[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8},"actionData","errors","root",{"_3415":3416,"_3417":59,"_3418":15,"_3419":15,"_3420":15,"_3421":15,"_3422":15,"_3423":15,"_3424":-5,"_3425":3426},"routes/s.$postId",{"_9":10,"_11":12,"_13":-7,"_14":15,"_16":15,"_17":-5,"_18":19},"kind","post_with_profile","postWithProfile",{"_20":21,"_22":23},"referrer","preferIntrinsicAspectRatioForOgImage",false,"enforceRenderedOgImg","ogImageVariantOverride","defaultOgDescription","ChatGPT helps you get answers, find inspiration, and be more productive.","post",{"_42":43,"_44":45,"_46":-5,"_47":-5,"_48":-5,"_49":-5,"_50":51,"_52":53,"_35":54,"_55":56,"_57":15},"profile",{"_24":25,"_26":25,"_27":28,"_29":-5,"_30":-5,"_31":32,"_33":15,"_34":-5,"_35":-5,"_36":-5,"_37":15,"_38":-5,"_39":-5,"_40":-5,"_41":15},"user_id","anonymous","username","profile_picture_url","https://cdn.openai.com/sora/images/profile_placeholder_v4.png","profile_picture_id","is_default_profile_picture","follower_count",0,"is_following","display_name","permalink","can_cameo","verified","character_count","owner_profile","social_context","follows_you","id","cd_6a66cc95ce848191b2c97eae9426fbcd","posted_at",1785121941.806929,"text","og_title","og_description","og_image_variant","attachments",[65],"preview_image_url","https://ogimg.chatgpt.com/?postId=cd_6a66cc95ce848191b2c97eae9426fbcd","https://chatgpt.com/s/cd_6a66cc95ce848191b2c97eae9426fbcd","permissions",{"_58":59,"_60":15,"_61":15,"_62":59,"_63":64},"use_experimental_unfurl","can_read",true,"can_write","can_delete","can_remix","share_setting","public",{"_42":66,"_67":68,"_9":69,"_70":71,"_72":73,"_74":75,"_76":77,"_78":79,"_80":-5},"cd_6a66cc95ce848191b2c97eae9426fbcd-attachment-0","tags",[],"codex","task",{"_42":3375,"_120":3376,"_499":3377,"_3378":59,"_83":84,"_3379":15,"_3380":3381,"_461":15,"_3382":3383,"_3384":-5,"_3385":3386},"current_user_turn",{"_93":512,"_42":85,"_97":512,"_1882":3358,"_1884":3359,"_1886":1887,"_133":-5,"_120":1888},"current_assistant_turn",{"_93":94,"_42":84,"_95":-5,"_96":-5,"_97":94,"_98":2649,"_100":2650,"_102":103,"_104":-5,"_105":2651,"_107":2652,"_109":2653,"_111":2654,"_113":114,"_115":-5,"_116":117,"_118":2655,"_120":121,"_122":-5,"_123":124,"_125":2656,"_127":128,"_129":130,"_131":-5,"_132":-5,"_133":85,"_134":2657,"_136":2658,"_138":-5,"_139":15,"_140":141,"_142":-5},"current_diff_task_turn",{"_93":94,"_42":84,"_95":-5,"_96":-5,"_97":94,"_98":1940,"_100":1941,"_102":103,"_104":-5,"_105":1942,"_107":1943,"_109":1944,"_111":1945,"_113":114,"_115":-5,"_116":117,"_118":1946,"_120":121,"_122":-5,"_123":124,"_125":1947,"_127":128,"_129":130,"_131":-5,"_132":-5,"_133":85,"_134":1948,"_136":1949,"_138":-5,"_139":15,"_140":141,"_142":-5},"turns",{"_81":82,"_83":84},"example_task_info","turn_mapping",{"_85":86,"_84":87},"current_turn_id","task_e_6a66cc9371048333acb2438cd494097e~assttrn_e_6a66cc94b6d88333acb467e18baa961a","task_e_6a66cc9371048333acb2438cd494097e~usertrn_e_6a66cc948ff48333a801e909e935c8b4",{"_42":85,"_88":1880,"_90":1881,"_92":-5},{"_42":84,"_88":89,"_90":91,"_92":85},"turn",{"_93":94,"_42":84,"_95":-5,"_96":-5,"_97":94,"_98":99,"_100":101,"_102":103,"_104":-5,"_105":106,"_107":108,"_109":110,"_111":112,"_113":114,"_115":-5,"_116":117,"_118":119,"_120":121,"_122":-5,"_123":124,"_125":126,"_127":128,"_129":130,"_131":-5,"_132":-5,"_133":85,"_134":135,"_136":137,"_138":-5,"_139":15,"_140":141,"_142":-5},"children",[],"parent","type","assistant","sibling_turn_ids","attempt_placement","role","output_items",[1454,1455,1456],"child_turns",[],"conversation_id","None","error","latest_event",{"_1449":1450,"_46":1451,"_1452":1453},"worklog",{"_1424":1425},"app_server_events",{"_523":1423},"thread_events",{"_523":524},"turn_status","completed","cancellation_requested_at","pull_request_status","externally_created","pull_request_data",{"_491":492,"_481":493,"_494":495,"_496":15,"_497":59,"_498":15,"_499":500,"_501":502,"_503":453,"_504":128,"_505":506,"_507":130,"_508":509,"_510":-5,"_511":-5,"_512":513,"_514":515,"_516":517,"_518":519,"_520":521},"created_at",1785121940.714331,"internal_only_rollouts","environment_id","691bd380045081918afbc67b5a4ff537","environment",{"_42":124,"_380":381,"_382":383,"_384":15,"_385":386,"_387":388,"_389":390,"_391":-5,"_392":-5,"_393":15,"_394":395,"_396":386,"_397":386,"_398":399,"_400":401,"_402":403,"_404":-5,"_405":406,"_407":408,"_409":410,"_411":412,"_55":-5,"_120":413,"_414":415,"_416":417,"_418":419,"_420":15,"_421":15},"branch","issue-1228/release-trigger","base_commit_sha","af8bbeee2b45d056b252d18dc59dbbbc38cd6a66","branch_name","direct_push_pushed_commit_sha","previous_turn_id","logs",{"_134":360},"proxy_events",[143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242],"debug_metadata","discarded","model_version","gpt-5.6-sol","languages",{"_243":359,"_245":246,"_247":248,"_249":262,"_251":292,"_253":254,"_255":32,"_256":-5},{"_243":358,"_245":246,"_247":248,"_249":250,"_251":274,"_253":254,"_255":32,"_256":-5},{"_243":357,"_245":246,"_247":248,"_249":250,"_251":274,"_253":254,"_255":32,"_256":-5},{"_243":356,"_245":246,"_247":248,"_249":250,"_251":274,"_253":254,"_255":32,"_256":-5},{"_243":355,"_245":246,"_247":248,"_249":250,"_251":274,"_253":254,"_255":32,"_256":-5},{"_243":354,"_245":246,"_247":248,"_249":250,"_251":274,"_253":254,"_255":32,"_256":-5},{"_243":353,"_245":246,"_247":248,"_249":262,"_251":292,"_253":254,"_255":32,"_256":-5},{"_243":352,"_245":246,"_247":248,"_249":262,"_251":292,"_253":254,"_255":32,"_256":-5},{"_243":351,"_245":246,"_247":248,"_249":250,"_251":274,"_253":254,"_255":32,"_256":-5},{"_243":350,"_245":246,"_247":248,"_249":262,"_251":292,"_253":254,"_255":32,"_256":-5},{"_243":349,"_245":246,"_247":248,"_249":262,"_251":292,"_253":254,"_255":32,"_256":-5},{"_243":348,"_245":246,"_247":248,"_249":250,"_251":274,"_253":254,"_255":32,"_256":-5},{"_243":347,"_245":246,"_247":248,"_249":250,"_251":274,"_253":254,"_255":32,"_256":-5},{"_243":346,"_245":246,"_247":248,"_249":250,"_251":274,"_253":254,"_255":32,"_256":-5},{"_243":345,"_245":246,"_247":248,"_249":250,"_251":252,"_253":254,"_255":32,"_256":-5},{"_243":344,"_245":246,"_247":248,"_249":262,"_251":263,"_253":254,"_255":32,"_256":-5},{"_243":343,"_245":246,"_247":248,"_249":250,"_251":252,"_253":254,"_255":32,"_256":-5},{"_243":342,"_245":246,"_247":248,"_249":250,"_251":252,"_253":254,"_255":32,"_256":-5},{"_243":341,"_245":246,"_247":248,"_249":250,"_251":252,"_253":254,"_255":32,"_256":-5},{"_243":340,"_245":246,"_247":248,"_249":250,"_251":274,"_253":254,"_255":32,"_256":-5},{"_243":339,"_245":246,"_247":248,"_249":250,"_251":274,"_253":254,"_255":32,"_256":-5},{"_243":338,"_245":246,"_247":248,"_249":262,"_251":292,"_253":254,"_255":32,"_256":-5},{"_243":337,"_245":246,"_247":248,"_249":250,"_251":274,"_253":254,"_255":32,"_256":-5},{"_243":336,"_245":246,"_247":248,"_249":262,"_251":292,"_253":254,"_255":32,"_256":-5},{"_243":335,"_245":246,"_247":248,"_249":250,"_251":274,"_253":254,"_255":32,"_256":-5},{"_243":334,"_245":246,"_247":248,"_249":250,"_251":274,"_253":254,"_255":32,"_256":-5},{"_243":333,"_245":246,"_247":248,"_249":262,"_251":292,"_253":254,"_255":32,"_256":-5},{"_243":332,"_245":246,"_247":248,"_249":250,"_251":274,"_253":254,"_255":32,"_256":-5},{"_243":331,"_245":246,"_247":248,"_249":262,"_251":292,"_253":254,"_255":32,"_256":-5},{"_243":330,"_245":246,"_247":248,"_249":250,"_251":274,"_253":254,"_255":32,"_256":-5},{"_243":329,"_245":246,"_247":248,"_249":250,"_251":274,"_253":254,"_255":32,"_256":-5},{"_243":328,"_245":246,"_247":248,"_249":250,"_251":274,"_253":254,"_255":32,"_256":-5},{"_243":327,"_245":246,"_247":248,"_249":262,"_251":292,"_253":254,"_255":32,"_256":-5},{"_243":326,"_245":246,"_247":248,"_249":262,"_251":292,"_253":254,"_255":32,"_256":-5},{"_243":325,"_245":246,"_247":248,"_249":250,"_251":274,"_253":254,"_255":32,"_256":-5},{"_243":324,"_245":246,"_247":248,"_249":250,"_251":252,"_253":254,"_255":32,"_256":-5},{"_243":323,"_245":246,"_247":248,"_249":250,"_251":274,"_253":254,"_255":32,"_256":-5},{"_243":322,"_245":246,"_247":248,"_249":250,"_251":252,"_253":254,"_255":32,"_256":-5},{"_243":321,"_245":246,"_247":248,"_249":250,"_251":252,"_253":254,"_255":32,"_256":-5},{"_243":320,"_245":246,"_247":248,"_249":250,"_251":274,"_253":254,"_255":32,"_256":-5},{"_243":319,"_245":246,"_247":248,"_249":250,"_251":252,"_253":254,"_255":32,"_256":-5},{"_243":318,"_245":246,"_247":248,"_249":250,"_251":274,"_253":254,"_255":32,"_256":-5},{"_243":317,"_245":246,"_247":248,"_249":250,"_251":274,"_253":254,"_255":32,"_256":-5},{"_243":316,"_245":246,"_247":248,"_249":262,"_251":292,"_253":254,"_255":32,"_256":-5},{"_243":315,"_245":246,"_247":248,"_249":262,"_251":292,"_253":254,"_255":32,"_256":-5},{"_243":314,"_245":246,"_247":248,"_249":250,"_251":274,"_253":254,"_255":32,"_256":-5},{"_243":313,"_245":246,"_247":248,"_249":250,"_251":274,"_253":254,"_255":32,"_256":-5},{"_243":312,"_245":246,"_247":248,"_249":250,"_251":274,"_253":254,"_255":32,"_256":-5},{"_243":311,"_245":246,"_247":248,"_249":262,"_251":292,"_253":254,"_255":32,"_256":-5},{"_243":310,"_245":246,"_247":248,"_249":262,"_251":292,"_253":254,"_255":32,"_256":-5},{"_243":309,"_245":246,"_247":248,"_249":250,"_251":274,"_253":254,"_255":32,"_256":-5},{"_243":308,"_245":246,"_247":248,"_249":250,"_251":274,"_253":254,"_255":32,"_256":-5},{"_243":307,"_245":246,"_247":248,"_249":250,"_251":274,"_253":254,"_255":32,"_256":-5},{"_243":306,"_245":246,"_247":248,"_249":250,"_251":252,"_253":254,"_255":32,"_256":-5},{"_243":305,"_245":246,"_247":248,"_249":250,"_251":274,"_253":254,"_255":32,"_256":-5},{"_243":304,"_245":246,"_247":248,"_249":250,"_251":274,"_253":254,"_255":32,"_256":-5},{"_243":303,"_245":246,"_247":248,"_249":250,"_251":252,"_253":254,"_255":32,"_256":-5},{"_243":302,"_245":246,"_247":248,"_249":250,"_251":252,"_253":254,"_255":32,"_256":-5},{"_243":301,"_245":246,"_247":248,"_249":250,"_251":252,"_253":254,"_255":32,"_256":-5},{"_243":300,"_245":246,"_247":248,"_249":250,"_251":274,"_253":254,"_255":32,"_256":-5},{"_243":299,"_245":246,"_247":248,"_249":250,"_251":274,"_253":254,"_255":32,"_256":-5},{"_243":298,"_245":246,"_247":248,"_249":250,"_251":274,"_253":254,"_255":32,"_256":-5},{"_243":297,"_245":246,"_247":248,"_249":250,"_251":274,"_253":254,"_255":32,"_256":-5},{"_243":296,"_245":246,"_247":248,"_249":250,"_251":274,"_253":254,"_255":32,"_256":-5},{"_243":295,"_245":246,"_247":248,"_249":262,"_251":292,"_253":254,"_255":32,"_256":-5},{"_243":294,"_245":246,"_247":248,"_249":250,"_251":274,"_253":254,"_255":32,"_256":-5},{"_243":293,"_245":246,"_247":248,"_249":250,"_251":274,"_253":254,"_255":32,"_256":-5},{"_243":291,"_245":246,"_247":248,"_249":262,"_251":292,"_253":254,"_255":32,"_256":-5},{"_243":290,"_245":246,"_247":248,"_249":250,"_251":274,"_253":254,"_255":32,"_256":-5},{"_243":289,"_245":246,"_247":248,"_249":250,"_251":252,"_253":254,"_255":32,"_256":-5},{"_243":288,"_245":246,"_247":248,"_249":250,"_251":252,"_253":254,"_255":32,"_256":-5},{"_243":287,"_245":246,"_247":248,"_249":250,"_251":252,"_253":254,"_255":32,"_256":-5},{"_243":286,"_245":246,"_247":248,"_249":250,"_251":252,"_253":254,"_255":32,"_256":-5},{"_243":285,"_245":246,"_247":248,"_249":250,"_251":274,"_253":254,"_255":32,"_256":-5},{"_243":284,"_245":246,"_247":248,"_249":250,"_251":274,"_253":254,"_255":32,"_256":-5},{"_243":283,"_245":246,"_247":248,"_249":250,"_251":274,"_253":254,"_255":32,"_256":-5},{"_243":282,"_245":246,"_247":248,"_249":250,"_251":274,"_253":254,"_255":32,"_256":-5},{"_243":281,"_245":246,"_247":248,"_249":250,"_251":252,"_253":254,"_255":32,"_256":-5},{"_243":280,"_245":246,"_247":248,"_249":250,"_251":252,"_253":254,"_255":32,"_256":-5},{"_243":279,"_245":246,"_247":248,"_249":250,"_251":274,"_253":254,"_255":32,"_256":-5},{"_243":278,"_245":246,"_247":248,"_249":250,"_251":274,"_253":254,"_255":32,"_256":-5},{"_243":277,"_245":246,"_247":248,"_249":250,"_251":274,"_253":254,"_255":32,"_256":-5},{"_243":276,"_245":246,"_247":248,"_249":250,"_251":274,"_253":254,"_255":32,"_256":-5},{"_243":275,"_245":246,"_247":248,"_249":250,"_251":274,"_253":254,"_255":32,"_256":-5},{"_243":273,"_245":246,"_247":248,"_249":250,"_251":274,"_253":254,"_255":32,"_256":-5},{"_243":272,"_245":246,"_247":248,"_249":250,"_251":252,"_253":254,"_255":32,"_256":-5},{"_243":271,"_245":246,"_247":248,"_249":250,"_251":252,"_253":254,"_255":32,"_256":-5},{"_243":270,"_245":246,"_247":248,"_249":250,"_251":252,"_253":254,"_255":32,"_256":-5},{"_243":269,"_245":246,"_247":248,"_249":250,"_251":252,"_253":254,"_255":32,"_256":-5},{"_243":268,"_245":246,"_247":248,"_249":250,"_251":252,"_253":254,"_255":32,"_256":-5},{"_243":267,"_245":246,"_247":248,"_249":250,"_251":252,"_253":254,"_255":32,"_256":-5},{"_243":266,"_245":246,"_247":248,"_249":250,"_251":252,"_253":254,"_255":32,"_256":-5},{"_243":265,"_245":246,"_247":248,"_249":262,"_251":263,"_253":254,"_255":32,"_256":-5},{"_243":264,"_245":246,"_247":248,"_249":250,"_251":252,"_253":254,"_255":32,"_256":-5},{"_243":261,"_245":246,"_247":248,"_249":262,"_251":263,"_253":254,"_255":32,"_256":-5},{"_243":260,"_245":246,"_247":248,"_249":250,"_251":252,"_253":254,"_255":32,"_256":-5},{"_243":259,"_245":246,"_247":248,"_249":250,"_251":252,"_253":254,"_255":32,"_256":-5},{"_243":258,"_245":246,"_247":248,"_249":250,"_251":252,"_253":254,"_255":32,"_256":-5},{"_243":257,"_245":246,"_247":248,"_249":250,"_251":252,"_253":254,"_255":32,"_256":-5},{"_243":244,"_245":246,"_247":248,"_249":250,"_251":252,"_253":254,"_255":32,"_256":-5},"timestamp","2026-07-27T03:14:09.773342","decision","allow","reason","checks