementations (InMemory sweep/cap, Redis reconnect/degradation, NoOp pass-through), board list cache-aside with TTL and write-through invalidation.","### OAuth Token Lifecycle Tests (`#723`/`#815`)","19+ integration tests covering DB-backed auth code store (valid exchange, expiry, replay prevention, concurrent atomicity, cleanup), JWT lifecycle (expiry, wrong key, garbage token, deactivated user), and SignalR query-string auth.","### MCP HTTP Transport Tests (`#654`/`#819`)","49 tests (11 domain + 38 integration) covering the API key entity (`tdsk_` prefix, SHA-256 hashing), real Streamable HTTP initialize/session/resource traffic at `/mcp`, missing/invalid/expired/revoked/valid Bearer keys, root-route exclusion, cross-user board isolation, correlation-matched telemetry, pre-authentication IP throttling, literal per-key partitioning, explicit no-CORS preflight behavior, all ASP.NET any-host forms, standalone loopback defaults, and REST key management.","Focused gate:","dotnet test backend/tests/Taskdeck.Api.Tests/Taskdeck.Api.Tests.csproj -c Release -m:1 --filter \"FullyQualifiedName~McpHttpTransportApiKeyTests\"","The standalone runtime proof also starts the normal API and `--mcp --transport http` against one throwaway SQLite database, creates a user/board/key through REST, then verifies `401 / 200 / 202 / 200` for missing-key, initialize, initialized notification, and `taskdeck://boards`, plus `404` at `/`. The security repair probe starts standalone with `AllowedHosts=localhost;*` and a one-request authentication window, proving hostile Host `400`, then missing-key `401`, repeated-attempt `429`, and root `404`. On Windows PowerShell 5.1, capture non-2xx status from `WebException.Response`; `Invoke-WebRequest -SkipHttpErrorCheck` is PowerShell 7-only.","## E2E Parallelization (TST-60, `#867`/`#949`)","Playwright E2E suite runs in parallel (`fullyParallel: true`) with 2-worker default for both local and CI runs. Worker count is overridable via `TASKDECK_E2E_WORKERS` environment variable.","Per-test isolation is built into the data layer: `registerUserSession` provisions a unique user per test with `Date.now() + random` suffixes; board/column/card names follow the same pattern; data is scoped server-side by authenticated user.","SQLite connection string uses `Pooling=True;Default Timeout=30` for E2E runs. `Cache=Shared` was intentionally removed (increases contention vs default private-cache mode). WAL mode (`PRAGMA journal_mode=WAL`) is documented as future work for genuine concurrent-read throughput.","Key test patterns for parallel safety:","- Use idempotent Playwright actions (`.check()` instead of `.click()`) when the dependent DOM element is `v-if`-gated on the control's reactive state","- UI tests touching controls whose sibling DOM is conditionally gated should wait for the dependent element, not the control itself","## Platform Expansion Testing Capabilities (2026-04-09)","The platform expansion wave (PRs `#796`–`#805`) delivered four new testing capabilities:","### Cross-Browser and Mobile E2E Matrix (TST-02, `#87`/`#800`)","Playwright config expanded with 5 projects: `chromium` (all tests), `firefox`/`webkit` (`@cross-browser` only), `mobile-chrome` Pixel 7/`mobile-safari` iPhone 14 (`@mobile` only). Global `@quarantine` tag exclusion.","Run commands:","cd frontend/taskdeck-web","npx playwright test --project=chromium # PR gate (default)","npx playwright test --project=firefox # Firefox cross-browser","npx playwright test --grep @mobile # All mobile tests","npx playwright test # Full matrix (nightly)","Tagging convention: `@smoke` (quick CI), `@cross-browser` (multi-browser), `@mobile` (viewport), `@quarantine` (flaky, excluded). See `docs/testing/FLAKY_TEST_POLICY.md`.","CI: `reusable-e2e-cross-browser.yml` in nightly + extended (testing label/manual). PR gate stays Chromium-only.","### Visual Regression Testing (TST-03, `#88`/`#797`)","Playwright `toHaveScreenshot()` with dedicated config: 1280x720 viewport, animations disabled, 0.5% pixel tolerance, light color scheme.","npx playwright test --config playwright.visual.config.ts # Run visual tests","npx playwright test --config playwright.visual.config.ts --update-snapshots # Update baselines","20 visual tests (expanded from 7 in TST-59, `#865`/`#948`): board (empty + populated), command palette (open + search), archive, inbox, home, login, register, today, calendar (clock-pinned), metrics, review, notifications, settings, card modal (timestamp-masked), column edit modal (timestamp-masked), board toolbar, capture/inbox views. Clock pinning via `page.clock.install()` for date-dependent views; `document.fonts.ready` wait for font-load determinism; dynamic content hidden via `data-testid=\"timestamp\"` + `hideDynamicContent` helper. Policy at `docs/testing/VISUAL_REGRESSION_POLICY.md`.","CI: `reusable-visual-regression.yml` in extended CI (testing/visual label). Uploads diff artifacts on failure. Baseline bootstrap: CI detects missing `__screenshots__/` directory, runs `--update-snapshots`, and uploads the `visual-regression-baselines` artifact for committing in a follow-up PR.","### Mutation Testing (TST-05, `#90`/`#796`)","Backend (Stryker.NET): targets `Taskdeck.Domain` with `Taskdeck.Domain.Tests`. Thresholds: break=60, high=80.","Frontend (Stryker JS): targets `captureStore`, `boardStore`, and `board/*.ts` submodules with vitest runner.","# Backend","cd backend && dotnet tool install dotnet-stryker && dotnet stryker","# Frontend","cd frontend/taskdeck-web && npm run mutation:test","CI: `mutation-testing.yml` runs weekly (Sunday 04:00 UTC) + manual dispatch. Non-blocking, reports uploaded as artifacts. Policy at `docs/testing/MUTATION_TESTING_POLICY.md`.","### Container Integration Tests (TST-06, `#91`/`#804`)","New `Taskdeck.Integration.Tests` project using `Testcontainers.PostgreSql` for ephemeral database isolation. Each test method gets a fresh PostgreSQL database. Requires Docker.","# Run all (skips gracefully without Docker)","dotnet test backend/tests/Taskdeck.Integration.Tests -c Release","# Run alongside main suite (integration tests auto-skip without Docker)","dotnet test backend/Taskdeck.sln -c Release -m:1","20 integration tests: Board CRUD, Card operations, Proposal lifecycle, cross-class isolation, parallel execution. Guide at `docs/testing/TESTCONTAINERS_GUIDE.md`.","CI: `reusable-container-integration.yml` in extended CI (testing label).","## Product-Coherence Testing Priorities (2026-03-07)","Testing priorities have shifted from \"does the harness exist?\" toward \"does the product remain understandable under change?\"","Near-horizon priorities:","- protect the current golden path: capture -> triage -> review -> execute -> board","- keep the deterministic first-run Playwright guardrail aligned to the shipped `Home -> capture -> review -> execute -> board` loop (`#328`, delivered)","- add explicit coverage for action-oriented empty states and board-centered context travel as those surfaces land","- keep stakeholder/demo recording opt-in; it supports product evidence, but it is not the primary product smoke","High-signal additions and delivered guardrails:","- `Home` view state coverage","- `Today` view state coverage","- workspace mode navigation rendering","- proposal summary card coverage","- board action rail coverage","- first-run golden-path Playwright smoke coverage, now delivered as the required regression guardrail in `#328`","Telemetry and release-gate follow-through from the expanded blueprint:","- product telemetry/event taxonomy documented in `#341`/`#741` — see `docs/product/TELEMETRY_TAXONOMY.md` (taxonomy spec, not shipped instrumentation); reuses `#77` as baseline; `#328` provides the delivered first-run guardrail","- keep event names privacy-safe and product-shaped using the canonical `noun.verb` format from `docs/product/TELEMETRY_TAXONOMY.md` (for example `capture.modal_opened`, `capture.submitted`, `proposal.approved`, `proposal.rejected`, `card.created`, `board.loaded`, `auth_session.started`, `agent_run.completed`, `agent_run.failed`)","- treat launch framing as evidence gates, not marketing labels:"," - `R1` novice-first beta -> coherent `Home -> capture -> review -> execute -> board` path"," - `R2` agent foundation alpha -> inspectable runs, policies, and bounded templates"," - `R3` knowledge/integrations alpha -> durable searchable context plus supervised connector flows","## Codex Coverage Wave (TST-CODEX-01 to TST-CODEX-15, delivered 2026-03-28)","A dedicated test-coverage wave designed for token-efficient agents (Codex, lightweight LLM runners). Each task is self-contained with pattern files, source paths, and verify commands in `docs/codex-tasks/`.","Tracked issues: `#415` to `#429`. PRs: `#436` to `#448`. All delivered and merged 2026-03-28 after adversarial review pass with fixes for tautological assertions, missing guard branches, and edge-case gaps.","| Tier | Tasks | Scope | Issues |","|------|-------|-------|--------|","| 1 — Frontend API | labelsApi, columnsApi, usersApi | Mock HTTP, verify URL/payload | `#415`-`#417` |","| 2 — Frontend Composables | useErrorMapper, useEscapeToClose, useShortcutContext | Pure function + lifecycle tests | `#418`-`#420` |","| 3 — Frontend Stores | auditStore, queueStore (real coverage, not demo) | Pinia store with mocked API | `#421`-`#422` |","| 4 — Backend Domain | CardComment, Notification, AutomationProposal, LlmUsageRecord | Entity construction + invariants | `#423`-`#426` |","| 5 — Backend Services | OutboundWebhookSignature (expand), WorkerHeartbeatRegistry, CompositeBoardRealtimeNotifier | Service tests with mocking | `#427`-`#429` |","Remaining coverage gaps (post-wave, now tracked in TST-32 to TST-57 wave `#721`):","- Frontend: 1 API module untested (captureApi), remaining composables/stores have baseline coverage → tracked in `#711`, `#716`","- Backend: Infrastructure repositories partially covered (7 classes, 77 tests in `#699`/`#730`; remaining repos untested); remaining domain entities untested → tracked in `#701`; 1 of 5 workers untested → tracked in `#700`","## LLM Tool-Calling Coverage (PR #669, delivered 2026-04-01)","Tracking issue: `#649` (Phase 1 of `#647`)","New test coverage:","- `ToolCallingChatOrchestratorTests`: multi-turn loop, timeout, max-round enforcement","- `ReadToolSchemasTests`: schema generation for all 5 read tools","- `MockLlmProviderToolCallingTests` / `MockToolCallDispatcherTests` / `MockToolResultsTests`: mock provider tool-calling dispatch and result formatting","- `OpenAiToolCallingParseTests` / `GeminiToolCallingParseTests`: provider-specific tool-call response parsing","Manual validation recommended: send \"What cards are in my Backlog?\" via chat with Mock provider and verify dynamic tool-calling response.","## MCP Server Coverage (PR #664, delivered 2026-04-01)","Tracking issue: `#652` (Phase 1 of `#648`)","- `McpBoardResourcesTests`: `taskdeck://boards` resource listing, phantom-user fallback, multi-user board scoping","Manual validation recommended: configure `mcp.example.json` in Claude Code / Cursor and ask \"What boards do I have?\" to verify resource delivery.","## GDPR Data Portability Coverage (PR #666, delivered 2026-04-01)","Tracking issue: `#83`","- `DataExportServiceTests` (10 tests): user-scoped data export completeness, versioned payload shape, cross-user isolation","- `AccountDeletionServiceTests` (15 tests): password re-auth, confirmation phrase enforcement, PII anonymization, audit ref cleanup, deactivated-user login rejection","## Board Metrics Coverage (PR #667, delivered 2026-04-01)","Tracking issue: `#77`","- `BoardMetricsServiceTests` (12 backend tests): board-scoped metric aggregation, date range filtering, label grouping","- `metricsApi.spec.ts` (4 frontend tests): API client mock verification","## GitHub OAuth Frontend Coverage (PR #668, delivered 2026-04-01)","Tracking issue: `#539`","- `authApi.spec.ts` (3 tests): `getProviders` and `exchangeOAuthCode` API calls","- `sessionStore.spec.ts` (2 tests): OAuth code exchange store action","## Rigorous Test Expansion Wave (TST-32 to TST-57, seeded 2026-04-03)","Tracker issue: `#721`. Seeded from a systematic codebase audit across backend, frontend, and cross-cutting integration boundaries.","Security finding during audit: `#722` (SEC-20) — `ChangePassword` endpoint does not verify caller identity. **RESOLVED** in `#732` (2026-04-04).","### Wave Scope","22 issues spanning integration tests, edge cases, adversarial inputs, failure modes, and cross-user data isolation. Focus is on integration seams (where services interact) rather than adding more isolated unit tests.","| Priority | Issues | Theme | Status |","|----------|--------|-------|--------|","| I | ~~`#703`~~ | Capture → triage → proposal → review → board end-to-end golden path | **Delivered** (`#735`) |","| II | ~~`#699`~~, ~~`#700`~~, ~~`#702`~~, ~~`#704`~~, ~~`#705`~~, ~~`#707`~~, ~~`#723`~~, ~~`#725`~~ | Infrastructure repos, worker, controller gaps, data isolation, concurrency, auth, OAuth, frontend HTTP interceptor | **8 of 8 delivered** |","| III | ~~`#701`~~, ~~`#706`~~, ~~`#708`~~, ~~`#709`~~, ~~`#710`~~, ~~`#711`~~, ~~`#712`~~, ~~`#713`~~, ~~`#714`~~, ~~`#715`~~, ~~`#716`~~, ~~`#718`~~, ~~`#719`~~, ~~`#720`~~, ~~`#726`~~ | Domain state machines, SignalR, proposal lifecycle, LLM tool-calling, webhooks, frontend stores/views, export/import, error contracts, archive, metrics, notifications, resilience | **15 of 15 delivered** |","| IV | ~~`#717`~~ | Property-based and adversarial input tests (extends `#89`) | **Delivered** (`#789`) |","**Wave progress**: 25 of 25 issues delivered (plus SEC-20 fix). ~1350+ new tests across six delivery waves. **Wave complete.** Final deliveries: concurrency stress tests (`#705`/`#793` — 13 tests), property-based adversarial tests (`#717`/`#789` — 211 tests).","### Key Gaps Identified (updated 2026-04-04)","- ~~**Infrastructure repositories**~~: 7 classes now have 77 integration tests (`#699`/`#730`); remaining repositories still untested","- ~~**`LlmQueueToProposalWorker`**~~: **RESOLVED** — 24 integration tests delivered (`#700`/`#734`) covering happy path, error/retry, cancellation, fair-batch, and capture triage paths","- ~~**Cross-user data isolation**~~: **RESOLVED** — 38 integration tests delivered (`#704`/`#733`) covering all major API boundaries; 3 false-positive tests caught and fixed in adversarial review","- ~~**Frontend HTTP interceptor and router auth guard**~~: **RESOLVED** — 33 tests delivered (`#725`/`#765`): 19 HTTP interceptor tests + 14 router integration tests","- ~~**Golden path**~~: **RESOLVED** — 7 integration tests delivered (`#703`/`#735`) proving full capture → triage → proposal → review → board pipeline","- ~~**Domain entity state machines**~~: **RESOLVED** — 174 exhaustive tests delivered (`#701`/`#740`) covering CommandRun, ArchiveItem, ChatSession, UserPreference, NotificationPreference, CardLabel, CardCommentMention","- ~~**SignalR hub integration**~~: **RESOLVED** — 19 integration tests delivered (`#706`/`#751`) covering auth, presence, multi-user, authorization, and edge cases","- ~~**LLM tool-calling edge cases**~~: **RESOLVED** — 101 tests delivered (`#709`/`#747`) for orchestrator, provider abstraction, intent classifier, and tool executor registry","- ~~**Export/import integrity**~~: **RESOLVED** — 64 round-trip tests delivered (`#713`/`#752`) covering JSON, CSV, GDPR, database, and cross-format validation","- ~~**API error contract regression**~~: **RESOLVED** — 57 tests delivered (`#714`/`#753`) verifying GP-03 error contract across 7 endpoint families","- ~~**Archive lifecycle**~~: **RESOLVED** — 74 tests delivered (`#715`/`#755`): 45 domain state machine + 29 API integration covering cross-user isolation, conflict detection, audit trail","- ~~**Board metrics accuracy**~~: **RESOLVED** — 61 tests delivered (`#718`/`#749`): 51 service + 10 controller covering throughput, cycle time, WIP, blocked cards, done-column heuristic","- ~~**Notification delivery**~~: **RESOLVED** — 36 tests delivered (`#719`/`#746`) covering all 5 types, deduplication, preference filtering, cross-user isolation, batch operations","- ~~**Webhook HMAC signature verification**~~: **RESOLVED** — 11 tests delivered (`#726`/`#750`) covering header format, HMAC round-trip, wrong-key rejection, secret rotation, timing-safe comparison","- ~~**Webhook delivery reliability and SSRF**~~: **RESOLVED** — 78 webhook tests across 9 files delivered (`#710`/`#756`) covering retry/backoff, dead-letter, SSRF boundary conditions (private IPv4/IPv6 ranges via `OutboundWebhookEndpointGuardTests`)","## Mutation Testing Pilot (TST-05, `#90`)","Mutation testing is available as a non-blocking quality signal for detecting weak assertions and test gaps.","### Scope","- **Backend**: Stryker.NET targeting `Taskdeck.Domain` (entity state machines, validation, business rules)","- **Frontend**: Stryker JS targeting `captureStore.ts`, `boardStore.ts`, and `board/*.ts` submodules (core data flow stores)","### Running locally","# Backend (requires dotnet-stryker global tool)","cd backend","dotnet stryker --config-file stryker-config.json","npm run mutation:test","### CI","Weekly workflow (Sunday 04:00 UTC) + manual dispatch via `.github/workflows/mutation-testing.yml`. Reports uploaded as artifacts.","### Policy and triage","See `docs/testing/MUTATION_TESTING_POLICY.md` for threshold strategy, report interpretation, and follow-up process.","### Relationship to Existing Test Issues","- Extends `#254` (testing harness improvement wave, delivered)","- Extends `#89` (property/fuzz pilot, delivered)","- Complements `#90` (mutation testing pilot)","- Complements `#91` (Testcontainers for isolation)","- Feeds into `#135` (integrated multi-component verification program) — **delivered** as `docs/testing/INTEGRATED_VERIFICATION_STRATEGY.md`","### Delivered: Infrastructure Repository Integration Tests (`#699`/`#730`)","First delivery from the rigorous test expansion wave. 77 integration tests across 7 repository classes running against real SQLite (not mocks or in-memory substitutes).","Pattern:","- Each test class creates a fresh SQLite database via `DbContextOptionsBuilder` with a unique filename","- Tests exercise actual EF Core queries, GUID formatting, ordering, pagination, and filtering against real SQLite behavior","- Database is cleaned up after each test run","Key findings:","- Found and fixed a real `LlmQueueRepository` ordering bug where queue items were not returned in the expected FIFO order","- Confirmed correct behavior for raw SQL queries, in-memory pagination edge cases, and GUID string formatting across repositories","Coverage:","- 7 repository classes tested (including `LlmQueueRepository`, `BoardRepository`, `CardRepository`, and others)","- Tests validate query correctness, cross-user isolation, empty-result handling, and ordering guarantees","This establishes the pattern for testing remaining infrastructure repositories tracked in the wave (`#721`).","### Delivered: SEC-20 ChangePassword Identity Bypass Fix (`#722`/`#732`)","Security fix: `ChangePassword` endpoint now derives userId exclusively from JWT claims instead of accepting client-supplied `UserId`. 5 new integration tests (unauthenticated 401, own-account success, wrong password, cross-user body-UserId ignored, invalid token).","### Delivered: Golden-Path Integration Test (`#703`/`#735`)","7 integration tests exercising the full capture → triage → proposal → review → board pipeline against real SQLite with Mock LLM provider:","- Happy path: single capture → proposal → approve → card on board with correct title and column placement","- Multi-operation: 3 checklist items → proposal with 3 operations → 3 cards created atomically","- Rejection: proposal rejected → board remains empty","- Cross-user isolation: User B cannot read/approve/execute User A's proposal","- Audit trail: card creation via proposal recorded in board audit log","- Provenance integrity: full backward-traceable chain (capture → proposal → card) at DB level","- Triage failure: capture without board fails deterministically","### Delivered: Cross-User Data Isolation Tests (`#704`/`#733`)","38 integration tests proving cross-user isolation across all major API boundaries:","- Boards, columns, cards, captures, proposals, notifications, audit trails, chat sessions, knowledge docs, webhooks, board exports, labels, board access controls","- 3 shared-board tests (grant, scope limitation, revocation)","- Adversarial review caught 3 false-positive tests (LlmQueue never seeded, notifications never created, mark-notification used fabricated GUID) and missing precondition assertions","### Delivered: LlmQueueToProposalWorker Integration Tests (`#700`/`#734`)","24 tests for the central background worker (previously zero coverage):","- Happy path, empty queue, transient error retry, max-retry boundary, permanent failure","- Unhandled exceptions, already-claimed items, capture triage paths, disabled processing","- Graceful cancellation, `BuildFairBatchItems` logic, retry backoff, multi-item batch","- Adversarial review fixed: fake repository ignoring status transitions, misleading race-condition test, weak interleaving assertions, premature ServiceProvider disposal","### Delivered: Controller HTTP Integration Tests (`#702`/`#738`)","67 tests covering 6 previously-untested controllers + 17 new authz regression matrix entries:","- DataPortabilityApiTests (8), AbuseContainmentApiTests (12), MetricsApiTests (7), SearchApiTests (6), AgentProfilesApiTests (10), AgentRunsApiTests (7)","- Discovered 2 pre-existing bugs: `GET /api/agents` and `GET /api/agents/{id}/runs` return 500","- Adversarial review fixed: weak `NotBe(OK)` assertions, resource leak, leaked file from another branch","### Delivered: Proposal Lifecycle Edge Cases (`#708`/`#736`)","74 tests across domain (42), application (25), and api (7) layers:","- Expiry timing boundaries, double-apply/fail prevention, comprehensive state machine violations","- Batch expiry, worker-vs-manual-approval race, dismissal edge cases, operation mutation guards","- Adversarial review fixed: clock-resolution flakiness (`AddMilliseconds` → `AddSeconds`), string-based Theory refactoring risk, aggressive cancellation timeout; added 5 new edge case tests","### Delivered: OAuth/Auth Edge Case Tests (`#707`/`#737`)","44 tests across service (31) and controller (13) layers:","- Login edge cases (blank creds, inactive user, wrong password, concurrent JWT uniqueness)","- Registration edge cases (duplicate email, invalid lengths)","- Token validation (malformed, wrong key, expired, future nbf, wrong issuer/audience, missing sub, deleted/inactive user)","- OAuth code exchange (empty, invalid, replay, expired), open redirect prevention","- **Production bug found and fixed**: `ExternalLoginAsync` `Substring(0, 50)` overflow for short usernames","### Delivered: MCP Full Resource and Tool Inventory (`#653`/`#739`)","42 MCP-specific tests for the full inventory:","- 9 resources under `taskdeck://` URI scheme","- 11 tools (2 read + 6 write + 3 proposal management)","- GP-06 compliance verified: all write tools produce proposals, `approve_proposal` excluded","- **User-scoping gap found and fixed in adversarial review**: proposal resources/tools were not checking `RequestedByUserId`","### Delivered: Domain Entity State Machine Exhaustive Tests (`#701`/`#740`)","174 tests across 7 entity test classes:","- **CommandRun** (68 tests): all 6 states × 5 transitions (valid + invalid), constructor validation, `SetOutputPreview` boundary (1000 chars), `SetTruncated` idempotency, `AddLog`, Touch verification","- **ArchiveItem** (41 tests): all 4 states × 4 transitions, constructor validation (entityType, name length 200, Guid.Empty, empty snapshot), round-trip flows","- **ChatSession** (22 tests): Active/Archived lifecycle, AddMessage blocked on archived, UpdateTitle validation","- **UserPreference** (18 tests): DismissOnboarding/ReplayOnboarding, RecordOnboardingCompletion once-only guard, UpdateWorkspaceMode","- **NotificationPreference** (7 tests): constructor validation, Update permutations","- **CardLabel** (4 tests): join entity construction","- **CardCommentMention** (6 tests): constructor validation, username length boundary (50 chars)","- Two rounds of adversarial review fixed misleading test name and leftover unused variable","### Delivered: SignalR Hub and Realtime Integration Tests (`#706`/`#751`)","19 integration tests using WebApplicationFactory with SignalR test client:","- Authentication (3): unauthenticated rejection, valid/invalid token","- Presence lifecycle (5): join broadcast, set/clear editing, leave cleanup, abrupt disconnect","- Multi-user (2): multiple users see all members, same-user two-connection aggregation","- Authorization (3): join/leave/editing without board access rejected","- Edge cases (6): board switching, two-tab disconnect, non-existent board, Guid.Empty, timestamps, cross-board isolation","- Adversarial review fixed false-positive auth tests (bare Exception → HttpRequestException+401), silent timeout, resource leak, missing status assertions","### Delivered: LLM Provider and Tool-Calling Edge Cases (`#709`/`#747`)","101 tests across 4 test classes:","- **ToolCallingChatOrchestratorEdgeCaseTests** (18): per-round timeout, empty tool calls, concurrent calls, cancellation, metadata, token accumulation, loop detection (added in review)","- **LlmProviderAbstractionEdgeCaseTests** (24): default CompleteWithToolsAsync throws, MockLlmProvider edge cases, provider selection, kill switch","- **LlmIntentClassifierEdgeCaseTests** (49): negation filtering, other-tool questions, positive intent, non-actionable, prompt injection, disambiguation, plurals, alternate verbs","- **ToolExecutorRegistryEdgeCaseTests** (10): empty registry, case-insensitive lookup, duplicate/null registration (added in review)","- Adversarial review fixed false-positive prompt injection test, replaced 30-second slow test, added loop detection and registry edge cases","### Delivered: Data Export/Import Round-Trip Integrity Tests (`#713`/`#752`)","64 tests across 5 test files:","- **BoardJsonExportImport** (23): full round-trip, special characters, 100-card scale, empty boards, WIP limits, cross-user isolation, corrupt JSON, duplicate labels","- **CsvImport** (23): RFC 4180 edge cases, BOM, CRLF, deduplication, 1000-row scale, missing fields, invalid dates","- **GdprDataExport** (9): valid parseable JSON, empty user, field preservation, cross-user isolation, version/timestamp","- **DatabaseExportImport** (21): byte-level round-trip, corrupted/truncated rejection, SQLite signature validation, oversized payload","- **CrossFormatImport** (11): format mismatch detection, binary garbage, wrong JSON shapes","- Adversarial review fixed weak DueDate assertion, brittle JSON substring checks, non-deterministic test branching","### Delivered: API Error Contract Regression Tests (`#714`/`#753`)","57 tests across 7 test files in `ErrorContract/` namespace:","- **Board** (9), **Card** (10), **Column** (11), **Capture** (8), **Proposal** (7), **Label** (4), **ContentType/Format** (7)","- All error assertions through `ApiTestHarness.AssertErrorContractAsync` validating GP-03 `{errorCode, message}` shape","- Adversarial review fixed 12 weak 404 assertions missing errorCode, 2 false-positive GP-03 tests, non-deterministic unauthenticated test, misleading test name","### Delivered: Archive and Restore Lifecycle Tests (`#715`/`#755`)","74 tests across domain (45) and API integration (29):","- **Domain** (45): all valid/invalid ArchiveItem transitions, full lifecycle sequences, Touch timestamp updates, constructor validation boundaries","- **API** (29): board/card/column archive-restore cycles, cross-user isolation (3 tests), double-archive/restore handling (409), conflict detection (Rename/Fail strategies), snapshot integrity, audit trail, restore to non-existent/archived boards, filter by type/status/board, auth enforcement","- Adversarial review fixed 2 false-positive tests missing key assertions, 1 missing position check, 2 weak assertions