passed","method","GET","domain","proxy.golang.org","protocol","HTTP/1.1","size","path","2026-07-27T03:14:09.748440","2026-07-27T03:14:09.747461","2026-07-27T03:14:09.741248","2026-07-27T03:14:09.711013","2026-07-27T03:14:09.707986","CONNECT","proxy.golang.org:443","2026-07-27T03:14:09.707529","2026-07-27T03:14:09.700899","2026-07-27T03:14:09.699579","2026-07-27T03:14:09.671762","2026-07-27T03:14:09.667326","2026-07-27T03:14:09.636199","2026-07-27T03:14:09.633134","2026-07-27T03:14:09.575289","2026-07-27T03:14:09.551624","2026-07-27T03:14:09.502404","sum.golang.org","2026-07-27T03:14:09.501305","2026-07-27T03:14:09.469109","2026-07-27T03:14:09.443928","2026-07-27T03:14:09.438954","2026-07-27T03:14:09.413603","2026-07-27T03:14:09.386223","2026-07-27T03:14:09.349165","2026-07-27T03:14:09.314636","2026-07-27T03:14:09.311572","2026-07-27T03:14:09.279217","2026-07-27T03:14:09.247872","2026-07-27T03:14:09.212106","2026-07-27T03:14:09.172932","2026-07-27T03:14:09.134681","2026-07-27T03:14:09.133563","2026-07-27T03:14:09.099101","2026-07-27T03:14:09.092042","sum.golang.org:443","2026-07-27T03:14:09.091028","2026-07-27T03:14:09.071801","2026-07-27T03:14:09.065367","2026-07-27T03:14:09.063480","2026-07-27T03:14:09.051507","2026-07-27T03:14:09.030680","2026-07-27T03:14:09.020811","2026-07-27T03:14:09.001837","2026-07-27T03:14:08.986662","2026-07-27T03:14:08.949133","2026-07-27T03:14:08.913301","2026-07-27T03:14:08.900925","2026-07-27T03:14:08.899952","2026-07-27T03:14:08.876475","2026-07-27T03:14:08.850475","2026-07-27T03:14:08.848872","2026-07-27T03:14:08.838887","2026-07-27T03:14:08.837418","2026-07-27T03:14:08.835726","2026-07-27T03:14:08.827997","2026-07-27T03:14:08.826469","2026-07-27T03:14:08.816145","2026-07-27T03:14:08.815561","2026-07-27T03:14:08.814031","2026-07-27T03:14:08.798907","2026-07-27T03:14:08.778673","2026-07-27T03:14:08.751514","2026-07-27T03:14:08.737413","2026-07-27T03:14:08.708871","2026-07-27T03:14:08.699928","2026-07-27T03:14:08.670788","2026-07-27T03:14:08.664980","2026-07-27T03:14:08.629146","2026-07-27T03:14:08.615465","2026-07-27T03:14:08.614140","2026-07-27T03:14:08.613254","2026-07-27T03:14:08.610656","2026-07-27T03:14:08.609626","2026-07-27T03:14:08.606890","2026-07-27T03:14:08.573561","2026-07-27T03:14:08.570909","2026-07-27T03:14:08.570357","2026-07-27T03:14:08.566473","2026-07-27T03:14:08.558702","2026-07-27T03:14:08.557227","2026-07-27T03:14:08.555647","2026-07-27T03:14:08.529534","2026-07-27T03:14:08.518646","2026-07-27T03:14:08.494237","2026-07-27T03:14:08.479556","2026-07-27T03:14:08.456494","2026-07-27T03:14:08.449863","2026-07-27T03:14:08.442203","2026-07-27T03:14:08.413314","2026-07-27T03:14:08.409200","2026-07-27T03:14:08.402417","2026-07-27T03:14:08.400976","2026-07-27T03:14:08.392547","2026-07-27T03:14:08.389399","2026-07-27T03:14:08.388839","2026-07-27T03:14:08.387412","2026-07-27T03:14:08.378822","2026-07-27T03:14:08.341898","2026-07-27T03:14:08.340371","2026-07-27T03:14:08.304483","2026-07-27T03:14:08.302383","2026-07-27T03:14:08.286537",[361,362,363],{"_364":376,"_366":377},{"_364":372,"_366":373},{"_364":365,"_366":367},"key",{"_368":369,"_93":370,"_120":371},"value","file_00000000565081f7ad22ace9ed262876","name","auto_setup","UserSetupScript","2026-07-27T02:58:02.527837",{"_368":374,"_93":370,"_120":375},"file_00000000e50c81f7b8a3c0df3fe9bcf5","warm_up_git_repo_1785121944","2026-07-27T03:12:24.633634",{"_368":378,"_93":370,"_120":379},"file_00000000284081f78cb3169031713599","setup_autodetect","2026-07-27T02:57:49.690917","machine_id","wham-public/wham-universal","label","Chris0Jeky/Taskdeck","is_pinned","description","","workspace_dir","/workspace","agent_network_access",{"_483":484,"_485":486,"_487":386,"_488":-5,"_489":-5,"_490":-5},"codex_github_direct","github_connector_id","enable_gitlab_webhooks","repos",[443],"setup","maintenance_setup","repo_map",{"_443":444},"env_vars",{"_425":426,"_427":428,"_429":430,"_431":432,"_433":434,"_435":436,"_437":438,"_439":440,"_441":442},"secrets",{},"secrets_with_domains","task_count",1304,"creator_id","user-945hDnoZKlADU2Nzt7kdutZp","share_settings","workspace","share_targets",[],1763431296.017003,"auto_setup_settings",{"_424":59},"cache_settings",{"_422":59,"_423":386},"etag","\"5b03bc49-0000-0200-0000-6a66cc350000\"","enable_authtranslator","enable_docker_in_docker","post_setup_cache_enabled","cache_invalidation_key","use_auto_setup","CODEX_ENV_PYTHON_VERSION","3.12","CODEX_ENV_NODE_VERSION","20","CODEX_ENV_RUBY_VERSION","3.4.4","CODEX_ENV_RUST_VERSION","1.89.0","CODEX_ENV_GO_VERSION","1.24.3","CODEX_ENV_BUN_VERSION","1.2.14","CODEX_ENV_PHP_VERSION","8.4","CODEX_ENV_JAVA_VERSION","21","CODEX_ENV_SWIFT_VERSION","6.1","github-1098648347",{"_42":445,"_368":446,"_447":448,"_449":383,"_450":451,"_452":453,"_454":455,"_456":457,"_458":459,"_460":64,"_461":15,"_462":-5,"_463":-5,"_464":-5,"_465":-5,"_466":-5,"_467":-5,"_255":468,"_469":-5,"_55":470},"1098648347","Taskdeck","owner",{"_475":476,"_42":477,"_93":478,"_479":480,"_481":482},"repository_full_name","clone_url","https://github.com/Chris0Jeky/Taskdeck.git","default_branch","main","git_commits_url","https://api.github.com/repos/Chris0Jeky/Taskdeck/git/commits{/sha}","git_refs_url","https://api.github.com/repos/Chris0Jeky/Taskdeck/git/refs{/sha}","git_url","git://github.com/Chris0Jeky/Taskdeck.git","visibility","archived","allow_auto_merge","allow_merge_commit","allow_rebase_merge","allow_squash_merge","allow_update_branch","language",20342,"master_branch",{"_471":15,"_472":15,"_473":15,"_474":15},"admin","maintain","push","pull","login","Chris0Jeky",59696583,"User","avatar_url","https://avatars.githubusercontent.com/u/59696583?v=4","url","https://api.github.com/users/Chris0Jeky","mode","on","preset_allowlist","all","allowlist_domains","allowlist_rules","denylist_domains","safe_methods_only","number",1502,"https://github.com/Chris0Jeky/Taskdeck/pull/1502","state","open","merged","mergeable","draft","title","Disable automatic staging gate release trigger","body","Closes #1228\n\n## Summary\n- remove the `release: published` subscription and unreachable release-event tag handling from the parked staging workflow\n- retain required-input manual dispatch, jobs, permissions, smoke/build phases, and the `production` environment binding\n- validate the operator-supplied image tag before it reaches shell/docker expressions\n- add a fail-closed governance check that keeps this parked workflow `workflow_dispatch`-only\n- correct deployment/revival documentation and stop claiming that the currently unconfigured environment binding is an approval gate\n\n## Review finding follow-up\n- real environment required-reviewer protection is outside this trigger-removal slice and is now tracked as maintainer-only #1504 (`Blocked / Priority II`)\n- the superseded optional-archive packaging wording is corrected to the accepted ADR-0044 revival/public-beta posture\n\n## Verification\n- `node scripts/check-docs-governance.mjs`\n- `node scripts/check-golden-principles.mjs`\n- `node scripts/check-github-ops-governance.mjs`\n- `docker run --rm -v \"${PWD}:/repo\" -w /repo rhysd/actionlint:1.7.12 .github/workflows/cd-staging-gate.yml`\n- `git diff --check`\n\n## Not verified\n- no release event was emitted; absence of that event subscription is now enforced by the required GitHub-operations governance check\n- no manual staging deployment or environment approval was run because the staged cloud path remains parked and the live repository has no protected `production` environment\r\n","base","head","base_sha","2f62c8ca82a66c5417abd03688e9dbbd219319d4","head_sha","merge_commit_sha","8e0a9555cd42ede28f90f3a627d24e78752a7d70","comments","diff","user",{"_475":476,"_368":476,"_522":-5,"_479":480,"_42":477},"commits",3,"changed_files",7,"additions",70,"deletions",33,"email","events",[525,526,527,528,529,530,531,532,533,534,535,536,537,538,539,540,541,542,543,544,545,546,547,548,549,550,551,552,553,554,555,556,557,558,559,560,561,562,563,564,565,566,567,568,569,570,571,572,573,574,575,576,577,578,579,580,581,582,583,584,585,586,587,588,589,590,591,592,593,594,595,596,597,598,599,600,601,602,603,604,605,606,607,608,609,610,611,612,613,614,615,616,617,618,619,620],{"_249":1396,"_622":1397},{"_249":639,"_622":1391},{"_249":1386,"_622":1387},{"_249":643,"_622":1378},{"_249":643,"_622":1372},{"_249":643,"_622":1365},{"_249":643,"_622":1357},{"_249":643,"_622":1352},{"_249":661,"_622":1341},{"_249":661,"_622":1336},{"_249":643,"_622":1328},{"_249":643,"_622":1323},{"_249":661,"_622":1314},{"_249":643,"_622":1305},{"_249":661,"_622":1300},{"_249":643,"_622":1294},{"_249":643,"_622":1289},{"_249":661,"_622":1280},{"_249":643,"_622":1271},{"_249":661,"_622":1266},{"_249":643,"_622":1258},{"_249":661,"_622":1255},{"_249":643,"_622":1247},{"_249":643,"_622":1242},{"_249":661,"_622":1203},{"_249":643,"_622":1193},{"_249":661,"_622":1188},{"_249":643,"_622":1180},{"_249":643,"_622":1175},{"_249":661,"_622":1166},{"_249":643,"_622":1157},{"_249":661,"_622":1152},{"_249":643,"_622":1144},{"_249":643,"_622":1139},{"_249":661,"_622":1121},{"_249":643,"_622":1112},{"_249":661,"_622":1107},{"_249":643,"_622":1097},{"_249":643,"_622":1092},{"_249":661,"_622":1074},{"_249":643,"_622":1066},{"_249":661,"_622":1061},{"_249":643,"_622":1053},{"_249":643,"_622":1048},{"_249":643,"_622":1039},{"_249":661,"_622":1028},{"_249":661,"_622":1023},{"_249":643,"_622":1013},{"_249":643,"_622":1008},{"_249":661,"_622":989},{"_249":643,"_622":980},{"_249":661,"_622":975},{"_249":643,"_622":967},{"_249":643,"_622":962},{"_249":661,"_622":949},{"_249":643,"_622":940},{"_249":661,"_622":935},{"_249":643,"_622":927},{"_249":643,"_622":922},{"_249":643,"_622":913},{"_249":661,"_622":908},{"_249":643,"_622":900},{"_249":643,"_622":895},{"_249":643,"_622":890},{"_249":661,"_622":885},{"_249":643,"_622":879},{"_249":643,"_622":875},{"_249":643,"_622":871},{"_249":643,"_622":867},{"_249":643,"_622":863},{"_249":643,"_622":859},{"_249":643,"_622":855},{"_249":643,"_622":851},{"_249":643,"_622":846},{"_249":643,"_622":839},{"_249":643,"_622":828},{"_249":661,"_622":817},{"_249":661,"_622":812},{"_249":643,"_622":802},{"_249":643,"_622":797},{"_249":661,"_622":788},{"_249":643,"_622":778},{"_249":661,"_622":773},{"_249":643,"_622":765},{"_249":643,"_622":760},{"_249":661,"_622":737},{"_249":643,"_622":728},{"_249":661,"_622":723},{"_249":643,"_622":711},{"_249":643,"_622":702},{"_249":661,"_622":682},{"_249":643,"_622":667},{"_249":661,"_622":662},{"_249":643,"_622":644},{"_249":639,"_622":640},{"_249":621,"_622":623},"turn/completed","params",{"_624":625,"_88":626},"threadId","019fa18f-4226-7590-9369-ae02b9af8fd9",{"_627":628,"_629":630,"_104":-5,"_42":631,"_632":633,"_634":635,"_636":637,"_638":114},"completedAt",1785122108,"durationMs",159755,"019fa18f-4509-7ad0-9baa-c42f6fc32cd7","items",[],"itemsView","notLoaded","startedAt",1785121948,"status","thread/status/changed",{"_638":641,"_624":625},{"_93":642},"idle","rawResponseItem/completed",{"_645":646,"_624":625,"_647":631},"item",{"_648":649,"_650":-5,"_42":651,"_652":653,"_654":655,"_97":94,"_93":656},"turnId","content",[658],"end_turn","msg_0ca5cfbf71c2b2e6016a66cd3153248190a223ab75b10a77ac","internal_chat_message_metadata_passthrough",{"_657":631},"phase","final_answer","message","turn_id",{"_46":659,"_93":660},"### Summary\n\n* Hardened staging-trigger discovery to recognize block, inline/flow, quoted, and comment-suffixed event mappings. Unrecognized top-level `on` entries are now rejected conservatively, preserving the manual-only contract. 【F:scripts/check-github-ops-governance.mjs†L144-L168】【F:scripts/check-github-ops-governance.mjs†L195-L207】\n* Added adversarial regression coverage for inline automatic triggers, quoted keys, comment-suffixed keys, and otherwise unrecognized indentation-two mappings. 【F:scripts/check-github-ops-governance.test.mjs†L6-L45】\n* Added the regression suite to Required Docs Governance before the production governance check executes. 【F:.github/workflows/reusable-docs-governance.yml†L60-L63】\n* Added the maintainer-only `#1504` environment-protection configuration and rehearsal task to the durable checklist. No existing checklist item was checked off. 【F:OUTSTANDING_TASKS.md†L89-L95】\n* Created signed-off commit `438e146b2919b222d77700733acd05092d51413d` (`Fail closed on staging trigger mappings`).\n* Created follow-up PR metadata through `make_pr` with title **“Fail closed on all staging trigger mappings.”**\n* Canonical `docs/STATUS.md` and `docs/IMPLEMENTATION_MASTERPLAN.md` were not changed because this follow-up hardens governance verification without changing shipped product or roadmap reality.\n\n**Testing**\n\n* ✅ `node --test scripts/check-github-ops-governance.test.mjs` — 3 tests passed.\n* ✅ `node scripts/check-github-ops-governance.mjs`\n* ✅ `node scripts/check-docs-governance.mjs`\n* ✅ `node scripts/check-golden-principles.mjs`\n* ✅ `go run github.com/rhysd/actionlint/cmd/actionlint@v1.7.12 .github/workflows/reusable-docs-governance.yml .github/workflows/cd-staging-gate.yml`\n* ✅ `git diff --check`\n* ✅ `git diff --cached --check`\n* ✅ `git commit -s --no-gpg-sign -m \"Fail closed on staging trigger mappings\"`\n* ✅ `git status --short --branch` — clean working tree on branch `work`.\n\n### Outstanding Maintainer Work\n\nThe durable checklist remains open, including `#1173`, newly recorded `#1504`, `#1303`, `#1482`, `#1458` maintainer check-off, `#1330`, `#1282/#1332/#1335`, `#1338`, `#1343`, `#1345` check-off, `#1274`, `#1347/#1348`, `#1323`, `#1456/PR #1457`, and merged-worktree pruning. 【F:OUTSTANDING_TASKS.md†L91-L105】","output_text","item/completed",{"_663":664,"_645":665,"_624":625,"_647":631},"completedAtMs",1785122108675,{"_42":651,"_654":655,"_46":659,"_93":666},"agentMessage",{"_645":668,"_624":625,"_647":631},{"_669":670,"_42":-5,"_652":671,"_368":-5,"_672":673,"_93":674},"call_id","call_Xi6KqhPaAKuW4G5gtXj9SLvD",{"_657":631},"output",{"_501":675,"_676":-5},"custom_tool_call_output",[677,678],"success",{"_46":681,"_93":680},{"_46":679,"_93":680},"## work\n 141\t }\n 142\t}\n 143\t\n 144\texport function discoverTopLevelMappingKeys(lines, indentation = 2) {\n 145\t const prefix = ' '.repeat(indentation)\n 146\t const keys = []\n 147\t const unrecognizedEntries = []\n 148\t\n 149\t for (const line of lines) {\n 150\t if (!line.startsWith(prefix) || line.startsWith(`${prefix} `)) {\n 151\t continue\n 152\t }\n 153\t\n 154\t const content = line.slice(indentation)\n 155\t if (content.trim().length === 0 || content.trimStart().startsWith('#')) {\n 156\t continue\n 157\t }\n 158\t\n 159\t const mappingEntry = content.match(/^(?:\"((?:[^\"\\\\]|\\\\.)+)\"|'((?:[^']|'')+)'|([A-Za-z][\\w-]*))\\s*:/)\n 160\t if (!mappingEntry) {\n 161\t unrecognizedEntries.push(content)\n 162\t continue\n 163\t }\n 164\t\n 165\t keys.push(mappingEntry[1] ?? mappingEntry[2]?.replaceAll(\"''\", \"'\") ?? mappingEntry[3])\n 166\t }\n 167\t\n 168\t return { keys, unrecognizedEntries }\n 169\t}\n 170\t\n 171\tasync function validateParkedStagingGateTriggers() {\n 172\t const workflowPath = '.github/workflows/cd-staging-gate.yml'\n 173\t if (!(await fileExists(workflowPath))) {\n 174\t errors.push(`Missing parked staging workflow: ${workflowPath}`)\n 175\t return\n 176\t }\n 177\t\n 178\t const workflowText = await readFile(resolve(workflowPath), 'utf8')\n 179\t const lines = workflowText.split(/\\r?\\n/)\n 180\t const onIndex = lines.findIndex((line) => line === 'on:')\n 181\t if (onIndex < 0) {\n 182\t errors.push(`${workflowPath} is missing its top-level on block`)\n 183\t return\n 184\t }\n 185\t\n 186\t const triggerLines = []\n 187\t for (let index = onIndex + 1; index < lines.length; index += 1) {\n 188\t const line = lines[index]\n 189\t if (line.length > 0 && !/^\\s/.test(line)) {\n 190\t break\n 191\t }\n 192\t triggerLines.push(line)\n 193\t }\n 194\t\n 195\t const { keys: triggerNames, unrecognizedEntries } = discoverTopLevelMappingKeys(triggerLines)\n 196\t\n 197\t if (unrecognizedEntries.length > 0) {\n 198\t errors.push(\n 199\t `${workflowPath} contains unrecognized top-level entries in its on block: ${unrecognizedEntries.join(', ')}`,\n 200\t )\n 201\t }\n 202\t\n 203\t if (triggerNames.length !== 1 || triggerNames[0] !== 'workflow_dispatch') {\n 204\t errors.push(\n 205\t `${workflowPath} is parked and must remain manual-only; expected only workflow_dispatch, found: ${triggerNames.join(', ') || '(none)'}`,\n 206\t )\n 207\t }\n 208\t\n 209\t if (workflowText.includes('github.event.release') || workflowText.includes('EVENT_NAME == \"release\"')) {\n 210\t errors.push(`${workflowPath} retains unreachable release-event handling after becoming manual-only`)\n 211\t }\n 212\t}\n 213\t\n 214\tasync function main() {\n 215\t await validateIssueTemplates()\n 1\timport assert from 'node:assert/strict'\n 2\timport test from 'node:test'\n 3\t\n 4\timport { discoverTopLevelMappingKeys } from './check-github-ops-governance.mjs'\n 5\t\n 6\ttest('discovers block and inline trigger mappings', () => {\n 7\t const result = discoverTopLevelMappingKeys([\n 8\t ' workflow_dispatch:',\n 9\t ' inputs:',\n 10\t ' release: { types: [published] }',\n 11\t ' push: {}',\n 12\t ])\n 13\t\n 14\t assert.deepEqual(result, {\n 15\t keys: ['workflow_dispatch', 'release', 'push'],\n 16\t unrecognizedEntries: [],\n 17\t })\n 18\t})\n 19\t\n 20\ttest('discovers quoted and comment-suffixed trigger mappings', () => {\n 21\t const result = discoverTopLevelMappingKeys([\n 22\t ' \"release\": { types: [published] }',\n 23\t \" 'push': # automatic trigger\",\n 24\t ' workflow_dispatch: # manual trigger',\n 25\t ])\n 26\t\n 27\t assert.deepEqual(result, {\n 28\t keys: ['release', 'push', 'workflow_dispatch'],\n 29\t unrecognizedEntries: [],\n 30\t })\n 31\t})\n 32\t\n 33\ttest('reports unrecognized indentation-two entries so validation fails closed', () => {\n 34\t const result = discoverTopLevelMappingKeys([\n 35\t ' workflow_dispatch:',\n 36\t ' [release]: { types: [published] }',\n 37\t ' # comments are allowed',\n 38\t '',\n 39\t ])\n 40\t\n 41\t assert.deepEqual(result, {\n 42\t keys: ['workflow_dispatch'],\n 43\t unrecognizedEntries: ['[release]: { types: [published] }'],\n 44\t })\n 45\t})\n 54\t - name: Validate docs governance invariants\n 55\t run: node scripts/check-docs-governance.mjs\n 56\t\n 57\t - name: Validate golden principles invariants\n 58\t run: node scripts/check-golden-principles.mjs\n 59\t\n 60\t - name: Validate GitHub operations governance invariants\n 61\t run: |\n 62\t node --test scripts/check-github-ops-governance.test.mjs\n 63\t node scripts/check-github-ops-governance.mjs\n 89\t## E. Revival overnight deferrals (added 2026-07-13)\n 90\t\n 91\t- [ ] **#1173** — Apply and verify the required branch-protection settings in GitHub. This is repository-settings work and remains maintainer-only.\n 92\t- [ ] **#1504** — Configure and rehearse required-reviewer protection for the parked staging workflow's `production` environment before Phase 3 is reactivated. This is maintainer-only repository-settings work.\n 93\t- [ ] **#1303** — Push the `v0.1.0` release tag only after the maintainer accepts the release deck and its pipeline evidence. Agents may repair the pipeline but must not push the tag.\n 94\t- [ ] **#1482 — Taskdeck name, pre-commercial legal residuals.** *(Supersedes the old \"#1299 trademark check\" line: #1299 shipped with PR #1337 on 2026-07-25 and its AC4 search + cost + recommendation are recorded on the issue.)* What remains is genuinely legal and none of it blocks the free beta: an **attorney registrability opinion** for Classes 9/42 asking about *descriptiveness* (not just conflict), a read on **TASKADE** (live, incontestable US Cl. 42 mark covering task management), the UKIPO/EUIPO coverage gaps (UKIPO hard-blocked automated access, so all GB data is indirect), perishable namespace reservations, and the **keep-or-rename decision before `v0.1.0` (#1303)** — renaming is nearly free pre-tag and expensive after.\n 95\t- [ ] **#1458 project-priority data cleanup — delivered; maintainer record check-off pending.** All 130 formerly unlabeled Taskdeck Issues were classified and verified, the reviewed project-field Apply succeeded 141/141, and the built-in plus three fresh complete audits proved 1,472/1,472 items with zero remaining Priority drift. PR #1488 merged; issue #1458 and both project items are `Done / Priority I`. The checkbox remains open because only the maintainer checks off this file.\n 96\t- [ ] **#1330** — Repair the CI Extended reusable-workflow permission contract; affected PRs remain ineligible while the workflow startup failure is red.\n 97\t- [ ] **#1282 / #1332 / #1335** — Stabilize the required full-suite harness: SQLite concurrency, Redis connect/dispose, and hosted-worker/presence lifecycle isolation. Narrow passes do not clear the recorded full-suite failures.\n 98\t- [ ] **#1338** — Map HTTP MCP and its API-key middleware to the same `/mcp` route before documenting or exposing HTTP transport; the current parameterless mapping serves MCP at an unintended unauthenticated root route.\n 99\t- [ ] **#1343** — Prevent late Home/Today summary responses from overwriting a newer local workspace-mode choice; add deterministic ordering tests and repeated error-recovery E2E proof.\n 100\t- [ ] **#1345 maintainer record check-off** — The code now centrally pins the matched SQLitePCLRaw 2.1.12 family, loads SQLite 3.53.3, enforces the advisory's >= 3.50.2 runtime floor, clears the solution vulnerability audit, preserves the EF model, and passes a self-contained `win-x64` health smoke. The implementation is complete; this checkbox remains human-owned.\n 101\t- [ ] **#1274 / `origin/issue-1274/paper-e2e-axe` at `993f188f`** — Resume the parked Paper E2E/axe re-point from the pushed WIP branch; fix tracked Paper Review blockers #1347/#1348, finish the named first-run/onboarding/smoke and axe coverage, then run the full frontend/E2E gates before opening a PR.\n 102\t- [ ] **#1347 / #1348** — Repair the Paper deep-review enum wire-contract crash and the SQLite-backed similar-past HTTP 500; both were reproduced by the real Paper capture/review path and must not be hidden by frontend fallbacks.\n 103\t- [ ] **#1323 prompt-rail remainder** — Bind the hostile transcript/PDF/image and malformed-response fixtures from PR #1340 to PR #1312's effective prompt/parser path before GEN-04; prove grounded-task-or-empty verdicts and deterministic fallback for schema escapes.\n 104\t- [ ] **#1456 / PR #1457 — Codex deny-floor adapter T4 gate.** **Do not run the posted `/hooks` canaries yet.** The 2026-07-26 audit found red DCO on all four commits, no substantive review of the current head, material drift behind `main`, a v1.6.5 pin behind the installed/producer v1.6.12 floor, and unresolved root/common-directory hook discovery. First repair and synchronize the branch, settle the exact reviewed dispatcher bytes and authoritative hook source, then rerun exact-head CI and two adversarial reviews. Only after those prerequisites may the maintainer trust the project hook in a fresh interactive `/hooks` session and record allow/deny canaries; no agent can perform or substitute for that final gate.\n 105\t- [ ] **Prune the merged agent worktrees.** `git worktree remove` is blocked by the deny floor, so this is human-only and recurs after every wave (upstream: [agent-harness#41](https://github.com/Chris0Jeky/agent-harness/issues/41)). *(Added 2026-07-25.)*\n","input_text","Script completed\nWall time 0.1 seconds\nOutput:\n",{"_663":683,"_645":684,"_624":625,"_647":631},1785122096156,{"_685":679,"_686":687,"_688":689,"_690":691,"_629":32,"_692":32,"_42":693,"_694":695,"_696":697,"_638":114,"_93":698},"aggregatedOutput","command","/bin/bash -lc \"git status --short --branch; nl -ba scripts/check-github-ops-governance.mjs | sed -n '141,215p'; nl -ba scripts/check-github-ops-governance.test.mjs; nl -ba .github/workflows/reusable-docs-governance.yml | sed -n '54,66p'; nl -ba OUTSTANDING_TASKS.md | sed -n '89,105p'\"","commandActions",[699],"cwd","/workspace/Taskdeck","exitCode","exec-7493e29f-33e2-4478-90c6-6e9d5d9e621c","processId","96704","source","unifiedExecStartup","commandExecution",{"_686":700,"_93":701},"git status --short --branch; nl -ba scripts/check-github-ops-governance.mjs | sed -n '141,215p'; nl -ba scripts/check-github-ops-governance.test.mjs; nl -ba .github/workflows/reusable-docs-governance.yml | sed -n '54,66p'; nl -ba OUTSTANDING_TASKS.md | sed -n '89,105p'","unknown",{"_645":703,"_624":625,"_647":631},{"_669":670,"_42":704,"_705":706,"_652":707,"_368":708,"_709":-5,"_638":114,"_93":710},"ctc_0ca5cfbf71c2b2e6016a66cd2dfa5481909fd5e8a63baea0b2","input","const r = await tools.exec_command({cmd:\"git status --short --branch; nl -ba scripts/check-github-ops-governance.mjs | sed -n '141,215p'; nl -ba scripts/check-github-ops-governance.test.mjs; nl -ba .github/workflows/reusable-docs-governance.yml | sed -n '54,66p'; nl -ba OUTSTANDING_TASKS.md | sed -n '89,105p'\",\"workdir\":\"/workspace/Taskdeck\",\"yield_time_ms\":10000,\"max_output_tokens\":12000}); text(r.output);\n",{"_657":631},"exec","namespace","custom_tool_call",{"_645":712,"_624":625,"_647":631},{"_648":-5,"_713":714,"_42":715,"_652":716,"_717":718,"_93":719},"encrypted_content","gAAAAABqZs0tB8O3Ki_76KwFvxcCXHlQIJYQYIX3vC3bFIFkLVxjv2phlIbM6uEXGvhH5PVKzboBeQNNyF0L4ZhvxCX0nPJ1sKQxUC5v64zndw7436mvHEobPR7rwT77NFGB3iGiNdnxlYrSXD6c--xRwgYz90rOoBns6uiEAfsJ5CmayEV2qqrmgyUqov86ZL5R4t2Q1smhHj6tU2Sjczdk3Y0bPKZns18m24PupIm0Kpte_bDOhiv6VlYrHbxLx5rWr9GUTrShiA3yMKB_stPWJ0b7Xr-CucSgwSmIPJKyXm3LjqAE3sR22cN6SlaGS_n5G5JrtEwvX9D1LVhnWLZ4DvQ2gVpfQQzKAVxyaNwBELq_fyaJl4oULNaB-g29iVmOYV3b-0RLnpBYP1XgtbnoXc9ttabhFe2QGfCFmybEloTps-xJzv3PHK1sMD7INKvDjx6HQTtQ5aHTTnohNsEtrq-E_pWx32ze-P-I-kw60PEYb2FLgP3CBZN7CvnCxFxeyG4_pB883kaZ-tiIS5rpCc5H-wWfjZNI3wmQ_JZZQeFUI5SoY0St65ZY6_OclsLsK-TmssYDho2DNbWRXHUlYFqSUgM3cJi4xrCcKXKRp-Ufx2CiPreRfxYKTQOjBtjf2G_H_vtgXqF6Tp_DTLg7bZfabOp188qiKJGOimtdTfqAWmp-j0pIPlsSMTmROB4A29-UPK886QQdiacIx3-HxA0YYXm0X6vXN7CoexReTp1ts0Kl9JXQlXi_eqLDcS03i8sYmq7SoFqoFwiYzhxUlcGscJAEiUUxyo6x-TF_FmTHEHw4nFl_O_eEvkP4Y7xTCPcgdqym633NpynueOKI-eP3qSE5_he81c5hrUlOdqPcZpEvVWxCOciDT5F-Gq5hy8Wi8LMPlwEDiqU-1q2Tp9e4UQlIACtqq1Rnkv-IMGdQAZyM6pNBHMNb8nN5ZELaEMHML1FDD001__QKrmYvIxuXeX-cjROKK69pZ3CK3Tbp8CekXWI=","rs_0ca5cfbf71c2b2e6016a66cd2d71bc8190806912b40da4a8c4",{"_657":631},"summary",[720],"reasoning",{"_46":721,"_93":722},"**Checking git status and line numbers**","summary_text",{"_663":724,"_645":725,"_624":625,"_647":631},1785122094021,{"_648":726,"_42":715,"_717":727,"_93":719},[],[721],{"_645":729,"_624":625,"_647":631},{"_669":730,"_42":-5,"_652":731,"_368":-5,"_672":732,"_93":674},"call_2Ym6yBQ4DeIvN5AlSCqsTNh8",{"_657":631},{"_501":733,"_676":-5},[734,735],{"_46":681,"_93":680},{"_46":736,"_93":680},"{\n \"title\": \"Fail closed on all staging trigger mappings\",\n \"body\": \"## Summary\\n- harden the parked staging workflow governance parser so inline values, quoted event keys, and comment-suffixed mappings cannot bypass the manual-only contract\\n- conservatively reject unrecognized indentation-two entries in the workflow `on` mapping\\n- add adversarial Node regression tests and run them in Required Docs Governance\\n- add the maintainer-only `#1504` environment-protection rehearsal to the durable outstanding checklist\\n\\n## Context\\nFollow-up to **Disable automatic staging gate release trigger** at head `af8bbeee2b45d056b252d18dc59dbbbc38cd6a66`. This addresses the exact-head P2 governance review and the independent re-review's checklist finding.