pinned to specific status codes","### Delivered: Board Metrics Accuracy Verification Tests (`#718`/`#749`)","61 tests across service (51) and controller (10):","- Done column detection (14): named patterns, case-insensitivity, positional fallback, multiple done-like columns","- Throughput (6): card counting, bounce, same-day grouping, non-done exclusion","- Cycle time (8): exact calculation, multi-column paths, averages, in-progress exclusion, zero cycle time","- WIP (4): per-column counts, position ordering, WIP limits","- Blocked cards (5): sort by duration, reasons, unblocked exclusion","- Controller (10): from-after-to validation, label filter, response structure, date range handling","- Adversarial review fixed misleading test name, vacuous sort assertion, silent reflection failure, naming convention","### Delivered: Notification Delivery Integration Tests (`#719`/`#746`)","36 integration tests:","- Delivery (5): all 5 notification types (Mention, Assignment, ProposalOutcome, BoardChange, System)","- Deduplication (4): same-key rejection, different-key allowance, no-key duplicates","- Preference filtering (6): type-level enable/disable, in-app channel kill switch, digest-only, BoardChange always-on","- Cross-user isolation (2): notifications scoped to owner, mark-all-read scoped","- Mark as read (4): basic, idempotent, 404, cross-user forbidden","- Batch (3): count returned, board-scoped, zero unread","- Pagination (4): limit enforcement, unread/board filters, invalid limit","- Auth (5): all endpoints reject unauthenticated","- Adversarial review fixed PascalCase typo, 4 weak assertions tightened, overly generous performance threshold","- Production observation noted: `NotificationRepository.GetByUserIdAsync` materializes all rows before in-memory pagination (tracked separately)","## Backend Commands","Run full backend verification (recommended):","Run project-split backend verification:","dotnet test backend/tests/Taskdeck.Domain.Tests/Taskdeck.Domain.Tests.csproj -c Release","dotnet test backend/tests/Taskdeck.Application.Tests/Taskdeck.Application.Tests.csproj -c Release","dotnet test backend/tests/Taskdeck.Api.Tests/Taskdeck.Api.Tests.csproj -c Release","dotnet test backend/tests/Taskdeck.Architecture.Tests/Taskdeck.Architecture.Tests.csproj -c Release","Note:","- If `Debug` runs fail with file-lock errors, stop running `Taskdeck.Api` processes or use `-c Release`.","- If backend tests unexpectedly bind to a live LLM provider in local Development, force deterministic mock mode before running the suite:"," - PowerShell: `$env:Llm__EnableLiveProviders='false'; $env:Llm__AllowLiveProvidersInDevelopment='false'; $env:Llm__Provider='Mock'; dotnet test backend/Taskdeck.sln -c Release -m:1`","## Container Integration Tests (Testcontainers)","Run container-backed integration tests against ephemeral PostgreSQL (requires Docker):","dotnet test backend/tests/Taskdeck.Integration.Tests/Taskdeck.Integration.Tests.csproj -c Release","Run a specific test class:","dotnet test backend/tests/Taskdeck.Integration.Tests/Taskdeck.Integration.Tests.csproj -c Release --filter \"FullyQualifiedName~BoardCrudIntegrationTests\"","- Docker must be running. Verify with `docker info`.","- First run downloads the `postgres:16-alpine` image (~80MB); subsequent runs use the cached image.","- Tests are parallel-safe: each test class gets its own isolated database within a shared PostgreSQL container.","- See `docs/testing/TESTCONTAINERS_GUIDE.md` for full setup and authoring guide.","## Frontend Unit + Build","npm run lint","npm run test:coverage","npm run typecheck","npm run build","Frontend lint suppression guidance:","- Prefer fixing lint violations over suppressing them.","- Keep suppressions as narrow as possible (`eslint-disable-next-line` with reason).","- Avoid file-wide disables unless absolutely required and documented with a follow-up issue.","Frontend coverage threshold policy:","- Coverage thresholds are enforced via `frontend/taskdeck-web/vitest.config.ts` and are part of the required CI gate.","- Global thresholds protect against broad regressions; per-surface thresholds protect high-signal areas (`src/api`, `src/store`, `src/composables`, `src/utils`, `src/components/board`).","- Ratchet rule: thresholds may stay flat or increase, but must not decrease.","- Threshold breach behavior can be validated locally with an override command, for example:"," - `cd frontend/taskdeck-web && npx vitest run --coverage --coverage.thresholds.lines=99 --coverage.thresholds.statements=99 --coverage.thresholds.functions=99 --coverage.thresholds.branches=99`","Frontend local dev server (manual workflows):","npm run dev","Notes:","- `npm run dev` now auto-resolves frontend port with fallback order `5173` -> `4173` -> `5001` when a port is restricted or unavailable.","- launcher now selects a bindable port first; occupied candidate ports (including existing Taskdeck listeners) are skipped for new Vite processes.","- launcher now applies strict-port startup semantics by default to avoid Vite auto-increment drift.","- explicit overrides remain supported (for example `npm run dev -- --host localhost --port 5001` or `TASKDECK_DEV_PORT=5001 npm run dev`).","- backend Development CORS defaults include localhost fallback ports (`4173`, `5001`) so login/API calls stay aligned when fallback startup is used.","## Frontend E2E","Install browser once:","npx playwright install chromium","Run E2E suite:","npx playwright test --reporter=line","Fallback (force an alternate frontend port):","PowerShell:","$env:TASKDECK_E2E_FRONTEND_PORT='5001'","Bash:","TASKDECK_E2E_FRONTEND_PORT=5001 npx playwright test --reporter=line","Optional E2E env overrides (Playwright config):","- `TASKDECK_E2E_FRONTEND_HOST` (default `localhost`)","- `TASKDECK_E2E_FRONTEND_PORT` (when unset, config auto-probes `5173`, then `4173`, then `5001`)","- `TASKDECK_E2E_FRONTEND_BASE_URL` (default `http://{host}:{port}`; must be `http://` with explicit port and no path/query/hash)","- `TASKDECK_E2E_API_BASE_URL` (default `http://localhost:5000/api`; must be `http://` with explicit port and API path)","- `TASKDECK_E2E_API_CORS_ORIGINS` (comma-separated additional origins merged with defaults: frontend origin plus `http://localhost:5174`; each value is passed to backend process as `Cors__DevelopmentAllowedOrigins__{index}`)","- `TASKDECK_E2E_REUSE_EXISTING_SERVER` (defaults to `true` locally and `false` in CI; full demo runs that inject live-provider backend overrides also switch reuse off by default so the intended backend process is actually launched; set `0` to force fresh backend/frontend startup or `1` to force reuse intentionally)","Override behavior notes:","- backend Playwright `webServer` readiness URL is derived from `TASKDECK_E2E_API_BASE_URL` as `{apiBaseUrl}/boards`","- backend Playwright process startup binds to the same API origin via `ASPNETCORE_URLS`","- backend Playwright startup now forces deterministic mock-provider mode by default; live-provider env is only injected for explicit demo runs (`TASKDECK_RUN_DEMO=1` / director path) when LLM steps are enabled","Troubleshooting note (Windows local environments):","- if Playwright startup fails with `listen EACCES` for the frontend port, keep `TASKDECK_E2E_FRONTEND_PORT` unset so auto-fallback can select the next bindable port.","- when auto-fallback is used, Playwright keeps runner/worker aligned by storing the first resolved fallback port in-process (`TASKDECK_E2E_RESOLVED_FRONTEND_PORT`) so worker-side config evaluation does not drift to a different fallback port after the frontend webServer starts.","- local reuse mode prefers identity-verified listeners; CI mode prefers bindable ports for first resolution.","- `TASKDECK_E2E_API_CORS_ORIGINS` is only needed for origins *beyond* the frontend origin (which is already included automatically by `resolveBackendCorsOrigins`). Setting `TASKDECK_E2E_FRONTEND_PORT` alone is sufficient -- the resulting frontend origin is added to the CORS allow-list automatically.","- investigation details and reproduction commands are documented in `docs/analysis/2026-02-25_frontend-gate-port-bind-and-cors-blockers.md`.","Run concurrency harness spec only:","npm run test:e2e:concurrency","Opt-in live-provider check (headed-friendly):","$env:TASKDECK_RUN_LIVE_LLM_TESTS='1'","npx playwright test tests/e2e/live-llm.spec.ts --headed --reporter=line","Headed manual-audit pack:","npm run test:e2e:audit:headed","## Cross-Browser and Mobile E2E Testing","### Browser Projects","The Playwright config defines five projects:","| Project | Device Descriptor | When It Runs |","|---------|------------------|--------------|","| `chromium` | Desktop Chrome | Every PR (ci-required), nightly, manual |","| `firefox` | Desktop Firefox | Nightly, manual dispatch, `testing` label |","| `webkit` | Desktop Safari | Nightly, manual dispatch, `testing` label |","| `mobile-chrome` | Pixel 7 | Nightly, manual dispatch, `testing` label |","| `mobile-safari` | iPhone 14 | Nightly, manual dispatch, `testing` label |","### Test Tagging","Tests use tag annotations in their title strings to control which projects run them:","- **(no tag)** or `@smoke` — runs on chromium only (PR gate default)","- `@cross-browser` — runs on chromium, firefox, and webkit","- `@mobile` — runs on mobile-chrome and mobile-safari only","- `@quarantine` — excluded from all CI (see `docs/testing/FLAKY_TEST_POLICY.md`)","### Running Cross-Browser Tests Locally","Install all browsers (one-time):","npx playwright install --with-deps","Run a specific project:","npx playwright test --project=firefox --reporter=line","npx playwright test --project=mobile-safari --reporter=line","Run all projects:","Run only cross-browser tagged tests across all desktop browsers:","npx playwright test --grep=\"@cross-browser\" --reporter=line","Run only mobile tests:","npx playwright test --grep=\"@mobile\" --reporter=line","### CI Configuration","- **PR gate** (`ci-required.yml`): calls `reusable-e2e-smoke.yml` which installs and runs chromium only. This keeps PR feedback fast (~12 min timeout).","- **Nightly** (`ci-nightly.yml`): calls `reusable-e2e-cross-browser.yml` which runs all 5 projects in a matrix with `fail-fast: false`.","- **Extended/manual** (`ci-extended.yml`): calls `reusable-e2e-cross-browser.yml` on `testing` label or manual dispatch.","### Writing New E2E Tests","1. **Default tests** (no tag): run on chromium in PR gate. Use for most new tests.","2. **Critical journeys** that must work cross-browser: add `@cross-browser` tag. These will also run on chromium in PR gate.","3. **Mobile-specific behavior** (viewport responsiveness, touch targets, overflow): add `@mobile` tag. These only run on mobile projects.","4. **Flaky or unstable tests**: add `@quarantine` tag and file an issue. See `docs/testing/FLAKY_TEST_POLICY.md`.","### Flaky Test Policy","See `docs/testing/FLAKY_TEST_POLICY.md` for the full quarantine/remediation process, SLA timelines, and prevention guidelines.","## Visual Regression Tests","Visual regression tests capture baseline screenshots of key UI surfaces and compare them against future renders to catch unintended layout changes.","**Policy document**: `docs/testing/VISUAL_REGRESSION_POLICY.md` (thresholds, false-positive mitigation, baseline management)","**Test location**: `frontend/taskdeck-web/tests/visual/`","**Config**: `frontend/taskdeck-web/playwright.visual.config.ts`","**Covered surfaces**: board view (empty + populated), command palette (open + search), archive view, inbox/capture view, home view","Run visual tests:","npm run test:visual","Update baselines after intentional UI changes:","npm run test:visual:update","Key settings: fixed viewport 1280x720, animations disabled, 0.5% pixel tolerance, platform-specific baselines (CI canonical platform: ubuntu-latest).","CI integration: runs in CI Extended pipeline with `testing` or `visual` PR labels. Diff artifacts uploaded on failure for review.","## Demo Tooling Policy","Default CI posture:","- Required Playwright regression lanes explicitly set `TASKDECK_RUN_DEMO=0`; the stakeholder recorder is never part of required CI.","- Load/concurrency Playwright coverage also keeps demo recording off by default so those lanes stay focused on product/runtime regressions.","- The deterministic demo regression command is `npm run demo:director:smoke`.","- Demo tooling remains supporting evidence for seeded workflows; it does not replace the required product smoke path.","Run the smoke path locally:","npm run demo:director:smoke","Policy notes:","- `demo:director:smoke` runs `engineering-sprint` with `--skip-llm`, zero autopilot turns, a fixed RNG seed, a stable artifact directory (`demo-artifacts/ci-smoke`), an isolated smoke DB (`taskdeck.demo.ci.db`), and fresh backend/frontend startup.","- when fresh-server mode cannot bind `http://localhost:5000/api`, the director automatically selects a free local API port; if explicit overrides still conflict, it prints a remediation hint for `TASKDECK_E2E_API_BASE_URL` / `TASKDECK_E2E_FRONTEND_PORT`.","- `ci-extended.yml` exposes a matching `demo-director-smoke` lane for explicit validation through `workflow_dispatch` or a PR labeled `automation` when the PR touches `.github/workflows/**`, `backend/**`, `frontend/**`, `deploy/**`, or `scripts/**`.","- `npm run demo:seed` is expected to be rerun-safe on the canonical demo account: seeded captures, queue examples, chat evidence, comments, and Ops logs should be reused when present instead of multiplying on every local/manual regression run.","- `demo:director` validates its own options before Playwright passthrough; keep director flags before `--` and pass raw Playwright arguments only after `--`.","- Full stakeholder walkthrough recording remains manual/headed via `TASKDECK_RUN_DEMO=1`.","- opt-in live-provider chat verification is now separate from demo mode: use `TASKDECK_RUN_LIVE_LLM_TESTS=1` when you want a real-provider probe without running the full stakeholder demo flow.","## Saul-Facing Rehearsal Contract","Canonical operator contract:","- `docs/product/SAUL_DEMO_REHEARSAL_CONTRACT.md`","Deterministic bootstrap for the Saul-facing story:","npm run demo:seed","npm run demo:run -- --clean --skip-llm client-onboarding","Deterministic artifact rehearsal bundle:","npm run demo:director -- --output-dir ./demo-artifacts/saul-rehearsal --e2e-db ./taskdeck.demo.saul.db --reset-e2e-db --fresh-servers --scenario client-onboarding --skip-llm --turns 0 --rng-seed saul-rehearsal","Acceptance focus for this rehearsal:","- prove `Home -> Inbox/Capture -> Review -> Board`","- prove review-first trust language is visible without narration","- prove ACME onboarding capture becomes clean board work after explicit approval","## Load Harness (k6 + Playwright Concurrency)","Run local k6 board-heavy profile (backend API must be reachable at `K6_BASE_URL`):","docker run --rm --network host \\"," --user \"$(id -u):$(id -g)\" \\"," -e K6_BASE_URL=http://127.0.0.1:5000/api \\"," -e K6_VUS=20 \\"," -e K6_DURATION=90s \\"," -e K6_USER_POOL=6 \\"," -v \"$PWD:/work\" \\"," -w /work \\"," grafana/k6:0.49.0 \\"," run tests/load/k6/board-heavy-load.js \\"," --summary-export frontend/taskdeck-web/test-results/load/k6-summary.json","- tune `K6_VUS`, `K6_DURATION`, and `K6_USER_POOL` per machine capacity.","- the default 20-VU SQLite profile warns when tagged board writes reach the measured 2000 ms p95 capacity and fails at 4500 ms; together with the 5000 ms global p99 gate these sit at ~1.5–1.7× the worst same-code nightly tail observed on shared runners (calibrated 2026-07-23 — evidence in #1445; the write-tail itself is tracked in #1446).","- aggregate p95/p99, board-read p95, error-rate, and check-rate thresholds remain hard gates.","- both reusable k6 workflows fail closed when the required summary is missing, empty, malformed, lacks any hard-gate metric, contains an out-of-domain direct/nested value, mixes conflicting flattened/nested metric evidence, or has threshold evidence that contradicts the corresponding strict numeric comparator (including equality boundaries); pinned k6 0.49's flattened breach flags are normalized before analysis, aggregate p95 must not exceed p99, and the `always()` artifact uploads still preserve available diagnostics.","- run `node --test scripts/ci/require-k6-summary.test.mjs` from the repository root for summary validation and workflow-wiring checks.","- run `node --test scripts/ci/check-k6-thresholds.test.mjs` from the repository root for the focused tagged-capacity analyzer checks.","- script thresholds fail on sustained latency/error budget breaches and emit actionable status/body diagnostics.","## Container Baseline Validation","TASKDECK_JWT_SECRET=local-test-secret TASKDECK_CONNECTORS_ENCRYPTION_KEY=local-test-key docker compose -f deploy/docker-compose.yml --profile baseline config","docker build -f deploy/docker/backend.Dockerfile -t taskdeck-api:local .","docker build --build-arg VITE_API_BASE_URL=/api -f deploy/docker/frontend.Dockerfile -t taskdeck-web:local .","Deployment script smoke path (PowerShell):","powershell -File ./scripts/deploy/Start-TaskdeckStack.ps1","powershell -File ./scripts/deploy/Smoke-TestTaskdeckStack.ps1 -Port 8080 # if TASKDECK_PROXY_PORT differs, set -Port to match","powershell -File ./scripts/deploy/Stop-TaskdeckStack.ps1","Deployment hardening matrix automation (PowerShell):","powershell -File ./scripts/deploy/Verify-TaskdeckDeploymentHardening.ps1 -Port 8080","Hardening matrix pass/fail criteria:","- `docs/ops/DEPLOYMENT_HARDENING_MATRIX.md`","## Failure-Injection Drills","Repeatable failure-injection scenarios for deployment and MCP workflows:","bash scripts/drills/run-all-drills.sh # local run","bash scripts/drills/run-all-drills.sh --ci # CI-compatible with machine-readable output","Scenarios covered:","- Missing SQLite database at startup","- Locked SQLite database at startup","- Readiness-check timeout behavior","- MCP configuration validation / unknown-server handling","- Reverse-proxy misconfiguration regression","Drill documentation and recovery paths: `docs/ops/FAILURE_INJECTION_DRILLS.md`","## Terraform IaC Baseline Validation","Static validation (no cloud apply required):","terraform fmt -check -recursive deploy/terraform/aws","powershell -File ./scripts/deploy/Test-TaskdeckTerraformBaseline.ps1","Real-environment drift check (requires environment-specific `terraform.tfvars`, backend config, and AWS credentials):","powershell -File ./scripts/deploy/Invoke-TaskdeckTerraformDriftCheck.ps1 `"," -Environment staging `"," -VarFile deploy/terraform/aws/environments/staging/terraform.tfvars `"," -BackendConfigFile deploy/terraform/aws/environments/staging/backend.hcl `"," -RefreshOnly","- `Test-TaskdeckTerraformBaseline.ps1` runs `terraform init -backend=false` and `terraform validate` for `dev`, `staging`, and `prod`.","- `Invoke-TaskdeckTerraformDriftCheck.ps1` relies on `terraform plan -detailed-exitcode`; `0` means no changes, `2` means drift for `-RefreshOnly` or planned changes for a non-refresh-only run, and any other exit is a failure.","- The Terraform baseline intentionally provisions the current single-node Docker deployment model; the JWT signing secret comes from a pre-created SecureString SSM parameter, and the SQLite path lives on a dedicated persistent EBS data volume so routine host replacement does not discard `/var/lib/taskdeck/taskdeck.db`.","- `staging` and `prod` default `protect_data_volume` to `true`; intentional destroys or migrations that must remove the data volume require a reviewed switch to the unprotected path plus a reviewed module-source change to relax/remove `prevent_destroy` before the destructive apply.","- Changing an existing environment from `protect_data_volume = false` to `true` also replaces the underlying EBS volume with a new protected one; treat that as a destructive migration and capture a backup or snapshot first.","- Staged rollout policy, managed DB, and full secret-rotation posture remain tracked in `#101`, `#84`, and `#110`.","## MCP Operations Validation","docker mcp server ls","powershell -File ./scripts/mcp/Test-DockerMcpProfile.ps1","Optional servers (`postman`, `dockerhub`) warning mode:","powershell -File ./scripts/mcp/Test-DockerMcpProfile.ps1 -IncludeOptional","Optional servers strict mode (fail-fast on missing prereqs/runtime failures):","powershell -File ./scripts/mcp/Test-DockerMcpProfile.ps1 -IncludeOptional -FailOnOptionalErrors","CI-friendly variants:","powershell -File ./scripts/mcp/Test-DockerMcpProfile.ps1 -CiMode","powershell -File ./scripts/mcp/Test-DockerMcpProfile.ps1 -IncludeOptional -SkipOptionalWhenMissingPrereqs -CiMode","powershell -File ./scripts/mcp/Test-DockerMcpProfile.ps1 -IncludeOptional -FailOnOptionalErrors -CiMode","## CI Gates","Required workflow: `.github/workflows/ci-required.yml`","- `dco`"," - Checks every pull-request commit for a DCO `Signed-off-by:` trailer with the"," SHA-pinned `KineticCafe/actions-dco` action"," - Active for pull requests and currently **advisory**"," (`continue-on-error: true`); promotion into branch protection remains"," maintainer-owned under #1173","- `docs-governance`"," - Enforces required active docs and docs index invariants","- `backend-architecture`"," - Enforces architecture boundaries in CI","- `backend-unit`"," - Domain + Application + CLI contract tests"," - Ubuntu and Windows matrix","- `api-integration`"," - API integration tests","- `frontend-unit`"," - Lint + coverage-threshold Vitest + typecheck + build"," - Uploads JUnit + coverage artifacts (`test-results/`, `coverage/`) for triage","- `container-images`"," - Validates compose rendering"," - Builds backend/frontend container images"," - Exports compressed image artifacts plus SHA256 checksums","- `e2e-smoke`"," - Playwright smoke + automation/ops + fixture bootstrap flow"," - Ubuntu only"," - Depends on all prior gates","- `migration-validation`"," - EF Core migration chain validation via `scripts/ci/validate-migrations.sh` (TST-61, `#869`/`#916`)"," - Runs in parallel with other required jobs","- `secret-scan` (#1132, ADR-0035)"," - Gitleaks PR-diff secret detection via `reusable-gitleaks.yml` (scan-mode `pr`, **enforcing** — fails on a newly-introduced secret)"," - Guarded to `pull_request` events (gitleaks PR mode is invalid on `push`/`merge_group`)","- `dependency-security` (#1132, ADR-0035)"," - Vulnerable-dependency scan via `reusable-dependency-security-signals.yml`; production deps only (`frontend-omit-dev`), high+ severity"," - **Advisory** (`enforce-findings: false`) pending baseline remediation (#1175); flips to enforcing per #1175","- `sast-scan` (#1132, ADR-0035)"," - Semgrep SAST via `reusable-sast-scanning.yml`"," - **Advisory** (`enforce-findings: false`) pending the pre-existing finding baseline triage (#1175)","- Frontend bundle-size budget runs **enforcing** as a step inside `frontend-unit` (`scripts/ci/check-bundle-size.mjs`, total-js < 1200 KB)","> Phased enforcement (ADR-0035): only `secret-scan` and the bundle check hard-block today;","> `dependency-security`/`sast-scan` run on every PR but are advisory until the baseline is clean.","> Branch-protection registration of the new check contexts is tracked in #1173.","Extended workflow: `.github/workflows/ci-extended.yml`","- `workflow-lint`"," - Actionlint validation for `.github/workflows/**` drift","- `dependency-review`"," - PR dependency change risk signal (`actions/dependency-review-action`)","- `backend-solution` + `e2e-smoke` + `load-concurrency-harness`"," - opt-in on PRs labeled `testing` or manual `workflow_dispatch` (runs Playwright smoke suite via `reusable-e2e-smoke.yml`)"," - load harness lane runs k6 board-heavy profile plus Playwright multi-session concurrency spec via `reusable-load-concurrency-harness.yml`","- `demo-director-smoke`"," - opt-in on PRs labeled `automation` or manual `workflow_dispatch`; PR-triggered runs still require watched-path changes because `ci-extended.yml` does not include `docs/**`"," - runs the deterministic `demo:director:smoke` path via `reusable-demo-director-smoke.yml`","- `sast-scanning`"," - Semgrep SAST with custom C# and TypeScript rules via `reusable-sast-scanning.yml` (CI-01, `#870`/`#915`)"," - opt-in on PRs labeled `security` or manual `workflow_dispatch`"," - advisory mode by default; enforceable via workflow input"," - `scripts/ci/summarize-sast-findings.mjs` produces human-readable summary","- `performance-regression-gate`"," - k6 thresholds (aggregate p95 <2s and p99 <5s, tagged SQLite board-write p95 <4.5s with a warning at the measured 2s capacity, error rate <1%) + bundle size checks via `reusable-performance-regression-gate.yml` (CI-03, `#872`/`#918`, recalibrated by `#1358` then `#1445`)"," - opt-in on PRs labeled `performance` or manual `workflow_dispatch`"," - `scripts/ci/check-bundle-size.mjs` and `scripts/ci/check-k6-thresholds.mjs` for deterministic threshold enforcement","Nightly workflow: `.github/workflows/ci-nightly.yml`","- scheduled/manual backend solution regression (`dotnet test backend/Taskdeck.sln -c Release -m:1`)","- scheduled/manual E2E smoke suite (`reusable-e2e-smoke.yml`)","- scheduled/manual load-concurrency harness (`reusable-load-concurrency-harness.yml`)","- scheduled/manual container image regression","- scheduled/manual SAST scanning (Semgrep) via `reusable-sast-scanning.yml`","- scheduled/manual performance regression gate via `reusable-performance-regression-gate.yml`","- `developer-portal`: builds API, fetches `/swagger/v1/swagger.json`, runs `@redocly/cli build-docs`, uploads `artifacts/developer-portal/` including docs from `docs/api/` (PR #658)","Nightly quality workflow: `.github/workflows/nightly-quality.yml`","- scheduled/manual reporting lane for quality telemetry (non-blocking for required PR CI checks)","- backend coverage artifacts:"," - Domain coverage (`Taskdeck.Domain.Tests` with XPlat Code Coverage)"," - Application coverage (`Taskdeck.Application.Tests` with XPlat Code Coverage)","- frontend coverage artifacts:"," - `npm run test:coverage` output (`coverage/` + `test-results/`)","- dependency/security signal artifacts:"," - `dotnet list package --vulnerable --include-transitive` output + exit code"," - `npm audit --audit-level=high --json` output + exit code"," - normalized dependency-security summary (`summary.md`, `summary.json`) linked to `docs/security/SECURITY_DEPENDENCY_VULNERABILITY_POLICY.md`","Triage usage:","- check workflow step summary first for signal exit codes","- inspect uploaded artifacts to differentiate command failures from dependency findings","- treat this lane as reporting-first; promote to stricter gating only through a dedicated follow-up issue/decision","Release/security workflow: `.github/workflows/release-security.yml`","- release/tag/manual dependency inventory artifact generation","- backend/frontend vulnerability signal capture","- manual strict-enforcement option that fails on unresolved high/critical findings, non-zero dependency scan exits, or unparseable scan outputs","- reusable container artifact/checksum lane for release-ready outputs","CI extended dependency-security lane:","- `.github/workflows/ci-extended.yml` now exposes an opt-in `Dependency Security Signals` job through manual dispatch or PRs labeled `security`","- this lane is reporting-first and uses the same normalized summary format as nightly/release flows","## Testing Harness Improvement Wave (Delivered 2026-02-24)","Tracking issues:","- wave tracker: `#254`","- delivered execution: `#255` to `#260`","Already-covered pack scenarios (no duplicate implementation issue required):","- WIP limit enforcement already covered across application/API/E2E.","- sandbox-gated database import/export rejection outside Development already covered.","- starter-pack idempotency/conflict safety already covered.","Knowledge transfer applied to existing seeds:","- `#89`: targeted property/fuzz pilot surfaces (manifest/query/import-export boundaries)","- `#90`: non-blocking scheduled mutation-lane posture","- `#106`: dependency/security signal command baseline (`dotnet list package --vulnerable`, `npm audit`)","- `#168`: CI topology routing for OpenAPI/nightly-quality lanes","Delivered outcomes:","- `#255` removed residual wall-clock flake vectors and centralized reusable E2E polling helpers","- `#256` locked drag/drop persistence after full reload into Playwright smoke coverage","- `#257` centralized representative `400/401/403/404/409` API error-contract assertions","- `#258` added OpenAPI generation + parse-validation artifacts in CI","- `#259` codified `docs/GOLDEN_PRINCIPLES.md` with lightweight mechanical enforcement","- `#260` added the non-blocking nightly-quality workflow for coverage and dependency/security signal artifacts","Useful local checks for this wave:","rg -n \"Thread\\\\.Sleep|new Promise\\\\(.*setTimeout\" backend/tests frontend/taskdeck-web/tests/e2e","dotnet test backend/tests/Taskdeck.Api.Tests/Taskdeck.Api.Tests.csproj -c Release --filter \"FullyQualifiedName~ApiErrorContractApiTests\"","(cd frontend/taskdeck-web && npx playwright test tests/e2e/smoke.spec.ts tests/e2e/automation-ops.spec.ts tests/e2e/capture-loop.spec.ts --reporter=line)","OpenAPI guardrail local checks (`#258`):","./scripts/ci/generate-openapi-artifact.ps1 -OutputPath \"artifacts/openapi/taskdeck-api.json\"","./scripts/ci/validate-openapi.ps1 -SpecPath \"artifacts/openapi/taskdeck-api.json\"","Malformed-output simulation (deterministic parse failure check):","\"not-json\" | Set-Content -Path artifacts/openapi/invalid-openapi.json","./scripts/ci/validate-openapi.ps1 -SpecPath \"artifacts/openapi/invalid-openapi.json\"","Follow-up intentionally deferred from this issue:","- snapshot/diff enforcement against a checked-in OpenAPI baseline remains a future enhancement","- current guardrail scope is generation + parse/shape validation + CI artifact publication","## Outreach CRM Deferred Wave (Planning, 2026-02-23)","- wave tracker: `#262`","- deferred execution: `#263` to `#268`","Reuse links (no duplicate implementation issue):","- `#75` delivered import-adapter foundation for outreach CSV mapping/dedupe profile","- `#77` analytics model/dashboards for future outreach scoreboard metrics","- `#175` first-party starter-pack catalog expansion for outreach blueprint inclusion","Planned quality expectations when implementation starts:","- YAML front-matter parser round-trip stability tests (contact fields + timeline preservation)","- cadence scheduling determinism + throughput-control guardrail tests","- API/UX regression for contact logging and dashboard action loops","- E2E coverage for outreach loop: import/apply -> contact update -> cadence proposal -> dashboard action flow","## Coverage Map","- Domain invariants:"," - `backend/tests/Taskdeck.Domain.Tests`","- Application services:"," - `backend/tests/Taskdeck.Application.Tests`"," - Includes board/card/column/label/auth/authorization/board-access/export-import/history/queue plus automation/archive/chat/ops/log services"," - Includes database export/import guardrail coverage (sandbox gating, payload validation, file replacement)"," - Includes external import-adapter parsing and board upsert orchestration coverage (CSV/outreach profile, dedupe policy, rollback safety path)"," - Includes starter-pack manifest parsing/validation, first-party catalog validity, and apply-planning coverage"," - Includes LLM tool-calling orchestrator coverage (multi-turn loop, timeout, round limits) and read tool schema generation"," - Includes GDPR data export service (user-scoped completeness, versioned payload) and account deletion service (re-auth, confirmation phrase, PII anonymization)"," - Includes board metrics service coverage (aggregation, date range, label grouping)"," - Includes MCP board resource coverage (listing, phantom-user fallback, multi-user scoping)"," - Includes integrations registry service coverage (connector CRUD, enable/disable lifecycle, event logging)","- HTTP contracts and behavior mappings:"," - `backend/tests/Taskdeck.Api.Tests`"," - Includes core + automation/archive/chat/ops/log/health controllers"," - Includes rate-limit policy coverage (`RateLimitingApiTests`) for burst throttling, retry metadata contract, reset-window recovery, and cross-user boundary behavior"," - Includes security-header baseline coverage (`SecurityHeadersApiTests`) for success/auth-failure paths and HTTPS HSTS posture assertions"," - Includes board-scoped external import endpoint coverage (authz, malformed input, duplicate handling, apply/update flow, rollback safety)"," - Includes outbound webhook API and worker coverage (`OutboundWebhooksApiTests`, `OutboundWebhookDeliveryWorkerTests`) for claim/reload handling, cancellation requeue, and non-success HTTP retry/dead-letter branches"," - Includes `ResultExtensions` mapping tests for standardized API error/status behavior"," - Includes integrations controller coverage (7 endpoints: CRUD + enable/disable, auth enforcement)","- CLI contracts:"," - `backend/tests/Taskdeck.Cli.Tests`","- Architecture boundaries:"," - `backend/tests/Taskdeck.Architecture.Tests`"," - Enforces project-reference boundaries between Domain/Application/Infrastructure/API projects"," - Enforces source-layer purity via forbidden namespace imports in Domain and Application source trees"," - Enforces API controller boundary invariants:"," - only `AuthController` and `HealthController` may inherit `ControllerBase` directly"," - protected controllers must declare `[Authorize]`"," - Failure remediation:"," - move forbidden dependencies to the correct layer abstraction/interface"," - route protected HTTP surface through `AuthenticatedControllerBase`"," - add/restore `[Authorize]` on protected controller classes","- Frontend unit behavior:"," - `frontend/taskdeck-web/src/tests`"," - Components, stores, API modules, composables, utilities"," - Includes shared utility tests for `queryBuilder` and `errorMessage`"," - Includes GitHub OAuth API client and session store coverage (`authApi`, `sessionStore`)"," - Includes board metrics API client and store coverage (`metricsApi`, `metricsStore`)","- End-to-end journeys:"," - `frontend/taskdeck-web/tests/e2e`"," - Includes deterministic starter-pack fixture bootstrap coverage for `small`, `medium`, and `edge` manifest scenarios"," - Includes unauthenticated SignalR negotiate rejection coverage aligned with the runtime client handshake path"," - Includes dedicated multi-session concurrency regression coverage (`tests/e2e/concurrency.spec.ts`)"," - Includes integrated multi-component verification journeys (`tests/e2e/integrated-verification.spec.ts`) — see `docs/testing/INTEGRATED_VERIFICATION_STRATEGY.md`"," - Includes manual validation slice C E2E coverage: `tests/e2e/validation-automation-proposals.spec.ts` (8 tests), `tests/e2e/validation-chat-bootstrap.spec.ts` (9 tests)"," - Includes manual validation slice D E2E coverage: `tests/e2e/validation-ops-logs-health.spec.ts` (17 tests)"," - Includes manual validation slice E E2E coverage: `tests/e2e/validation-starter-packs.spec.ts`, `tests/e2e/validation-archive-recovery.spec.ts`, `tests/e2e/validation-activity-traceability.spec.ts` (23+ tests)"," - Includes integrated verification E2E coverage: `tests/e2e/integrated-verification.spec.ts` (4 tests covering capture-to-board pipeline, board bootstrap, workspace navigation, auth denial)","- Load and concurrency API profile:"," - `tests/load/k6/board-heavy-load.js`"," - Includes seeded-user board-heavy read/write load mix and threshold-based regression diagnostics","## Integrated Multi-Component Verification","The integrated verification program ties automated and manual testing into cross-component scenarios that validate subsystem interactions end-to-end.","Key resources:","- `docs/testing/INTEGRATED_VERIFICATION_STRATEGY.md` — scenario matrix, release gating criteria, automated/manual split","- `docs/testing/MANUAL_REHEARSAL_TEMPLATE.md` — standard template for manual verification cycles","- `frontend/taskdeck-web/tests/e2e/integrated-verification.spec.ts` — automated cross-component E2E journeys","The strategy defines 18 verification scenarios (V-01 through V-18) across 5 subsystem areas. Scenarios are tiered by severity:","- **Tier 1** (V-01 to V-04): Critical path — must pass for any release","- **Tier 2** (V-05 to V-10): High-value cross-cutting — must pass for feature releases","- **Tier 3** (V-11 to V-18): Extended coverage — recommended for major releases","## Manual Verification","Use `docs/MANUAL_TEST_CHECKLIST.md` for action-by-action manual validation.","Use `docs/ops/OBSERVABILITY_BASELINE.md` for telemetry dashboard/alert baseline and observability smoke validation.","Use `docs/testing/MANUAL_REHEARSAL_TEMPLATE.md` for structured manual rehearsal cycles with evidence capture.","Detailed step-indexed validation checklists:","- Slice A — workspace shell, board lifecycle, keyboard UX: `docs/testing/manual-validation-a-workspace-board-ux.md`","- Slice B — authz policy, cross-user isolation, API error contracts: `docs/testing/manual-validation-b-authz-contracts.md`","- Slice C — automation proposals, chat bootstrap, execution safety (45 scenarios): `docs/testing/MANUAL_VALIDATION_SLICE_C_SCENARIOS.md`; rehearsal runbook: `docs/testing/MANUAL_REHEARSAL_RUNBOOK_SLICE_C.md`","- Slice D — ops CLI, log query/correlation, health telemetry (25 scenarios): `docs/testing/MANUAL_VALIDATION_SLICE_D_SCENARIOS.md`; rehearsal runbook: `docs/testing/MANUAL_REHEARSAL_RUNBOOK_SLICE_D.md`","- Slice E — starter packs, archive recovery, activity traceability (25 scenarios): `docs/testing/MANUAL_VALIDATION_SLICE_E_SCENARIOS.md`; rehearsal runbook: `docs/testing/MANUAL_REHEARSAL_RUNBOOK_SLICE_E.md`","Integrated verification program:","- Cross-component verification strategy (18 scenarios): `docs/testing/INTEGRATED_VERIFICATION_STRATEGY.md`","- Manual rehearsal template: `docs/testing/MANUAL_REHEARSAL_TEMPLATE.md`","## Thesis Alignment Validation (Capture Realignment)","This section defines validation expectations for the capture-first direction.","Current state:","- capture MVP loop is shipped end-to-end (`#200` to `#211`)","- capture loop assertions below are required baseline checks for regression safety","Required assertions:","- capture action is fast and deterministic (target under 10 seconds to persisted artifact in normal local conditions)","- triage path stays proposal-first (no direct board mutation from model output)","- provenance links are visible from proposal/card surfaces back to capture source","- error and auth contracts remain stable (`ApiErrorResponse`, `401/403/404` policy)","Recommended execution pairing:","- automated: API + frontend unit + E2E capture loop (`#210` delivered, retained as active regression path)","- manual: capture friction/trust checks in `docs/MANUAL_TEST_CHECKLIST.md`","## Incident Rehearsals","Manual incident rehearsals complement automated tests by validating diagnosis and recovery workflows against realistic failure conditions. Rehearsals are scheduled monthly (lightweight, ~30 min) and quarterly (deep drill, ~2 hours).","- `docs/ops/INCIDENT_REHEARSAL_CADENCE.md` -- schedule, rotation, and process","- `docs/ops/rehearsal-scenarios/` -- scenario templates (health degradation, telemetry gaps, deployment failures)","- `docs/ops/EVIDENCE_TEMPLATE.md` -- evidence package format","- `docs/ops/REHEARSAL_BACKOFF_RULES.md` -- how rehearsal findings become tracked issues","- `docs/ops/rehearsals/` -- completed rehearsal evidence packages","Rehearsals are distinct from the automated failure-injection drill suite (`docs/ops/FAILURE_INJECTION_DRILLS.md`). Drills are scripted and CI-runnable; rehearsals are human-driven and focus on diagnosis speed, tooling gaps, and recovery muscle memory.","## Development Sandbox Mode","For local development only, authorization bypass can be enabled via:","- `backend/src/Taskdeck.Api/appsettings.Development.json`","- `DevelopmentSandbox.Enabled = true`","Safety boundary:","- Sandbox bypass is forced off outside Development environment.","- Validation and data integrity rules still apply.","## Webhook HMAC Signature Verification Coverage (PR #750, delivered 2026-04-04)","Tracking issue: `#726`","- `OutboundWebhookHmacDeliveryTests` (11 tests): header format verification (`sha256=<64-hex>`), HMAC round-trip receiver recompute and match, wrong-key rejection, secret rotation produces different signature, body/content-type matching, large payload (100 kB), timing-safe comparison via `CryptographicOperations.FixedTimeEquals`, determinism, key-differ properties","Key adversarial review findings fixed: secret rotation test was testing different subscriptions (not actual rotation on same subscription); BCL-testing assertions replaced with real domain property tests.","## Webhook Delivery Reliability and SSRF Coverage (PR #756, delivered 2026-04-04)","Tracking issue: `#710`","New test coverage across webhook test suite (78 tests total across 9 files):","- `OutboundWebhookEndpointGuardTests` (Application.Tests): SSRF guard cases covering private IPv4 ranges and endpoint validation","- `OutboundWebhookServiceTests` (Application.Tests, 19 tests): service-level webhook subscription and delivery orchestration","- `OutboundWebhookSignatureTests` (Application.Tests, 8 tests): HMAC signature computation and verification","- `OutboundWebhookDeliveryWorkerTests` (Api.Tests, 8 tests): worker-level delivery scheduling and retry logic","- `OutboundWebhookHmacDeliveryTests` (Api.Tests, 11 tests): end-to-end HMAC delivery including header format, round-trip, wrong-key rejection","- `OutboundWebhooksApiTests` (Api.Tests, 10 tests): API endpoint contract for webhook subscription management","- `OutboundWebhookDeliveryRepositoryTests` (Api.Tests, 3 tests): repository-level delivery persistence","- `OutboundWebhookDeliveryTests` (Domain.Tests, 8 tests): domain entity state and transitions","- `OutboundWebhookSubscriptionTests` (Domain.Tests, 7 tests): subscription domain entity","Key adversarial review fix: `HttpClient` resource leaks across 9 test methods.","Manual validation recommended: configure a webhook endpoint with a known secret and verify that (a) the `X-Taskdeck-Webhook-Signature` header (alongside `X-Taskdeck-Webhook-Timestamp`) is present and verifiable with HMAC-SHA256, and (b) a webhook targeting `http://localhost/` or `http://10.0.0.1/` is rejected at the SSRF guard.","## Frontend Regression Test Wave (PRs #742–#745, #748, #743, #744, #754, delivered 2026-04-04)","Tracking issues: `#683`, `#680`, `#685`, `#686`, `#687`, `#688`","New test files:","- `boardStore.wipLimit.spec.ts` (7 tests): WIP-limit toast deduplication regression for `createCard` and `moveCard`; guards against future double-toast introduction","- `sessionStore.authToast.spec.ts` (20 tests): auth-flow toast lifecycle — login/register/OAuth failure and success toasts, cross-flow isolation, auto-removal independence; uses real `toastStore` backed by fresh Pinia","- `router/authGuard.spec.ts` (new): auth guard decision table — unauthenticated redirect, expired-token cleanup, authenticated pass-through, deflection from /login when authenticated, demo mode, 12-route exhaustive table","- `router/workspaceRouteStability.spec.ts` (new): workspace mode persistence across simulated reloads, hydration drift prevention, `resetForLogout` cleanup","- `InboxView.spec.ts` (+21 tests): single-item triage action states (per status variant), bulk action bar visibility and count, batchBusy disabled state, select-all behavior; all assertions on DOM state","Frontend suite total after this wave: **1592 passing** (up from 1496 pre-wave).","## Feature, Analytics, MCP, Chat, Testing, and UX Wave (PRs #787–#793, delivered 2026-04-08)","Tracking issues: `#78`, `#79`, `#249`, `#576`, `#654`, `#705`, `#717`","New test coverage (~390+ new tests total):","### Backend","- `MetricsExportServiceTests.cs` (21 unit tests + 5 adversarial-review injection tests): CSV structure validation, all 5 sections, CSV injection prevention vectors including embedded newlines","- `MetricsExportApiTests.cs` (8 integration tests): auth, cross-user isolation, empty board, date range, Content-Disposition headers","- `ForecastingServiceTests.cs` (32 tests): validation, authorization, edge cases (zero throughput, no done column, single data point, large card counts, bounce deduplication, history-window-vs-span)","- `ApiKey` domain tests (11 tests): entity construction, SHA-256 hashing, `tdsk_` prefix, revocation, expiration","- API key integration tests (20 tests): auth, key lifecycle (create/list/revoke), cross-user isolation, MCP endpoint access","- `ClarificationDetectorTests.cs` (22 tests + 6 false-positive regression): pattern detection, skip phrases, round counting, prompt building, strong/weak signal split","- `ChatServiceClarificationTests.cs` (7 tests): service-level clarification flow, round enforcement, skip behavior","- `ConcurrencyRaceConditionStressTests.cs` (13 tests): queue claim races, card conflicts, proposal approval races, rate limiting, multi-user stress","- `EntityAdversarialInputTests.cs` (77 FsCheck tests): Board, Card, Column, Label, AutomationProposal with adversarial strings, boundary lengths, GUID validation","- `JsonSerializationRoundTripFuzzTests.cs` (29 tests): serialize/deserialize identity, GUID format variations, DateTime boundaries, malformed JSON","- `AdversarialInputApiTests.cs` (80 tests): no 500s from adversarial input across all major endpoints, malformed JSON, wrong content types, concurrent adversarial","### Frontend","- `InboxView.spec.ts` (+7 tests): primitive-driven loading/error/empty state assertions, skeleton detection, retry button","- `inputSanitization.spec.ts` (16 fast-check tests): card titles, search queries, board names, chat messages, URL encoding, JSON round-trip, Unicode edge cases","- `storeResilience.spec.ts` (9 fast-check tests): random action sequences on board store, API error handling, adversarial content","### Dependencies added","- Backend: `FsCheck` and `FsCheck.Xunit` (for property-based testing, extending existing pattern)","- Frontend: `fast-check` (dev dependency, for property-based testing)","### Key adversarial review findings fixed","- **HIGH**: CSV injection via embedded newlines in export (`#787`), throughput double-counting in forecasting (`#790`), false-positive clarification heuristic (`#791`)","- **MEDIUM**: Key-existence oracle + modulo bias in API key generation (`#792`), capture DTO round-trip test (`#789`), history window denominator (`#790`), CancellationToken forwarding (`#787`)","- Fixed test quality issues: misleading doc comments, weak assertions, non-thread-safe variables, redundant ARIA roles, missing screen reader announcements","Backend suite total after this wave: **~3,460+ passing** (estimated at time of wave). Frontend suite total: **~1,891 passing** (estimated at time of wave). Combined: **~5,370+** (estimated at time of wave). See [Current Verified Totals](#current-verified-totals-2026-04-25) for latest recertified counts.","### Test expansion wave (`#721`) completion","This wave delivered the final 2 issues from the rigorous test expansion wave (`#721`):","- `#705` — Concurrency and race condition stress tests (13 tests)","- `#717` — Property-based and adversarial input tests (211 tests)","**All 25 of 25 issues in the test expansion wave are now delivered.** Total new tests from the wave: ~1,350+.","docs/STATUS.md",[3576],{"_1787":716,"_1788":3577,"_672":3578,"_1791":59},1458,[3579,381,3580,381,3581,3582,381,3583,3584,381,3585,381,3586,3587,381,3588,3589,381,3590,3591,3592,381,3593,3594,3595,3596,3597,3598,3599,3600,3601,3602,3603,381,3604,3605,3606,3607,3608,3609,3610,3611,381,3612,381,3613,3614,3615,3616,3617,3618,381,3619,3620,3621,3622,3623,3624,3625,381,3626,3627,3628,3629,3630,3631,3632,3633,3634,381,3635,3636,3637,3638,3639,3640,3641,3642,3643,3644,3645,3646,3647,381,3648,3649,3650,3651,3652,3653,3654,3655,3656,3657,3658,3659,3660,381,3661,3662,3663,3664,3665,3666,381,3667,3668,3669,381,3670,3671,3672,3673,3674,3675,3676,3677,3678,3679,3680,381,3681,381,3682,3683,3684,3685,3686,381,3687,3688,3689,3690,381,3691,3692,3693,3694,3695,3696,381,3697,3698,3699,3700,3701,3702,3703,3704,3705,2417,2418,2419,2420,2421,2422,381,3706,381,3707,3708,381,3709,3710,3711,3712,381,3713,3714,3715,3716,3717,3718,3719,3720,3721,381,3722,3723,3724,3725,3726,3727,3728,381,3729,3730,3731,3732,3733,3734,381,3735,3736,3737,3738,3739,3740,3741,3742,3743,3744,3745,3746,3747,3748,3749,3750,381,3751,3752,3753,3754,3755,3756,3757,3758,381,3759,3760,3761,3762,3763,3764,3765,3766,3767,3768,3769,3770,3771,3772,3773,3774,3775,3776,3777,3778,3779,3780,3781,3782,3783,3784,3785,3786,3787,3788,3789,3790,3791,3792,3793,3794,3795,3796,3797,3798,3799,3800,3801,3802,3803,3804,3805,3806,3807,3808,3809,3810,3811,3812,3813,3814,3815,3816,3817,3818,3819,3820,3821,3822,3823,3824,3825,3826,3827,3828,3829,3830,3831,3832,3833,3834,3835,3836,381,3837,3838,3839,3840,3841,3842,3843,3844,3845,381,3846,3847,3848,3849,3850,3851,3852,3853,3854,381,3855,381,3856,3857,3858,3859,3860,3861,3862,381,3863,3864,3865,3866,3867,3868,3869,381,3870,3871,3872,381,3873,3874,3875,3876,3877,3878,3879,3880,3881,3882,3883,3884,3885,381,3886,3887,3888,3889,3890,3891,3892,3893,3894,3895,3896,3897,3898,3899,3900,3901,3902,3903,3904,3905,3906,3907,3908,3909,3910,381,3911,3912,3913,3914,3915,381,3916,3917,3918,3919,3920,3921,3922,3923,3924,3925,3926,381,3927,3928,3929,381,3930,3931,3932,3933,381,3934,381,3545,381,3935,3936,3937,3938,3939,3940,3941,3942,3943,3944,3945,3946,3947,3948,3949,3950,3951,3952,3953,3954,3955,3956,3957,3958,3959,3960,3961,3962,3963,3964,3965,3966,3967,3968,3969,3970,3971,3972,3973,3974,3975,3976,3977,381,3557,381,3978,3979,3980,3981,3982,3983,3984,3985,3986,3987,3988,3989,3990,3991,3992,3993,3994,3995,3996,3997,3998,3999,4000,4001,4002,4003,4004,4005,4006,4007,4008,4009,4010,4011,4012,4013,4014,4015,4016,4017,4018,4019,4020,4021,4022,4023,4024,4025,4026,4027,4028,4029,4030,4031,4032,4033,4034,4035,4036,4037,4038,4039,4040,4041,4042,4043,4044,4045,4046,4047,4048,4049,4050,4051,4052,4053,4054,4055,4056,4057,4058,4059,4060,4061,4062,4063,4064,4065,381,4066,381,4067,381,4068,4069,4070,4071,381,4072,4073,4074,4075,4076,381,4077,4078,381,4079,4080,4081,381,4082,381,4083,381,4084,381,4085,4086,4087,4088,4089,381,4090,4091,4092,381,4093,4094,4095,381,4096,381,4097,4098,4099,4100,4101,4102,4103,4104,381,4105,381,4106,381,4107,381,4108,381,4109,4110,4111,4112,381,4113,4114,4115,4116,4117,4118,4119,4120,4121,4122,4123,4124,4125,4126,4127,4128,4129,4130,4131,4132,4133,4134,4135,4136,4137,4138,4139,4140,381,4141,4142,4143,381,4144,381,4145,381,4146,381,4147,4148,4149,4150,4151,4152,4153,4154,381,4155,4156,4157,381,4158,381,4159,4160,4161,4162,4163,381,4164,4165,4166,4167,4168,381,4169,4170,4171,381,4172,381,4173,381,4174,4175,4176,381,4177,4178,4179,4180,4181,381,4182,4183,4184,4185,4186,4187,381,4188,381,4189,381,3489,4190,4191,4192,4193,381,4194,4195,4196,4197,381,4198,4199,4200,4201,4202,4203,381,4204,381,4205,381,4206,4207,381,4174,4208,4209,4210,4211,4212,4213,4214,381,4215,4216,381,4217,381,4218,381,4169,4219,381,2928,4220,4221,4222,381,4223,4224,4225,4226,4227,381,4228,381,4229,4230,4231,381,4232,4233,4234,381,4235,4236,4237,4238,381,4239,4240,4241,381,4242,381,4243,4244,4245,4246,381,4247,4248,4249,4250,4251,381,4252,4253,4254,4255,4256,4257,381,4258,4259,4260,4261,4262,4263,381,4264,4265,4266,4267,4268,4269,4270,381,4271,381,4272,4273,4274,4275,4276,381,4277,4278,4279,4280,381,4281,4282,4283,4284,4285,381,4286,4287,4288,4289,4290,381,4291,4292,4293,4294,381,4295,4296,4297,4298,4299,381,4300,4301,4302,4303,4304,4305,381,4306,4307,4308,4309,4310,381,4311,4312,4313,4314,4315,381,4316,4317,4318,4319,4320,381,4321,4322,4323,4324,381,4325,4326,4327,4328,4329,381,4330,4331,4332,4333,4334,4335,4336,4337,381,4338,4339,4340,4341,381,4342,381,4343,381,4344,4345,381,4346,381,4347,4348,4349,4350,4351,4352,4353,4354,381,4355,381,4356,4357,4358,4359,4360,4361,4362,4363,4364,4365,4366,4367,4368,4369,4370,381,4371,381,4372,4373,4374,4375,4376,381,4377,4378,4379,4380,4381,4382,4383,381,4384,4385,4386,4387,4388,4389,4390,4391,4392,4393,4394,4395,4396,4397,4398,4399,4400,4401,4402,4403,4404,4405,4406,4407,4408,4409,4410,4411,4412,4413,4414,4415,4416,4417,4418,4419,4420,4421,4422,4423,4424,4425,4426,4427,4428,4429,4430,4431,4432,4433,4434,4435,4436,4437,4438,4439,4440,4441,4442,4443,4444,4445,4446,4447,381,4448,4449,4450,4451,381,4452,4453,4454,4455,381,4456,381,4457,381,4458,4459,4460,4461,381,4462,381,4463,4464,4465,4466,381,4467,381,4468,381,4469,381,4470,381,4471,4472,4473,4474,4475,4476,381,4477,381,4478,381,4479,4480,381,4481,381,4482,4483,4484,381,4485,381,4486,4487,4488,381,4452,381,4489,381,4490,381,4491,381,4492,381,4481,381,4493,4494,4495,4496,4497,4498,4499,381,4500,381,4501,4502,4503,4504,381,4452,381,4505,381,4506,4507,4508,4509,4510,4511,4512,4513,4514,4515,4516,4517,381,4518,381,4519,381,4520,381,4481,381,4521,4522,4523,381,4485,381,4524,4525,4526,381,4452,381,4527,381,4528,381,4529,381,4530,381,4531,381,4532,4533,381,4534,4535,4536,4537,4538,4539,4540,4541,381,4542,381,4543,4544,4545,4546,4547,381,4534,4548,4549,4550,381,4551,381,4532,4552,381,4534,4553,4554,4555,4556,4557,4558,4559,4560,4561,4562,4563,381,4564,381,4532,4565,381,4534,4566,4567,381,4568,381,4569,4570,381,4571,381,3270,381,4572,4573,4574,4575,4576,4577,4578,4579,381,4580,381,4581,4582,4583,4584,4585,4586,4587,4588,4589,381,4590,381,4591,4592,4593,381,4594,381,4595,381,4596,4597,381,4598,381,4599,4600,381,4601,381,4602,381,3333,381,4603,4604,4605,4606,3337,381,4607,381,4608,4609,4610,4611,381,4612,381,4613,4614,4615,381,4616,381,4617,4618,4619,381,4620,4621,381,4622,381,4623,4624,4625,4626,4627,381,4628,4629,4630,4631,4632,4633,4634,4635,4636,4637,381,4638,4639,4640,4641,4642,4643,4644,4645,4646,4647,4648,4649,4650,4651,4652,4653,4654,4655,4656,4657,4658,381,4659,4660,4661,4662,4663,4664,381,4665,381,4666,4667,4668,4669,4670,4671,4672,4673,4674,4675,4676,4677,4678,4679,4680,4681,4682,4683,4684,4685,4686,4687,4688,4689,4690,4691,4692,4693,4694,4695,4696,4697,4698,4699,4700,4701,4702,4703,4704,4705,4706,4707,4708,4709,4710,4711,4712,4713,4714,4715,4716,4717,4718,4719,4720,4721,4722,4723,4724,4725,4726,4727,4728,4729,4730,4731,4732,4733,4734,4735,4736,4737,4738,4739,4740,4741,4742,4743,4744,4745,4746,4747,4748,4749,4750,4751,4752,4753,4754,4755,4756,4757,4758,4759,4760,4761,4762,4763,4764,4765,4766,4767,4768,381,4769,381,4770,2418,2419,2420,2421,381,4771,4772,4773,4774,381,4775,4776,381,4777,4778],"# Taskdeck Status (Source of Truth)","Last Updated: 2026-07-27","Required Docs Governance hardening (2026-07-26, `#1492`):","- **Required CI now enforces failure-ledger projection synchronization.** The reusable Docs Governance job pins Python 3.12 and runs the existing `failure_ledger.jsonl` ↔ `FAILURE_LEDGER.md` synchronization unittest before its governance checks, so a stale checked-in projection fails without any renderer masking it. Local agentic update workflows intentionally render first and then test so a valid hook-appended JSONL entry can be projected; the smoke contract keeps that distinction from drifting.","Windows agent-utility launcher hardening (2026-07-26, `#1487`):","- **Configured Python-backed agent handlers no longer depend on the unusable Microsoft Store `python` aliases on native Windows.