\\n\\n## Verification\\n- `node --test scripts/check-github-ops-governance.test.mjs`\\n- `node scripts/check-github-ops-governance.mjs`\\n- `node scripts/check-docs-governance.mjs`\\n- `node scripts/check-golden-principles.mjs`\\n- `go run github.com/rhysd/actionlint/cmd/actionlint@v1.7.12 .github/workflows/reusable-docs-governance.yml .github/workflows/cd-staging-gate.yml`\\n- `git diff --check`\\n\\n## Notes\\n- Commit `438e146b2919b222d77700733acd05092d51413d` includes the required DCO sign-off.\\n- No product runtime or UI changed; no screenshot is applicable.\\n- No existing `OUTSTANDING_TASKS.md` item was checked off.\"\n}",{"_663":738,"_645":739,"_624":625,"_647":631},1785122090463,{"_740":-5,"_741":742,"_629":517,"_104":-5,"_42":743,"_744":-5,"_745":-5,"_746":-5,"_747":748,"_749":750,"_638":114,"_751":750,"_93":752},"appContext","arguments",{"_499":757,"_501":758},"exec-6bec49e9-1285-401c-bd00-3c1cffb65add","mcpAppResourceUri","pluginId","readOnlyHint","result",{"_753":-5,"_648":754,"_755":756},"server","make_pr","tool","mcpToolCall","_meta",[759],"structuredContent",{"_499":757,"_501":758},"Fail closed on all staging trigger mappings","## Summary\n- harden the parked staging workflow governance parser so inline values, quoted event keys, and comment-suffixed mappings cannot bypass the manual-only contract\n- conservatively reject unrecognized indentation-two entries in the workflow `on` mapping\n- add adversarial Node regression tests and run them in Required Docs Governance\n- add the maintainer-only `#1504` environment-protection rehearsal to the durable outstanding checklist\n\n## Context\nFollow-up to **Disable automatic staging gate release trigger** at head `af8bbeee2b45d056b252d18dc59dbbbc38cd6a66`. This addresses the exact-head P2 governance review and the independent re-review's checklist finding.\n\n## Verification\n- `node --test scripts/check-github-ops-governance.test.mjs`\n- `node scripts/check-github-ops-governance.mjs`\n- `node scripts/check-docs-governance.mjs`\n- `node scripts/check-golden-principles.mjs`\n- `go run github.com/rhysd/actionlint/cmd/actionlint@v1.7.12 .github/workflows/reusable-docs-governance.yml .github/workflows/cd-staging-gate.yml`\n- `git diff --check`\n\n## Notes\n- Commit `438e146b2919b222d77700733acd05092d51413d` includes the required DCO sign-off.\n- No product runtime or UI changed; no screenshot is applicable.\n- No existing `OUTSTANDING_TASKS.md` item was checked off.",{"_93":46,"_46":736},{"_645":761,"_624":625,"_647":631},{"_669":730,"_42":762,"_705":763,"_652":764,"_368":708,"_709":-5,"_638":114,"_93":710},"ctc_0ca5cfbf71c2b2e6016a66cd22295c81909fe179b40856c05b","const result = await tools.mcp__make_pr__make_pr({title:\"Fail closed on all staging trigger mappings\",body:\"## Summary\\n- harden the parked staging workflow governance parser so inline values, quoted event keys, and comment-suffixed mappings cannot bypass the manual-only contract\\n- conservatively reject unrecognized indentation-two entries in the workflow `on` mapping\\n- add adversarial Node regression tests and run them in Required Docs Governance\\n- add the maintainer-only `#1504` environment-protection rehearsal to the durable outstanding checklist\\n\\n## Context\\nFollow-up to **Disable automatic staging gate release trigger** at head `af8bbeee2b45d056b252d18dc59dbbbc38cd6a66`. This addresses the exact-head P2 governance review and the independent re-review's checklist finding.\\n\\n## Verification\\n- `node --test scripts/check-github-ops-governance.test.mjs`\\n- `node scripts/check-github-ops-governance.mjs`\\n- `node scripts/check-docs-governance.mjs`\\n- `node scripts/check-golden-principles.mjs`\\n- `go run github.com/rhysd/actionlint/cmd/actionlint@v1.7.12 .github/workflows/reusable-docs-governance.yml .github/workflows/cd-staging-gate.yml`\\n- `git diff --check`\\n\\n## Notes\\n- Commit `438e146b2919b222d77700733acd05092d51413d` includes the required DCO sign-off.\\n- No product runtime or UI changed; no screenshot is applicable.\\n- No existing `OUTSTANDING_TASKS.md` item was checked off.\"}); for (const c of (result?.content ?? [])) { if (c.type === \"text\") text(c.text); else if (c.type === \"image\") image(c); }\n",{"_657":631},{"_645":766,"_624":625,"_647":631},{"_648":-5,"_713":767,"_42":768,"_652":769,"_717":770,"_93":719},"gAAAAABqZs0iWiGak-Q_Z1ZZMyC5rqbsnxkaF-giaX68QrCqnAlHu-xC8Evai4OyGoVcfAky5yVc0e3mCy0uwGns9rzG7K_XaQIIiD4WOSNc2ZlmGroUgQAMOzU-96fcWduGNK2mybIYkzNiDZyhjsUpP8Sd5777GNJR_cYC__9QeiOHr6jy2cfSg2QjMcyywXChjA8U2AmTE61v72eV32QwZ7GGEqywCNL2ZZyYbZfanzKgRgxgELllX8gnKuv2M4soNwSSNrYXLf4H3ooLCiH8YP_6m4dhfqsepGMCg0iw8JiJos5AUElRvH8vUSTd9x5hy1iLb8EdVmVBACwhvqtYXQ2nc3bRs9YmEnhenztQQr35A7G4oWA3tXHXiyh8DOhRPZ44vsdUAk4IIz24b2A3cC3EwezOk_LZ_0hd2KIR1flRJ9kqoFoa73Z8G-KWYL-_17xVU1Vusvlw8nbprbO8mKB3113S4GTq8E2nfQfjSVFSw2uEV5VYdMCAhNigLk18RhzvtJtN_HNg_rmoftcb6vPDAt9tJd9fRPU2Ez2JRnP7TXwKcvgyfQ6smcLV5Cv5gmmM6XmEiUN8eWD30__WRywyY78PJfYR7j8MHAII3x2S1O64qkZ4QWNlgDhcRX_K35MNbWDceho5q_1pErwA6wqq3MH1JcK3NLVGBsECiIFgBegllaUTjLa-83UpFQzftFbVUJzCaLFf7L4XCP4J5ZFE2PxJRKbOH_exySemuxrUpJf3UlKLJGppjZh8Jz4T1hfdfAxNLkpYrYfaJqbkxQCgwZh8ZlzKyy8vvQZtgmgiCwtrf7ie_4sLOiWaA0G4k_vA2xIjB4ixr101K41OwXtyTgH-nYRU7wnrPkpbu3TBwp4FUX5_dZHFDE_aLazl_CC9pVQoOAjj18iwNhVGY27-_llTtRinkytjFNyOU65_Oq9aqmWqCYcPLJdttgF2nIHS2XymSkwWCjGknOM-fS07SEWw-1bl1FTMG-1KVHblzc7kd1A=","rs_0ca5cfbf71c2b2e6016a66cd21523c81908dd4712c7b62bc2c",{"_657":631},[771],{"_46":772,"_93":722},"**Preparing new PR with updated title**",{"_663":774,"_645":775,"_624":625,"_647":631},1785122082190,{"_648":776,"_42":768,"_717":777,"_93":719},[],[772],{"_645":779,"_624":625,"_647":631},{"_669":780,"_42":-5,"_652":781,"_368":-5,"_672":782,"_93":674},"call_AqQSzoQtdgL0kZWDGGhiDbLk",{"_657":631},{"_501":783,"_676":-5},[784,785],{"_46":787,"_93":680},{"_46":786,"_93":680},"diff --git a/.github/workflows/reusable-docs-governance.yml b/.github/workflows/reusable-docs-governance.yml\nindex ea1650e..358f2e6 100644\n--- a/.github/workflows/reusable-docs-governance.yml\n+++ b/.github/workflows/reusable-docs-governance.yml\n@@ -58,4 +58,6 @@ jobs:\n run: node scripts/check-golden-principles.mjs\n \n - name: Validate GitHub operations governance invariants\n- run: node scripts/check-github-ops-governance.mjs\n+ run: |\n+ node --test scripts/check-github-ops-governance.test.mjs\n+ node scripts/check-github-ops-governance.mjs\ndiff --git a/OUTSTANDING_TASKS.md b/OUTSTANDING_TASKS.md\nindex 4542833..c335013 100644\n--- a/OUTSTANDING_TASKS.md\n+++ b/OUTSTANDING_TASKS.md\n@@ -89,6 +89,7 @@ Analysis docs: `docs/PROJECT_TRAJECTORY.md` (strengths + path) and `docs/COURSE_\n ## E. Revival overnight deferrals (added 2026-07-13)\n \n - [ ] **#1173** — Apply and verify the required branch-protection settings in GitHub. This is repository-settings work and remains maintainer-only.\n+- [ ] **#1504** — Configure and rehearse required-reviewer protection for the parked staging workflow's `production` environment before Phase 3 is reactivated. This is maintainer-only repository-settings work.\n - [ ] **#1303** — Push the `v0.1.0` release tag only after the maintainer accepts the release deck and its pipeline evidence. Agents may repair the pipeline but must not push the tag.\n - [ ] **#1482 — Taskdeck name, pre-commercial legal residuals.** *(Supersedes the old \"#1299 trademark check\" line: #1299 shipped with PR #1337 on 2026-07-25 and its AC4 search + cost + recommendation are recorded on the issue.)* What remains is genuinely legal and none of it blocks the free beta: an **attorney registrability opinion** for Classes 9/42 asking about *descriptiveness* (not just conflict), a read on **TASKADE** (live, incontestable US Cl. 42 mark covering task management), the UKIPO/EUIPO coverage gaps (UKIPO hard-blocked automated access, so all GB data is indirect), perishable namespace reservations, and the **keep-or-rename decision before `v0.1.0` (#1303)** — renaming is nearly free pre-tag and expensive after.\n - [ ] **#1458 project-priority data cleanup — delivered; maintainer record check-off pending.** All 130 formerly unlabeled Taskdeck Issues were classified and verified, the reviewed project-field Apply succeeded 141/141, and the built-in plus three fresh complete audits proved 1,472/1,472 items with zero remaining Priority drift. PR #1488 merged; issue #1458 and both project items are `Done / Priority I`. The checkbox remains open because only the maintainer checks off this file.\ndiff --git a/scripts/check-github-ops-governance.mjs b/scripts/check-github-ops-governance.mjs\nindex 79dc8ce..00660fa 100644\n--- a/scripts/check-github-ops-governance.mjs\n+++ b/scripts/check-github-ops-governance.mjs\n@@ -3,6 +3,7 @@\n import { access, readFile } from 'node:fs/promises'\n import { constants as fsConstants } from 'node:fs'\n import { resolve } from 'node:path'\n+import { pathToFileURL } from 'node:url'\n \n const errors = []\n \n@@ -140,6 +141,33 @@ async function validateProjectAutomationDocs() {\n }\n }\n \n+export function discoverTopLevelMappingKeys(lines, indentation = 2) {\n+ const prefix = ' '.repeat(indentation)\n+ const keys = []\n+ const unrecognizedEntries = []\n+\n+ for (const line of lines) {\n+ if (!line.startsWith(prefix) || line.startsWith(`${prefix} `)) {\n+ continue\n+ }\n+\n+ const content = line.slice(indentation)\n+ if (content.trim().length === 0 || content.trimStart().startsWith('#')) {\n+ continue\n+ }\n+\n+ const mappingEntry = content.match(/^(?:\"((?:[^\"\\\\]|\\\\.)+)\"|'((?:[^']|'')+)'|([A-Za-z][\\w-]*))\\s*:/)\n+ if (!mappingEntry) {\n+ unrecognizedEntries.push(content)\n+ continue\n+ }\n+\n+ keys.push(mappingEntry[1] ?? mappingEntry[2]?.replaceAll(\"''\", \"'\") ?? mappingEntry[3])\n+ }\n+\n+ return { keys, unrecognizedEntries }\n+}\n+\n async function validateParkedStagingGateTriggers() {\n const workflowPath = '.github/workflows/cd-staging-gate.yml'\n if (!(await fileExists(workflowPath))) {\n@@ -164,9 +192,13 @@ async function validateParkedStagingGateTriggers() {\n triggerLines.push(line)\n }\n \n- const triggerNames = triggerLines\n- .map((line) => line.match(/^ {2}([A-Za-z][\\w-]*):\\s*$/)?.[1])\n- .filter(Boolean)\n+ const { keys: triggerNames, unrecognizedEntries } = discoverTopLevelMappingKeys(triggerLines)\n+\n+ if (unrecognizedEntries.length > 0) {\n+ errors.push(\n+ `${workflowPath} contains unrecognized top-level entries in its on block: ${unrecognizedEntries.join(', ')}`,\n+ )\n+ }\n \n if (triggerNames.length !== 1 || triggerNames[0] !== 'workflow_dispatch') {\n errors.push(\n@@ -196,7 +228,10 @@ async function main() {\n console.log('GitHub operations governance check passed.')\n }\n \n-main().catch((error) => {\n- console.error('GitHub operations governance check crashed:', error)\n- process.exit(1)\n-})\n+const entryUrl = process.argv[1] ? pathToFileURL(resolve(process.argv[1])) : null\n+if (entryUrl && import.meta.url === entryUrl.href) {\n+ main().catch((error) => {\n+ console.error('GitHub operations governance check crashed:', error)\n+ process.exit(1)\n+ })\n+}\ndiff --git a/scripts/check-github-ops-governance.test.mjs b/scripts/check-github-ops-governance.test.mjs\nnew file mode 100644\nindex 0000000..47696a7\n--- /dev/null\n+++ b/scripts/check-github-ops-governance.test.mjs\n@@ -0,0 +1,45 @@\n+import assert from 'node:assert/strict'\n+import test from 'node:test'\n+\n+import { discoverTopLevelMappingKeys } from './check-github-ops-governance.mjs'\n+\n+test('discovers block and inline trigger mappings', () => {\n+ const result = discoverTopLevelMappingKeys([\n+ ' workflow_dispatch:',\n+ ' inputs:',\n+ ' release: { types: [published] }',\n+ ' push: {}',\n+ ])\n+\n+ assert.deepEqual(result, {\n+ keys: ['workflow_dispatch', 'release', 'push'],\n+ unrecognizedEntries: [],\n+ })\n+})\n+\n+test('discovers quoted and comment-suffixed trigger mappings', () => {\n+ const result = discoverTopLevelMappingKeys([\n+ ' \"release\": { types: [published] }',\n+ \" 'push': # automatic trigger\",\n+ ' workflow_dispatch: # manual trigger',\n+ ])\n+\n+ assert.deepEqual(result, {\n+ keys: ['release', 'push', 'workflow_dispatch'],\n+ unrecognizedEntries: [],\n+ })\n+})\n+\n+test('reports unrecognized indentation-two entries so validation fails closed', () => {\n+ const result = discoverTopLevelMappingKeys([\n+ ' workflow_dispatch:',\n+ ' [release]: { types: [published] }',\n+ ' # comments are allowed',\n+ '',\n+ ])\n+\n+ assert.deepEqual(result, {\n+ keys: ['workflow_dispatch'],\n+ unrecognizedEntries: ['[release]: { types: [published] }'],\n+ })\n+})\n[work 438e146] Fail closed on staging trigger mappings\n 4 files changed, 91 insertions(+), 8 deletions(-)\n create mode 100644 scripts/check-github-ops-governance.test.mjs\n## work\ncommit 438e146b2919b222d77700733acd05092d51413d\nAuthor: Codex \nCommit: Codex \n\n Fail closed on staging trigger mappings\n \n Signed-off-by: Codex \n","Script completed\nWall time 0.2 seconds\nOutput:\n",{"_663":789,"_645":790,"_624":625,"_647":631},1785122079813,{"_685":786,"_686":791,"_688":792,"_690":691,"_629":32,"_692":32,"_42":793,"_694":794,"_696":697,"_638":114,"_93":698},"/bin/bash -lc 'git diff -- .github/workflows/reusable-docs-governance.yml OUTSTANDING_TASKS.md scripts/check-github-ops-governance.mjs; git diff --no-index /dev/null scripts/check-github-ops-governance.test.mjs || true; git add .github/workflows/reusable-docs-governance.yml OUTSTANDING_TASKS.md scripts/check-github-ops-governance.mjs