** Configured PowerShell handlers and PowerShell-scoped utility allow-rules use the verified `py -3 -B` launcher; POSIX Bash allow-rules and guidance retain `python3 -B`; and the smoke harness runs child hook scripts through its active `sys.executable -B`. The permission contract asserts five direct utilities plus the renderer synchronization unittest on each platform's actual tool surface. PreToolUse maps a missing launcher or failed policy process to fail-closed exit 2. The native-Windows smoke feeds `Bash` payloads through PowerShell-hosted handlers; it does not prove native PowerShell-tool interception, which remains the T4 gap tracked by [#1497](https://github.com/Chris0Jeky/Taskdeck/issues/1497). No Python installation, global PATH change, or product-runtime packaging is introduced.","Paper-default regression alignment (2026-07-14, `#1274`): authenticated E2E sessions now follow the production Paper default unless a frozen Legacy-selector suite opts out explicitly. The refreshed core lane proves the real capture → Accept → Review → approve/apply → board path and runs the full axe WCAG 2.1 A/AA ruleset against settled Paper Home, Today, Inbox, Review, and a seeded Board, plus Login and functional skip-link keyboard coverage. The global Vitest Legacy pin remains intentional because those component tests assert the frozen Legacy DOM directly. Focused Chromium verification is 37/37 across `accessibility`, `onboarding`, `capture-loop`, `review-proposals`, `first-run`, and `smoke`.","Direction change (2026-07-10, maintainer-decided, **ADR-0044**): **the 2026-06-13 archive pivot is superseded — Taskdeck is being revived** and shipped as a **free open beta** (adoption/feedback/exposure first; the commercial side is developed in parallel by the maintainer). Positioning: the local-first, review-first **action-item engine** — transcripts/notes in, evidence-linked proposals out, applied to a board only on human approval — with the write-gated MCP server as the developer-facing second act. Everything shipped under MIT stays MIT (no retroactive relicensing). The active planning spine is **`docs/REVIVAL_PLAN.md`** (Phase 1 \"truth + safety before strangers\" repurposes the #1278 archive exit criteria as the v0.1 ship gate; Phase 2 is the LLM transcript-triage engine — the largest authorized new-backend-surface slice; Phase 3 is the beta launch; other scoped exceptions include registration gating, feedback/telemetry, and MCP key/identity hardening as enumerated in §7; then a ~8-week traction checkpoint with the archive plan as the documented fallback). New backend surface is authorized only by REVIVAL_PLAN §7 — the Phase-2 transcript-engine grants (ADR-0044) plus the Phase-4 generalist-expansion grants (**ADR-0046, Accepted 2026-07-13**: artefact intake, dossier read model, mode-scoped navigation; tracker `#1327`; the twin generalist app is explicitly deferred behind the GEN-12 `#1326` evidence gate). Evidence base: `docs/analysis/2026-07-10_revival_assessment.md` (7 code-review dimensions, ~25 adversarially verified claims, live-verified market data). Archive-closeout issues #1269–#1278 are re-scoped in place (same work, new purpose); dogfooding (#1271) remains the acceptance test for either path. **Dogfooding is now instrumented (2026-07-25):** `docs/dogfooding/README.md` holds the protocol — a dedicated `TASKDECK_DOGFOOD_DB` so dev/demo/E2E traffic cannot contaminate the signal, `scripts/dogfooding/dogfood-snapshot.py` (read-only; counts and dates only) for objective metrics, `docs/dogfooding/LOG.md` for friction, and a checkpoint rubric fixed before any real usage data existed. Read it before collecting checkpoint evidence, or the evidence will not be comparable. The measured pre-dogfooding baseline is recorded in `LOG.md`: **8 active days, none in the last 28, last activity 2026-04-23, 10 of 13 boards demo/test residue** — sustained use has not started, though the loop itself works (**17 of 20 proposals reached Apply**, counted by `AppliedAt`; a status-based count reads 1/20 because `Dismiss()` overwrites an `Applied` status).","","Security runway slice (2026-07-26, `#1345`):","- **The inherited HIGH SQLite native advisory is remediated without bypassing Central Package Management.** `Taskdeck.Infrastructure` now directly references the centrally pinned `SQLitePCLRaw.bundle_e_sqlite3` 2.1.12, so bundle, core, provider, and native library resolve as one 2.1.12 family instead of mixing a new native leaf with 2.1.6 managed components. The loaded SQLite runtime is 3.53.3, above the advisory's 3.50.2 security floor; a host-native integration test opens an in-memory database and enforces that floor. The solution vulnerability audit is clean, a fresh database update reports no pending model changes, and a self-contained `win-x64` published API booted against SQLite and returned `/health/ready` HTTP 200.","Project-automation runway slice (2026-07-26, `#1458`):","- **The ProjectV2 priority helper now establishes completeness instead of trusting a capped sample.** It follows cursor pages to a stable item-count/project-stamp snapshot, uses ordinal identity for GitHub node IDs and cursors, rejects truncated nested connections, treats a positive `-Limit` as a fail-closed ceiling, and derives PR priority from complete repository-aware closing links/body references. Before `-Apply`, it validates all option mappings and rebuilds the complete source-derived plan; any drift aborts before the first write, and a complete post-apply audit remains mandatory. Its authentication-free self-test covers the >1,000-item and failure boundaries.","- **The live project-priority cleanup is complete.** On 2026-07-27, the 130 previously unlabeled Taskdeck Issues were classified and verified 130/130 with exactly one Priority label (`I=5`, `II=9`, `III=2`, `IV=18`, `V=96`). External Issue references are visible non-authority: their labels never rank, external-only PRs derive `Priority V`, and an external closing Issue still permits same-repository body fallback. After the closing link reduced the plan to 141 real field drifts, the reviewed Apply succeeded 141/141; its built-in audit, two fresh pre-merge audits, and the final post-merge handoff audit each proved 1,472/1,472 items, 12 ignored external references, and zero remaining drift. PR #1488 merged as `84674979`, and issue #1458 plus both project items are `Done / Priority I`.","PR-queue clearing wave (2026-07-25, **8 PRs merged**, and the open-PR queue is down to one human-gated draft):","- **`#1469` (`#1462`) — the frontend `Proposal` type exposes `approvedRevisionId`,** declared **required** rather than optional because `MapToDto` always assigns it and the API serializes with default options, so an unpinned proposal arrives as an explicit `null` and never an absent key — which also turns a field-by-field rebuild that drops the pin into a compile error. Contract exposure only; no UI claim, per `#1298`. Held against a dead-code sweep by an exported type alias, because `tsconfig.app.json` excludes `src/tests/**` from typecheck (`#1468`, measured at **415** pre-existing errors when the exclusion is lifted).","- **`#1337` (`#1299`) — the permanent licensing posture is published.** `LICENSING.md` states the MIT-forever commitment for everything already shipped, the never-gated free boundary, and an additive-only posture for any future commercial module; `ee/` is reserved with a separately-licensed placeholder; DCO sign-offs are required in contributor guidance behind a SHA-pinned advisory CI job; MIT is declared in npm and all 11 `.csproj` files. The root `LICENSE` is deliberately unchanged. Name/trademark availability was researched and recorded on `#1299` (**no registered TASKDECK mark found in any register that could be queried** — USPTO, TMview and WIPO, each null result control-validated against a known-hit term; UKIPO's own register hard-blocked automated access, so GB coverage is indirect via TMview, which EUIPO states is not an official register. The real risk is **registrability**, not collision). Pre-commercial legal residuals — attorney registrability/TASKADE opinion, the UKIPO/EUIPO coverage gaps, perishable namespace reservations, and the keep-or-rename decision before `v0.1.0` — are tracked as **`#1482`**.","- **`#1477` + `#1481` (`#1123`) — the release pipeline is rehearsable without pushing a tag.** `create-release` had no condition and a bare `workflow_dispatch` resolved the version to the literal `refs/heads/main`, whose slashes broke packaging — so the pipeline could not be exercised at all before the one irreversible action `#1303` reserves to the maintainer. A blank-tag dispatch from a **branch** is now an explicit rehearsal (`v0.0.0-dryrun+`, builds, smoke-tests, uploads artifacts, publishes nothing); a tag push, a dispatch naming a tag, **or a dispatch whose ref is itself a tag** publishes. Rehearsed for real: all four platforms green, `create-release` skipped, **0 tags and 0 releases created**. Note the smoke test covers the **three runner-native RIDs** only — `osx-x64` is cross-arch on the arm64 macOS runner and ships with less release evidence than the other three.","- **`#1478` (`#1271`) — dogfooding is instrumented.** A dedicated `TASKDECK_DOGFOOD_DB` so dev/demo/E2E traffic cannot contaminate the signal, a read-only snapshot script (counts and dates only; safe to paste into an issue), a friction log, and a checkpoint rubric fixed before any real usage data existed. **The measured pre-dogfooding baseline is the finding:** 8 active days, none in the last 28, last activity 2026-04-23, 10 of 13 boards demo/test residue — sustained use has not started. But the loop itself works: **17 of 20 proposals reached Apply**, counted by `AppliedAt`. A status-based count reads 1/20, because `Dismiss()` accepts an already-`Applied` proposal and overwrites `Status` — so filing away a finished item erases the evidence it applied. Seven adversarial review rounds; residual activity-source accuracy questions consolidated on **`#1480`**.","- **`#1471`, `#1472`, `#1479` — canonical-doc and human-action hygiene:** the `#1462` residual list reconciled across both canonical docs (and a wrong measurement of my own corrected, 383 → **415**); `#1457`'s `/hooks` trust gate and the recurring merged-worktree prune recorded as human-only items, which no file previously tracked; `#1273`/`#1235` checked off on explicit maintainer instruction (a recorded rule-3 exception).","- **`#1295` CLOSED as superseded, not merged.** The deny-floor overlay failed **13 of 13 of its own bypass tests** and targeted global floor v1.3.0 against an installed 1.6.5. A repo-local overlay is still needed — **11 rule-classes are `allow` at every tier including T4** — so the full salvage plan, with acceptance criteria and the branch's 16 review threads retained as the successor's regression corpus, is recorded on **`#1293`**.","- **Repository hardening:** `main` previously permitted **force-pushes and deletions**; both are now blocked (deliberately relaxed otherwise — no required checks, no required approvals). The old project-priority helper silently truncated at 1,000 items; a one-off 1,444-item snapshot repaired 288 mismatched fields (`#1474`), but that was not durable proof of a clean project. The complete, fail-closed contract and the remaining label/data gate are tracked by `#1458`.","- **Backlog triage (`#1270`):** 12 already-decided issues closed with dated pivot notes, after an adversarial pass **bounced 13 of 25 proposed closures** — including `#1123`, the v0.1 ship-gate item. `#1270` itself stays open: two of its own acceptance criteria are obsolete against ADR-0044 and REVIVAL_PLAN §6 and must not be executed as written.","- **Seeded this wave:** `#1470`, `#1473`, `#1474`, `#1475` (the repo hook denies 6 of 8 *benign* commands), `#1476` (the configured-handler `smoke_test.py` / deny-floor matrix remains ungated; failure-ledger renderer synchronization now runs in Required Docs Governance), `#1480`, `#1482`, plus upstream `agent-harness#56` (`docker exec` is not unwrapped by the global floor at any tier).","- **Still open — producer/runtime-gated:** `#1457` is ready-for-review but cannot be salvaged in place: all four shared commits lack DCO sign-off, its v1.6.5 dispatcher pin is obsolete, five current Codex threads are unresolved, and no reviewed producer floor is both canonical and deployed. Rebuild a signed replacement from final `main` only after the agent-harness producer/deployment gate converges; then require exact-head automation/reviews followed by a fresh interactive `/hooks` trust session and handler-attributed allow/deny canaries.","Overnight wave (2026-07-23/24, **6 PRs merged** + 3 dependabot PRs — the four feature/substrate PRs below plus `#1447`, the docs sync that recorded the maintainer-merged `#1414` (its content is the 2026-07-18 post-merge comment further down), and `#1448` below; per-PR gate: two independent adversarial review lenses, all-severity findings fixed with posted evidence, full backend suite on the exact head where code changed, required CI green, bot window honored with a content sweep). The wave's own delivery sweep was `#1454`; `#1448`, `#1427`, and dependabot `#1441` merged *after* that sweep ran, so their entries below were added on 2026-07-25:","- **`#1439` (`#1428`, `#1424`) — the approved revision is pinned at approve time and Apply executes exactly it.** Approve reads the latest saved revision, validates it through the approve-time gates, and persists its id as `AutomationProposal.ApprovedRevisionId` (null pin = approved the original operations; a post-approval raced revision can no longer change what Apply executes — closes the `#1428` race). The migration backfills Approved proposals to their latest revision saved **at or before `DecidedAt`** (an explicit, reviewed reversal of latest-revision parity: the invariant is \"Apply executes exactly what the approver saw\", so a raced post-decision revision is never backfilled; empirically-proven SQLite text-format comparison). Single-proposal read/decide paths return the EFFECTIVE operation set with `Presentation` rebuilt from it (`#1424`); Rejected proposals freeze to the latest revision saved at or before decision time; the MCP terminal stored preview is suppressed whenever an effective revision applies (one payload can no longer carry revision operations beside an original-operations `DiffPreview`). Full suite on head: 7430/0/1. **`#1444` closed this residual:** the review-queue **list** endpoint now returns the same EFFECTIVE operations and rebuilt `Presentation` the single reads do, so a queue card can no longer disagree with the detail view, the diff and Apply. The former \"list maps originals\" boundary existed only to avoid a per-proposal revision query; a two-phase batched read (payload-free metadata for the page, then payloads for the winning revisions only) removes that cost without loading revision payloads the reader will not use, and both read shapes now select through one shared dispatcher. **`#1462` closed the frontend half** (PR `#1469`, merged 2026-07-25): the `Proposal` type in `types/automation.ts` now exposes `approvedRevisionId` (contract only — no UI claim, per `#1298`), declared **required rather than optional** because `MapToDto` always assigns it and the API serializes with default options (bare `AddControllers()`, no `DefaultIgnoreCondition`), so an unpinned proposal arrives as an explicit `null` and never an absent key — which also turns a field-by-field rebuild that drops the pin into a compile error. It is held against a dead-code sweep by an exported type alias because `tsconfig.app.json` excludes `src/tests/**` from typecheck. Remaining tracked residuals: `#1453` (reject-time pin: the `RevisedAt <= DecidedAt` heuristic is not commit-visibility; display-only), `#1464` (the review surfaces' \"recorded operations show the original submission\" caveat is inverted now that list reads are effective-set-aware; terminal proposals only — now unblocked by `#1462`), `#1465` (dismissing a rejected proposal drops its decision-time frozen revision back to the originals), `#1467` (the list resolution is bounded in bytes but not in row count, and reads proposal state and revision rows from two snapshots; display-only), `#1468` (frontend specs are never type-checked — lifting `src/tests/**` from `tsconfig.app.json` and running `npm run typecheck` surfaces **415** pre-existing errors, all of them under `src/tests/`, against a clean baseline of 0), `#1470` (`docs/architecture/DATA_MODEL.md` omits `ApprovedRevisionId` and `DeferredUntil`, and the \"855 lines, 37 entities\" figure describing it is stale — the file is 897 lines, and the figure lives in three historical delivery-ledger entries rather than in the document itself; find them with `grep -rn \"855 lines, 37 entities\" docs/`).","- **`#1449` (`#1445`) — the nightly k6 Performance Regression Gate is recalibrated to same-code runner variance.** The gate had gone red 3 of 5 nights on an identical main SHA (board-write p95 observed 2.0–3.0 s either side of the old 2200 ms threshold; 2 of the 5 nights passed, and even a passing night cleared the gate by only ~10%). Tail gates moved to global p99 < 5000 ms / board-write p95 < 4500 ms (~1.5–1.7× worst observed-good; calibration evidence inline in the script comment), the 2000 ms measured-capacity warning retained, warning-band edges now pinned by tests (7/7), and every doc/contract mirror synced. The write tail itself (median ~12 ms, p90 1–2 s at 20 VUs — SQLite write convoy) is tracked as `#1446`, including the sub-order-of-magnitude masking window this calibration accepts. **Confirmed on the first post-recalibration night:** the 2026-07-24 06:06Z nightly (run `30071303816`, on `36d563d7`) passed the Performance Regression Gate, against 3 reds in the 5 nights before it. One passing night is not yet a trend — a fresh red is now real signal and should be read from the k6 numbers before any threshold is touched again.","- **`#1451` (`#1438`) — `AuditLogRepositoryIntegrationTests` moved onto the workerless factory** (`#1391` family): the live `AuditRetentionWorker` startup pass can no longer race the ordering test's backdated seeds in full-suite runs; 6× consecutive class runs green. Seeded `#1452`: no test anywhere exercises the retention worker's real `ExecuteAsync` startup path (pre-existing gap a flake had been masquerading as).","- **`#1427` (`#1313`) — the LLM quota-reservation lifecycle is hardened, and a client can no longer erase its own billed usage.** The security half (M1): the streaming and non-streaming `ChatService` surfaces plus the extractor now finalize with `CancellationToken.None` and settle in `finally`, so a client that aborts mid-stream after tokens are billed — including the read-one-token-and-disconnect variant — can no longer discard its own usage record (previously client-controllable). Alongside it: a TTL-swept reservation's real billed tokens are recovered into a committed row instead of being silently dropped (F1, idempotent, warns); `ReservationEstimatedTokens` is floored at 1 so a reservation can never be invisible to the token/global budget sums (F2); the capture-triage reservation settles in `finally` (F4); the release paths are pinned by tests (M2) — provider-throw, zero-token, no-LLM bootstrap, board-context-build throw, and a provider yielding only an error event all **release** the reservation, while cancel-after-billed-tokens is pinned to the **opposite** invariant (`StreamResponseAsync_CancelledAfterBilledTokens_ShouldCommitNotRelease`): once tokens are billed, cancellation must commit and must never release, because releasing there is precisely the bypass M1 closes; and reservation cleanup now wraps request/board-context construction, so a setup failure releases instead of leaking until TTL (Codex P2). **The check-then-insert atomicity guarantee is explicitly NOT closed here** — it was proven not closeable in-process (the reservation over-admits even under a global full-span lock, because of cold-start WAL `-shm` read-visibility), so the redesign it needs (eager `-shm` warm-up, or non-snapshot enforcement) is deferred to `#1435` and routed to the maintainer; the concurrency-guarantee tests are skipped pending that issue, which is why this hardening ships green. Merged on the maintainer's explicit merge-with-tracked ruling; residual review P2s tracked as `#1431`.","- **`#1448` — FRUGALITY MODE is now *in* the Fable overnight manual** (`docs/agentic/OVERNIGHT_LOOP.fable.md`) instead of being re-pasted into each launch prompt, per the enforcement-ladder rule that an amendment surviving two runs belongs in the manual. Its review round also produced a reusable structural lesson: Codex found sampling-exemption classes one at a time across three rounds, and a single allowlist inversion — only pure mechanical-motion packets are sampleable, while suite/CI verdicts and reviewer/settlement packets never are — closed the whole class at once.","- **Dependabot:** `#1443` (.NET 8.0.28 → 8.0.29 patch train + Test.Sdk 18.8.1) and `#1440` (npm minor-patch group incl. vue 3.5.40) merged green. `#1441` (actions group) was staged green and then **merged on explicit maintainer authorization** — workflow-file PRs remain maintainer-merge-only. `#1442` (pinia 3→4 MAJOR) was genuinely red and is **closed to snooze**; the migration slice it actually needs is tracked as `#1455` rather than rubber-stamped.","- **Review-bot estate note:** the consumer Gemini Code Assist GitHub integration is sunset (its farewell notice now posts on every PR) and Copilot review is quota-exhausted — Codex is currently the only live external review bot; the in-house two-lens adversarial pass carries correspondingly more weight.","","Frugal wave (2026-07-18, wave #2 — the follow-on to the approve == apply trust-class closure wave below; **2 PRs merged** — per-PR gate: independent adversarial review, all-severity findings fixed, required CI green):","- **`#1430` (split from `#1379`) — artefact extraction is now bounded by a permit/concurrency gate.** A new `ArtefactExtractionGate` (Application singleton) takes a non-blocking permit before the parse worker spawns and releases it on both the completed and abandoned paths (a runaway parse holds its permit for its full lifetime); saturation ⇒ a pre-parse `TooManyRequests` with no history row and no new thread. The bound is `ExtractionMaxConcurrency` (`int`, default 2, `[Range(1, 64)]`, startup-validated). This is the verified-sound permit half split out of the parked `#1417` extraction-resource-ceiling work; the decompression-bomb containment half is deliberately **not** here — PdfPig 0.1.15 decodes xref streams with a hard-coded provider before any injected ceiling exists, so a provider-injection ceiling is bypassed (proven on `#1417`) — and continues under `#1429`. Adds **ADR-0047** (artefact-extraction resource bounding: permit gate + provider-injection ceiling as ObjStm-covering defense-in-depth with the documented xref gap) and **ADR-0048** (decompression-bomb containment boundary: a memory-capped extraction worker process — Job Object on Windows / cgroup under Docker — reversing the earlier sidecar rejection on the new evidence).","- **`#1432` (`#1426`) — `ValidatePermissionsAsync` always gates board access, even for an empty operation list.** The engine previously short-circuited an empty operation list to `Result.Success()` with the board half of the access gate skipped (`boardId` forced to `null`), silently treating an operation-less proposal as permitted and forcing every new consumer to bolt on its own board-access fallback (the `#1415`/`#1425` trap). Now the full requester/board access gate always runs; only the per-operation contract validator is skipped when the list is empty. Emptiness itself is still **not** rejected here by design (a legitimate transient shape for revise-into-validity, `#1423`) — the \"at least one operation\" rejection stays with the structure gate, which runs before permissions in every approve/apply/diff/executor chain, so **approve == apply is unchanged** and the change is strictly additive restriction (a previously-`Success` empty-op result can only become a denial). Chosen over forbidding zero-op proposals at create, which would break the create-empty-then-revise flow `#1423` pins.","- **Nightly k6 confirmed GREEN:** the first nightly run after the `#1359` repair (run `29632619187` on `326b6b5b`) passed, and the `#1359` failure-ledger row was flipped to resolved (commit `4fdae133`).","- **Seeded this wave:** `#1429` (memory-capped extraction worker process — the ADR-0048 containment boundary), `#1431`, `#1433`, `#1434`, `#1435`, `#1436`. `#1427` (LLM quota-reservation robustness hardening, `#1313`) sat in the final review gate at the close of this wave and **has since shipped** — see the 2026-07-23/24 wave above; its atomicity redesign remains open as `#1435`.","- **Standing human-gated holds:** `#1337` (licensing pack — blocked on human-only trademark/name clearance) and `#1295` (deny-floor overlay). On 2026-07-25 the maintainer dispositioned `#1295` explicitly: **keep the evidence, return the PR to draft, retain the human gate, and do not revive it in place.** The branch is conflicting and hundreds of commits behind `main`, all 16 review threads remain unresolved (11 still current, including command-wrapper, root-delete, SQL/container, npm-executor, and Windows parsing bypasses), and its delegation model targets a global floor version the installed floor has long since moved past — so its old green checks establish nothing about current behavior. If `#1293` proceeds, the smallest Taskdeck-specific overlay is to be rebuilt from current `main` once the chosen agent-harness floor is itself reviewed and stable; conflict churn on the ancient branch is not the path.","Approve == apply trust-class closure wave (2026-07-18, **6 PRs merged** — per-PR gate: independent adversarial review, all-severity findings fixed, required CI green): closes the \"a user approves or previews something the executor will then refuse\" (preview == apply) trust-violation class on the server, across the diff, approve, and MCP surfaces (the `#1370`→`#1374`, `#1376`→`#1395`, `#1398` chain).","- **`#1413` (`#1398`) — the proposal diff now runs Apply's permission/existence gates.** `GetProposalDiffAsync` (both the revised-payload and original-operations paths, before the cached-`DiffPreview` fast-path return) now calls the same `ValidatePermissionsAsync` Apply calls: requester-exists → `404`, board-exists → `404`, board-access → `403`, then the operation-contract validator. Closes the third and last asymmetry from the `#1395` parity round — a reviewer whose board access was revoked (or whose board/requester was deleted) mid-review previewed a clean `200` then failed at Apply. Status-agnostic on purpose: terminal proposals no longer disclose stored board-derived content on preview — access errors (`403`/`404`) surface once the earlier structure/expiry gates pass (a preview denial, stricter than Apply's idempotent short-circuit); an expired, access-revoked proposal still reports expiry first (pinned by `GetProposalDiffAsync_ShouldReportExpiry_NotForbidden_WhenExpiredAndAccessRevoked`).","- **`#1423` (`#1416`) — Approve runs Apply's structure + permission/contract gates before committing the transition.** `ApproveProposalAsync` validates the effective (revision-aware) operation set: structure → `400`, expiry → `409` (the existing domain-transition contract, deliberately not the diff path's `400` shape), permissions/contract → `400`/`403`/`404`. A zero-op or access-revoked proposal that used to approve `200` and only fail at Apply now fails at approve. Gate ordering (structure → expiry → permissions) mirrors diff/apply; only `PendingReview` runs the gates. Seeded `#1424` (approve/get DTO returns original ops even when a revision exists).","- **`#1425` (`#1415`) — the MCP `proposal_detail` preview is gated through the diff path.** It no longer emits the raw stored `DiffPreview`: open proposals route through the fully-gated `GetProposalDiffAsync`; decided/terminal proposals serve the stored preview but re-check requester/board access via a new `GetTerminalProposalStoredPreviewAsync` seam, so a reviewer who lost board access is denied the stored preview instead of reading stale board contents through it. The payload gains a `diffPreviewSource` provenance marker (`\"live\"` vs `\"stored\"`).","- **`#1421` (`#1403`) — SQLite timestamp bounds are parameterized so zero-fraction boundary rows compare correctly.** EF trims trailing fraction zeros (a whole-second instant stores as `...00:00:00+00:00`, no `.