scripts/check-github-ops-governance.test.mjs; git diff --cached --check; git commit -s --no-gpg-sign -m \"Fail closed on staging trigger mappings\"; git status --short --branch; git log -1 --format=full'",[795],"exec-936760f4-790e-4834-bd83-49c6cb04ee5a","64431",{"_686":796,"_93":701},"git diff -- .github/workflows/reusable-docs-governance.yml OUTSTANDING_TASKS.md scripts/check-github-ops-governance.mjs; git diff --no-index /dev/null scripts/check-github-ops-governance.test.mjs || true; git add .github/workflows/reusable-docs-governance.yml OUTSTANDING_TASKS.md scripts/check-github-ops-governance.mjs scripts/check-github-ops-governance.test.mjs; git diff --cached --check; git commit -s --no-gpg-sign -m \"Fail closed on staging trigger mappings\"; git status --short --branch; git log -1 --format=full",{"_645":798,"_624":625,"_647":631},{"_669":780,"_42":799,"_705":800,"_652":801,"_368":708,"_709":-5,"_638":114,"_93":710},"ctc_0ca5cfbf71c2b2e6016a66cd1d7e2c8190b668ce6b3352f02c","const r = await tools.exec_command({cmd:\"git diff -- .github/workflows/reusable-docs-governance.yml OUTSTANDING_TASKS.md scripts/check-github-ops-governance.mjs; git diff --no-index /dev/null scripts/check-github-ops-governance.test.mjs || true; git add .github/workflows/reusable-docs-governance.yml OUTSTANDING_TASKS.md scripts/check-github-ops-governance.mjs scripts/check-github-ops-governance.test.mjs; git diff --cached --check; git commit -s --no-gpg-sign -m \\\"Fail closed on staging trigger mappings\\\"; git status --short --branch; git log -1 --format=full\",\"workdir\":\"/workspace/Taskdeck\",\"yield_time_ms\":30000,\"max_output_tokens\":30000}); text(r.output);\n",{"_657":631},{"_645":803,"_624":625,"_647":631},{"_648":-5,"_713":804,"_42":805,"_652":806,"_717":807,"_93":719},"gAAAAABqZs0dUCi5uQ0kPfmH7qvxjXqyk1AfvQyZKHsnN1DYs7BNVq4HETCX5a_TyupOThpAR4b8T81vNkBiCtAyUAOZer_mo16YQgV9uhhBkgjbl_BnJW2s0dIgGTUH9yykiaDzF3j2Mts6ws2g9csi3bY-naDdGkIOcvxoTySogFjUy-eaollsoBMsiU0trQ9i18CXoNpiH_SHOC_e2YJe5Szh1svMnNqzmjGzsI84_M5HYYmswq93BhK32P4xPExn_f9aHMFYvN1m7H7dEdbKy0jBgsPpGr7m2p9SzmipUAAig3INj0hg2noar_T7VFBzvbaPvhiv87LjXkw7UNHLbt3H-egQLJsA4qMJpV4l-MnHAbHrVtqqqxuLt0Q52TYNsZEE6U78n1RILuAQoqkp9x_w2x0ODCGpEY5u0r4dylanNaLMsC7-_acFBEDnSjWOJfsyhjuAje0hxs3RKuPcM_sKZ-mPJNj5QDPTISsTLzQdkL3TBxcEyDBBdPr5miwUUaUyoxKSj-vC64ClRecvByj3w0L8UemwVjTi0PQV_E0Pb7E6q0kaa-3KIfcbOWAQluBRtACZJqEm2E3knjW5XrR_b-ihMg4BlaIi6yRrZNjLIr8IEyY_7WARyKeBPSo8o7EMe9dwjnZzZveY5SiMoIt-myoaYDrc36ulxdlc3yZ5QOjB0YhrMK7UHURlVh50U7IGjqnbpZXHdPOFZUtePGP8NAqukyEpOpo92iRqb2eDWpIRMQfINGsvyiZGyuisLtT9PMwFnUQgWlWXX6e6d9XwXVAPq1AkBtJ1IChbxt_OiKmibMO_C0ivvAq1Bs3j1S-YXjXv-i0F3QfdyVpKV6FJ50mtJz4Gjt_K87uX7uWvUBsjcUZlrhDVq_UWTds0QEq1TKkhAL-Lm8IG_Gqiyy9Fzeuc5v00uOM5-OdndOykiur7On48-wJUaYUoRgxrghtxuISeQc7bkCZDBD_5lrcd2EUIDYEYDeEftQKfDgUbaxaNHAAQI9GNLnp5iMhldlfS_aUAYML0c8fXeZh5q3MVnzfX76IsUNFOvpHVVExruzfvx1SHfSM2Dgio-tE1cviJcJp8wo0S-_Z-x7DYghrbvazHEugFJgHWKzWnl-YWe076KcjfpAw8O5fZfecVzx9iritejrEGcN6kDY7jc_xxpFkXcKg6rfQy06K66BCGQSOE5F2aiEUSWPzUt0nkurp_OHIgTjYGa3csBZO3lLFgPFf_dI3f87JmisVDSvz7pKEgIm0WY_mqT3blee100Y5reY2yzNOUrbvN0RwuQsSzr2dIjMq-gNNMmE0U27VwZvsu70pAvsZ2U4omTL87bL50p_sjP6BLXIilCp-X3pwC1kad0YrZSGcIB-okoAoVdvsn5qq9v8g7o7XPYLttfhhexlX_SFz-2fG9dLEId7BRKCp7_7kK19zqxrNpd08CL1FpdOlBHkdxC5N3aJ5wye5v9t-_ec-pvAWt-ALkPp5ks3MkhZOmEOs1ZDGzZl6Ws3EvVpXT82wm1sKitKqYpU6sO-RXVl34Ib7rwOB4mvX-wuieg4t0CMHBSMiDKKnrhO8j-LzcQnb3GyrTQ0O3C4VSPYQDnWvEzcrS7GqLARVLaClcN1bA93BU9inHLmazxLl4myK53AWeGtRkhG1vqoMN0nsocdHJz0s1Km3tFchpC83PW6V0J1KI-BPKCFED5KsXrMGHMPtXEWc_6_o1gCNpXQrz7uL4LeGvDlb0-2TVDQslfnDEPakClCHqjeZQ3UcO9M_8yujXpVdlbsglwlSy-KLVJWxydxTqYe2utjWEXdwk23LPtUYGkWJPTug7bVGWlt9fTF8iZyCKZH0a4s2dYuQXrnXOaDUexq90LcdRC0Et_XJ_rhmaXysngIJX66YXOKO3CCy4HH_05raZkUiNhFl6beHN8QFMGxdcN8bESEZDRr9sysRX5TUGAXskCb3uwZPO5IVbTq2frVCY6s2I_cvf2ZZIKnH_6Lw0htsrtYLybAady__j3Yvpc9r31w9HnlEcRKNiewuX8e1OGVGlJ012_Fsa8feNcCsLOugV_fJflkh3XSCnqBJ4o4WBMbrC22fw-HqN02Ub69LjUBzhMr9n1a7yIaFAgtdSSD6uqp3HOlkyO8cdtfIcTNBfF0swUb4C2cnwfeyf41CC_-kv5zTA_6PWkirLt8tkbwk5k3xQ9iArT_sDqFH76qvIxgSequVWGz5zbZd0M8tmm2QtL0u05GkM98HWlWuL9CR_RAaFutMWNZp2XLt8r_1sVziHkCdaNdGbjwQsbZR1B2vPUH_jJ0CKlIDdWPUWARYCUVp0p1JDg-0bSwrfWhBGC_-nE5DAOjbYU7oK-75bmbVc3TWM","rs_0ca5cfbf71c2b2e6016a66cd17c7d88190ba90685acf976998",{"_657":631},[808,809],{"_46":811,"_93":722},{"_46":810,"_93":722},"**Planning trigger parsing fix and commit**","**Assessing YAML key escape handling**",{"_663":813,"_645":814,"_624":625,"_647":631},1785122077531,{"_648":815,"_42":805,"_717":816,"_93":719},[],[811,810],{"_663":818,"_645":819,"_624":625,"_647":631},1785122068666,{"_685":820,"_686":821,"_688":822,"_690":691,"_629":823,"_692":32,"_42":824,"_694":825,"_696":697,"_638":114,"_93":698},"# Subtest: discovers block and inline trigger mappings\nok 1 - discovers block and inline trigger mappings\n ---\n duration_ms: 2.197361\n ...\n# Subtest: discovers quoted and comment-suffixed trigger mappings\nok 2 - discovers quoted and comment-suffixed trigger mappings\n ---\n duration_ms: 0.2575\n ...\n# Subtest: reports unrecognized indentation-two entries so validation fails closed\nok 3 - reports unrecognized indentation-two entries so validation fails closed\n ---\n duration_ms: 0.305954\n ...\n1..3\n# tests 3\n# suites 0\n# pass 3\n# fail 0\n# cancelled 0\n# skipped 0\n# todo 0\n# duration_ms 164.27412\nGitHub operations governance check passed.\nDocs governance check passed.\nGolden principles check passed.\ngo: downloading github.com/rhysd/actionlint v1.7.12\ngo: github.com/rhysd/actionlint@v1.7.12 requires go >= 1.25.0; switching to go1.25.12\ngo: downloading go1.25.12 (linux/amd64)\ngo: downloading github.com/bmatcuk/doublestar/v4 v4.10.0\ngo: downloading github.com/fatih/color v1.19.0\ngo: downloading github.com/mattn/go-colorable v0.1.14\ngo: downloading github.com/mattn/go-runewidth v0.0.21\ngo: downloading github.com/mattn/go-shellwords v1.0.12\ngo: downloading github.com/robfig/cron/v3 v3.0.1\ngo: downloading go.yaml.in/yaml/v4 v4.0.0-rc.3\ngo: downloading golang.org/x/sync v0.20.0\ngo: downloading golang.org/x/sys v0.42.0\ngo: downloading github.com/mattn/go-isatty v0.0.20\ngo: downloading github.com/clipperhouse/uax29/v2 v2.7.0\n .github/workflows/reusable-docs-governance.yml | 4 ++-\n OUTSTANDING_TASKS.md | 1 +\n scripts/check-github-ops-governance.mjs | 49 ++++++++++++++++++++++----\n 3 files changed, 46 insertions(+), 8 deletions(-)\n## work\n M .github/workflows/reusable-docs-governance.yml\n M OUTSTANDING_TASKS.md\n M scripts/check-github-ops-governance.mjs\n?? scripts/check-github-ops-governance.test.mjs\n","/bin/bash -lc 'node --test scripts/check-github-ops-governance.test.mjs && node scripts/check-github-ops-governance.mjs && node scripts/check-docs-governance.mjs && node scripts/check-golden-principles.mjs && go run github.com/rhysd/actionlint/cmd/actionlint@v1.7.12 .github/workflows/reusable-docs-governance.yml .github/workflows/cd-staging-gate.yml && git diff --check && git diff --stat && git status --short --branch'",[826],29251,"exec-89dd4d49-6e04-4c84-837e-e8f3fa9effe4","84435",{"_686":827,"_93":701},"node --test scripts/check-github-ops-governance.test.mjs && node scripts/check-github-ops-governance.mjs && node scripts/check-docs-governance.mjs && node scripts/check-golden-principles.mjs && go run github.com/rhysd/actionlint/cmd/actionlint@v1.7.12 .github/workflows/reusable-docs-governance.yml .github/workflows/cd-staging-gate.yml && git diff --check && git diff --stat && git status --short --branch",{"_645":829,"_624":625,"_647":631},{"_669":830,"_42":-5,"_652":831,"_672":832,"_93":833},"call_Do3UIx60TSe7oRUuHNcHp2y8",{"_657":631},{"_501":834,"_676":-5},"function_call_output",[835,836],{"_46":838,"_93":680},{"_46":837,"_93":680},"TAP version 13\n# Subtest: discovers block and inline trigger mappings\nok 1 - discovers block and inline trigger mappings\n ---\n duration_ms: 2.197361\n ...\n# Subtest: discovers quoted and comment-suffixed trigger mappings\nok 2 - discovers quoted and comment-suffixed trigger mappings\n ---\n duration_ms: 0.2575\n ...\n# Subtest: reports unrecognized indentation-two entries so validation fails closed\nok 3 - reports unrecognized indentation-two entries so validation fails closed\n ---\n duration_ms: 0.305954\n ...\n1..3\n# tests 3\n# suites 0\n# pass 3\n# fail 0\n# cancelled 0\n# skipped 0\n# todo 0\n# duration_ms 164.27412\nGitHub operations governance check passed.\nDocs governance check passed.\nGolden principles check passed.\ngo: downloading github.com/rhysd/actionlint v1.7.12\ngo: github.com/rhysd/actionlint@v1.7.12 requires go >= 1.25.0; switching to go1.25.12\ngo: downloading go1.25.12 (linux/amd64)\ngo: downloading github.com/bmatcuk/doublestar/v4 v4.10.0\ngo: downloading github.com/fatih/color v1.19.0\ngo: downloading github.com/mattn/go-colorable v0.1.14\ngo: downloading github.com/mattn/go-runewidth v0.0.21\ngo: downloading github.com/mattn/go-shellwords v1.0.12\ngo: downloading github.com/robfig/cron/v3 v3.0.1\ngo: downloading go.yaml.in/yaml/v4 v4.0.0-rc.3\ngo: downloading golang.org/x/sync v0.20.0\ngo: downloading golang.org/x/sys v0.42.0\ngo: downloading github.com/mattn/go-isatty v0.0.20\ngo: downloading github.com/clipperhouse/uax29/v2 v2.7.0\n .github/workflows/reusable-docs-governance.yml | 4 ++-\n OUTSTANDING_TASKS.md | 1 +\n scripts/check-github-ops-governance.mjs | 49 ++++++++++++++++++++++----\n 3 files changed, 46 insertions(+), 8 deletions(-)\n## work\n M .github/workflows/reusable-docs-governance.yml\n M OUTSTANDING_TASKS.md\n M scripts/check-github-ops-governance.mjs\n?? scripts/check-github-ops-governance.test.mjs\n","Script completed\nWall time 0.0 seconds\nOutput:\n",{"_645":840,"_624":625,"_647":631},{"_741":841,"_669":830,"_42":842,"_652":843,"_368":844,"_709":-5,"_93":845},"{\"cell_id\":\"11\",\"yield_time_ms\":1000,\"max_tokens\":20000}","fc_0ca5cfbf71c2b2e6016a66cd139b708190a69728bacd958261",{"_657":631},"wait","function_call",{"_645":847,"_624":625,"_647":631},{"_669":848,"_42":-5,"_652":849,"_672":850,"_93":833},"call_RaIQlVTM5Vizcg41MgAvOuuC",{"_657":631},"Script running with cell ID 11\nWall time 1.0 seconds\nOutput:\n",{"_645":852,"_624":625,"_647":631},{"_741":841,"_669":848,"_42":853,"_652":854,"_368":844,"_709":-5,"_93":845},"fc_0ca5cfbf71c2b2e6016a66cd0dc108819091cfe6612cfc34c2",{"_657":631},{"_645":856,"_624":625,"_647":631},{"_669":857,"_42":-5,"_652":858,"_672":850,"_93":833},"call_NjUTs6T3sDlcysPVK3b45WNg",{"_657":631},{"_645":860,"_624":625,"_647":631},{"_741":841,"_669":857,"_42":861,"_652":862,"_368":844,"_709":-5,"_93":845},"fc_0ca5cfbf71c2b2e6016a66cd089d2481908e221e37acb0c124",{"_657":631},{"_645":864,"_624":625,"_647":631},{"_669":865,"_42":-5,"_652":866,"_672":850,"_93":833},"call_zvVTanNBzD4X2iFE5dlFt6g4",{"_657":631},{"_645":868,"_624":625,"_647":631},{"_741":841,"_669":865,"_42":869,"_652":870,"_368":844,"_709":-5,"_93":845},"fc_0ca5cfbf71c2b2e6016a66cd050d5c81909eff892367b9bb03",{"_657":631},{"_645":872,"_624":625,"_647":631},{"_669":873,"_42":-5,"_652":874,"_672":850,"_93":833},"call_JHOxo5dsNuvfGXwR9DigXPgV",{"_657":631},{"_645":876,"_624":625,"_647":631},{"_741":841,"_669":873,"_42":877,"_652":878,"_368":844,"_709":-5,"_93":845},"fc_0ca5cfbf71c2b2e6016a66cd02c1b08190bf158fcf68eaa177",{"_657":631},{"_645":880,"_624":625,"_647":631},{"_648":-5,"_713":881,"_42":882,"_652":883,"_717":884,"_93":719},"gAAAAABqZs0COHqFrVGzH_apm4TbHmZRQmYsMY1uCi5LQLp_0J7p52H0XlzSpvyDhQEHqFdbIML9lwyuBqQuQALUCGg51qMYmyoxGzLQ6y5cjERHauf1yfuP04se23Yo_zXhCAgSOvCP6c4N7FqVkT0zwJQM5XceLLjLyxrNBGAbz3YE0H8coD0Jyugd8WMd4NjapyvkE9c0pFsuP_FCjIQ3LSX91e_HfVAPGcnml3A6sCkVm7w0gESuhHd5DBrBt6MmZhrOAR1c68oQgTA3V0S0-_8F0oyRXglK6oEN6wVpNsRisC3UDUAqe3f4ZEoeigiPg8Nfv_WZpXw8k2VK2SQPGSqSgjdNI4OlPtr3EuRObK928bX6JswyC4DwRi_oBEi-ajOPBqgzs9DGlsyGHO3TczGmieaKNV4P1KhEokndIjxGpcC7QJq-ulS7DrbW3ccrCiu5JfIAnr4PX5QarxOpz5bZRXl47s1TMzqivDAOLZNDFAPwuf5Ov2qijiBuEXJo7vl0JljG26F6DHqEoCCM0P--VhlUOBxtYC7MN5wBOIjYrr0uOBe7w3q0AzwRnbt8Bb5s0oiKRlfC86Rx2I0gBnQHtDYcypI1xKtZNVUAj0sA3JguNU2UOwck8pFK_6H4eOzhb6HMP9VBQYyx-mW1-O1EjkqrdosHCA8uLAgXcqic23fqchOWjVgvLn_ogCzqcBqzx_JGC9QywGLYJUWvsYbkYZG_9SbXTOgBPXf9mM-mWZgFKUc7DP0XD2YebPOxidAFSXBbP-mXHx1b6DiLhxeMHX2Cg9Ri8Hm4msukGW7QQ-iyS87c2ourmq3Bf7RqFVWGFyvAGqD2vdJC7Vw0ck3800kZnFd_SVEwzIEAFQxFe-iNwP-Sth_v_vVW4-D9eMlKXqsW-JsDQUxilbeUqRcClqhbz5BX9ZA6DursmV0u1PA1l0bXiVyrw2Fu9OtcJrDRIXn_","rs_0ca5cfbf71c2b2e6016a66cd023eac8190a6692470427fd020",{"_657":631},[],{"_663":886,"_645":887,"_624":625,"_647":631},1785122050823,{"_648":888,"_42":882,"_717":889,"_93":719},[],[],{"_645":891,"_624":625,"_647":631},{"_669":892,"_42":-5,"_652":893,"_368":-5,"_672":894,"_93":674},"call_O7MiHDcV2BjYL0a9866jzKd3",{"_657":631},"Script running with cell ID 11\nWall time 10.0 seconds\nOutput:\n",{"_645":896,"_624":625,"_647":631},{"_669":892,"_42":897,"_705":898,"_652":899,"_368":708,"_709":-5,"_638":114,"_93":710},"ctc_0ca5cfbf71c2b2e6016a66ccf483f48190bd256d909f5b2273","const r = await tools.exec_command({cmd:\"node --test scripts/check-github-ops-governance.test.mjs && node scripts/check-github-ops-governance.mjs && node scripts/check-docs-governance.mjs && node scripts/check-golden-principles.mjs && go run github.com/rhysd/actionlint/cmd/actionlint@v1.7.12 .github/workflows/reusable-docs-governance.yml .github/workflows/cd-staging-gate.yml && git diff --check && git diff --stat && git status --short --branch\",\"workdir\":\"/workspace/Taskdeck\",\"yield_time_ms\":30000,\"max_output_tokens\":20000}); text(r.output); if(r.session_id) text(`SESSION_ID=${r.session_id}`);\n",{"_657":631},{"_645":901,"_624":625,"_647":631},{"_648":-5,"_713":902,"_42":903,"_652":904,"_717":905,"_93":719},"gAAAAABqZsz0bN2uh2C1ICJoXggCZ7wTEjs6d0ljaXXgpssE8IhKwm9pZgu4qONXMcHANCrt_W3SwgpTqvi7K3LJzh4AHVxHeu6xoTt8x8dmYga1ztceckVTtkFHAfRL6qFUxNGcOpsb7EmdmzMjQ7yWw21XYRsP87lCawv5O2SNGimtDlRgq8mqMRLLztdgBReabLsQSViHpjZVmNpWgK-h2E2y8HwyHNcZjNj9dKFl1r8SKbZ2T-wCisyRN8QwLMh76FhRe8JwG0MKef8B0yJmAcsUnK3dvLaYuAdhy7Hv-6wpQ0ctSm7mlW-rjDWjCURHa6LhNXIGK2WyoXMGVvyQ_aKYia0U20FFwTSMKUt0N1PZSnhheS0btFk-_WSX_EDQBbHJfGPo8du-Twf_MRLbvTPB6MpFUQSE52X-i-mhfjGFe54ewCV8KRriw0AlEQwayi8PoEsiZMqrKQ-YtihDKpjBAH6waPtK1aqxTBwS8-nlVcNgdVrCfS099hW6_eTQGG73DSnVwPKETX459SV7iDKVAbb_vH2Ms35UIQYPqygGfZzgpMMDRFxUYy9OBP0rVSpv-9_v9bEVVfnskGlRrKYGt3qJuQPy8kDdEJdIknl9Tac7W-WmptwbeeCPJvjkhNOXXbY9eoVA_j7I4Ie92Z9QfWYmKVdCrRDFyRUI6kaPKRDaTNgVonY1O107EgaN0kREuf2xCnQft0ME5wfH2gMMmUo10r1cW5uVTsMbAlXZCNlxVk26gtvC0LIghMo2xHyyoutsO_Tw7_JWmOc-4fTa9ThmP1bKcT-kjDgWzB0QwNCFDAZ0GPHLYDLdYyWerziQ_m8kVlD5E2Hsl40f96dhWGT6ds2TKVT15dWYIsYUM9so7xO1vv2ZAM9zk1eWkSh-r0VTW-iEo-DDYEotvP34R6ji7DfLdpPZmXUESyXayRQ3ySadjq8nI-AcQjuAco0AsL1MhWtri6PdwFJu2T7qKuHe4ytPdWzievGSy53m2dC8Q5jJjuhKiVT8ei6MMZo0Qqgyf-CYj2647PGN6e2wlfIcPg==","rs_0ca5cfbf71c2b2e6016a66ccf39e048190a1e6643086da129e",{"_657":631},[906],{"_46":907,"_93":722},"**Running actionlint for commit checks**",{"_663":909,"_645":910,"_624":625,"_647":631},1785122036555,{"_648":911,"_42":903,"_717":912,"_93":719},[],[907],{"_645":914,"_624":625,"_647":631},{"_669":915,"_42":-5,"_652":916,"_368":-5,"_672":917,"_93":674},"call_vw4Mcn9CATzSxJSVd1x48gEy",{"_657":631},{"_501":918,"_676":-5},[919,920],{"_46":838,"_93":680},{"_46":921,"_93":680},"[{\"name\":\"mcp__make_pr__make_pr\",\"description\":\"Simple MCP server providing a make_pr tool for preparing pull request metadata.