`), so the old fixed-width `.fffffff` bound strings mis-sorted at the exact boundary tick. `AuditLogRepository` (`CountByDateAsync`/`DeleteOldEntriesAsync`/`BuildSqliteQueryAsync`) and `OAuthAuthCodeRepository` (`DeleteExpiredAsync`/`TryConsumeAtomicAsync`) now pass `DateTimeOffset` predicates, UTC-normalized (`.ToUniversalTime()`) so the offset-preserving mapping can't mis-compare non-UTC bounds. Seeded `#1422` (repo-wide sweep of remaining timestamp seams).","- **`#1420` (`#1409`) — removed the dead `ApiKeyService.ValidateKeyAsync` usage-recording path** and its `ApiKey.RecordUsage()` domain helper (zero production callers; a dual-writer trap — MCP auth records usage via `ApiKeyMiddleware`'s `ExecuteUpdateAsync`). `LastUsedAt` is untouched.","- **`#1419` (`#1418`) — test isolation:** `WorkspaceApiTests` moved onto `HostedWorkerDisabledTestWebApplicationFactory` so the live capture-lane worker can't claim a seeded `Processing` row mid-test (the `#1335` boundary). Test-only.","Overnight correctness + test-reliability wave #2 (2026-07-17, **7 PRs merged** — per-PR gate: independent adversarial review, all-severity findings fixed, required CI green; the late-evening/overnight follow-on to the 11-PR sweep below):","- **`#1394` (`#1335`) — hosted-worker test-isolation factory.** A new `HostedWorkerDisabledTestWebApplicationFactory` strips app-assembly hosted services from the test host via a shared predicate (also asserted by a dedicated guard test); adopted by `LlmQueueRepositoryIntegrationTests`, `OutboundWebhookDeliveryRepositoryTests`, `AutomationProposalRepositoryIntegrationTests`, and a new `ProcessNextClaimRaceTests` (split out from `QueueClaimRaceTests`, whose CaptureTriage cases need live workers). Kills the hosted-worker pre-emption flake family in full-suite runs.","- **`#1391` (`#1383`) — AuditRetention integration determinism.** `AuditRetentionRepositoryIntegrationTests` adopts the workerless factory and is hardened (`BackdateEntryAsync` asserts affected==1, InvariantCulture, `ReloadAsync` read-back) — root cause was the live `AuditRetentionWorker` startup pass (90-day cutoff) racing 100/200-day backdated seeds. Empirically pinned the EF SQLite `DateTimeOffset` storage format: `yyyy-MM-dd HH:mm:ss.FFFFFFFzzz` (trailing zeros trimmed).","- **`#1392` (`#1332`) — deterministic Redis dispose-vs-connect seam.** `RedisCacheServiceTests` now reaches the connect seam through a dedicated named background `Thread` instead of `Task.Run` (eliminates the thread-pool-saturation flake) and disposes its `ManualResetEventSlim`s. Test-only.","- **`#1395` (`#1376`) — proposal diff now runs apply's structure and expiry gates on every path.** `AutomationProposalService.GetProposalDiffAsync` runs the same gates apply runs (structure, then expiry) on all diff paths including the cached-`DiffPreview` fast path — expired → `400` \"Proposal has expired\", zero-op → `400` \"Proposal must contain at least one operation\" (was `200`/`404`). Extends the `#1374` preview==apply parity contract for the structure/expiry/cached-preview paths; full parity still excludes apply's `ValidatePermissionsAsync` access/existence gates (tracked below). Seeded `#1397` (frontend expired/zero-op preview UX + coverage) and `#1398` (fold `ValidatePermissionsAsync` access/existence gates into diff — the third asymmetry).","- **`#1396` (`#1387`) — buffered account-export extraction-history N+1 removed.** A new `IArtefactExtractionRepository.GetByArtefactsForUserAsync` batch method (user-scoped IN query, 900-id cap, SQLite TEXT-ordering parity with the old paged path) is fed by the export's 500-id chunks. Seeded `#1399` (the streaming-path N+1, which needs a streaming-safe design).","- **`#1400` (`#1393`) — production timestamp culture-invariance.** InvariantCulture on 5 hand-built SQLite timestamp string sites (`AuditLogRepository` CountByDateAsync/DeleteOldEntriesAsync + `DateOnly.Parse`; `OAuthAuthCodeRepository` TryConsumeAtomicAsync/DeleteExpiredAsync, now also `.UtcDateTime`-normalized; `KnowledgeFtsSearchService` CreatedAt parse) with hostile-culture regression tests. Seeded `#1403` (the fixed-digit vs EF-trimmed boundary residual).","- **`#1401` (`#1384`) — MCP per-key rate budget charged once, at the right point.** The 60/min per-key budget is now spent inside `ApiKeyMiddleware` immediately after key resolution, BEFORE the Users lookup + `UpdateLastUsedAsync`, so valid over-quota keys no longer drive auth-stage DB work; the endpoint-stage policy is removed (one budget, checked once) across both co-hosted and standalone pipelines; the `#1381` pre-auth-IP-budget semantics and the `429` contract are preserved. Seeded `#1402` (`UpdateLastUsedAsync` silently never persists — a swallowed EF translation failure) and `#1404` (stale-owner-key IP-budget escape).","- **Seeded this wave:** `#1397`, `#1398`, `#1399`, `#1402`, `#1403`, `#1404`. **Still open — NOT shipped:** `#1386` (wave-1 final review round) plus the standing human-gated holds `#1295` (deny-floor overlay), `#1337` (licensing pack), and `#1359`.","Overnight substrate + correctness wave (2026-07-17, **11 PRs merged** — per-PR gate: independent adversarial review, all-severity findings fixed, required CI green; full backend suite reported 7223 passed / 0 failed / 1 skipped post-`#1373`):","- **`#1373` (`#1282`) — the API test factory now mirrors production SQLite settings.** A new shared `UseTaskdeckSqlite` registration helper in Infrastructure is used by BOTH production DI and the integration test factory, so WAL/busy-timeout drift between them is now structurally impossible; retires the `test/sqlite-concurrency` ledger flake.","- **`#1375` (`#1298`, REVIVAL-02 Phase-1 ship gate) — removed the fake Paper review undo timeline** and replaced the reversibility copy with factual apply-risk guidance (\"Apply considerations\"), while the confidence label now renders \"Operation safety\"; the stable side-effect wire shapes are preserved for GP-03. Full contract detail is in the 2026-07-17 REVIVAL-02 note directly above — not duplicated here.","- **`#1374` (`#1370`; seeded `#1376`) — proposal preview aligned with apply for reorder/collision/structure.** The clamped reorder position is surfaced in the diff, create-card id collisions fail at validation with a stable `409`, and a shared `ProposalOperationStructureValidator` runs before original-proposal diffs (one source of truth with Apply). A true preview==apply parity contract test was added.","- **`#1372` (`#1367`) — the standalone MCP host-security guard now mirrors `HostFilteringMiddleware` exactly.** It fails closed on all zero-host `AllowedHosts` shapes (`\";\"`, `\";;\"`, blank) while preserving port-suffixed / whitespace-bearing literals; a new in-process standalone-host integration test carries a mutation proof.","- **`#1377` (`#1357`) — the concurrent-migrator test asserts final schema state** (any-`SqliteException` collision signature, at most one fault, exact `__EFMigrationsHistory` equivalence) instead of no-throw; adds a deterministic fail-open collision test and an `AcquireLock` exclusivity contract test (internal seam). Retires the windows-latest migrator flake.","- **`#1378` (`#1369`; `#1379` expanded to a hard wiring gate) — artefact extraction is bounded by a wall-clock budget** (`Artefacts:ExtractionTimeoutSeconds`, default 30s) with warning-bearing `extraction-timeout` history rows and abandoned-task handling; real PdfPig / plain-text extractors are exercised through the budgeted path.","- **`#1362` (`#1274`, P-I ship gate; seeded `#1363` earlier, `#1380`, `#1382`) — core E2E is re-pointed at Paper-default sessions** with explicit frozen-Legacy opt-outs (builds on the 2026-07-14 Paper-default alignment paragraph above, which it does not restate). Adds full axe WCAG 2.1 A/AA on Home/Today/Inbox/Review/seeded Board/Login, a real capture → review → apply lane with a hard-asserted confirmation dialog, a `PaperBoardCard` nested-interactive fix + focus-follows-selection, `--faint` token contrast floors, and a Boards shortcut ledger.","- **`#1366` (`#1365`, `#1371`) — the presence stress test proves join/leave broadcast delivery** (not just tracker membership) with fail-closed controls; 15/15 consecutive runs post-`#1373` parity.","- **`#1385` (`#1355`) — buffered account-export artefact blob loads are now batched.** A new `SourceArtefactRepository` batch blob-load feeds the buffered GDPR export in bounded chunks (idiomatic `Chunk()`), with a batch-id-count guard against the SQLite parameter limit (pass-side boundary pinned at 900 ids) and export-JSON round-trip + missing-blob contract tests. Closes the LOW efficiency finding seeded from the `#1341` security review.","- **`#1381` (`#1368`) — the MCP pre-auth per-IP limiter is now a failure budget with admission control.** Budget is spent only on authentication failures (successful auth never consumes, so multiple keys behind one egress address keep independent per-key budgets); an exhausted address is rejected before the API-key lookup via non-consuming inspection; a per-IP concurrency gate (`RateLimiting:McpAuthenticationPerIpConcurrency`, default 16) caps in-flight pre-auth work; consumption is abort-proof (an auth-failed marker set before the 401 write is consumed in a `finally`, so abort-storms still spend budget); trusted forwarded headers now also apply to the standalone MCP host (default OFF — XFF is never trusted from an unknown peer).","- **`#1390` — same-night hotfix of the `#1377` fail-open collision test.** The barrier design flaked an unrelated PR in the opposite direction of the flake it covered (run 29552875836: fast runners let the winner finish the whole chain before the loser applied anything, failing the required-collision assertion). The test now stages the interception structurally — migrator A runs alone until `__EFMigrationsHistory` polling proves it mid-chain, then B is released — and a pathological staging miss passes gracefully with a loud `WARNING: STAGING MISSED` diagnostic, so the test can never flake an unrelated PR again.","- **Seeded follow-ups:** `#1376`, `#1379`, `#1380`, `#1382`, `#1383` (AuditRetention flake), `#1384`, `#1387`, `#1388`. **Still open — NOT shipped:** `#1386` (final review round in flight), plus the standing human-gated holds `#1295` (deny-floor overlay), `#1337` (licensing pack), and `#1359`.","Revival + generalist-expansion wave delivery (2026-07-13, **15 PRs merged** — the revival/GEN direction is now live on `main`; per-PR review gate: independent adversarial reviews, all-severity findings fixed, real merge conflicts resolved, required CI green after the `#1352` CI-Extended fix):","- **Direction ratified:** `#1296` (ADR-0044 revival pivot — open-beta direction + REVIVAL_PLAN spine + canonical doc sync), `#1328` (ADR-0046 generalist expansion — artefact intake + dossiers, Phase 4; the twin generalist app stays deferred behind the GEN-12 `#1326` evidence gate), `#1312` (ADR-0045 LLM transcript-triage engine, REVIVAL-08 M1). **ADR-0044 / ADR-0045 / ADR-0046 are all now Accepted.**","- **Generalist expansion (GEN wave, ADR-0046):** `#1341` GEN-01 artefact-storage foundation (immutable user-owned `SourceArtefact` + blobs; claims-scoped, IDOR-safe upload/download/delete with a race-safe in-transaction board-access recheck; streaming size caps preserving HTTP 413; magic-byte content validation; FK cascade + GDPR export/delete — independently security-reviewed, no CRITICAL/HIGH) → `#1346` GEN-02 bounded local text extraction (plain-text / Markdown / PdfPig, immutable warning-bearing extraction history); `#1339` GEN-05 apply due dates + labels from proposals (closes the extract-but-unappliable gap — also fixed a latent bug where a tautological guard silently cleared a column's WIP limit on *every* reorder, and made proposal reorder atomic/lossless with the destination position shown in the approval diff); `#1340` GEN-09 untrusted-artefact threat model + injection canaries; `#1342` GEN-10 generalist-friendly guided navigation.","- **Revival (ADR-0044):** `#1334` REVIVAL-01 registration gating by deployment mode (Open / InviteOnly / Closed; operator-minted bootstrap invite; new `AddRegistrationGating` migration) → `#1344` REVIVAL-05 Paper first-run onboarding (real capture → reviewed proposal → board-apply milestone; fail-closed registration availability; theme-aware on-ember CTA contrast + restored Legacy focus ring); `#1329` REVIVAL-04 self-hosted Paper fonts + branding metadata; `#1331` README rewrite for the revival beta; `#1333` de-stubbed the fabricated Today dossier (`#1272`, latest-request-wins guard).","- **Infra / harness / ops:** the maintainer first merged the linchpin `#1352` (systemic CI-Extended reusable-workflow permission `startup_failure`, `#1330`) plus dependabot `#1351` / `#1349` to unblock the deck; this session then merged `#1294` (harness T3 region maps + skill read-first diet, `#1291`) and `#1336` (overnight human-action + failure-ledger record, `#1327`).","- **MCP HTTP security boundary (`#1338`):** standalone and co-hosted Streamable HTTP now share the only `MapMcp(\"/mcp\")` registration; API-key auth, telemetry, user-scoped resources, pre-authentication IP throttling, and opaque-key-ID rate limiting run on that exact route, while `/` is no longer an alternate MCP endpoint. The route explicitly disables browser CORS. Standalone defaults to loopback and replaces blank or any-host configuration (`*`, `0.0.0.0`, `[::]`, including mixed lists) with an exact loopback allowlist; remote binds require explicit host configuration and TLS termination.","- **Seeded follow-up:** `#1355` (batch the buffered-export artefact blob loads — LOW efficiency finding from the `#1341` security review). **Human-gated, NOT merged:** `#1295` (deny-floor overlay — 16 unresolved review threads including a CRITICAL, needs remediation) and `#1337` (licensing pack — blocked on human trademark clearance).","","","","","","","Wave-6 backend + run-story delivery (2026-06-26, **3 PRs merged**; full review gate per PR — independent adversarial reviews, all-severity findings fixed, Codex bot threads resolved, fresh green CI + aging):","- **`#1236` (`#1195`) — bounded the `LlmQueueToProposalWorker` status reads at the database.** Replaced the unbounded `GetByStatusAsync` worker reads with **type-aware in-query bounded reads** (`GetOldestPendingNonCaptureAsync` / `GetOldestProcessingCaptureAsync` + `CountPendingNonCaptureAsync` / `CountProcessingCaptureAsync` for true backlog telemetry). Two adversarial reviews + Codex independently caught a **HIGH starvation regression** in the original generic-limit design (bounding raw status before the request-type filter lets older untriaged capture rows starve non-capture automation work) → re-architected to predicate-in-query bounded reads (SQLite raw-SQL `ORDER BY CreatedAt ASC LIMIT` + in-memory re-sort). The unbounded `GetByStatusAsync` is kept for full-set callers (health gauge, OpsCli) and is **GDPR-safe** (delete/export use `GetByUserAsync`). Seeded `#1237` (remaining unbounded Pending reads in `LlmQueueService`/`OpsCliService`).","- **`#1238` (`#1193`) — paged `CaptureService.ListAsync` from the database.** New capture-only `GetCapturesByUserAsync(userId, limit, offset)` (newest-first `ORDER BY CreatedAt DESC, Id`, SQLite raw + EF) replaces loading the user's entire `LlmRequest` history then filtering/paging in memory; a fetch-until-enough loop with a `seenIds` dedup guard keeps filtered queries correctly filled across OFFSET page boundaries. `GetByUserAsync` untouched → GDPR-safe. Seeded `#1239` (push board/status filters into SQL).","- **`#1240` (`#1131`) — made the self-contained desktop exe runnable without manually supplying a connector key.** `ShouldAutoGenerateConnectorKey(isProd, isHeadless) => !isProd || !isHeadless`: a desktop install (Production, not headless) auto-generates + persists the connector encryption key to `appsettings.local.json`; **headless Production (CI / container / Terraform) still hard-fails** without a supplied stable key (`backend.Dockerfile` sets `TASKDECK_HEADLESS=true` so every container image is classified headless). The AWS single-node Terraform `user_data` generates+persists the key onto the durable EBS data volume (refusing to regenerate when a DB already exists without a key), `scripts/backup.sh`/`restore.sh`/`restore.ps1` keep the key paired with the database, and a deep review loop hardened the persistence path against silent key loss (reuse a masked persisted key instead of overwriting it; self-heal a corrupt local config; case-insensitive + provider-lenient reads; read-vs-parse error separation; owner-only ACL on the restored key). **`ADR-0041`** records the decision. ~15 distinct review findings (1 HIGH + many P2) across 6 Codex rounds + a 2-lens adversarial sweep, all fixed with tests.","- **ADR added on main:** `ADR-0041` (desktop connector-key auto-generation; headless Production excluded).","- **Seeded follow-ups:** `#1237` (bound remaining unbounded Pending reads) **— shipped (`#1250`)**; `#1239` (push capture board/status filters into SQL) **— board pre-filter shipped 2026-06-30 (`#1254`); the status filter stays in-service (provenance-derived), so `#1239` remains open for that portion**. Shipped from earlier: `#1241` (Windows ACL on the desktop key file) **— 2026-07-02 (`#1263`)**. Still open from earlier: `#1242` (relocate persisted secrets to the durable app-data location).","Canonical UI + historical archive period (2026-06-13; direction superseded 2026-07-10):","- **Historical direction only:** from 2026-06-13 until ADR-0044 on 2026-07-10, the project direction was finish-for-personal-use, then archive, with no distribution. **That posture no longer controls execution.** The revival direction at the top of this file and `docs/REVIVAL_PLAN.md` are authoritative; previously de-scoped distribution work is re-triaged only where the ratified REVIVAL wave admits it.","- **Paper is the canonical UI AND now the DEFAULT theme** per **ADR-0038** — the **Wave-3 default-theme flip shipped 2026-06-27**: `paperThemeStore` defaults to `'paper'` (was `'off'`), the storage key is bumped to `td.paper.mode.v2` with a one-time migration (a deliberate pre-flip `paper`/`paper-night`/`auto` choice carries over; a stored `'off'` — the old default / never-opted-in — and absent/invalid fall through to the new `'paper'` default), and the legacy `.td-*`-selector E2E specs pin Legacy via `authSession` (`td.paper.mode.v2='off'`). Legacy stays reachable through the Appearance toggle. **Activation prerequisites shipped earlier (2026-06-19):** the `#1161` \"File away\" dismiss affordance (`#1219`), the shared review-actionability composable (`#1217`), light-theme straggler tokenization (`#1216`), and a **real in-app Appearance theme toggle** (`#1221`, `AppearanceSettingsView` at `/workspace/settings/appearance` — off / paper / paper-night / auto) which replaces the unlinked `/styleguide/paper` route as the reachable Legacy escape hatch. **Paper-review de-stubs now shipped (2026-06-27):** `onPreviewDiff` (`#1234`), plus `onDefer` (snooze 1h — net-new `DeferredUntil` timing field + `POST /api/automation/proposals/{id}/defer`, the proposal leaves the queue and resurfaces without expiring, **ADR-0042**) and `onReportBadSuggestion` (net-new content-free `ProposalFeedback` table + `POST /api/automation/proposals/{id}/feedback`, orthogonal feedback that never changes status, **ADR-0043**) — **which unblocked the Wave-3 default-theme flip, now shipped (see above).** **All new frontend UX work targets the Paper views; Legacy is frozen** (no new fixes). The ~26 routes without Paper variants keep rendering Legacy views inside the Paper shell after a contrast pass.","Archive-pivot delivery wave (2026-06-13, **17 PRs merged** across Waves 0–2, including 2 follow-on dependabot bumps `#1211`/`#1212`; **plus 4 follow-on PRs merged 2026-06-19** — `#1219`/`#1220`/`#1221`/`#1225`, see the \"Merged 2026-06-19\" sub-section below — for **21 total**; full review gate per PR — 2 independent adversarial reviews, all-severity findings fixed, Gemini/Codex/Copilot bot threads resolved, fresh green CI + aging):","- **Wave 0 — PR deck cleared (7 PRs):** dependabot npm `#1202` + nuget `#1203` group bumps; automation-chat composable cleanup `#1199` (isDisposed guard on the unguarded `loadBoardOptions().then()` continuation); false-green E2E re-enabled on real Paper selectors `#1197` (the 7 `fixme`'d specs cover features that exist under Paper — paper-night class, dark-Paper toggle, PaperShortcutsOverlay, workspace-mode selector); queue-claim race fix `#1200` (the raw-SQL claim now `Reload()`s so the returned DTO shows Processing instead of a stale Pending identity-map entity — seeded `#1209` for the remaining non-capture stuck-in-Processing sweeper gap); **SDK pin + Central Package Management `#1196` (ADR-0039)** — carried the `#1203` NuGet bumps into `Directory.Packages.props` and copied `global.json` into the backend Dockerfile; **ExpiresAt UTC convention `#1201` (ADR-0040)** — global `ConfigureConventions` DateTimeOffset materialization so SQLite reads come back UTC.","- **Wave 1 — decision + cheap foundations (3 PRs):** **ADR-0038 ratified — Paper is the canonical UI, Legacy frozen `#1207`** (STATUS + masterplan now state the canonical stack; storage-key migration deferred to the Wave-3 flip); `#1139` AC1 compose-secret quickstart docs `#1205` (README + `docs/ops/DEPLOYMENT_CONTAINERS.md` now name BOTH required secrets, since compose aborts on a missing `TASKDECK_CONNECTORS_ENCRYPTION_KEY`); `*.migrate.lock` gitignored + `.dockerignore` mirror `#1204` (the SerializedMigrator sidecar no longer dirties `git status` on every startup).","- **Wave 2/6 — Paper activation prerequisites + backend quality (5 PRs):** paper-night straggler tokenization `#1216` (`#1135` — KeyboardShortcutsHelp border + full-opacity WCAG focus ring; seeded `#1218` for the repo-wide `focus:ring-primary/50` contrast sweep); **shared review-actionability composable `#1217`** — extracted `isProposalApplyActionable` / `isProposalRejectActionable` / `isProposalApproveActionable` / `isProposalDismissable` / `isProposalStale` as pure functions in `useReviewProposals` so Paper and Legacy can never drift at the 24h-stale or Approved+expired boundaries (the `#1124` bug class is now fixed once, not twice), and de-stubbed the fabricated `4s · 1.2k tokens` author metadata in favour of the real `/confidence` value; dead-code removal `#1198`/`#1214` (see below); Redis lock-starvation fix `#1213` (`#1189` — dropped the in-lock retry loop and the 3s blocking Connect inside the lock; single attempt per throttle window → null/no-cache fallthrough, proven by deterministic regression guards); **one-command dev-up + clean-workspace scripts `#1208` (`#1140`)** — `dev-up.ps1/.sh` (dependency check, `%LOCALAPPDATA%` DB path to fix the CWD-dependent `taskdeck.db`, port-bound API via `--no-launch-profile --urls`, `/health/ready` poll, npm dev, optional `-Seed demo/demo123`) and `clean-workspace.ps1/.sh` (stray DBs/migrate-locks/logs, process-held-DB refusal), with recursive process-tree kill, live-PID-file refusal, and a `.migrate.lock` guard against deletion during an active migration; the dev-up DB-pinning path was live-smoke-verified before merge.","- **ADRs added on main:** `ADR-0038` (Paper UI canonical / Legacy frozen), `ADR-0039` (Central Package Management, SDK pin, 8.x dependency alignment), `ADR-0040` (global UTC DateTime materialization for SQLite).","- **Seeded follow-ups:** `#1209` (no sweeper recovers non-capture `LlmRequests` stuck in Processing) **— shipped 2026-06-30 (`#1256`)**; `#1215` (`FieldVerifier`/`DeterministicPreExtractor` registered-but-unconsumed after V1 removal) **— removed as dead code 2026-07-04 (V2 generator cancelled by the archive pivot; the transitively-orphaned `FuzzyTextMatcher`, `FieldVerificationResult`, `ExtractedEntity`, and the `Microsoft.Recognizers.Text` packages were swept with it)**, `#1218` (repo-wide focus-ring contrast sweep) **— shipped 2026-07-02 (`#1265`)**.","- **Merged 2026-06-19** (maintainer lifted the merge hold; all four shipped to `main` after 2 independent adversarial reviews, all-severity findings fixed, fresh green CI):"," - `#1219` (`#1161`) — Paper review \"File away\" dismiss affordance built on the `#1217` shared-actionability foundation (per-proposal filing rail in terminal states + bulk \"File away N settled\" + dual-purpose ⌫). Closes `#1161`."," - `#1221` — reachable in-app **Appearance** theme toggle (`AppearanceSettingsView` at `/workspace/settings/appearance`; off / paper / paper-night / auto), the reachable Legacy escape hatch that replaces the unlinked `/styleguide/paper` route — a Paper-activation prerequisite."," - `#1220` — canonical-docs reconciliation with the archive-pivot direction (14 Codex review rounds + 3 multi-agent drift sweeps; ~70 banner-vs-reality edges fixed)."," - `#1225` — `StackExchange.Redis` + `Microsoft.AspNetCore.SignalR.StackExchangeRedis` semver-major caps (dormant Redis under the archive pivot).","Dead-code removal (2026-06-13, `#1198`): deleted the unused `ProposalGeneratorV1` — the `IProposalGenerator` interface (incl. its V1-only `ProposalGenerationResult`/`GeneratedProposal` result DTOs), its sole DI registration, and its test class — after confirming **zero consumers** inject `IProposalGenerator` (the only non-definition reference was the DI line). This resolves the tracked partial-entity-tracking bug in `#1198` by removing the unreachable code path rather than patching it. The shared `FieldVerifier`/`IFieldVerifier` and `DeterministicPreExtractor`/`IDeterministicPreExtractor` utilities (V1 was their only consumer but each has standalone tests and DI registration) are retained for a future V2 generator. Build clean, Proposal-filtered backend tests green.","Security gate + hardening epic (2026-06-05/06, 5 PRs merged; **2 independent adversarial reviews per PR** plus Gemini/Codex bot reviews, all findings of every severity fixed or tracked, merges gated on green CI + aging):","- **#1132 (security gate + config hardening) delivered across 4 PRs**: a single ≥32-char JWT secret floor (`JwtSettings.MinSecretKeyLength`) with **fail-fast** registration (throws instead of silently no-op'ing auth) + CORS that **fails closed** in Production when no origins are configured (`#1169`, AC2/AC3); required **secret/dependency/SAST scans + the bundle-size budget promoted into the PR merge gate** (`#1170`, AC1/AC5), with **phased enforcement** per **ADR-0035** (gitleaks + bundle enforcing; dependency + SAST advisory pending baseline remediation) and the pre-existing Semgrep `pkg_resources`/`setuptools-82` crash fixed; a global default-deny `AuthorizationOptions.FallbackPolicy = RequireAuthenticatedUser` with an explicit `[AllowAnonymous]` audit (SPA fallback opt-out; the API-key MCP path now sets an authenticated principal in `ApiKeyMiddleware`) per **ADR-0036** (`#1176`, AC4).","- **#1133 (backend query perf, first slices — `#1171`)**: `NotificationRepository.GetByUserIdAsync` now pushes ORDER BY + LIMIT/OFFSET into SQL (SQLite raw-SQL path for `DateTimeOffset` ordering, fully parameterized, negative-clamp guard) instead of materializing every row; `.AsSplitQuery()` on `CardRepository` collection reads. SignalR-incremental-refetch and FTS card-search remain open on `#1133`.","- **#1131 AC1 (CLI hardening — `#1177`)**: the CLI provisions a connector encryption key on first run (CSPRNG 256-bit, atomic merge-preserving write under a cross-process mutex, `0600` perms, stderr-only diagnostics) so `taskdeck boards list` works on a clean machine; guarded the `Mutex` ctor against locked-down hosts and honored the documented `TASKDECK_CONNECTORS__ENCRYPTIONKEY` override. CLI authorization routing is **#1131 AC2** (deferred).","- **New ADRs**: `ADR-0035` (required security-scan merge gate), `ADR-0036` (default-deny authorization fallback). **Seeded follow-ups**: `#1172` (AccountDeletion notification paging), `#1173` (branch-protection registration of the new check contexts — a repo-settings action), `#1174` (per-advisory dependency allowlist / break-glass), `#1175` (security-baseline remediation incl. the `NuGet.CommandLine`-via-Recognizers.Text transitive, then flip dependency/SAST to enforcing), `#1178` (apply the CLI's `0600` + guarded-mutex hardening to the API `FirstRunBootstrapper`).","Post-audit correctness sweep (analysis 2026-05-31; landed as reviewed PR 2026-06-04): audited all 31 PRs merged since 2026-05-28 for CC 2.1.154–2.1.158 tool-channel corruption fallout. Results: **0 SUSPECT, 0 NO-OP, 31 CLEAN** — no corruption artifacts. Full build/test suite green (6,735 BE + 3,662 FE tests). Fan-out correctness review (4 agents, 219 tool calls) found 2 issues + 9 nitpicks, all addressed:","- **Fixes applied**: `useGlobalSearch` dispose-race guard on the success, catch, and finally branches (no reactive writes after teardown); `useCaptureQueueSync` fire-and-forget replays switched to `void replayQueue()` (replayQueue wraps its body in try/catch/finally and logs internally, so the prior empty `.catch(() => {})` was dead code); Ollama `appsettings.json` BaseUrl changed from empty string to `null` with a clearer validation message pointing at the real `Llm:Ollama:BaseUrl` section; `RoadmapInvariantTests` placed in a named xUnit `[Collection]` so any future TelemetryGuard-mutating test class in the same assembly stays serialized with INV-11; `AutomationMetricsController` TODO comment replaced with honest stub note referencing `#1142`.","- **PR #1160 review fixes**: two independent adversarial passes plus Gemini/Codex/Copilot bot reviews refined the sweep — the dispose-race guard was extended to the catch paths, the dead replay `.catch` became `void`, and the Ollama hint was corrected from the non-existent `LlmProviders:` path to `Llm:Ollama:BaseUrl`.","- **Documented**: `AutomationMetricsController.GetCohortMetrics` is a stub returning empty data — `CohortDashboard` frontend works but will show \"No cohort data available\" until `ICohortMetricsService` ships (tracked in `#1142`). `OllamaLlmProvider.StreamAsync` uses pseudo-streaming (complete-then-drip), not Ollama's native streaming API.","Cleanup/hardening wave (2026-05-31, 8 PRs merged, 2 issues closed; 2 adversarial review passes per PR with all findings of every severity fixed and all bot threads resolved):","- **Open-PR backlog cleared** (`#1143`–`#1147`): non-watch `vitest run` + MetricsView flake fix (`#1143`), docs-truth corrections (`#1144`), CI-aligned release scripts + stale PKG-01 warning removed (`#1145`), duplicate operation idempotency-key now returns **409 not 500** (`#1146`), `AsSplitQuery` on the multi-collection board read (`#1147`).","- **Proposal endpoint hardened** (`#1125`/`#1151`): new `ProposalOperationInputValidator` rejects malformed operation input (markup/binary `actionType`/`targetType`, non-JSON / oversized / over-nested `parameters`) with **400** at the shared create path, using a permissive identifier-format check so it never rejects legitimate planner/chat/capture/MCP operations. Adversarial review caught a self-introduced HIGH (a null `operations` element → 500) which was fixed before merge.","- **Roadmap invariants enforced** (`#1126`/`#1153`): INV-10 (MCP hash-pin), INV-11 (TelemetryGuard), INV-12 (provenance source spans) un-skipped with real assertions against the shipped services; only INV-09 (DataFlowRegistry, genuinely unbuilt) remains skipped. Surfaced that `McpToolDefinitionHashService` is registered but **not wired into the MCP runtime** (tracked `#1154`).","- **Swallowed audit failures surfaced** (`#1134` first slice / `#1155`): the 4 copy-pasted empty-catch `SafeLogAsync` (Board/Card/Column/Label) now route through a shared `AuditLogWriter` that logs at **Warning** on a thrown exception or a returned failed `Result`, keeping the never-crash intent.","- Seeded follow-ups: `#1149` (idempotency-key contract ADR), `#1150` (packaging-doc trim drift), `#1152` (Queue/V1 validator bypass), `#1154` (MCP hash wiring). `#1134` stays open for its remaining 6 acceptance criteria.","Continuous-cycle wave (2026-05-29, 19 PRs merged, zero open PRs): cleared the entire open-PR backlog with two adversarial reviews per PR and all findings (all severities, including bot comments) addressed.","- **RFAI roadmap complete**: RFAI-11 (`#983`/`#1079`, ambient channel — VS Code extension + voice prototype; voice composable is tested but not yet wired into any UI component) and RFAI-12 (`#984`/`#1080`, Ollama provider, ProvenanceDrawer, cohort dashboard shell) delivered. All 12 RFAI issues now shipped. **Note:** `CohortDashboard` frontend is wired but backend returns empty data (stub); `OllamaLlmProvider.StreamAsync` uses pseudo-streaming; `useVoiceCapture` has no UI integration yet. These are tracked in `OUTSTANDING_TASKS.md`.","- **Composable hardening**: unhandled promise rejections (`#1093`/`#1095`), cleanup/memory-leak fixes with `onScopeDispose` (`#1094`/`#1104`), FilterPanel aria-labels (`#1097`/`#1098`).","- **Identity/authz hardening**: an audit confirmed all 42 API controllers are claims-first with zero bypass risk; migrated `TelemetryController`/`EgressDisclosureController` onto `AuthenticatedControllerBase` (`#1109`/`#1111`) and added architecture guards enforcing per-action `[Authorize]`/`[AllowAnonymous]` (`#1110`/`#1116`).","- **Dependency wave**: nuget/npm minor-patch groups, YamlDotNet 18, and a dotnet group (EF8/9 split fixed) merged; FluentAssertions moved to the free **7.x** line (`#1088`) instead of paid v8; durable dependabot `ignore` rules added for EF Core and FluentAssertions majors (`#1112`, `#1118`) so those churns stop recurring.","- **Housekeeping** (`#1092`): STATUS.md contradiction fixed; v-for key stability (`#1107`/`#1108`); 112 stale stashes cleared and stale branches pruned.","
","Status Owner: Repository maintainers","Authoritative Scope: Current implementation, verified test execution, and active phase progress","## Project Summary","Taskdeck is a local-first execution system for developers, built with a .NET 8 backend and a Vue 3 frontend.","Core board workflows are stable, and advanced slices are implemented for automation proposals, chat, ops/log querying, archive recovery, and worker health reporting.","Rebranding thesis (2026-02-23):","- capture should be near-zero friction","- automation should remain review-first and provenance-visible","- product value is reducing maintenance overhead, not maximizing opaque autonomy","Bulk merge wave (2026-05-16, PRs `#1055`–`#1074`, 15 PRs, all with 2+ rounds of adversarial review):","- **Security hardening** (3 PRs): redirect handler buffer/header filtering (`#1055`), hardcoded encryption key removal + RBAC on abuse endpoints (`#1067`, SEC-31/SEC-32), health endpoint exception detail suppression (`#1068`, SEC-33)","- **Test coverage** (2 PRs): MFA, API Keys, Board Access controller tests (`#1069`, TST-62), ConnectorProviders API + useAutomationChat composable tests (`#1072`)","- **RFAI feature delivery** (5 PRs): `IProposalGenerator`/`FieldVerifier`/`ProposalGeneratorV1` (`#1071`, RFAI-03), revision endpoints + edit-before-approve flow (`#1058`, RFAI-04), Paper Review deep-dive frontend wiring (`#1062`, RFAI-05), egress disclosure API endpoint (`#1073`, RFAI-08), privacy insights API for proposal outcome cohorts (`#1074`, RFAI-08)","- **PAPER frontend** (2 PRs): Today dossier real backend API wiring (`#1056`, PAPER-08), narrow companions with sidebar variants + board snap scroll (`#1057`, PAPER-11)","- **Dependency updates** (3 PRs): `actions/dependency-review-action` 4→5 (`#1059`), npm minor/patch group 11 updates (`#1060`), NuGet minor/patch group 4 updates (`#1061`)","- Post-merge verification: 6,532 backend tests pass (0 failures), 3,267 frontend tests pass (0 failures), both builds clean","- Roadmap v4 RFAI progress: RFAI-01 through RFAI-09 now fully delivered (9 of 12 issues); remaining: RFAI-10 (PWA share-target), RFAI-11 (ambient channel), RFAI-12 (learning loop UI + beta gate)","- PAPER progress: PAPER-03 (shell), PAPER-08 (today dossier), PAPER-11 (narrow companions) now delivered; remaining: PAPER-05 (board/kanban surface)","Post-merge follow-up (2026-05-17, PRs `#1076`–`#1078` and `#1082`–`#1084`, 6 PRs merged after the bulk wave; `#1079`/`#1080` remain open):","- **RFAI-10** (`#982`/`#1078`): PWA share-target quick capture with offline queue, browser extension prototype, share captures preserved after auth rejection, ambiguous POST provenance fail-closed; issue closed","- **PAPER-05** (`#1001`/`#1083`): Paper board card drag E2E test with audit-log assertion","- **Bug fix** (`#1077`): Encoding artifact in PaperBoardCard drag handle","- **Test coverage** (`#1076`, `#1082`, `#1084`): MFA setup 409-Conflict integration test (`#1076`, TST-63), composable unit tests for inkBleed, reviewKeymap, useInboxOrchestrator, useReviewProposals","- Roadmap RFAI progress: 10 of 12 delivered; 2 remaining (RFAI-11 `#1079`, RFAI-12 `#1080`)","- PAPER progress: all 4 PAPER issues now delivered (PAPER-03, PAPER-05, PAPER-08, PAPER-11)","Agentic operating layer expansion (2026-05-11):","- Taskdeck now has a shared agentic protocol layer under `docs/agentic/` for blocker-question batching, failure/workaround capture, guide-update promotion rules, and skill routing.","- `autodoc/AGENT_INDEX.md` is the fast agent seam map for low-context orientation, context traps, and verification hints; it is a pointer layer, not canonical product truth.","- Codex and Claude skill mirrors now include `taskdeck-question-batch`, `taskdeck-failure-capture`, and `taskdeck-interface-map`.","- Claude project hooks now route dangerous shell-command checks and failed-tool capture through `scripts/agent_hooks/`, while preserving existing Taskdeck-specific pre-commit and PR-review reminders.","- Codex and Claude tool parity is explicit in `docs/agentic/AGENT_TOOL_PARITY.md`; Claude `.mcp.json` now mirrors the shared MCP baseline with OpenAI docs, GitHub, Context7, Playwright, Chrome DevTools, and Docker gateway access.","Paper backend gap delivery (2026-05-05, PRs `#1031`--`#1040`, 10 of 10 issues `#1015`--`#1024`):","- 10 Paper backend gaps delivered or merge-ready with two rounds of adversarial review per PR; ~480 new backend tests across the delivered set; bot review findings (Gemini Code Assist + Codex connector) addressed on delivered PRs","- **Today dossier backends** (4 endpoints on `TodayController`, required by PAPER-08 `#1004`):"," - Cadence aggregation (`#1015`/`#1031`): `GET /api/today/cadence?date=` returns 24-hour activity buckets with first/peak/last action timestamps; `CadenceBucket` and `CadenceSnapshot` value objects with cached `Empty()` singleton; queries `IAuditLogRepository`; 26 tests"," - Streak query (`#1016`/`#1032`): `GET /api/today/streak?days=90` returns 90-day streak with intensity buckets (quartile-based) and current/longest streak lengths; `StreakDay`/`StreakResult` value objects; server-side `GROUP BY` via `CountByDateAsync` (replaced 100k entity load after review); 61 tests"," - Seal day action (`#1017`/`#1037`): `POST /api/today/seal` and `GET /api/today/seal?date=` for idempotent day-sealing with `DailySnapshot` entity; EF Core migration with unique index on `(UserId, Date)`; `UnitOfWork` unique constraint handler for concurrent seals; CancellationToken threaded through all layers after review; 28 tests"," - Line for tomorrow (`#1018`/`#1035`): `GET /api/today/tomorrow-note?date=` and `PUT /api/today/tomorrow-note` for autosave-friendly upsert; `TomorrowNote` entity (500 char max); 204 NoContent for missing notes; concurrent upsert race-condition handling via `UnitOfWork`; 25 tests","- **Review deep-dive backends** (6 endpoints on `AutomationProposalsController`, required by PAPER-06 `#1002`):"," - Provenance rows (`#1019`/`#1039`): `GET /api/automation/proposals/{id}/provenance` returns `ProvenanceRowDto[]` with icon/key/value/weight; 26-entry icon map; weight bucketing from `ProvenanceField` confidence; FK migration added after review; `Math.Round` for confidence display; 41 tests"," - Side-effect analysis (`#1020`/`#1033`): `GET /api/automation/proposals/{id}/side-effects` returns 7-category breakdown (Cards/Subtasks/Comments/Activity/Notifications/Webhooks/Calendar) with active/passive tone and risk-based reversibility window (6h default, 3h for Critical); review fixed target-type checks and webhook-without-operations logic; 66 tests *[2026-07-17: the `windowMs` field is legacy review-attention metadata, not an undo capability — no revert endpoint exists; copy/semantics reframed to apply-risk guidance by REVIVAL-02 `#1298`, wire shape unchanged]*"," - Confidence breakdown (`#1021`/`#1036`): `GET /api/automation/proposals/{id}/confidence` returns 4-component weighted breakdown (Pattern match 0.30, Reach 0.20, Reversibility 0.35, Recency 0.15) with threshold and explanatory note; review fixed reach formula, promoted weights to static field, removed unused userId; 63 tests"," - Conflict detection (`#1022`/`#1040`): `GET /api/automation/proposals/{id}/conflicts` returns tone-classified Warn/Info/Ok rows for stale data, missing targets, projected WIP overflow, duplicate pending proposals, high-risk operations, outbound webhooks, active comments, multi-op card conflicts, and positive capacity/fresh-data signals; review fixed create-card false positives, JSON ValueKind guards, projected WIP accounting, missing-column detection, webhook event mapping, soft-deleted comment counts, and entity caching; 78 tests"," - Card history ledger (`#1023`/`#1034`): `GET /api/automation/proposals/{id}/history` returns per-card touch history with serial/event/age/status; bounded at 200 entries/card and 500 total; review fixed duplicate dedup, JSON property parsing, GUID single-pass, `InvariantCulture` formatting; 42 tests"," - Similar past decisions (`#1024`/`#1038`): `GET /api/automation/proposals/{id}/similar-past` returns 3 nearest-neighbour prior decisions with apply rate; board-scoped query (review fixed userId filter that excluded non-caller proposals); 200-proposal lookback limit; UTC week formatting; 50 tests","- New EF Core migrations: `AddDailySnapshots`, `AddTomorrowNotes`, `AddProvenanceEntities`, `AddProposalProvenanceForeignKey`, `ExtendProposalOutcomesForMetrics`","- New repository methods: `IAuditLogRepository.CountByDateAsync`, `IAutomationProposalRepository.GetTerminalByActionTypeAsync`, `IAutomationProposalRepository.GetPendingByOperationTargetAsync`, `ICardCommentRepository.CountByCardIdAsync`","Roadmap v4 second-wave delivery (2026-04-25, PRs `#989`--`#994` + `#995`):","- RFAI-02 (`#974`/`#989`): `IntentEnvelopeV1` domain spine with `SourceBlock`/`SourceSpan`, `IntentCandidate`, `EvidenceLink`, `TaskdeckProposalBatch`, `IIntentEnvelopeFactory` application interface, `IChatClient` adapter spike, handwritten `proposal-batch.v1.schema.json`; 117 tests; adversarial review fixed partial-write status transition bug, span length consistency, evidence fabrication prevention, nullable schema fields","- RFAI-06 (`#978`/`#990`): `IVectorIndex` and `IEmbeddingGenerator` application interfaces, `InMemoryVectorIndex` (cosine similarity + SIMD), `InMemoryEmbeddingGenerator` (FNV-1a hash), `EmbeddingBackfillService` with batch processing and stale vector pruning, `FallbackSemanticSearchService`, `EmbeddingBackfillWorker`; 61 tests; adversarial review fixed batch API usage, stale vector cleanup, unbounded memory growth","- RFAI-05 (`#977`/`#991`): `ConfidenceScore` value object, `FieldConfidence`, `SelfConsistencyQuota`, `SelfConsistencyPolicy`, `ConfidenceBucket`/`ConfidenceSource` enums, `ConfidenceAggregator`, `BrierScoreCalculator`; 136 tests; adversarial review fixed hash/equality contract violations, non-finite value rejection, BrierScore input validation","- RFAI-08 (`#980`/`#992`): `TelemetryGuard` with allowlist-based metric validation and ReDoS-safe regex, `EgressRegistry` with wildcard host matching and thread safety, `InsightMetric`/`InsightCohort` content-free records, eval harness framework (`IEvalCase`, `EvalRunner`, 12 seed cases); 108 tests; adversarial review fixed wildcard matching, thread safety, volatile field, unsupported type rejection; CI failure was pre-existing flaky test (fixed in `#995`)","- RFAI-03 (`#975`/`#993`): `ProposalProvenance`, `ProvenanceField` (extractive/inferred with confidence), `FieldVerificationResult`, `ProposalOutcome` (content-free decision ledger), `FuzzyTextMatcher` (Levenshtein sliding-window), `DeterministicPreExtractor` (Microsoft.Recognizers.Text), EF Core migration for `ProposalOutcomes`; 139 tests; adversarial review fixed verification-status/confidence consistency, provenance parent-ID validation, unbounded query limit","- RFAI-04 (`#976`/`#994`): `ProposalRevision` entity (immutable revision chain), `IProposalCompiler` interface, `CompilerValidationResult`, `OperationRisk` value object, `OutcomeType` enum, `UnsupportedOperationFailure`, `IProposalRevisionService`, EF Core migration for `ProposalRevisions` and `ProposalOutcomes`; 70 tests; adversarial review fixed DateTime→DateTimeOffset alignment, redundant cast, documented TOCTOU race","- Flaky CI test fix (`#995`): `Presence_RapidJoinLeave_EventuallyConsistent` replaced exact-count polling with stabilization-based assertions and range checks; timeout increased from 20s to 30s","Current constraints are mostly hardening and consistency:","- _(Historical — superseded first by the 2026-06-13 archive pivot and then by the 2026-07-10 revival pivot; the active execution order is `docs/REVIVAL_PLAN.md`, not `#972`.)_ `taskdeck-12-week-roadmap-v4.md` had been promoted from research input into the near-horizon planning spine via tracker `#972` and child issues `#973`--`#984` (RFAI complete 2026-05-29). The product framing it carried remains valid and unchanged: automation-originated board writes must stay proposal-first, manual board UI writes stay direct and auditable as user-manual activity, and outbound data flow must be guarded separately through the EgressEnvelope/disclosure/MCP-hash/telemetry controls.","- Roadmap v4 execution progress: **RFAI-01 through RFAI-12 fully delivered (12 of 12 issues — roadmap complete)**; RFAI-10 PWA share-target merged in `#1078`, RFAI-11 ambient channel in `#1079`, RFAI-12 learning loop in `#1080` (2026-05-29).","- Codex and Claude high-autonomy issue execution now have first-class local guidance: `.codex/README.md`, `.codex/memories/00_ACTIVE.md`, `.codex/skills/README.md`, `.claude/README.md`, `.claude/skills/README.md`, `docs/tooling/CODEX_AUTONOMY_RUNBOOK.md`, generalized worktree protocol, PowerShell git/worktree guards, GitHub helper scripts, Project v2 priority audit/sync support, and dedicated skills for batch orchestration, worktree issue workers, PR review loops, CI/conflict recovery, question batching, failure capture, and interface-map maintenance. A reusable Gitleaks workflow syntax issue in the summary heredoc has been corrected after the workflow began failing before job creation.","- ~~**security bug discovered 2026-04-03**: `#722` (SEC-20) — `ChangePassword` endpoint does not verify caller identity~~ **RESOLVED** (`#722`/`#732`, 2026-04-04): `ChangePassword` now derives userId exclusively from JWT claims; `[Authorize]` enforced; `UserId` removed from request body; `AuthController` inherits `AuthenticatedControllerBase`; 5 integration tests proving the fix","- security and identity behavior is converging but still not uniform across all controller families","- some UX/operator surfaces are functional but not yet keyboard-first or discoverability-first","- LLM flow now supports config-gated `OpenAI` and `Gemini` providers with deterministic `Mock` fallback for safe local/test posture; degraded provider responses are now structurally distinct (`messageType: \"degraded\"` + `degradedReason`) and the health endpoint supports opt-in probe verification (`?probe=true`); chat-to-proposal pipeline improvements delivered: `LlmIntentClassifier` now uses compiled regex patterns with word-distance matching, stemming/plurals, broader verb coverage, and negative context filtering for negations and other-tool questions (`#571`); parse failures now return structured hint payloads with closest-match suggestions and a frontend hint card with \"try this instead\" pre-fill (`#572`); dedicated classifier and chat-to-proposal integration test coverage added (`#577`); LLM-assisted instruction extraction now delivered (`#573`): OpenAI and Gemini providers request structured JSON output with a system prompt describing supported instruction patterns, parse the response into `LlmCompletionResult.Instructions`, and fall back to the static `LlmIntentClassifier` when structured parsing fails; `ChatService` iterates LLM-extracted instructions (supporting multiple proposals from a single message) and falls back to raw user message parsing when no instructions are extracted; Mock provider unchanged for deterministic test behavior; multi-instruction batch parsing now delivered (`#574`): `ParseBatchInstructionAsync` splits multiple natural-language instructions into individual planner calls, `ChatService` routes multi-instruction messages through batch parsing to generate multiple proposals from a single chat message; board-context LLM prompting now delivered (`#575`, expanded in `#617`): `BoardContextBuilder` constructs bounded board context (columns, card IDs, titles, labels) grouped per column and appends it to system prompts across OpenAI and Gemini providers via `LlmSystemPromptBuilder`; card IDs are included as first-8 hex chars so the LLM can generate `move card ` instructions; context budget increased to 4000 chars with single-query card fetch; **remaining gap**: conversational refinement (`#576`) remains undelivered; analysis at `docs/analysis/2026-03-29_chat_nlp_proposal_gap.md`","- managed-key shared-token abuse-control strategy is now explicitly seeded in `#235` to `#240` before broad external exposure","- testing-harness guardrail expansion from `#254` to `#260` is shipped; remaining work is normal follow-up hardening rather than the original wave","- rigorous test expansion wave seeded 2026-04-03 (`#721` tracker, 22 issues `#699`–`#726`): systematic codebase audit identified 25+ untested infrastructure repositories, zero tests on the central worker, 6 controllers with untested HTTP surfaces, and no golden-path integration test for the capture → proposal → board pipeline; execution is tracked in `docs/TESTING_GUIDE.md`; first delivery: infrastructure repository integration tests (`#699`/`#730` — 77 tests across 7 repo classes against real SQLite); **major wave delivery 2026-04-04** (PRs `#732`–`#739`, 8 issues, ~300 new tests): SEC-20 ChangePassword fix (`#722`/`#732`), golden-path capture→board integration test (`#703`/`#735` — 7 tests proving full pipeline), cross-user data isolation tests (`#704`/`#733` — 38 tests across all major API boundaries), LlmQueueToProposalWorker integration tests (`#700`/`#734` — 24 tests, previously zero coverage), controller HTTP integration tests (`#702`/`#738` — 67 tests covering 6 untested controllers, found 2 pre-existing bugs), proposal lifecycle edge cases (`#708`/`#736` — 74 tests for state machine/expiry/race conditions), OAuth/auth edge cases (`#707`/`#737` — 44 tests, found and fixed `Substring` overflow bug in `ExternalLoginAsync`), MCP full resource/tool inventory (`#653`/`#739` — 9 resources + 11 tools with 42 tests, GP-06 compliant, user-scoping gap fixed during review); **second wave delivery 2026-04-04** (PRs `#740`–`#755`, 8 issues, ~586 new tests with two rounds of adversarial review, 47 review-fix commits): domain entity state machine exhaustive tests (`#701`/`#740` — 174 tests across 7 entities: CommandRun, ArchiveItem, ChatSession, UserPreference, NotificationPreference, CardLabel, CardCommentMention), SignalR hub and realtime integration tests (`#706`/`#751` — 19 tests covering auth, presence lifecycle, multi-user, authorization, edge cases), LLM provider abstraction and tool-calling edge cases (`#709`/`#747` — 101 tests across orchestrator, provider, classifier, registry), data export/import round-trip integrity tests (`#713`/`#752` — 64 tests covering JSON, CSV, GDPR, database, cross-format validation), API error contract regression and boundary validation (`#714`/`#753` — 57 tests across 7 endpoint families with GP-03 contract enforcement), archive and restore lifecycle integration tests (`#715`/`#755` — 74 tests: 45 domain + 29 API covering state machine, cross-user isolation, conflict detection, audit trail), board metrics and analytics accuracy verification (`#718`/`#749` — 61 tests: 51 service + 10 controller covering throughput, cycle time, WIP, blocked cards, done-column heuristic), notification delivery, deduplication, and preference filtering (`#719`/`#746` — 36 tests covering all 5 notification types, deduplication, preference filtering, cross-user isolation, batch operations)","- MVP dogfooding flow now supports canonical checklist bootstrap in chat (proposal-first, board-scoped); broader template coverage remains future work","- collaborative editing now includes board/card presence visibility and conflict-hinting guardrails for stale card writes","- card collaboration now includes threaded comments with mention-linked notifications and moderation-aware edit/delete guardrails","- capture/inbox realignment is now shipped for the CAP MVP loop (`#200` to `#211`); logging redaction guardrails are delivered in `#212`, and long-list virtualization for inbox/activity views is delivered in `#213`","- frontend interaction latency budgets and instrumentation are delivered in `#250`: performance mark composable, route-transition/board/inbox/review/home/diff instrumentation, lazy route splitting, and documented thresholds in `docs/PERFORMANCE_BUDGETS.md`","- post-demo-expansion planning is now explicitly biased toward product legibility before new surface breadth: novice-first entry, board-context continuity, readable review flows, and stronger in-app guidance take precedence over broad autonomy work","- cold first-run now has launch-criteria proofing beyond route teaching; guided `Home`, durable workspace modes, review-first automation routing, the recoverable `Today` onboarding path, board-centered review/capture handoff, key-route contextual help, and the novice-first docs/help-center stack (root entry docs, chaptered manual, and page-level help/workflow guides) are now shipped, and the dedicated first-run smoke plus launch-criteria guardrail is delivered in `#328`","- Saul-facing demo reconciliation is now explicit: the core `Home -> Inbox/Capture -> Review -> Board` proof is shipped, the business-facing substrate/trust-cue/hero-path slices are delivered through `#354` plus demo-critical follow-through from `#326` and `#330`; the rehearsal contract is now codified in `docs/product/SAUL_DEMO_REHEARSAL_CONTRACT.md` (`#355`), and the GTM baseline was delivered in `#216` with a timed demo script (`docs/product/DEMO_SCRIPT.md`), thesis-aligned landing copy (`docs/product/LANDING_COPY.md`), and beta intake workflow/cadence (`docs/product/BETA_INTAKE_WORKFLOW.md`) _(caveat — landing copy + beta intake are now **not-in-use per the 2026-06-13 archive pivot** (GTM retired); `DEMO_SCRIPT.md` stays a live demo asset)_","- demo rehearsal walkthrough (2026-03-27) confirmed the core loop is visually correct but surfaced 9 runtime issues in seed tooling, scenario runner, and DX ergonomics; two are blockers for one-command deterministic rehearsal: seed re-run 409 conflicts (`#387`) and `--skip-llm` proposal alias resolution failure (`#389`); tracked in `#395` with analysis in `docs/analysis/2026-03-27_demo-rehearsal-runtime-issues.md`","- fresh-registration manual test (2026-03-29) surfaced 2 P0 blockers and 16 additional bugs/observations spanning data isolation, board stability, dark-mode theming, chat utility, and UX polish; full findings at `docs/analysis/2026-03-29_manual_testing_consolidated_findings.md`; P0 blockers: queue data not scoped to the authenticated user (`#508`), board auto-switching on multi-board accounts (`#509`); P1 issues tracked in `#510` through `#515`; P2/P3 in `#516` through `#524`; **no external user onboarding should occur until `#508` is resolved**; two bugs from this session now resolved: activity audit trail not recording board mutations (`#521`, fixed — audit logging wired for all board/card/column/label mutations with `SafeLogAsync` resilience wrapper), archive board 30-second freeze (`#519`, fixed — navigation before reactive state teardown prevents cascading re-renders)","- _(**Superseded 2026-06-13** by the archive pivot — the cloud/mobile/distribution pillars and the `v0.1.0`→`v1.0.0` GA versioning plan below are **de-scoped**; see the Direction note at the top of this file. Kept as a historical record.)