\\n\\nRecord a pull request title and body.\\ntitle: Title of the pull request\\nbody: Body message of the pull request\\n\\nexec tool declaration:\\n```ts\\ndeclare const tools: { mcp__make_pr__make_pr(args: { body: string; title: string; }): Promise>; };\\n```\"}]",{"_645":923,"_624":625,"_647":631},{"_669":915,"_42":924,"_705":925,"_652":926,"_368":708,"_709":-5,"_638":114,"_93":710},"ctc_0ca5cfbf71c2b2e6016a66ccf2312481909dd5318ebb362736","const matches = ALL_TOOLS.filter(x => /make.pr/i.test(x.name+\" \"+x.description)); text(matches);\n",{"_657":631},{"_645":928,"_624":625,"_647":631},{"_648":-5,"_713":929,"_42":930,"_652":931,"_717":932,"_93":719},"gAAAAABqZszyxo5W5lzoS1LPXOivkrpXxIjDbMHryKR9KJqqoCY79fX0uzCV4a2EuOf-ZB6OQarnS9e2gzRSFbk3nTWfM3s3UNFMVPHOwBTA-xBOolvuoDEoWaKOp0gSSe6odCUxzb3HdMPsW7iv_yuq5OaTuf5LN51Y607oiGU_FswWaHE0oGwckxuLiIe-sLWOVAx7LaWX_Yw0uiv8J0lyQe3R__V-uz7v3FmwkldUSDG0BSgn3SACaCLxExLmKuFXfJB6LET6L2APs-dZG2hJ3YJZoNx7mJ6hxnJkjaM-01NdwGxgJ519raPCZlEOvgoxku-MsgieH2Dsy03W7_5LHTxAkL8H00BJsGLsEqJ88mRaqojLyEslvb4p___wwIohILxNDBO_RgPXIvlm83iPOz4uUMVPnFlklTfhokdyLPYyAkK4MrWkBK_LawAaFzpBy6leVpdP-6YoKbDcHqcxEBRY_y-JbPVTVKBvpRaRgMej29Umj5txtRH_5j0Cdr2XRp3obXGc827asV7LyZp6-hFgIOL0EAVobNiCIAKtkeePmYmWvoaoj-dlrA12Z6WBwn5xu65XOFo0YxYZmvk4DybdnZWAk7Ibbt9upchm-e53VVpbPPqHzjcZgo4JpRovSvAM18pA4N4AjFMokxJUMOx8LuaM2l3-_i6qka9Dj8uL_H-ZyI7c-HiLTcZ77IPjuohPArIV0n5UNv9lDhyxtF_qz6F5iQHRso8uDAOALeULaB8oclN_-P6jap7HAUTlmfNttXwH2iQ4V-MuZhOAP1a9Wm21h3knAKT1C8XR6tw563oPS-oBIPJwer0EmlMfRCZEKYnKQ5RHjQ8YLj_bFTCxaNCdAC4yaq5LGGZ6L7waSE53J95Y_xO2JDwRr1ZQZYgIoXm46Gbm_GaIzFLdWpCzTeUi9FraEcQ4m4pqAHgkUVjnt3p9xC2AzI-vZx1jgZ0HY3qoZRxp_2nI_oCH2tX84QaYR-tXrCxn1q6-PBIXVPG2RtlQLot2JgIvE5Mr4YlgNPmex1GRWq7dxfv2NUoI4vy6Tw==","rs_0ca5cfbf71c2b2e6016a66ccf15214819084f51aeb6d8661c5",{"_657":631},[933],{"_46":934,"_93":722},"**Checking for actionlint installation**",{"_663":936,"_645":937,"_624":625,"_647":631},1785122034218,{"_648":938,"_42":930,"_717":939,"_93":719},[],[934],{"_645":941,"_624":625,"_647":631},{"_669":942,"_42":-5,"_652":943,"_368":-5,"_672":944,"_93":674},"call_zBDA5wqBMerjKLX3FnN2bw1n",{"_657":631},{"_501":945,"_676":-5},[946,947],{"_46":681,"_93":680},{"_46":948,"_93":680},"{}",{"_663":950,"_645":951,"_624":625,"_647":631},1785122032151,{"_952":953,"_42":954,"_638":114,"_93":955},"changes",[956],"exec-983ebab4-94f1-4809-8009-64ca65e00a41","fileChange",{"_511":957,"_9":958,"_256":959},"@@ -60,2 +60,4 @@\n - name: Validate GitHub operations governance invariants\n- run: node scripts/check-github-ops-governance.mjs\n+ run: |\n+ node --test scripts/check-github-ops-governance.test.mjs\n+ node scripts/check-github-ops-governance.mjs\n",{"_960":-5,"_93":961},"/workspace/Taskdeck/.github/workflows/reusable-docs-governance.yml","move_path","update",{"_645":963,"_624":625,"_647":631},{"_669":942,"_42":964,"_705":965,"_652":966,"_368":708,"_709":-5,"_638":114,"_93":710},"ctc_0ca5cfbf71c2b2e6016a66ccee652081909d978673483aba84","const patch = \"*** Begin Patch\\n*** Update File: /workspace/Taskdeck/.github/workflows/reusable-docs-governance.yml\\n@@\\n - name: Validate GitHub operations governance invariants\\n- run: node scripts/check-github-ops-governance.mjs\\n+ run: |\\n+ node --test scripts/check-github-ops-governance.test.mjs\\n+ node scripts/check-github-ops-governance.mjs\\n*** End Patch\";\ntext(await tools.apply_patch(patch));\n",{"_657":631},{"_645":968,"_624":625,"_647":631},{"_648":-5,"_713":969,"_42":970,"_652":971,"_717":972,"_93":719},"gAAAAABqZszu7V5mVzMPex0aB_YzjR8GJg07I0CcxN9xgUnnosdsaDHd7WetsgHrPUTqucuNljoz0-VJULX5XPDW6duxHB7S4Q35urQhbadAPPvXi2RExaAiuZTRP8aswnzJeb-C-R2S55XY2oCDgUWmCGxjjPwsVPv3Ua52KAT_DW_anyZeMLePWwsfzZ3amcqwx4KBHHQCeAI9UDAMGTbOhxqH2wDnZXsYnlsADEK8qtEpzVCVIFi9p1v-QSQ_FsqIT6boq5DUEa1Xn31zRTGqI6JXbmBGxoNICS72autnk9st_69PpQWwxOeq2JK9PXVm-3oERNEnufP_M9DTjQbHH9jzRYX-Iq_VXL7Bzaa65xM45GyKnbkiGMCq6WXmpyVn8Mmzeg98ug9D2LGu4l8A-KEAGqqF2ZWOLpYueQ9ioFTS95aGRIaYMbtZDJKwwYK9GF7je78LyoT6vR6T8ablaEzfiFIA0jJrUr5JY8krXi_aZ0bWyyFTw8Q_zPNNUsbk55Sb7qNE48GCMpvIur15S6Pi9iuYpZIF3ueIVNnur8YyUVgySRVt0siM7jazIGKKimustoYjbtj-b0Gty797KpH_N-P2onhix2ditKGEIYDbPplJOjHf0Ek2kh2Ue-PiuRpyV_dPFkKH_kYX6-Y_J7x2h5UBTS7ECylNla4T_67_6NLC0KrpTyoK1UEqYfSxxD-ZULcmHFgnCIc0w0jRoSOzyK-hrT_QCGA58MJuEa-ZkS3f6rc2rm4l7U6KKMYxdkMeTJjokScGXc-S_xtuRq_AvwrGTPPej3jDIF4jQFDuD7t_ZB6F0OmAG2hKu1aaynVYsUxKUggMxRL0LXI8vfylgK3o1ikySsJViHwK0KNyveyFHFYdRBzpOo9PpYieR3WJbcMfaI0bsAa_Pn47TIiQAKvZ-nbapGqtE2AKQkJN0qmMgSrahlRiAdzYPwovhi-4lSDnNgrz2wy4NAFRxl7vbxH_E7tCq3shYkleR4Ns2XpWYG99lmR5Ay-5C_dZN69xzPusyNoT9LGGay_3xPMLzsfZqR56V-x_Fj7pQlEil4JoViI8V-tZgE7dnea1h8fPaeFo1UApTVLP-8fewH-FkfwLIAzDE2KFzuAdugPAqva2Po7lg9Axmr51ds7GqjZ7baUFTep1e9lFrbLfniCcvbBBE3zOg0-bpjBjPh02PI7ofokLkjCCNK4lOgskUK2byTPj","rs_0ca5cfbf71c2b2e6016a66cced01948190959194ed32215c34",{"_657":631},[973],{"_46":974,"_93":722},"**Integrating multiline tests into CI workflow**",{"_663":976,"_645":977,"_624":625,"_647":631},1785122030419,{"_648":978,"_42":970,"_717":979,"_93":719},[],[974],{"_645":981,"_624":625,"_647":631},{"_669":982,"_42":-5,"_652":983,"_368":-5,"_672":984,"_93":674},"call_QbCfknJcermHcMZA0D9DBFyy",{"_657":631},{"_501":985,"_676":-5},[986,987],{"_46":681,"_93":680},{"_46":988,"_93":680}," 45\t $parseErrors | ForEach-Object { Write-Error $_ }\n 46\t exit 1\n 47\t }\n 48\t\n 49\t & $script -SelfTest\n 50\t\n 51\t - name: Validate failure ledger projection synchronization\n 52\t run: python -m unittest discover -s scripts/agent_hooks -p \"test_render_failure_ledger.py\"\n 53\t\n 54\t - name: Validate docs governance invariants\n 55\t run: node scripts/check-docs-governance.mjs\n 56\t\n 57\t - name: Validate golden principles invariants\n 58\t run: node scripts/check-golden-principles.mjs\n 59\t\n 60\t - name: Validate GitHub operations governance invariants\n 61\t run: node scripts/check-github-ops-governance.mjs\n",{"_663":990,"_645":991,"_624":625,"_647":631},1785122027517,{"_685":988,"_686":992,"_688":993,"_690":691,"_629":32,"_692":994,"_42":995,"_694":996,"_696":697,"_638":997,"_93":698},"/bin/bash -lc \"nl -ba .github/workflows/reusable-docs-governance.yml | sed -n '45,72p'; rg -n \\\"node --test scripts/.*test.mjs\\\" .github/workflows\"",[998,999],1,"exec-96f0ec84-21cc-4791-a54a-105febf66b98","94612","failed",{"_686":1005,"_368":1006,"_256":959,"_93":1007},{"_686":1000,"_256":1001,"_1002":1003,"_93":1004},"rg -n 'node --test scripts/.*test.mjs' .github/workflows","workflows","query","node --test scripts/.*test.mjs","search","nl -ba .github/workflows/reusable-docs-governance.yml","reusable-docs-governance.yml","read",{"_645":1009,"_624":625,"_647":631},{"_669":982,"_42":1010,"_705":1011,"_652":1012,"_368":708,"_709":-5,"_638":114,"_93":710},"ctc_0ca5cfbf71c2b2e6016a66cceaaf00819091f86c8b42716e4f","const r = await tools.exec_command({cmd:\"nl -ba .github/workflows/reusable-docs-governance.yml | sed -n '45,72p'; rg -n \\\"node --test scripts/.*test.mjs\\\" .github/workflows\",\"workdir\":\"/workspace/Taskdeck\",\"yield_time_ms\":10000,\"max_output_tokens\":5000}); text(r.output);\n",{"_657":631},{"_645":1014,"_624":625,"_647":631},{"_648":-5,"_713":1015,"_42":1016,"_652":1017,"_717":1018,"_93":719},"gAAAAABqZszqDO22sTfVGmWgLlfYJ_xp4l9r6-fZub4ctAj6EWpXMAIH2W2PNZ2487PJW_cw20hDjEgRN3j1CqhJLQAJy-rTWR1cPhvagIjWOlyT84aFP1OV13DP2VJbYYWuk-9MtEK3BZ8CQeaTPvpv9r8VggWxb6BXpPk7W4lIHPBinnbmqbJivGJNKeGVfYFMk2Euuf1Rh9PRjf-IWPHszw9JqJz5wvr_larPasGpU8jJpgyYE-qo0Sj-Lf-cG8YZlY5V5K-C59s6GRE3eJ5Fkan2nNGXYh8mKhazP0wDDV-eCIDubz4w8dWXw2WtST1leZqKttMZXQrcbzRdQAbPdIAL0icl4sTIxsw4pXNJazJ41a5Ta1UYtrFRuFXTZ66LPWitnkh99AH9BC9iang-KX9NLR6yqdUM_4blGtBMTqdwYyQRf0iN96j79p26ppxkcfQHnZI48cq9IbI6Kv8dDt7Z_Xds_Rj-BJNSvrGj6b-HdjnZFBaA0H9QdWEYz8MrAgx72iRVxVbweOuATT9GPvAhBM0S98_1Vf4XPp4Y-e6tNUOqt12sipmwp4WVQ-DAkTDKSkz-imUQIbGNNBm50RxrPz4bg4yBLEkX1j-Z73PNA7xsggJ3UEePKMxch4FRZdOmrCsT10ZVncbNJeS4bVCAOGGwscUBsSovfg9qRcNr7Ef4UXaTljcpYqUBllmBiGIxojiYxU6ckCjcHrmaf6o4yv5mdLrNL6pyuE1KEAeZ9CQa0p-u1GPtdOPOPm30TInWMJVENBf2Y3xDS8hRKftRMemZW592MZdoIymybDCpEodpqijzRYf3dMHlUC4iCl6tWBT7IKTLh2TDVxmn4IP_ETjcz5yU_suFYkWLGPqWhmvuzYCDH_Z0fZ9du4hIIkI3gw1ai7UNP7ynCXn71nb5PQVLlo6th2fnwIqLta_goeJuXnDu17hAe386kT42DO9eALOmfb7pn_kRi-yxo3H0UnZc3r7tvb_VPlqaJGYHgC9rCkYnLFiaHl-CSJYEZXBELZ53hfrBVzBB8WkrN_7YeBas21RLWOf7Fe6Ju2Xd4TMJ262M2iNrF8-ed0lqqMygDk-z7ceq5u0adpHa0HmXTaHpvytJv1pKBvOAbJAq3CMGh1BikfOJiJHiHVbNgu7kcb-VfISl_deug7p4Ul4IxZ5bLkC5ry8sqrWn_-qh1ZflxgizMqewIEG9Nlmuw-glGG_DiH6T4sf-_4pi3YQCpYKYiz8EQ8QfDQi3ttLhg51ljK4on6SBAX5EGvsxhDyksrHoeMG67pp6JUhkiOPu72Q3ZMMtLbAD5_n1Isv9zCghhVOJUEU6_zrjuFiPU4qesI-rX1fPnvmtOIuKs1ivXlQmUz2QpDpwXxNcD3-gnCZlmgU9ziS8poHVzteXpVTPYp9bDzAEpdIQGEBUU7WI7crY61K3mVvw8-qR4iJxzor9mJ0IjB7wTn0ouZyuyCSDpLBxic7pBeWvk3GfczKLAOo0Hdwy6Wlywo3V-9GbeZ1sIXkGHWPbgc-kgW2CwcM0K1DK4G35uSf3FVDEqi9Le0b_LOgb2C5tJGUI2hVwMLHPRGEKFWJtSejNheDQl584d2Gfg4g3CDSkDTNI-8SZwWPFGv3X9KCw_JD4kKNDm5wS7u_ZNeAIJ1lXjyKHtjUZEkp1Rlo63gSfPsZeigP20L5S12ab49KydAM0Y7oKp9IYKMVwHLrezK5UwLWuWTC2VK8p9mXJV5ypqQp8Fl1Zyj1YEqlzrqkr1R_xLhSPzKjykW8WE6PxUCIbwsf4XG3OtQQAb9KPF6iA9UPBiBpUWZrzRwnolV_2ecYhFCUeogOFZwBORCTlEO9Ckg0OcRFUvP7rtcQFuSUDbbkjDFv3aHpNGgYusCHqnApHngFQA90OSlb1tpMP1lvGXs-x0bBe_5yRR4vybeEb-zzDp-ICRvMqGYhRiyOf0EyrNijgjbp_JhhQbA9XYhvP5uf76vRWwDzltXEpcFl2pZ9Cec1Lia5VqM-sAW2Oe5NLABMPP9xEmzPTrgWOlDOKbJhcfQdW5UubIaf5B5-SIGPaGCOdzGBwYGVlb05BSmzeraliYCIwyJnpHLNFTRBOC-WbnvQk1P3Yl271dfcajeksK-TS1CFleTlFd-EO4MOovx9R0UXbELmidt2uG_ros6XTBaUNl0BJ5fiBNPM1m1fv30RwAraN34hKLHC1n7f1EYdF0P34aYI4Am-zuleWeyoB__9cryoiCFh67xhLscVm8dshsADVhQ==","rs_0ca5cfbf71c2b2e6016a66cce4e4b8819099bf19da43c01add",{"_657":631},[1019,1020],{"_46":1022,"_93":722},{"_46":1021,"_93":722},"**Adding self-tests to CI workflow**","**Planning workflow validation refactor**",{"_663":1024,"_645":1025,"_624":625,"_647":631},1785122026708,{"_648":1026,"_42":1016,"_717":1027,"_93":719},[],[1022,1021],{"_663":1029,"_645":1030,"_624":625,"_647":631},1785122019602,{"_685":1031,"_686":1032,"_688":1033,"_690":691,"_629":1034,"_692":32,"_42":1035,"_694":1036,"_696":697,"_638":114,"_93":698},"TAP version 13\n# Subtest: discovers block and inline trigger mappings\nok 1 - discovers block and inline trigger mappings\n ---\n duration_ms: 2.341388\n ...\n# Subtest: discovers quoted and comment-suffixed trigger mappings\nok 2 - discovers quoted and comment-suffixed trigger mappings\n ---\n duration_ms: 0.295826\n ...\n# Subtest: reports unrecognized indentation-two entries so validation fails closed\nok 3 - reports unrecognized indentation-two entries so validation fails closed\n ---\n duration_ms: 0.346588\n ...\n1..3\n# tests 3\n# suites 0\n# pass 3\n# fail 0\n# cancelled 0\n# skipped 0\n# todo 0\n# duration_ms 155.269562\nGitHub operations governance check passed.\nDocs governance check passed.\nGolden principles check passed.\n M OUTSTANDING_TASKS.md\n M scripts/check-github-ops-governance.mjs\n?? scripts/check-github-ops-governance.test.mjs\ndiff --git a/OUTSTANDING_TASKS.md b/OUTSTANDING_TASKS.md\nindex 4542833..c335013 100644\n--- a/OUTSTANDING_TASKS.md\n+++ b/OUTSTANDING_TASKS.md\n@@ -89,6 +89,7 @@ Analysis docs: `docs/PROJECT_TRAJECTORY.md` (strengths + path) and `docs/COURSE_\n ## E. Revival overnight deferrals (added 2026-07-13)\n \n - [ ] **#1173** — Apply and verify the required branch-protection settings in GitHub. This is repository-settings work and remains maintainer-only.\n+- [ ] **#1504** — Configure and rehearse required-reviewer protection for the parked staging workflow's `production` environment before Phase 3 is reactivated. This is maintainer-only repository-settings work.\n - [ ] **#1303** — Push the `v0.1.0` release tag only after the maintainer accepts the release deck and its pipeline evidence. Agents may repair the pipeline but must not push the tag.\n - [ ] **#1482 — Taskdeck name, pre-commercial legal residuals.** *(Supersedes the old \"#1299 trademark check\" line: #1299 shipped with PR #1337 on 2026-07-25 and its AC4 search + cost + recommendation are recorded on the issue.)* What remains is genuinely legal and none of it blocks the free beta: an **attorney registrability opinion** for Classes 9/42 asking about *descriptiveness* (not just conflict), a read on **TASKADE** (live, incontestable US Cl. 42 mark covering task management), the UKIPO/EUIPO coverage gaps (UKIPO hard-blocked automated access, so all GB data is indirect), perishable namespace reservations, and the **keep-or-rename decision before `v0.1.0` (#1303)** — renaming is nearly free pre-tag and expensive after.\n - [ ] **#1458 project-priority data cleanup — delivered; maintainer record check-off pending.** All 130 formerly unlabeled Taskdeck Issues were classified and verified, the reviewed project-field Apply succeeded 141/141, and the built-in plus three fresh complete audits proved 1,472/1,472 items with zero remaining Priority drift. PR #1488 merged; issue #1458 and both project items are `Done / Priority I`. The checkbox remains open because only the maintainer checks off this file.\ndiff --git a/scripts/check-github-ops-governance.mjs b/scripts/check-github-ops-governance.mjs\nindex 79dc8ce..00660fa 100644\n--- a/scripts/check-github-ops-governance.mjs\n+++ b/scripts/check-github-ops-governance.mjs\n@@ -3,6 +3,7 @@\n import { access, readFile } from 'node:fs/promises'\n import { constants as fsConstants } from 'node:fs'\n import { resolve } from 'node:path'\n+import { pathToFileURL } from 'node:url'\n \n const errors = []\n \n@@ -140,6 +141,33 @@ async function validateProjectAutomationDocs() {\n }\n }\n \n+export function discoverTopLevelMappingKeys(lines, indentation = 2) {\n+ const prefix = ' '.repeat(indentation)\n+ const keys = []\n+ const unrecognizedEntries = []\n+\n+ for (const line of lines) {\n+ if (!line.startsWith(prefix) || line.startsWith(`${prefix} `)) {\n+ continue\n+ }\n+\n+ const content = line.slice(indentation)\n+ if (content.trim().length === 0 || content.trimStart().startsWith('#')) {\n+ continue\n+ }\n+\n+ const mappingEntry = content.match(/^(?:\"((?:[^\"\\\\]|\\\\.)+)\"|'((?:[^']|'')+)'|([A-Za-z][\\w-]*))\\s*:/)\n+ if (!mappingEntry) {\n+ unrecognizedEntries.push(content)\n+ continue\n+ }\n+\n+ keys.push(mappingEntry[1] ?? mappingEntry[2]?.replaceAll(\"''\", \"'\") ?? mappingEntry[3])\n+ }\n+\n+ return { keys, unrecognizedEntries }\n+}\n+\n async function validateParkedStagingGateTriggers() {\n const workflowPath = '.github/workflows/cd-staging-gate.yml'\n if (!(await fileExists(workflowPath))) {\n@@ -164,9 +192,13 @@ async function validateParkedStagingGateTriggers() {\n triggerLines.push(line)\n }\n \n- const triggerNames = triggerLines\n- .map((line) => line.match(/^ {2}([A-Za-z][\\w-]*):\\s*$/)?.[1])\n- .filter(Boolean)\n+ const { keys: triggerNames, unrecognizedEntries } = discoverTopLevelMappingKeys(triggerLines)\n+\n+ if (unrecognizedEntries.length > 0) {\n+ errors.push(\n+ `${workflowPath} contains unrecognized top-level entries in its on block: ${unrecognizedEntries.join(', ')}`,\n+ )\n+ }\n \n if (triggerNames.length !== 1 || triggerNames[0] !== 'workflow_dispatch') {\n errors.push(\n@@ -196,7 +228,10 @@ async function main() {\n console.log('GitHub operations governance check passed.')\n }\n \n-main().catch((error) => {\n- console.error('GitHub operations governance check crashed:', error)\n- process.exit(1)\n-})\n+const entryUrl = process.argv[1] ? pathToFileURL(resolve(process.argv[1])) : null\n+if (entryUrl && import.meta.url === entryUrl.href) {\n+ main().catch((error) => {\n+ console.error('GitHub operations governance check crashed:', error)\n+ process.exit(1)\n+ })\n+}\n","/bin/bash -lc 'node --test scripts/check-github-ops-governance.test.mjs; node scripts/check-github-ops-governance.mjs; node scripts/check-docs-governance.mjs; node scripts/check-golden-principles.mjs; git diff --check; git status --short; git diff -- scripts/check-github-ops-governance.mjs scripts/check-github-ops-governance.test.mjs OUTSTANDING_TASKS.md'",[1037],622,"exec-8baec856-9b2a-4bd5-b6f0-c67fa69d3c9f","94738",{"_686":1038,"_93":701},"node --test scripts/check-github-ops-governance.test.mjs; node scripts/check-github-ops-governance.mjs; node scripts/check-docs-governance.mjs; node scripts/check-golden-principles.mjs; git diff --check; git status --short; git diff -- scripts/check-github-ops-governance.mjs scripts/check-github-ops-governance.test.mjs OUTSTANDING_TASKS.md",{"_645":1040,"_624":625,"_647":631},{"_669":1041,"_42":-5,"_652":1042,"_368":-5,"_672":1043,"_93":674},"call_ECgtupdQSxGHfQMUdHGgpZzK",{"_657":631},{"_501":1044,"_676":-5},[1045,1046],{"_46":1047,"_93":680},{"_46":1031,"_93":680},"Script completed\nWall time 0.7 seconds\nOutput:\n",{"_645":1049,"_624":625,"_647":631},{"_669":1041,"_42":1050,"_705":1051,"_652":1052,"_368":708,"_709":-5,"_638":114,"_93":710},"ctc_0ca5cfbf71c2b2e6016a66ccdda8c881909a4662aef7d2ebe8","const r = await tools.exec_command({cmd:\"node --test scripts/check-github-ops-governance.test.mjs; node scripts/check-github-ops-governance.mjs; node scripts/check-docs-governance.mjs; node scripts/check-golden-principles.mjs; git diff --check; git status --short; git diff -- scripts/check-github-ops-governance.mjs scripts/check-github-ops-governance.test.mjs OUTSTANDING_TASKS.md\",\"workdir\":\"/workspace/Taskdeck\",\"yield_time_ms\":30000,\"max_output_tokens\":30000}); text(r.output);\n",{"_657":631},{"_645":1054,"_624":625,"_647":631},{"_648":-5,"_713":1055,"_42":1056,"_652":1057,"_717":1058,"_93":719},"gAAAAABqZszdORaWwxWU57hGuWEiOCTcW_EKFe7Cw9wiSvLm1nL7bkgp9u-E2wQIWoIShCKUyBJtR3eXPqaBfjhsHRYd7p-yVr5CQ_wk1u3DQybtL2g8gf7vP8_QYvGSlnvtve9IjULweHGzw0g4aaxyMlMaI0O_BE1Fn8dDTAKV4iLtnJBuMp3m_yu1pK8tBywVtqxJsPBkbhO4okwcYtb6_z-PmffHAxM9wxw43-JIiJzNS-QJIbUWIMmFIKNvswXx0O9cB3yPdHfeUQHPewgdlqVODR5gt6_Oa6FqSyATdRq9-PQtbrIGpcZaQ_58UspmsTj2B_BcNlRk2PYslh3Js6tpaMXqWs2z7D3r6_GRPhwavdyO07vu3m5hsrckudmhlDBhrD5Lzw4BTE88QmyhKOGeZA8AGmSHEtmIwf1RjZN2So4yjivrFIAoGZH7Q0_PA3RJVGRxqhjpbRfPzMqt_l2sS31E6Lw5rkEaOEfIyggds_0MtHhhUEQNLFyMdAapa0bPKP--ktE-z8Aiv0PknuVkAW0DltbNXlUhST7Ohec8so4ZFbSs0r-RGrC11WADfE-4oXivwfaGqkJLAoZ-EftJPQn_slLW4Pn3jGHwph9hok92ifGyICCkr24zrIfC93j8cOT26396FoW2F5hQ5IJhEym7mJQFTSzB-i0LSj3Mo_os0aHGdH2OQD_MWMLK8zN1EE8ukJ4gSCALEy9XqEGZnD6FjHpnxg3muptXa1nbGTzxbY54GeUBH1voqpGuaX2tQdAssnw-VnH8eHHS3o2CGieLnhL9tVam18wbOvdpjqQoS-Ulu_4m7DEd-k78peHQQUqFdNp58dExsAp-0JbU3DARjwlklcbt4w1KyfEM1E62ZnXjwRVQYD_zdM9jwY8pdJ6UnAIyLAc51WnQfCFxbgRM0zwDHH2qgA_XwoN-XeA_9QJuDqWhF832v2bNJ4aIzwVKBWkElXhwXecz-QX9zb4t1waypHA9H44lKysOpVN7y69FssmYTAXlzbjrSXlDEXOk7k0Bdp5S1o-BwWaOx61f-hO0PULgJxBlOvwFAMWiMTUoMs0_NYfOcUtn53uVPd4Pj3B1xcrAnNCqXh4RWWgYJzW2gEAeclAD7P0AaatAT7nG1bJUWp2zOLn9KGI2Enge","rs_0ca5cfbf71c2b2e6016a66ccdc53a08190815a7446dbdf8ea6",{"_657":631},[1059],{"_46":1060,"_93":722},"**Planning adversarial regression tests**",{"_663":1062,"_645":1063,"_624":625,"_647":631},1785122013683,{"_648":1064,"_42":1056,"_717":1065,"_93":719},[],[1060],{"_645":1067,"_624":625,"_647":631},{"_669":1068,"_42":-5,"_652":1069,"_368":-5,"_672":1070,"_93":674},"call_vVpSbVGzuFyZ5dMETnUDT2cw",{"_657":631},{"_501":1071,"_676":-5},[1072,1073],{"_46":838,"_93":680},{"_46":948,"_93":680},{"_663":1075,"_645":1076,"_624":625,"_647":631},1785122010628,{"_952":1077,"_42":1078,"_638":114,"_93":955},[1079,1080,1081],"exec-45084fe6-530e-4883-9868-474d0d1fd50c",{"_511":1089,"_9":1090,"_256":1091},{"_511":1086,"_9":1087,"_256":1088},{"_511":1082,"_9":1083,"_256":1084},"import assert from 'node:assert/strict'\nimport test from 'node:test'\n\nimport { discoverTopLevelMappingKeys } from './check-github-ops-governance.mjs'\n\ntest('discovers block and inline trigger mappings', () => {\n const result = discoverTopLevelMappingKeys([\n ' workflow_dispatch:',\n ' inputs:',\n ' release: { types: [published] }',\n ' push: {}',\n ])\n\n assert.deepEqual(result, {\n keys: ['workflow_dispatch', 'release', 'push'],\n unrecognizedEntries: [],\n })\n})\n\ntest('discovers quoted and comment-suffixed trigger mappings', () => {\n const result = discoverTopLevelMappingKeys([\n ' \"release\": { types: [published] }',\n \" 'push': # automatic trigger\",\n ' workflow_dispatch: # manual trigger',\n ])\n\n assert.deepEqual(result, {\n keys: ['release', 'push', 'workflow_dispatch'],\n unrecognizedEntries: [],\n })\n})\n\ntest('reports unrecognized indentation-two entries so validation fails closed', () => {\n const result = discoverTopLevelMappingKeys([\n ' workflow_dispatch:',\n ' [release]: { types: [published] }',\n ' # comments are allowed',\n '',\n ])\n\n assert.deepEqual(result, {\n keys: ['workflow_dispatch'],\n unrecognizedEntries: ['[release]: { types: [published] }'],\n })\n})\n",{"_93":1085},"/workspace/Taskdeck/scripts/check-github-ops-governance.test.mjs","add","@@ -5,2 +5,3 @@\n import { resolve } from 'node:path'\n+import { pathToFileURL } from 'node:url'\n \n@@ -142,2 +143,29 @@\n \n+export function discoverTopLevelMappingKeys(lines, indentation = 2) {\n+ const prefix = ' '.repeat(indentation)\n+ const keys = []\n+ const unrecognizedEntries = []\n+\n+ for (const line of lines) {\n+ if (!line.startsWith(prefix) || line.startsWith(`${prefix} `)) {\n+ continue\n+ }\n+\n+ const content = line.slice(indentation)\n+ if (content.trim().length === 0 || content.trimStart().startsWith('#')) {\n+ continue\n+ }\n+\n+ const mappingEntry = content.match(/^(?:\"((?:[^\"\\\\]|\\\\.)+)\"|'((?:[^']|'')+)'|([A-Za-z][\\w-]*))\\s*:/)\n+ if (!mappingEntry) {\n+ unrecognizedEntries.push(content)\n+ continue\n+ }\n+\n+ keys.push(mappingEntry[1] ?? mappingEntry[2]?.replaceAll(\"''\", \"'\") ?? mappingEntry[3])\n+ }\n+\n+ return { keys, unrecognizedEntries }\n+}\n+\n async function validateParkedStagingGateTriggers() {\n@@ -166,5 +194,9 @@\n \n- const triggerNames = triggerLines\n- .map((line) => line.match(/^ {2}([A-Za-z][\\w-]*):\\s*$/)?.[1])\n- .filter(Boolean)\n+ const { keys: triggerNames, unrecognizedEntries } = discoverTopLevelMappingKeys(triggerLines)\n+\n+ if (unrecognizedEntries.length > 0) {\n+ errors.push(\n+ `${workflowPath} contains unrecognized top-level entries in its on block: ${unrecognizedEntries.join(', ')}`,\n+ )\n+ }\n \n@@ -198,5 +230,8 @@\n \n-main().catch((error) => {\n- console.error('GitHub operations governance check crashed:', error)\n- process.exit(1)\n-})\n+const entryUrl = process.argv[1] ? pathToFileURL(resolve(process.argv[1])) : null\n+if (entryUrl && import.meta.url === entryUrl.href) {\n+ main().catch((error) => {\n+ console.error('GitHub operations governance check crashed:', error)\n+ process.exit(1)\n+ })\n+}\n",{"_960":-5,"_93":961},"/workspace/Taskdeck/scripts/check-github-ops-governance.mjs","@@ -91,2 +91,3 @@\n - [ ] **#1173** — Apply and verify the required branch-protection settings in GitHub. This is repository-settings work and remains maintainer-only.\n+- [ ] **#1504** — Configure and rehearse required-reviewer protection for the parked staging workflow's `production` environment before Phase 3 is reactivated. This is maintainer-only repository-settings work.\n - [ ] **#1303** — Push the `v0.1.0` release tag only after the maintainer accepts the release deck and its pipeline evidence. Agents may repair the pipeline but must not push the tag.\n",{"_960":-5,"_93":961},"/workspace/Taskdeck/OUTSTANDING_TASKS.md",{"_645":1093,"_624":625,"_647":631},{"_669":1068,"_42":1094,"_705":1095,"_652":1096,"_368":708,"_709":-5,"_638":114,"_93":710},"ctc_0ca5cfbf71c2b2e6016a66ccc6d9f081909538353effe5a6eb","const patch = \"*** Begin Patch\\n*** Update File: /workspace/Taskdeck/scripts/check-github-ops-governance.mjs\\n@@\\n import { constants as fsConstants } from 'node:fs'\\n import { resolve } from 'node:path'\\n+import { pathToFileURL } from 'node:url'\\n@@\\n async function validateProjectAutomationDocs() {\\n@@\\n }\\n+\\n+export function discoverTopLevelMappingKeys(lines, indentation = 2) {\\n+ const prefix = ' '.repeat(indentation)\\n+ const keys = []\\n+ const unrecognizedEntries = []\\n+\\n+ for (const line of lines) {\\n+ if (!line.startsWith(prefix) || line.startsWith(`${prefix} `)) {\\n+ continue\\n+ }\\n+\\n+ const content = line.slice(indentation)\\n+ if (content.trim().length === 0 || content.trimStart().startsWith('#')) {\\n+ continue\\n+ }\\n+\\n+ const mappingEntry = content.match(/^(?:\\\"((?:[^\\\"\\\\\\\\]|\\\\\\\\.)+)\\\"|'((?:[^']|'')+)'|([A-Za-z][\\\\w-]*))\\\\s*:/)\\n+ if (!mappingEntry) {\\n+ unrecognizedEntries.push(content)\\n+ continue\\n+ }\\n+\\n+ keys.push(mappingEntry[1] ?? mappingEntry[2]?.replaceAll(\\\"''\\\", \\\"'\\\") ?? mappingEntry[3])\\n+ }\\n+\\n+ return { keys, unrecognizedEntries }\\n+}\\n \\n async function validateParkedStagingGateTriggers() {\\n@@\\n- const triggerNames = triggerLines\\n- .map((line) => line.match(/^ {2}([A-Za-z][\\\\w-]*):\\\\s*$/)?.[1])\\n- .filter(Boolean)\\n+ const { keys: triggerNames, unrecognizedEntries } = discoverTopLevelMappingKeys(triggerLines)\\n+\\n+ if (unrecognizedEntries.length > 0) {\\n+ errors.push(\\n+ `${workflowPath} contains unrecognized top-level entries in its on block: ${unrecognizedEntries.join(', ')}`,\\n+ )\\n+ }\\n@@\\n-main().catch((error) => {\\n- console.error('GitHub operations governance check crashed:', error)\\n- process.exit(1)\\n-})\\n+const entryUrl = process.argv[1] ? pathToFileURL(resolve(process.argv[1])) : null\\n+if (entryUrl && import.meta.url === entryUrl.href) {\\n+ main().catch((error) => {\\n+ console.error('GitHub operations governance check crashed:', error)\\n+ process.exit(1)\\n+ })\\n+}\\n*** Add File: /workspace/Taskdeck/scripts/check-github-ops-governance.test.mjs\\n+import assert from 'node:assert/strict'\\n+import test from 'node:test'\\n+\\n+import { discoverTopLevelMappingKeys } from './check-github-ops-governance.mjs'\\n+\\n+test('discovers block and inline trigger mappings', () => {\\n+ const result = discoverTopLevelMappingKeys([\\n+ ' workflow_dispatch:',\\n+ ' inputs:',\\n+ ' release: { types: [published] }',\\n+ ' push: {}',\\n+ ])\\n+\\n+ assert.deepEqual(result, {\\n+ keys: ['workflow_dispatch', 'release', 'push'],\\n+ unrecognizedEntries: [],\\n+ })\\n+})\\n+\\n+test('discovers quoted and comment-suffixed trigger mappings', () => {\\n+ const result = discoverTopLevelMappingKeys([\\n+ ' \\\"release\\\": { types: [published] }',\\n+ \\\" 'push': # automatic trigger\\\",\\n+ ' workflow_dispatch: # manual trigger',\\n+ ])\\n+\\n+ assert.deepEqual(result, {\\n+ keys: ['release', 'push', 'workflow_dispatch'],\\n+ unrecognizedEntries: [],\\n+ })\\n+})\\n+\\n+test('reports unrecognized indentation-two entries so validation fails closed', () => {\\n+ const result = discoverTopLevelMappingKeys([\\n+ ' workflow_dispatch:',\\n+ ' [release]: { types: [published] }',\\n+ ' # comments are allowed',\\n+ '',\\n+ ])\\n+\\n+ assert.deepEqual(result, {\\n+ keys: ['workflow_dispatch'],\\n+ unrecognizedEntries: ['[release]: { types: [published] }'],\\n+ })\\n+})\\n*** Update File: /workspace/Taskdeck/OUTSTANDING_TASKS.md\\n@@\\n - [ ] **#1173** — Apply and verify the required branch-protection settings in GitHub. This is repository-settings work and remains maintainer-only.