_ platform expansion strategy (2026-03-29) covered four strategic pillars: market adoption (`#544`), packaging/distribution (`#532`), cloud/collaboration (`#537`), and mobile platform (`#540`); master strategy tracker at `#531`; strategy documents at `docs/strategy/`; release versioning plan: `v0.1.0` (self-contained exe) → `v0.2.0` (hosted cloud) → `v0.3.0` (PWA/mobile) → `v0.4.0` (collaboration) → `v0.5.0` (platform maturity) → `v1.0.0` (GA)","- hands-on UX testing (2026-03-31) surfaced 8 areas of feedback spanning review, inbox, today, home, board, notifications, and LLM chat; 2 P1 issues (capture triage fails on natural-language text `#614`, chat response truncation showing raw JSON `#616`), 11 P2 usability/visual-coherence issues (`#611`–`#613`, `#615`, `#617`, `#620`, `#622`, `#624`–`#627`), and 4 P3 polish/strategic items (`#618`–`#619`, `#621`, `#623`); tracker at `#628`; full analysis at `docs/analysis/2026-03-31_manual_testing_ux_feedback.md`; cross-cutting themes: progressive disclosure needed across review/today/notifications, semantic color vocabulary for status tags, capture pipeline needs LLM-assisted extraction, and chat needs tool-calling/function-calling architecture; LLM tool-calling spike (`#618`) and MCP server spike (`#619`) seeded for strategic planning","- UX feedback wave 1 delivered (2026-03-31): 6 of 17 issues from `#628` resolved — sidebar footer pinned (`#623`), card drag layout shift eliminated (`#621`), starter-pack modal migrated to design tokens (`#612`), capture triage error messages surfaced with retry hint (`#615`), board context expanded with card IDs for LLM chat (`#617`, N+1 query fixed), review proposal cards now use collapsible detail sections with risk color-coding and keyboard-accessible links dropdown (`#626`)","- UX feedback wave 2 delivered (2026-03-31): 5 additional issues resolved — both P1 blockers closed: capture triage now handles dash-separated (` - `) and semicolon-delimited text with first-segment context hints and single-sentence fallback (`#614`), chat JSON array truncation detection extended to `[`-started responses with degraded message UX (`#616`); P2: notification list now has type-colored left borders, type badges, smart same-type grouping, time-based section headers, and batch \"Mark all read\" with board-scoped optimistic update (`#625`); P4: global search endpoint now supports `maxResults`/`offset` pagination with `hasMore`/`totalCardCount` response fields and frontend \"Load more\" in command palette (`#610`); ops: `ci-extended.yml` now auto-triggers on `.csproj`/workflow/deploy/script changes, PR template and AGENTS.md updated (`#608`); remaining open from `#628`: 0 P2 (~~`#613`~~ delivered in `#665`), 2 P3 strategic spikes (`#618`, `#619`) both completed with implementation waves delivered (Phase 1+2 for tool-calling `#647`, Phase 1 for MCP `#648`)","- LLM tool-calling spike (`#618`) completed (2026-04-01): architecture document at `docs/spikes/SPIKE_618_COMPLETED.md`; decided on custom implementation over Semantic Kernel (~800 LOC, zero new dependencies), extending `ILlmProvider` with `CompleteWithToolsAsync`, 11 tools (5 read + 6 write, writes always produce proposals per GP-06), new `ToolCallingChatOrchestrator` with multi-turn loop (max 5 rounds, 60s timeout), Mock provider with pattern-based dispatch, ~$0.00088 per 3-round conversation on GPT-4o-mini; implementation tracker at `#647` with phase issues `#649` (read tools + orchestrator — delivered), `#650` (write tools + proposals — delivered), `#651` (Phase 3 refinements — delivered, PR `#773`)","- LLM tool-calling Phase 1 delivered (`#649`, 2026-04-01): `CompleteWithToolsAsync` added to `ILlmProvider` with OpenAI, Gemini, and Mock implementations; 5 read tool executors (`list_board_columns`, `list_cards_in_column`, `get_card_details`, `search_cards`, `get_board_labels`) in Application layer; `ToolCallingChatOrchestrator` with multi-turn loop (max 5 rounds, 30s/round, 60s total timeout) and graceful degradation to single-turn on failure; Mock provider uses pattern-matching dispatch table for deterministic simulation; SignalR `ToolStatusEvent` integration for intermediate state streaming; `ChatService` delegates to orchestrator for board-scoped sessions with automatic single-turn fallback; 67 new tests","- LLM tool-calling Phase 2 delivered (`#650`/`#731`, 2026-04-03): 6 write tool executors (`propose_create`, `propose_move`, `propose_archive`, `propose_update`, `propose_bulk_move`, `propose_create_column`) in Application layer; EF migration adds `ToolCallMetadataJson` for provenance; orchestrator now serves 11 tools (5 read + 6 write); writes always produce proposals per GP-06; frontend tool-status indicators show write-tool progress via SignalR","- Double LLM call eliminated (`#672`/`#727`, 2026-04-03): `ChatService` reuses the orchestrator's text response when no tools are called instead of making a second LLM call; halves latency for non-tool chat messages; remaining follow-up items: argument replay (`#673`)","- MCP server spike (`#619`) completed (2026-04-01): architecture document at `docs/spikes/SPIKE_619_COMPLETED.md`; decided on official MCP C# SDK (`ModelContextProtocol` v1.2.0), embedded in API process with `--mcp` startup flag, stdio transport first (Claude Code/Cursor), 9 resources under `taskdeck://` URI scheme, 9 tools (2 read + 5 write + 2 proposal management, `approve_proposal` intentionally excluded), API key auth (`tdsk_` prefix) for remote HTTP transport, write tools return proposal IDs for review-first compliance; implementation tracker at `#648` with phase issues `#652` (minimal prototype), `#653` (full inventory), `#654` (HTTP + auth), `#655` (production hardening, deferred)","- MCP minimal prototype delivered (`#652`/`#664`, 2026-04-01): `ModelContextProtocol` NuGet v1.2.0 added; `IUserContextProvider` interface in Application layer with `StdioUserContextProvider` implementation; `BoardResources` class with `[McpServerResource]` for `taskdeck://boards` resource returning compact JSON (id, name, columnCount, cardCount, isArchived, updatedAt); `--mcp` startup flag in `Program.cs` selects stdio host builder skipping web server overhead; 11 integration tests covering shape, archived exclusion, counts, empty results, and multi-user scoping","- UX feedback wave 3 delivered (2026-04-01): review proposal card UX improved (`#613`/`#665`) — sticky action footer with `position: sticky; bottom: 0` keeps action buttons visible regardless of card content length, cards constrained to `max-height: 70vh` (80vh mobile) with internal scrolling, detail section heights capped at `12rem`","- GDPR data portability delivered (`#83`/`#666`, 2026-04-01): `DataExportService` exports all user-scoped data as versioned JSON package (boards, notifications, captures, proposals, chat sessions, audit trail, preferences); `AccountDeletionService` with password re-authentication + confirmation phrase safeguard, PII anonymization (username/email/password), `BoardAccess` cleanup, sole-owner guard, transactional rollback on partial failure; `DataPortabilityController` with `[Authorize]` + `[ResponseCache(NoStore = true)]`; PII-free audit logging at request and completion stages; 32 tests; follow-up items: export streaming for large datasets (`#670`); JWT invalidation after deletion delivered (`#671`/`#698`+`#728`)","- Board metrics dashboard delivered (`#77`/`#667`, 2026-04-01): `BoardMetricsService` computes throughput (audit-log-based card completion), cycle time (creation-to-done via audit), WIP (cards per column), and blocked card count/duration; `MetricsController` with date range, board, and label filters; done column resolved by name heuristic (done/complete/finished/shipped/etc.) with positional fallback; frontend dashboard at `/workspace/metrics` with CSS bar charts, summary cards, tables, board selector, date picker, loading/error/empty states; lazy-loaded route + sidebar nav link; 24 backend + 22 frontend tests; SQL-level filtering follow-up delivered (`#675`/`#724`)","- GitHub OAuth frontend integration delivered (`#539`/`#668`, 2026-04-01): conditional \"Sign in with GitHub\" button in LoginView based on `/api/auth/providers` response; OAuth code exchange flow with demo-mode gating, array-safe query param extraction, and awaited URL cleanup; session store action with error handling and toast notifications; open redirect prevention on both backend (`Url.IsLocalUrl`) and frontend (`sanitizeInternalRedirect`); follow-up: distributed auth code store, PKCE, account linking (`#676`)","- Hardening and UX wave delivered (2026-04-03, PRs `#691`–`#698`): 9 issues resolved across 8 PRs with adversarial review follow-through:"," - **P1 bug fixed** (`#681`/`#691`): Archive, Activity, Ops, and Access workspace routes no longer silently redirect to Home — feature flags for shipped surfaces now default to `true`; 5 new router guard tests"," - **Expired proposal handling** (`#678`+`#690`/`#696`): Review no longer presents expired proposals as \"Approved, ready to apply\"; expired proposals show distinct status badge with dismiss/clear action; client-side expiry detection with 60-second reactive clock covers proposals the housekeeping worker hasn't transitioned yet; 9 new tests"," - **Chat card ID continuity** (`#677`/`#695`): new `CardIdPrefixResolver` resolves 8-char hex prefixes to full GUIDs via board-scoped prefix matching; wired into `AutomationPlannerService` (6 call sites) and `NaturalLanguageInstructionExtractor`; full GUIDs pass through without DB hits; 15 new tests"," - **Human-readable proposal diffs** (`#682`/`#697`): `GetProposalDiffAsync` now batch-loads cards and columns (2 queries) and resolves operation targets to names; falls back to raw GUID when resolution fails; frontend diff panel with ARIA label and word-wrapping; 4 new tests"," - **Dark theme label manager** (`#684`/`#692`): 22 light-theme Tailwind classes replaced with design-token equivalents following ColumnEditModal pattern; 2 new tests"," - **Chat health banner three-state** (`#679`/`#693`): `verificationStatus` field (`unverified`/`verified`/`failed`) added to health DTO; banner shows amber for configured-but-unverified, green for verified, red for failed; 6 new tests"," - **OpenAI strict mode + loop detection** (`#674`/`#694`): `strict: true` added to OpenAI tool schemas; SHA256-based loop detection in orchestrator aborts when consecutive rounds have identical tool-call fingerprints (with error-retry bypass for transient failures); 10 new tests"," - **JWT invalidation after account deletion** (`#671`/`#698`): `TokenInvalidatedAt` field on User entity with EF migration; `TokenValidationMiddleware` checks `IsActive` and compares token `iat` against invalidation timestamp on every authenticated request; `AccountDeletionService` sets invalidation timestamp during deletion; whole-second precision truncation matches JWT `iat` granularity; ADR-0021 documents the design decision; 9 new tests","- Post-hardening delivery wave (2026-04-03, PRs `#724`–`#731`): 6 issues resolved across 6 PRs:"," - **SQL-level board metrics filtering** (`#675`/`#724`): `BoardMetricsService` now uses SQL-level filtering via new repository methods (`GetForMetricsAsync`, `CountCardsByColumnAsync`, `GetBlockedByBoardIdAsync`) instead of in-memory filtering; frontend `Math.max(...spread)` replaced with `reduce` for empty-array safety"," - **Double LLM call elimination** (`#672`/`#727`): `ChatService` reuses the orchestrator's text response when no tools are called, halving latency for non-tool chat messages"," - **JWT invalidation hardening** (`#671`/`#728`): `ActiveUserValidationMiddleware` checks user active status on every authenticated request with 30-second in-memory cache; cache invalidated on deletion/deactivation"," - **Expired proposal review UX** (`#678`+`#690`/`#729`): `IsExpired` flag on `ProposalDto`, domain `CanBeDismissed` method, expired proposals rendered distinctly in Review with dismiss action and disabled apply/approve buttons"," - **Infrastructure repository integration tests** (`#699`/`#730`): 77 new tests across 7 repository classes against real SQLite; found and fixed a real `LlmQueueRepository` ordering bug"," - **LLM write tools and proposal integration** (`#650`/`#731`): 6 write tool executors (`propose_create`, `propose_move`, `propose_archive`, `propose_update`, `propose_bulk_move`, `propose_create_column`), EF migration for `ToolCallMetadataJson`, orchestrator now serves 11 tools total (5 read + 6 write), frontend tool-status indicators for write operations","- Security + testing + MCP delivery wave (2026-04-04, PRs `#732`–`#739`): 8 issues resolved across 8 PRs with two rounds of adversarial review:"," - **SEC-20 ChangePassword identity bypass fixed** (`#722`/`#732`): userId now derived exclusively from JWT claims; `[Authorize]` enforced; `UserId` removed from request body; `AuthController` refactored to inherit `AuthenticatedControllerBase`; 5 new integration tests"," - **Golden-path integration test** (`#703`/`#735`): 7 tests exercising full capture → triage → proposal → review → board pipeline; validates card title, column placement, provenance chain, multi-operation atomicity, cross-user isolation, audit trail, and triage failure determinism"," - **Cross-user data isolation tests** (`#704`/`#733`): 38 integration tests across all major API boundaries (boards, columns, cards, captures, proposals, notifications, audit trails, chat sessions, knowledge docs, webhooks, board exports, labels, board access controls); includes shared-board grant/scope/revocation tests; adversarial review caught and fixed 3 false-positive tests and missing precondition assertions"," - **LlmQueueToProposalWorker integration tests** (`#700`/`#734`): 24 tests covering happy path, empty queue, transient/permanent error, retry/backoff, cancellation, fair-batch interleaving, already-claimed items, and capture triage paths; adversarial review fixed fake repository status-tracking and race condition simulation"," - **Controller HTTP integration tests** (`#702`/`#738`): 67 tests covering 6 previously-untested controllers (DataPortability, AbuseContainment, Metrics, Search, AgentProfiles, AgentRuns) + 17 new authz regression matrix entries; discovered 2 pre-existing bugs (agent list 500, empty board export); adversarial review fixed weak assertions and resource leaks"," - **Proposal lifecycle edge cases** (`#708`/`#736`): 74 tests (42 domain + 25 application + 7 api) covering expiry timing boundaries, double-apply prevention, comprehensive state machine violations, dismissal edge cases, operation mutation guards, batch expiry, worker-vs-manual race conditions; adversarial review fixed clock-resolution flakiness and added 5 new edge case tests"," - **OAuth/auth edge case tests** (`#707`/`#737`): 44 tests covering login/registration edge cases, token validation (malformed/expired/wrong-key/missing-claims), OAuth code exchange, open redirect prevention, middleware enforcement; **found and fixed production bug**: `ExternalLoginAsync` `Substring(0, 50)` overflow for short usernames"," - **MCP full resource and tool inventory** (`#653`/`#739`): 9 resources under `taskdeck://` URI scheme + 11 tools (2 read + 6 write + 3 proposal management); all write tools produce proposals per GP-06; `approve_proposal` intentionally excluded; 42 MCP-specific tests; **adversarial review found and fixed user-scoping gap** on proposal resources/tools","- Post-adversarial-review hardening and test expansion wave (2026-04-04, PRs `#741`–`#756`, 9 issues):"," - **Product telemetry taxonomy** (`#341`/`#741`): `docs/product/TELEMETRY_TAXONOMY.md` defines 35+ named events across 7 categories (Capture, Proposal/Review, Board, Auth, Navigation, Agent, Error) with `noun.verb` naming convention, universal envelope, privacy guardrails (bucketed counts, no PII), and R1/R2/R3 launch gate anchors. The recording surface **is implemented** (`TelemetryController` `POST /api/telemetry/events` + `GET /api/telemetry/config`, backed by `TelemetryEventService` with event-name **format** validation (the `noun.verb` regex — not membership in the taxonomy registry) and a property-key allowlist) but is **opt-in and OFF by default** (`TelemetrySettings.Enabled = false`); recorded events are currently logged rather than persisted/forwarded. _(The R1/R2/R3 launch-gate anchors are de-scoped by the archive pivot; syncing the backend allowlist/registry to the full taxonomy remains open — see `docs/product/TELEMETRY_TAXONOMY.md`.)_"," - **Board header presence label fixed** (`#683`/`#744`): `normalizePresenceMembers()` in `BoardView.vue` now replaces current user's SignalR `displayName` with locally-known username, eliminating email/username flip on card open; 3 new tests"," - **Manual card provenance empty state** (`#680`/`#754`): `cardsApi.getCardProvenance()` now returns null only for \"Capture provenance not found\" 404s (not all 404s); CardModal shows \"No capture provenance available.\" with `loadedCaptureProvenanceCardId` guard against flash; 4 new tests; adversarial review caught and fixed 3 bugs (overly broad 404 catch, global Axios log-level regression, empty-state flash)"," - **WIP-limit duplicate toast regression** (`#686`/`#745`): 7 regression tests in `boardStore.wipLimit.spec.ts` guard against future double-toast on WIP limit violations for createCard and moveCard"," - **Auth-flow toast regression coverage** (`#685`/`#742`): 20 tests in `sessionStore.authToast.spec.ts` covering login/register/OAuth failure and success toast lifecycle, isolation, and auto-removal; adversarial review fixed timer leak, mock isolation, and inverted assertion"," - **Route and workspace-state stability** (`#687`/`#748`): `authGuard.spec.ts` (auth guard decision table) and `workspaceRouteStability.spec.ts` (mode persistence, hydration drift, resetForLogout) with 16-case exhaustive guard table; also fixed pre-existing `AuthControllerEdgeCaseTests.cs` compile error"," - **Inbox triage action visibility** (`#688`/`#743`): 21 new tests in `InboxView.spec.ts` covering single-item triage action states and bulk action bar visibility with DOM-level assertions"," - **Webhook HMAC signature verification** (`#726`/`#750`): 11 tests in `OutboundWebhookHmacDeliveryTests.cs` covering header format, HMAC round-trip, wrong-key rejection, secret rotation, large payload, and timing-safe comparison; adversarial review fixed rotation test and replaced BCL-testing stubs with real domain property tests"," - **Webhook delivery reliability and SSRF boundary** (`#710`/`#756`): 78 webhook tests across 9 files (endpoint guard, service, signature, delivery worker, HMAC delivery, API, repository, domain delivery, domain subscription); SSRF coverage via `OutboundWebhookEndpointGuardTests` includes private IPv4/IPv6 ranges; delivery reliability covers retry/backoff, dead-letter, concurrent delivery, HMAC at worker boundary; `HttpClient` resource leak fixed in tests","- Tech-debt, security, and feature hardening wave (2026-04-04, PRs `#765`–`#770`, `#776`, 7 issues, ~32 new backend tests + 33 new frontend tests, two rounds of adversarial review per PR):"," - **Agent API 500 fix** (`#758`/`#776`): root cause was `DateTimeOffset` ORDER BY failing in SQLite; `AgentProfileRepository` fixed with materialize-then-sort; `AgentRunRepository` upgraded to `IsSqlite()` + `FromSqlInterpolated` pattern for SQL-level ORDER BY + LIMIT; 2 previously-skipped tests un-skipped; round 2 review caught and fixed the load-all-before-limit performance issue in `AgentRunRepository`"," - **DataExport exception logging** (`#759`/`#766`): `ILogger` added to `DataExportService` and `AccountDeletionService` with `LogError` in previously-silent catch blocks; round 2 review added `OperationCanceledException` filter to avoid monitoring noise and changed rollback to `CancellationToken.None` for reliability; 3 new tests"," - **Streaming chat token usage** (`#763`/`#768`): `LlmTokenEvent` extended with `TokensUsed`, `Provider`, and `Model` fields; all 3 LLM providers (Mock, OpenAI, Gemini) populate usage on final stream event; `ChatService.StreamResponseAsync` now persists assistant `ChatMessage` with token usage and records quota via `ILlmQuotaService.RecordUsageAsync` (matching non-streaming path); 4 new/updated tests"," - **EF Core version alignment** (`#760`/`#767`): downgraded `Microsoft.EntityFrameworkCore`, `.Sqlite`, `.Design`, and `.Tools` from 9.0.14 to 8.0.14 across Infrastructure and Api projects; removed EF9-only `PendingModelChangesWarning` suppression; replaced stale `Microsoft.AspNetCore.Http` 2.3.9 with `FrameworkReference Include=\"Microsoft.AspNetCore.App\"`; round 2 review added `PrivateAssets=\"all\"` to Design package; migration snapshot `ProductVersion: \"9.0.14\"` is metadata-only, self-corrects on next migration"," - **Frontend HTTP interceptor and auth guard tests** (`#725`/`#765`): 33 new tests across 2 files — `http.spec.ts` (19 tests: token injection, 401 handling, demo mode, X-Request-Id, error propagation) and `routerIntegration.spec.ts` (14 tests: auth guards, feature flags, legacy redirects, expired token handling); `axios-mock-adapter` added as dev dependency; round 2 review fixed CI-breaking ESLint `no-import-assign` with `vi.hoisted` pattern, `window.location` restoration leak, and inaccurate docstring"," - **OAuth token lifecycle tests** (`#723`/`#769`): 19 integration tests covering auth code store (valid exchange, expiry, replay prevention, concurrent atomicity, cleanup), JWT lifecycle (expiry, wrong key, garbage token, deactivated user, re-issue after password change), SignalR query-string auth (3 tests), and GitHub OAuth config (2 tests); round 2 review fixed redundant ternary, `HttpClient` resource leak in concurrent test, misleading SignalR test names, and weak string-contains assertion"," - **Tool argument replay** (`#673`/`#770`): `Arguments` field (`JsonElement`) added to `ToolCallResult` with backward-compatible default; orchestrator passes original arguments through; OpenAI uses `GetRawText()` and Gemini uses inline `Arguments` object in synthetic replay messages instead of hardcoded `\"{}\"` / `new { }`; falls back to empty when `ValueKind == Undefined`; `GeminiLlmProvider.BuildToolCallingPayload` promoted to `internal` for testability; 6 new tests","- Dependency hygiene, accessibility, tool-calling refinements, streaming, and test coverage wave (2026-04-04, PRs `#771`–`#779`, 8 issues, ~258 new tests with two rounds of adversarial review per PR):"," - **Vendored dependency cleanup** (`#761`/`#771`): removed `vendor/ws-7.5.10.tgz` file and orphaned Dockerfile `COPY vendor/` line; `ws` now resolves from npm registry as `^7.5.10`; no-op `p-limit@3.0.2` override removed; adversarial review caught stale STATUS.md and MASTERPLAN docs references and updated them"," - **Accessibility lint: 105 warnings → 0** (`#762`/`#779`): form label associations (`for`/`id` pairs, `aria-label`), keyboard event companions for click handlers, `role=\"dialog\"` + `aria-modal` + Escape handler on modal backdrops, redundant-role removals; `--max-warnings 20` CI threshold enforced; adversarial review found and fixed 2 CI regressions: `TdTooltip.vue` Vue-Fragment breakage (9 failing tests) and invalid `tabindex=\"-1\"` on `role=\"option\"` items; 2 non-blocking ARIA follow-up items filed"," - **Tool-calling Phase 3 refinements** (`#651`/`#773`): `LlmToolCallingSettings` DI singleton with `Enabled` (default `true`) and `MaxToolResultBytes` (default 8 000) config keys; `ChatService` bypasses orchestrator when disabled; `TruncateToolResult` enforces UTF-8 byte budget via binary search with zero heap allocations in the search loop; cost tracking DI wiring completed; 17 new tests; adversarial review caught byte-budget contract violation when `maxBytes < marker length` and replaced O(n) loop with correct binary search"," - **Export streaming for large datasets** (`#670`/`#774`): new `GET /api/account/export/stream` endpoint streams JSON response body via `Utf8JsonWriter` — memory usage is constant regardless of dataset size; N+1 chat-message count query fixed with `CountBySessionIdsAsync` (single GROUP BY query, 500-session windows to respect SQLite 999-param limit); backward-compatible with original `/export` endpoint; 15 tests; adversarial review caught `ToErrorActionResult()` crash when called after `Response.HasStarted`; streaming HTTP 200 partial-response limitation documented in controller comment"," - **Frontend view vitest coverage** (`#716`/`#775`): 83 new tests for 6 previously-untested views (LoginView, RegisterView, BoardsListView, ExportImportView, SavedViewsView, DevToolsView) with DOM-level assertions for loading/error/empty states, user interactions, and form validation; adversarial review fixed 3 ESLint errors (CI blocker: unused vars, invalid `[key]` selector) and added 3 missing OAuth callback path tests"," - **Pinia store integration tests** (`#711`/`#777`): 91 new tests across 6 stores (boardStore, captureStore, workspaceStore, queueStore, notificationStore, sessionStore) mocking HTTP layer rather than API modules, exercising real API client code; covers boardStore auto-switch regression (`#509`), queueStore data isolation (`#508`); adversarial review fixed fake timer leak, unreliable microtask drain, and 4 `as never[]`/`as never` type bypasses defeating integration test value"," - **Resilience and degraded-mode tests** (`#720`/`#778`): 34 new tests (18 backend + 16 frontend) covering ChatService LLM provider failure/fallback, worker crash/retry/cancellation/max-retries, frontend store error states, SignalR reconnect polling fallback; adversarial review fixed unused import (CI blocker), double-invocation anti-pattern, and 150ms timing race widened to 500ms"," - **E2E error state expansion** (`#712`/`#772`): 25 new Playwright scenarios across 3 spec files (`error-recovery.spec.ts`, `multi-board.spec.ts`, `edge-journeys.spec.ts`) using `page.route()` for deterministic error injection without live backend dependency; adversarial review fixed unused import (CI blocker), route glob missing query-param suffix, 3 vacuous soft-assertion blocks replaced with unconditional assertions","- Feature, analytics, MCP, chat, testing, and UX expansion wave (2026-04-08, PRs `#787`–`#793`, 7 issues, ~390+ new tests with two rounds of adversarial review per PR):"," - **Exportable analytics CSV** (`#78`/`#787`): `MetricsExportService` with schema-versioned CSV export, CSV injection protection (leading-char and embedded-newline sanitization), UTF-8 BOM for Excel compatibility; `GET /api/metrics/boards/{boardId}/export` endpoint with date range/label filters and `Content-Disposition` attachment header; frontend \"Export CSV\" button in MetricsView with error toast; `ADR-0022` defers PDF export; 29 tests (21 unit + 8 integration); adversarial review caught and fixed embedded-newline injection vector (HIGH), missing CancellationToken forwarding, and silent frontend error swallowing"," - **Forecasting and capacity-planning service** (`#79`/`#790`): `ForecastingService` with rolling-average throughput from audit log card-move events, standard-deviation confidence bands (optimistic/expected/pessimistic), average cycle time from creation-to-done; `GET /api/forecast/board/{boardId}` endpoint with documented assumptions and data-point count; frontend forecast section in MetricsView showing estimated completion, confidence range, and caveats; 32 tests; adversarial review caught and fixed throughput double-counting when cards bounce Done→InProgress→Done (HIGH), history-window calculation using wrong denominator, and regex compiled fresh on every call"," - **MCP HTTP transport and API key authentication** (`#654`/`#792`): `ApiKey` domain entity with `tdsk_` prefix and SHA-256 hashing at rest; EF Core migration for `ApiKeys` table with unique `KeyHash` index; `ApiKeyMiddleware` for Bearer token validation on `/mcp` path; `HttpUserContextProvider` maps API key → user for claims-first identity; `ApiKeysController` REST endpoints (create/list/revoke) with JWT auth; `MapMcp()` HTTP transport alongside REST endpoints via `ModelContextProtocol.AspNetCore`; rate limiting per API key (60 req/60s); 31 tests (11 domain + 20 integration); adversarial review caught and fixed key-existence oracle via differentiated error messages (MEDIUM), modulo bias in key generation, and bare catch block"," - **Conversational refinement loop** (`#576`/`#791`): `ClarificationDetector` with strong/weak signal pattern split for ambiguity detection, max 2 clarification rounds before best-effort, skip-phrase detection (\"just do your best\"); `ChatService` integration tracking clarification state and injecting system prompt guidance; Mock provider simulates clarification for deterministic testing; frontend clarification badge and \"Skip, just do your best\" button in AutomationChatView; 41 tests (22 detector + 7 service + 6 false-positive regression + domain); adversarial review caught and fixed false-positive heuristic classifying normal LLM responses as clarification (HIGH)"," - **Concurrency and race condition stress tests** (`#705`/`#793`): 13 stress tests in `ConcurrencyRaceConditionStressTests.cs` covering queue claim races (double-triage, stale timestamp, batch concurrent), card update conflicts (concurrent moves, stale-write 409, last-writer-wins), column reorder race, proposal approval races (double-approve, approve+reject, double-execute), rate limiting under load (burst beyond limit, cross-user isolation), and multi-user board stress; uses `SemaphoreSlim` barriers with `WaitAsync` for true simultaneity and separate `HttpClient` per task; SQLite write serialization limitations documented; proposal decision losers now return `409 Conflict` via proposal `UpdatedAt` optimistic concurrency; adversarial review fixed misleading doc comments, tightened weak assertions, and replaced non-thread-safe variables with `ConcurrentDictionary`"," - **Property-based and adversarial input tests** (`#717`/`#789`): 211 tests across 5 files — 77 FsCheck domain entity tests (adversarial strings: unicode, null bytes, BOM, ZWSP, RTL override, surrogate pairs, XSS, SQL injection; boundary lengths; GUID/position validation), 29 JSON serialization round-trip fuzz tests (GUID format variations, DateTime boundaries, malformed JSON, large payloads), 80 API adversarial integration tests (no 500s from any adversarial input across board/card/column/capture/auth/search endpoints, malformed JSON, wrong content types, concurrent adversarial requests), 16 fast-check frontend input sanitization property tests, 9 store resilience property tests; `fast-check` added as frontend dev dependency; adversarial review fixed capture payload round-trip testing wrong DTO and null handling inconsistency in FsCheck generators"," - **Inbox premium primitives** (`#249`/`#788`): `InboxView.vue` reworked to use shared UI primitive components — `TdSkeleton` for loading states, `TdInlineAlert` for errors, `TdEmptyState` for empty list, `TdBadge` for status chips, `TdSpinner` for detail refresh; ~65 lines of redundant CSS removed; 7 new vitest tests; adversarial review fixed skeleton screen reader announcements (added `role=\"status\"` and sr-only labels) and redundant `role=\"alert\"` nesting","- Ephemeral integration databases via Testcontainers (`#91`): `Taskdeck.Integration.Tests` project with `Testcontainers.PostgreSql` and `Npgsql.EntityFrameworkCore.PostgreSQL` packages; `PostgresContainerFixture` manages a shared ephemeral PostgreSQL container per xUnit collection; each test method gets its own isolated database (no cross-test contamination); schema created via `EnsureCreated()` from the EF Core model for PostgreSQL provider parity; 20 integration tests across 7 test classes covering Board CRUD, Card operations, Proposal lifecycle, per-test isolation verification, and sequential operation validation; CI workflow at `reusable-container-integration.yml` in ci-extended lane (label: testing); guide at `docs/testing/TESTCONTAINERS_GUIDE.md`","- Mutation testing pilot now delivered (`#90`): Stryker.NET targeting `Taskdeck.Domain` (backend) and Stryker JS targeting `captureStore`/`boardStore` (frontend); non-blocking weekly CI lane (`.github/workflows/mutation-testing.yml`); policy and triage guidance at `docs/testing/MUTATION_TESTING_POLICY.md`; 60% low / 80% high thresholds with 0% break (triage signal, not enforcement gate); scope expansion roadmap covers Application layer and additional frontend stores","- Supplementary test depth wave (2026-04-13, PRs `#821`–`#826`, ~429 new tests with two rounds of adversarial review per PR):"," - **Frontend store integration tests** (`#711`/`#821`): 88 new tests across 6 files — chatApi integration (22), boardStore column reorder/conflict (11), queueStore polling/transitions (12), sessionStore OIDC/SSO (14), notificationStore realtime (15), workspaceStore mode persistence (14); mocks HTTP layer (not API modules) to test full store → API → HTTP chain; round 2 review fixed missing in-memory state assertions, incorrect resetForLogout test comment, and 12 weak `rejects.toBeDefined()` assertions replaced with type-specific matchers"," - **E2E scenario expansion** (`#712`/`#822`): 20 new Playwright scenarios across 5 spec files — onboarding (5), review proposals (3), capture edge cases (4), keyboard navigation (4), dark mode (4); 17 passing, 3 gracefully skipped (dark mode toggle not present in current UI); round 2 review fixed missing `baseURL` in browser context (critical), brittle CSS selectors replaced with `getByLabel`, no-op assertions, unreliable `body.click()` defocusing, and misleading header comments"," - **Resilience and degraded-mode behavior tests** (`#720`/`#823`): 30 new tests across 3 files — LLM provider resilience (13: garbage/empty/missing-choices/429/timeout for OpenAI and Gemini, probe unhealthy), queue accumulation resilience (3: accumulation without corruption, item processability, rapid concurrent captures), frontend slow-API/storage resilience (14: loading states, throttle dedup, corrupted localStorage/token handling); round 2 review fixed CI-breaking unused import, unhandled promise rejections, contradictory test name, and misleading JWT comment"," - **Property-based and adversarial input tests** (`#717`/`#824`): 162 new tests across 8 files — domain property tests (93: ChatSession, ChatMessage, Notification, KnowledgeDocument, WebhookSubscription with adversarial strings, boundary lengths, state machine exhaustion), application fuzz tests (19: JSON round-trip for chat/notification DTOs), API adversarial tests (50: raw JSON with adversarial positions, XSS/injection payloads, unicode blocks, extra unknown fields, control chars); round 2 review fixed silent 500-skip, fake `[Property]` on deterministic tests, 7× copy-pasted generators replaced with shared adversarial generator (~45 vectors), and misleading URL trim comment"," - **Concurrency and race condition stress tests** (`#705`/`#825`): 22 new tests across 7 files — queue claim races (4), card update conflicts (5), proposal approval races (4), webhook delivery concurrency (2), board presence concurrency (2), rate limiting (3), cross-user isolation stress (2); uses `SemaphoreSlim` barriers for true simultaneous execution; SQLite write serialization limitations documented; round 2 review fixed critical thread-pool deadlock (blocking `Barrier.SignalAndWait` in async lambdas), cross-user isolation race condition, silent pass on broken rate limiting, and 2 data-loss-hiding weak assertions"," - **Frontend view and component coverage gaps** (`#716`/`#826`): 107 new tests across 8 files — ArchiveView (11), MetricsView (16), BoardView (12), ReviewView (10), AutomationChatView (16), CardItem (21), BoardCanvas (12), BoardActionRail (9); covers loading/error/empty states, user interactions, ARIA attributes, drag events; round 2 review fixed CI-blocking unused import, DOM pollution (missing afterEach cleanup), incorrect generic type, and misleading test name","- Manual validation and verification program delivery (2026-04-15, PRs `#837`–`#841`):"," - **TST-09 manual validation slice C** (`#132`/`#839`): 45-scenario catalog for automation proposals, chat bootstrap, and execution safety in `docs/testing/MANUAL_VALIDATION_SLICE_C_SCENARIOS.md`; 17 Playwright E2E tests across 2 spec files (`validation-automation-proposals.spec.ts` with 8 tests, `validation-chat-bootstrap.spec.ts` with 9 tests); manual rehearsal runbook at `docs/testing/MANUAL_REHEARSAL_RUNBOOK_SLICE_C.md`"," - **TST-10 manual validation slice D** (`#133`/`#837`): 25-scenario catalog for ops CLI, log query/correlation, and health telemetry in `docs/testing/MANUAL_VALIDATION_SLICE_D_SCENARIOS.md`; 17 Playwright E2E tests in `validation-ops-logs-health.spec.ts`; operator rehearsal runbook at `docs/testing/MANUAL_REHEARSAL_RUNBOOK_SLICE_D.md`"," - **TST-11 manual validation slice E** (`#134`/`#840`): 25-scenario catalog for starter packs, archive recovery, and activity traceability in `docs/testing/MANUAL_VALIDATION_SLICE_E_SCENARIOS.md`; 23+ Playwright E2E tests across 3 spec files (`validation-starter-packs.spec.ts`, `validation-archive-recovery.spec.ts`, `validation-activity-traceability.spec.ts`); rehearsal runbook at `docs/testing/MANUAL_REHEARSAL_RUNBOOK_SLICE_E.md`"," - **TST-12 integrated verification program** (`#135`/`#838`): 18-scenario cross-component verification strategy in `docs/testing/INTEGRATED_VERIFICATION_STRATEGY.md`; 4 Playwright E2E tests in `integrated-verification.spec.ts` covering full capture-to-board pipeline, board bootstrap, workspace navigation, and auth denial; manual rehearsal template at `docs/testing/MANUAL_REHEARSAL_TEMPLATE.md`; release gating criteria documented; `docs/TESTING_GUIDE.md` updated with cross-references"," - **INT-06 integrations registry foundation** (`#340`/`#841`): full-stack integrations registry with domain entities (`IntegrationConnector`, `ConnectorEvent` with `ConnectorType`/`ConnectorDirection`/`ConnectorStatus` enums), application service (`IntegrationRegistryService` with `IIntegrationConnectorRepository`/`IConnectorEventRepository`), EF Core infrastructure (repositories + `AddIntegrationConnectorsAndEvents` migration), API (`IntegrationsController` with 7 endpoints — CRUD + enable/disable, all `[Authorize]`), frontend (`IntegrationsView.vue` at `/workspace/integrations` with `integrationStore` and `integrationsApi` with enum normalization), connector taxonomy (inbound/context/outbound per GP-06 — inbound connectors route through capture), architecture documentation at `docs/architecture/INTEGRATIONS_REGISTRY.md`; 60 new tests (24 domain + 12 application + 15 API + 9 frontend)"," - Tracker closures: 6 completed trackers closed — `#721` (TST-54 rigorous test expansion wave), `#647` (LLM-05 tool-calling), `#648` (MCP-00 server), `#329` (MVP-03 secondary follow-through), `#242` (UI-00 premium UI wave), `#235` (SEC-15 managed-key threat model)","- Post-validation documentation sweep (2026-04-16, PR `#844`):"," - **Wave index and delivery annotations sweep** (`#844`): updated `#107` wave execution index with 126/129 completed items checked; added \"(delivered)\" annotations to ~100+ items across Stages 2--5 in `ISSUE_EXECUTION_GUIDE.md`"," - Note: PRs `#822`, `#841`, `#877`--`#880`, `#882` remain open and are not yet merged; their contents will be documented here upon merge","- Production hardening wave from AUDIT.md findings (2026-04-22, PRs `#902`–`#913`, 12 PRs covering 10 tracked audit issues plus 2 CI stabilisation fixes):"," - **PERF-13 SQL-level AuditLog filtering** (`#849`/`#903`): `AuditLogRepository.QueryAsync` SQLite branch now uses `BuildSqliteQueryAsync` that pushes `userId`/`boardId`/`source`/`level` filters plus `ORDER BY`/`LIMIT` into a parameterised raw SQL query; board-scoped filter uses `EXISTS` subqueries (matching `GetByBoardAsync`) to avoid the SQLite `SQLITE_MAX_VARIABLE_NUMBER` limit and removes 3 extra round-trips from `ResolveBoardScopedEntityIdsAsync` for SQLite; non-SQLite providers continue to use in-memory pagination with `Contains()`"," - **PERF-11 WorkspaceService sync-over-async removal** (`#847`/`#904`): replaced `.Result` in `GetOnboardingForPreferenceAsync` with sequential `await`; parallel `Task.WhenAll` branches in `GetHomeAsync`/`GetTodayAsync` intentionally reverted to sequential awaits in round 2 review because all repositories share the scoped `DbContext` via `IUnitOfWork` (EF Core `DbContext` is not thread-safe)"," - **SEC-26 SSRF protection for webhook and LLM provider URLs** (`#850`/`#905`): new `SsrfProtectionService` in Application layer with `ValidateUrl`/`ValidateUrlWithDnsAsync`/`ValidateLlmProviderUrl` methods wrapping `OutboundWebhookEndpointGuard`; explicit cloud metadata hostname blocking (`metadata.goog`, `metadata.google.internal`, Alibaba Cloud `100.100.100.200`, AWS IMDSv2 IPv6 `fd00:ec2::254`); LLM provider selection policy now calls `ValidateLlmProviderUrl` for `OpenAi`/`Gemini` `BaseUrl` (rejects private IPv4/IPv6, cloud metadata, non-HTTPS) with `allowLocalhostEndpoints` toggle for Development + `AllowLiveProvidersInDevelopment` (enables Ollama/LM Studio); OpenAI + Gemini `HttpClient` registrations now use `OutboundWebhookConnectCallback` for DNS-rebinding defense and `AllowAutoRedirect = false`; 83 `SsrfProtectionServiceTests` covering private IPv4 (`127/8`, `10/8`, `172.16/12`, `192.168/16`), IPv6 ranges (`::1`, `fc00::/7`, `fe80::/10`), IPv4-mapped IPv6, decimal/hex/octal IP bypass attempts, and HTTPS enforcement"," - **TST-58 CLI test discovery + shared harness** (`#853`/`#906`): added missing `[Fact]`/`[Theory]` attributes across CLI test files; extracted shared `CliTestHarness` (replaced ~90-line duplicated harness in 5 files); `AppContext.BaseDirectory` dll lookup replaces fragile repo-tree walk; 30-second process timeout via `CancellationTokenSource`; `[Collection(\"Console Tests\")]` for `Console.Out` thread safety; `InternalsVisibleTo` added so internal CLI types can be unit-tested; CLI test suite now totals ~78 tests across 10 files (ArgParser 15, ApiKey 12, Cards 11, Columns 10, Boards 7, ConsoleOutput 7, CliActorIdentity 5, ExitCodes 4, CliJsonContract 4, CommandDispatcher 3)"," - **OPS-27 startup configuration validation** (`#863`/`#908`): data annotations (`[Required]`, `[Range]`, `[MinLength]`, `[RegularExpression]`, `[Url]`) on 15 settings classes (`JwtSettings`, `WorkerSettings`, `CacheSettings`, `RateLimitingSettings`, `LlmProviderSettings`, `OpenAiProviderSettings`, `GeminiProviderSettings`, `ObservabilitySettings`, `SentrySettings`, `SecurityHeadersSettings`, `TelemetrySettings`, `LlmQuotaSettings`, `LlmToolCallingSettings`, `AbuseDetectionSettings`, `MfaPolicySettings`); 4 cross-property `IValidateOptions` validators (`WorkerSettingsValidator` for `RetryBackoffSeconds.Length >= MaxRetries`, `JwtSettingsValidator` for secret length, `SentrySettingsValidator` for `Dsn` when `Enabled`, `RateLimitingSettingsValidator` for nested policy ranges); `ValidateDataAnnotations()` + `ValidateOnStart()` wiring via new `RegisterValidatedOptions` helper; `LlmProvider`/`CacheProvider` regex patterns use `(?i)` case-insensitive flag to match runtime comparison; `RateLimitPolicySettings` exposes range constants to prevent data-annotation/validator divergence; `JwtSettings.SecretKey` intentionally not `[Required]` because `FirstRunBootstrapper` generates it; 34 new `OptionsValidationTests`"," - **PERF-12 board list pagination** (`#848`/`#909`): new `PaginatedResult` DTO (`items`/`totalCount`/`hasMore`/`offset`/`limit`); `BoardService.ListBoardsPaginatedAsync` applies authorization filter before pagination so `totalCount` reflects only authorised boards; `BoardRepository.SearchIdsAsync` sorts by `CreatedAt DESC` with `Id` as deterministic tiebreaker so page boundaries do not overlap across calls; `GET /api/boards` accepts `offset`/`limit` query parameters (default `limit=50`, server-clamped to `[1, 200]`); frontend `boardsApi.getBoards` delegates to new `getBoardsPaginated` and unwraps `.items` for backward compatibility; archive-recovery E2E fix: unwrap `.items` from paginated response; 11 new `BoardPaginationApiTests` (default pagination, empty, offset beyond total, zero limit clamp, cross-user isolation, full-page iteration)"," - **SEC-30 file import content validation** (`#860`/`#910`): new `FileContentValidator` in Application layer with `ValidateTextContent` (binary/null-byte/C1-control detection; blocks all C1 controls including `0x91-0x94`/`0x96-0x97` because in UTF-16 they are genuine control chars, not Windows-1252 smart quotes — real smart quotes decode to `U+2018-U+201D`), `ValidateJsonContent` (BOM-aware parse + magic-byte check against SQLite `SQLite format 3\\0`), and character-based limits (renamed from `MaxMarkdownContentBytes` → `MaxMarkdownContentChars` to match `NoteImportService` CJK-safe semantics); `NoteImportController` (markdown + web clip), `ExternalImportsController` (CSV), and `ExportController` (board JSON) now validate content before it reaches the service layer; board JSON re-import passes `maxBytes: 0` to preserve round-trip portability for large exports; 52 `FileContentValidatorTests` covering text/JSON/binary/BOM/C1-control/size-limit/Unicode edge cases"," - **SEC-27 dev JWT secret removal and unconditional bootstrap** (`#851`/`#911`): removed hardcoded `Jwt:SecretKey` from `appsettings.Development.json`; `FirstRunBootstrapper.EnsureJwtSecret` now runs unconditionally in all environments (including Development and CI/headless) after round 2 review — the original headless guard caused CI auth failures because `GITHUB_ACTIONS=true` made `IsHeadlessEnvironment()` return `true` and the subsequent `AddTaskdeckAuthentication` short-circuited without registering auth services; non-JWT bootstrap checks consolidated into a single early-return; `TestWebApplicationFactory` now provides its own in-memory JWT secret so API tests are environment-independent; `IOException` fallback catches parallel-test contention on `appsettings.local.json`; `CONTRIBUTING.md` documents auto-generation, `dotnet user-secrets`, and `Jwt__SecretKey` env-var alternatives; `CONFIGURATION_REFERENCE.md` and `SECRETS_MANAGEMENT_BASELINE.md` updated to match"," - **OPS-28 EF Core migration bootstrap verification** (`#864`/`#907`): 5 `MigrationBootstrapTests` verifying fresh-database migration integrity — full chain applies cleanly, all expected tables created (verified via reflection from `DbContext` DbSets rather than hardcoded list so tests auto-adapt), `Migrate()` is idempotent, no pending migrations after full apply, `HasPendingModelChanges()` reports no drift (detects real model/snapshot divergence, not just missing migration files), and all migration timestamps are distinct; `GetUserTables()` uses `OpenConnection()`/`CloseConnection()` instead of disposing the `DbContext`-owned connection; workflow guide at `docs/platform/EF_MIGRATION_WORKFLOW.md` (add/apply/revert/script migrations, bootstrap verification, SQLite troubleshooting); round 2 review surfaced real model drift: `ExternalLoginConfiguration` declared a `HasOne` FK with cascade delete but the original `AddExternalLogins` migration did not create the FK constraint — captured in new migration `AddExternalLoginsUserForeignKey` (SQLite table-rebuild) so the snapshot and model agree; `ProductVersion` bumped `8.0.25` → `8.0.26` to match installed EF packages"," - **CI-02 Gitleaks secrets detection** (`#871`/`#902`): `.gitleaks.toml` extends default rules with project-specific allowlists (test fixture secrets, dev placeholders, CI-only config strings, JWT test keys, fake LLM API keys, OAuth test fixtures); `.gitleaksignore` for per-finding fingerprint suppression; reusable workflow `reusable-gitleaks.yml` with configurable `scan-mode` (`pr`/`full`) and `fail-on-findings` toggle, `gitleaks/gitleaks-action` pinned to commit SHA `ff98106e` (not a mutable tag) for supply-chain safety; `ci-extended.yml` runs a non-blocking advisory PR scan on every PR; `ci-release.yml` runs a blocking full-history scan via the CLI (event-agnostic, works on `release` events that the GitHub Action does not support); SARIF artefacts uploaded for review; CI topology comment in `ci-required.yml` updated"," - **CI stabilisation — ActivityView test flake on Windows** (`#912`, no issue): `ActivityView.spec.ts` `seedBoards()` previously called `new Date().toISOString()` twice in immediate succession and relied on stable sort preserving declaration order when both timestamps resolved to the same millisecond; on `windows-latest` the second call advanced past the first more often, making the component's `updatedAt DESC` sort pick `board-2` instead of `board-1` as the default selection and breaking downstream `fetchBoard` assertions; fix assigns explicit ordered ISO timestamps (`board-1 = 2025-01-02`, `board-2 = 2025-01-01`) so sort order is deterministic regardless of `Date` resolution"," - **CI stabilisation — cross-process FirstRunBootstrapper write serialisation** (`#913`, no issue): parallel xUnit test processes racing on `appsettings.local.json` read-modify-write produced invalid trailing `}` after valid JSON (`File.WriteAllText` is not atomic across processes); fix serialises the read-modify-write with a named cross-process mutex (hashed from the absolute config path) and stages new contents in a sibling temp file that is atomically moved over the destination so no partial file is ever visible to another process; surfaced by `#911` removing the headless early-return around `EnsureJwtSecret`","- CI/hardening, frontend decomposition, ops, and documentation wave (2026-04-22, PRs `#914`--`#924`, 10 issues):"," - **OPS-30 monitoring and alerting rules** (`#868`/`#914`): `docs/ops/ALERTING_RULES.md` (356 lines, 10 alert rules) with severity-tiered thresholds — P1: 5xx rate >1%, worker heartbeat >5min, DB connectivity loss, health endpoint failure; P2: p95 latency >2s, disk >80%, memory >85%, queue backlog >100, CPU >80%, SignalR/Redis degradation; integration paths for Grafana, CloudWatch, and PagerDuty documented; `docs/ops/README.md` and `docs/ops/OBSERVABILITY_BASELINE.md` updated with cross-links"," - **CI-01 SAST scanning with Semgrep** (`#870`/`#915`): `.semgrep/taskdeck-csharp.yml` (5 custom C# rules) and `.semgrep/taskdeck-typescript.yml` (5 custom TypeScript rules); `scripts/ci/summarize-sast-findings.mjs` for human-readable finding summaries; `.github/workflows/reusable-sast-scanning.yml` wired into `ci-extended` (label: `security`) and `ci-nightly`; advisory mode by default with enforceable option; ADR-0031 documents the SAST scanning decision"," - **TST-61 database migration validation in CI** (`#869`/`#916`): `scripts/ci/validate-migrations.sh` for CI migration chain validation; `.github/workflows/reusable-migration-validation.yml` wired into `ci-required` as a parallel job; `docs/platform/EF_MIGRATION_WORKFLOW.md` updated with CI validation section"," - **DOC-08 data model reference with ERD** (`#875`/`#917`): `docs/architecture/DATA_MODEL.md` (855 lines, 37 entities, Mermaid ERD) covering all domain entities with relationships, field types, and constraints; cross-linked from 5 API docs (BOARDS, CAPTURE, CHAT, WEBHOOKS, AUTHENTICATION)"," - **CI-03 performance regression gate** (`#872`/`#918`): k6 thresholds (p95 <2s, error rate <1%); `scripts/ci/check-bundle-size.mjs` and `scripts/ci/check-k6-thresholds.mjs` for deterministic threshold enforcement; `.github/workflows/reusable-performance-regression-gate.yml` wired into `ci-extended` (label: `performance`) and `ci-nightly`; `docs/PERFORMANCE_BUDGETS.md` updated with CI gate thresholds"," - **FE-20 session timeout warning** (`#861`/`#919`, backend `#933`/`#939`): `useSessionTimeout.ts` composable (245 lines) with configurable warning-before-expiry, countdown timer, and extend/logout actions; `SessionTimeoutWarning.vue` wired into `App.vue`; backend `POST /api/auth/refresh` endpoint now implemented with `[Authorize]` gate, JWT-claims-only user ID, `TokenRefreshPerUser` rate limiting (5/60s), and `TokenInvalidatedAt` enforcement; 19 frontend tests + 10 backend integration tests"," - **FE-18 decompose AutomationChatView** (`#859`/`#920`): 1,523 lines reduced to 235-line shell + 7 components (`ChatHeroHeader`, `LlmHealthStatusBar`, `ChatSessionSidebar`, `ChatMessageList`, `ChatParseHintCard`, `ChatToolCallDetails`, `ChatComposeBar`) + `useAutomationChat` composable (394 lines); all components under 400 lines"," - **FE-17 decompose InboxView** (`#858`/`#921`): 1,527 lines reduced to 222-line shell + `InboxListPanel`, `InboxDetailPanel`, `useInboxOrchestrator` composable, and `inboxUtils`; all existing tests pass without modification"," - **FE-16 decompose ReviewView** (`#856`/`#923`): 1,659 lines reduced to 148-line shell + 6 components (`ReviewHeader`, `ReviewSummaryCards`, `ReviewEmptyState`, `ReviewProposalCard`, `ReviewProposalActions`, `ReviewProposalDetails`) + 2 composables (`useReviewProposals`, `useReviewActions`); all 45 existing ReviewView tests pass without modification"," - **HARD-01 circuit breaker for external API calls** (`#876`/`#924`): Polly circuit breakers on OpenAI, Gemini HTTP clients, and OAuth backchannel; `CircuitBreakerStateTracker` singleton and `CircuitBreakerSettings` config class; health endpoint reports circuit breaker state as degraded (not 503); 23 tests; ADR-0032 documents the circuit breaker decision","- Docs, CI hardening, and bug-fix wave (2026-04-23, PRs `#936`–`#942`): 7 PRs across docs cleanup, bug fixes, and CI hardening:"," - **Docs cleanup** (`#934`/`#936`): removed legacy `TASKDECK_E2E_DB` env var prefix from Playwright commands across 5 docs; annotated duplicate `#326` follow-up relationship; removed redundant `TASKDECK_E2E_API_CORS_ORIGINS` env var from fallback commands"," - **UTF-8 mojibake fix** (`#929`/`#937`): 109 encoding fixes in `STATUS.md` — 46 em dashes, 17 en dashes, 46 right arrows replaced from CP1252→UTF-8 double-encoding artifacts"," - **Redundant migration no-op** (`#932`/`#938`): `AddExternalLoginsUserForeignKey` migration made no-op — FK was already added by earlier `AddTokenInvalidatedAt` migration"," - **Auth refresh endpoint** (`#933`/`#939`): `POST /api/auth/refresh` with `[Authorize]`, JWT-claims user ID, `TokenRefreshPerUser` rate limiting (5/60s), `TokenInvalidatedAt` enforcement; 10 integration tests; completes FE-20 session timeout backend"," - **Test count recertification** (`#930`/`#940`): TESTING_GUIDE.md updated with verified counts — backend 4,979, frontend unit 2,607, combined 7,586+ (subsequently recertified to 5,060/2,805/7,865+ in `#970`/`#987`)"," - **UserPreferences race fix** (`#931`/`#941`): replaced try-catch-retry (~105 lines) with atomic `INSERT OR IGNORE` SQLite upsert (~15 lines) in `UserPreferenceRepository`; 4 concurrency tests added"," - **Pre-existing CI fix** (`#942`): resolved 5 API Integration test failures — `Connectors:EncryptionKey` added to Production-mode test configuration; MCP telemetry test assertion index corrected","- Mobile, security, legal, and testing expansion wave (2026-04-23, PRs `#944`–`#949`):"," - **FE-19 mobile-responsive board, toolbar, and dialog** (`#860`/`#944`): board view stacks columns vertically on ≤640px viewports with page-level scroll; `TdDialog` becomes full-bleed at ≤640px with `100dvh` height and stacked footer actions (cascades to all consumers: CardModal, BoardSettingsModal, LabelManager, StarterPackCatalog, KeyboardHelp); board toolbar and action rail enforce 44×44px tap targets on mobile; `ColumnLane` uses `--td-font-lg` token for 16px font-size to prevent iOS zoom; new `@mobile` Playwright test; WCAG 2.4.3 dialog footer tab-order fix; adversarial review addressed scoped slot CSS penetration and overflow-x interaction"," - **SEC-29 CSP style-src tightening (partial)** (`#855`/`#945`): removed `'unsafe-inline'` from `style-src` in API CSP entirely; added `style-src-elem 'self'` in reverse-proxy CSP to block inline `