\\n+- [ ] **#1504** — Configure and rehearse required-reviewer protection for the parked staging workflow's `production` environment before Phase 3 is reactivated. This is maintainer-only repository-settings work.\\n - [ ] **#1303** — Push the `v0.1.0` release tag only after the maintainer accepts the release deck and its pipeline evidence. Agents may repair the pipeline but must not push the tag.\\n*** End Patch\";\ntext(await tools.apply_patch(patch));\n",{"_657":631},{"_645":1098,"_624":625,"_647":631},{"_648":-5,"_713":1099,"_42":1100,"_652":1101,"_717":1102,"_93":719},"gAAAAABqZszGYlDESfyXsiNCbgbUkctQ8Fh2xEiFBXswm7cT8g86z_eslGsxRMcuqL5T8-cbJB5S7-gjM39BLoxdI3CcBxdij_mhs0SDjQTto0dNVM0Yu-_kJ41bC4rdhxktLJ_CDa-HBL0G1LW2_88P8hITOwgTEbfNF-n44f3zN8sejT9emQT25aRKS-JYwuK0lXMfduMF8-01rl4u52JIjIywEr5WF7ARcVzpaPX_vQ9UK_WzXGpCvHJAUrRwJWWjTbL47zZywyxUVWegXS7Aqcq2fixZwuyWN7Uy8g65jIqe7l_tSafGC1OMOmbDFbcro49VFiYjgPa0yINrBv-Bey_j-suM0a8GJg2edv90N-Wmh3bvC93buUaKx_H4qCDcZMleW3bXao_qA31WwblRrTjkyKm455fZbQepwa_DolWwQtftDciUgc8bLA-I7-4C5JulzLFuh02pnulT7ZrEI0bCRXvBaQdNxj6vwAP8glajrE74U0fpNNwXCQFqmevOUClxniB9SUjqxtkSDsntlAyfUZ4xlumRMfY1nXIcwQl35VOmLoJDR7iUdso3yBEeOLBjbJwnPITJeSoW6OU3f7NJj3qb8XeC-Z_HQbiZ-buaDES5x33PpgBTWBVQosigKEqxnLojRinhfjBKyKPm8ZvMNHvf57TJf5rDm4xMJuccEFIQQLNKjzqbLVmOQd92aWMyLbkS3KIr7Nf4i-TwYyWyYwqpIinwNXP3FkDKtQgz5S9tP4KqqcoJ0qcH1WKV-neHfEfRMrn5QvWzPLt8BgIfasvgekPTgHrKDtkOOY39GeXzLOKcLjZbuOK8O-p38W43gajhNckomJqja8icTPUGIsTxV_FoQ5nfF-GLnxu98MicBuZn6OsSQDXwSIv76wA3_6hVJn_j6cCVcINyUxwAmmj6j-g5AKtgc0WSS8vkQXhek8FYsM_7TpZm9O7zkkvtHwIByyhlTlNDOrWfywvw6euEcp4TV6Zz21RVTacWxsyeIAtAQKfiy_wmG09Z4FHVqcG8_RdP3tcXD0ZtSvS7lNGl7H0XOq43piXlO3K8JOrsfk1rs7xSC_GRyDrpCYqjT8pNGEYankqt42eX9AdbScmFaYOxoa_VzyLYknoD0V-GkZsL9pm_N604XRTzT3MBy8_Ivm8zjGxJiVj3rhncaJT_bu5P5Od-ZISQAOohVH0GtrVl9tRoR7ptK1DV1s_Hc2V3dHpNX6xOcq5_zFMVU7tXyD7Ww8Ayr57GV-ty3Cvj2ebM86TMAUA-ZM3fN0PctelZIMqEmSGCN1V9bhNfGXmNOY_beB-bqhF7U4c2dev5IZjf6G5xgf1E9cZZRRjhAa8sIHplZD3eW59wvKUDbo_jfdsVloQi8GBUaFCPH6HxmGt04Y0XsKA40cbSr9k2DgVz6EAdG-QQ9lA2S17wG24sV-WLOPQM0VYEzQzGzqDZvZBmOyenBPzHAxsn7l0c75_cf-025Opg7evElgXEo4NUQz0tXb5gjRlLUig66AKhiDz7r2ac1D9WqA76RtOdPRfC4T4S31VTO_SBYr1PrECsIj_MqAbpRN1MNdOEgmpWlVhXvbTKNmvfjW13h2aBMitMpgCE4hhtMNP34jzZ5Jkiiz7nqoi7czQ5bWtfe7BYNEJgcqjygtKZ_DDA_UGp3vMdMrIg9LeINGmMpgIayf4pgLTxVd3GYNSc64FIn_gVjbx3dH4TRno1OF0yysyGJB5AYsP8sn70KEuSDvQU-mUHklLqi0GL-ktCePg46mHiqtwFirtzRWBEEyKxwgzyWAcYmkT9JfCcpk1jPjcFcy8j_hXYIHbSKzeJLVLTem0wDtJWsF_GHsnR65wdjYzQ0J7VYLmSkndDkqKtcztBb-Rcy8SBySVvU6JctKhSSaYEHWfrDDBPmVXXDKbN3QS_OqD9K1lVJEO9FBfFEFo3Sv1R0KaaJvPyb3XcKIl8bRasyOqDbdAHodYbf2cW9lM2dtVYrmwc6id-gBZDOdMwgUgpA05j5HXo3l_pnoBD4pjb-KS_1IeOn4Wvbs5398UW0ole_eeW4bAkCYBPM17SAevmPWJGnB3IaVZcmh1dy_OtHVtnbCDwt_yJeF4wZQUo-bED6OpdePj8-oeFZNl6UNGAWckl-tjUYPDVX_7xPlVuhZHBa6X1PILVSH1MCWSwzHKMeUyOFUktgyeYRMA7f8LwfbKtO2dCziLr5JQhYdiANGpe4DaMmQm7azWeeyiPStnq9sQqENoDsF29dx5HZ5C8pfgQqlmHqULgSpJI1EvbxWI8Z6gXk0Xv42y3mnuICw4JRFQEQitDd8pOiRsPGq_mu2FVf1yG6WSF7oyudkfZrlkTLDMUbpe9Jzw4sYDKyi1Ar6l5wCWGPezISjmRvc_yE87S1tHa9XZVmXbYTjTHjaKUhpxI6wOiJcUJbb1ZqEjo","rs_0ca5cfbf71c2b2e6016a66ccc0609c8190afef058a5a6a8a79",{"_657":631},[1103,1104],{"_46":1106,"_93":722},{"_46":1105,"_93":722},"**Implementing top-level YAML key discovery function**","**Designing robust YAML parsing rules**",{"_663":1108,"_645":1109,"_624":625,"_647":631},1785121990876,{"_648":1110,"_42":1100,"_717":1111,"_93":719},[],[1106,1105],{"_645":1113,"_624":625,"_647":631},{"_669":1114,"_42":-5,"_652":1115,"_368":-5,"_672":1116,"_93":674},"call_1D2iuU7gRAGyz1XAEWYPHgjB",{"_657":631},{"_501":1117,"_676":-5},[1118,1119],{"_46":681,"_93":680},{"_46":1120,"_93":680},"scripts/ci/require-k6-summary.test.mjs\nscripts/ci/check-k6-thresholds.test.mjs\nscripts/ci/summarize-dependency-security-signals.test.mjs\nscripts/ci/summarize-dependency-security-signals.mjs:5:import { pathToFileURL } from 'node:url'\nscripts/ci/summarize-dependency-security-signals.mjs:311:const entryUrl = process.argv[1] ? pathToFileURL(resolve(process.argv[1])) : null\nscripts/ci/summarize-dependency-security-signals.mjs:312:if (entryUrl && import.meta.url === entryUrl.href) {\nscripts/ci/summarize-dependency-security-signals.test.mjs:1:import { mkdtemp, rm, writeFile } from 'node:fs/promises'\nscripts/ci/summarize-dependency-security-signals.test.mjs:4:import test from 'node:test'\nscripts/ci/summarize-dependency-security-signals.test.mjs:10: const tempDir = await mkdtemp(join(tmpdir(), 'taskdeck-dependency-summary-'))\nscripts/ci/summarize-dependency-security-signals.test.mjs:93: const tempDir = await mkdtemp(join(tmpdir(), 'taskdeck-dependency-summary-'))\nscripts/ci/summarize-dependency-security-signals.test.mjs:128: const tempDir = await mkdtemp(join(tmpdir(), 'taskdeck-dependency-summary-'))\nscripts/ci/check-k6-thresholds.test.mjs:3:import { mkdtemp, readFile, rm, writeFile } from 'node:fs/promises'\nscripts/ci/check-k6-thresholds.test.mjs:6:import test from 'node:test'\nscripts/ci/check-k6-thresholds.test.mjs:9:const analyzerPath = fileURLToPath(new URL('./check-k6-thresholds.mjs', import.meta.url))\nscripts/ci/check-k6-thresholds.test.mjs:10:const fixturePath = fileURLToPath(new URL('./k6-summary-minimal.fixture.json', import.meta.url))\nscripts/ci/check-k6-thresholds.test.mjs:23: const tempDir = await mkdtemp(join(tmpdir(), 'taskdeck-k6-thresholds-'))\nscripts/ci/check-k6-thresholds.test.mjs:84: const alternateCwd = await mkdtemp(join(tmpdir(), 'taskdeck-k6-cwd-'))\nscripts/ci/require-k6-summary.test.mjs:3:import { mkdtemp, readFile, rm, writeFile } from 'node:fs/promises'\nscripts/ci/require-k6-summary.test.mjs:6:import test from 'node:test'\nscripts/ci/require-k6-summary.test.mjs:10:const validatorPath = fileURLToPath(new URL('./require-k6-summary.mjs', import.meta.url))\nscripts/ci/require-k6-summary.test.mjs:11:const analyzerPath = fileURLToPath(new URL('./check-k6-thresholds.mjs', import.meta.url))\nscripts/ci/require-k6-summary.test.mjs:12:const fixturePath = fileURLToPath(new URL('./k6-summary-minimal.fixture.json', import.meta.url))\nscripts/ci/require-k6-summary.test.mjs:27: const tempDir = await mkdtemp(join(tmpdir(), 'taskdeck-k6-summary-'))\nscripts/ci/require-k6-summary.test.mjs:63: const tempDir = await mkdtemp(join(tmpdir(), 'taskdeck-k6-summary-'))\nscripts/ci/require-k6-summary.test.mjs:329: const profile = await readFile(new URL('../../tests/load/k6/board-heavy-load.js', import.meta.url), 'utf8')\nscripts/ci/require-k6-summary.test.mjs:344: const loadWorkflow = await readFile(new URL('../../.github/workflows/reusable-load-concurrency-harness.yml', import.meta.url), 'utf8')\nscripts/ci/require-k6-summary.test.mjs:345: const performanceWorkflow = await readFile(new URL('../../.github/workflows/reusable-performance-regression-gate.yml', import.meta.url), 'utf8')\n# =============================================================================\n# CD Staging Gate — Automated staging deployment verification with a parked\n# production-environment handoff. Implements Phase 1-2 of the staged deployment\n# workflow (docs/ops/DEPLOYMENT_WORKFLOW.md). Environment protection is external\n# repository state and must not be inferred from this workflow definition.\n#\n# Triggers:\n# - Manual workflow dispatch (for re-runs or pre-release validation)\n#\n# ADR: ADR-0028 (Staged Deployment — Blue/Green with Canary Verification)\n# Issue: #101 (OPS-09)\n# =============================================================================\n\nname: CD Staging Gate\n\non:\n workflow_dispatch:\n inputs:\n image_tag:\n description: \"Container image tag to deploy (e.g., v0.2.0)\"\n required: true\n type: string\n skip_smoke:\n description: \"Skip smoke tests (emergency only)\"\n required: false\n type: boolean\n default: false\n\npermissions:\n contents: read\n actions: read\n\nconcurrency:\n group: cd-staging-${{ github.ref }}\n cancel-in-progress: false\n\nenv:\n NUGET_PACKAGES: ${{ github.workspace }}/.nuget/packages\n\njobs:\n # -----------------------------------------------------------------------\n # Phase 1: Build Verification\n # -----------------------------------------------------------------------\n build-verification:\n name: \"Phase 1: Build Verification\"\n runs-on: ubuntu-latest\n timeout-minutes: 20\n outputs:\n image_tag: ${{ steps.resolve-tag.outputs.tag }}\n steps:\n - name: Checkout\n uses: actions/checkout@v7\n\n - name: Resolve image tag\n id: resolve-tag\n env:\n INPUT_TAG: ${{ inputs.image_tag }}\n run: |\n if [[ ! \"$INPUT_TAG\" =~ ^[A-Za-z0-9_][A-Za-z0-9_.-]{0,127}$ ]]; then\n echo \"::error::image_tag must be a valid container tag (1-128 letters, digits, underscores, periods, or hyphens).\"\n exit 1\n fi\n printf 'tag=%s\\n' \"$INPUT_TAG\" >> \"$GITHUB_OUTPUT\"\n echo \"Resolved image tag: $INPUT_TAG\"\n\n - name: Setup .NET\n uses: actions/setup-dotnet@v6\n with:\n dotnet-version: 8.0.x\n cache: true\n cache-dependency-path: |\n backend/Taskdeck.sln\n backend/**/*.csproj\n backend/Directory.Packages.props\n\n - name: Setup Node\n uses: actions/setup-node@v7\n with:\n node-version: 24.13.1\n cache: npm\n cache-dependency-path: frontend/taskdeck-web/package-lock.json\n\n - name: Restore and build backend\n run: |\n dotnet restore backend/Taskdeck.sln\n dotnet build backend/Taskdeck.sln -c Release --no-restore\n\n - name: Install and build frontend\n working-directory: frontend/taskdeck-web\n run: |\n npm ci\n npx vite build\n\n - name: Build container images\n run: |\n docker build -f deploy/docker/backend.Dockerfile -t taskdeck-api:${{ steps.resolve-tag.outputs.tag }} .\n docker build --build-arg VITE_API_BASE_URL=/api -f deploy/docker/frontend.Dockerfile -t taskdeck-web:${{ steps.resolve-tag.outputs.tag }} .\n\n - name: Verify compose configuration\n run: |\n",{"_663":1122,"_645":1123,"_624":625,"_647":631},1785121982865,{"_685":1120,"_686":1124,"_688":1125,"_690":691,"_629":32,"_692":32,"_42":1126,"_694":1127,"_696":697,"_638":114,"_93":698},"/bin/bash -lc \"find scripts -maxdepth 3 -type f \\\\( -name '*.test.mjs' -o -name '*.spec.mjs' \\\\) -print | head -30; rg -n \\\"import.meta.url|pathToFileURL|node:test|mkdtemp\\\" scripts -g '*.mjs' | head -100; sed -n '1,100p' .github/workflows/cd-staging-gate.yml\"",[1128,1129,1130],"exec-45778c4c-602e-45c5-aad1-9872a1af3cd2","44266",{"_686":1137,"_256":1135,"_1002":1138,"_93":1004},{"_686":1134,"_256":1135,"_1002":1136,"_93":1004},{"_686":1131,"_368":1132,"_256":1133,"_93":1007},"sed -n '1,100p' .github/workflows/cd-staging-gate.yml","cd-staging-gate.yml","/workspace/Taskdeck/.github/workflows/cd-staging-gate.yml","rg -n 'import.meta.url|pathToFileURL|node:test|mkdtemp' scripts -g '*.mjs'","scripts","import.meta.url|pathToFileURL|node:test|mkdtemp","find scripts -maxdepth 3 -type f \"\\\\(\" -name '*.test.mjs' -o -name '*.spec.mjs' \"\\\\)\" -print","*.test.mjs",{"_645":1140,"_624":625,"_647":631},{"_669":1114,"_42":1141,"_705":1142,"_652":1143,"_368":708,"_709":-5,"_638":114,"_93":710},"ctc_0ca5cfbf71c2b2e6016a66ccbd097881908d21c2e7d7c0d581","const r = await tools.exec_command({cmd:\"find scripts -maxdepth 3 -type f \\\\( -name '*.test.mjs' -o -name '*.spec.mjs' \\\\) -print | head -30; rg -n \\\"import.meta.url|pathToFileURL|node:test|mkdtemp\\\" scripts -g '*.mjs' | head -100; sed -n '1,100p' .github/workflows/cd-staging-gate.yml\",\"workdir\":\"/workspace/Taskdeck\",\"yield_time_ms\":10000,\"max_output_tokens\":10000}); text(r.output);\n",{"_657":631},{"_645":1145,"_624":625,"_647":631},{"_648":-5,"_713":1146,"_42":1147,"_652":1148,"_717":1149,"_93":719},"gAAAAABqZsy9PId8V00ILsDZiBv5UOyw2k7YijOU8_zKpbmRLA_YWU7nXzGQi87-gihXsgY8kptU3vE56tLcOHKlLcfdBhUyrrOnPukH2gnGZtnpXaBSDP58vwex2enPruxObZIN5FyraA1N3cCKKDXXFyYbKOJAXKf_U77CflTVp_p2A2xJkAZQ_evnsGG8Elkl082sGCElAkkA6NMS9QhKbUVg6AY7Q4ov_20rTfYjeW04MiTU5Zv0TSPmWvwgjaLJ-2chbQQy9uyfxQ_tSzpmonq5_0O9PzpP-_wFtDDkic8W3VeNVTY4dlIwqtM2aeazRMbQ_3LMR5ggLPZoEKIege_q1RGuub9_72I8SWVmNzH-0lingBDodD8W6G0Qz5jko9uD2MHWScDdMIn7zTyaUd21k-sI3bnNHcdVEqVT1u8Nb0gINhYLJ6H7wvSmk-AEnrrCN2F3CNgSG56fmo9SDnskSizfLFCjpBm3TJmraptAoHRw0ZcB1Vg6QvXQBTPoGFP2BwNKr8Gv1tXDIWjYj0AFc5C34-ShSLUQIdic0_-vClgJEcQn_7btw5PjToNqU9_h0XQVsZRSGii5hYyudwsS53xCcmId1P8bT0XOoiB3UseBPcWRzwsinwTupoxZwrULU7CiD3VMUnv7WPLg-SwmUiEfObRW4RbUpGI51y9XuG_lTGLldGnxwSefaNESAMWn12AhdUBxs3TVunq4oXd12j26Acxb7iRGQh53R274Q2TbMqxnfDtn37xCZGK05BLd19Luvs2N4q1kdILcLOdkhDfLflcoBnBRmB-PX_IGlTZbk7boGymNdTOJ0lJsmCw-42G7Hfx8n_dwrOXJLtM18FwHTJ0nUn_U96OSexy1mJmvHx0tVbtLuXiY3-e1l7EIWAp7x2eV2nq7n6gIxypG8VALhrZJGqXM4KvvjMxnuRiob19YxPoufsdJhI1CCrj0w7jTz2FsHqr0iVCRC1yqV3XjInHpitUVfyD1amVuCrqr9-oGUAQ0WyDyRGzRZTSZaRycDaJA2wLeu6kWET4AEwcB8TTtgMEkH3IQI1Cb_uV4iHKZ4sug7OSJnUiErku_KPBgFMV6mVuSzzFkIvlfmVUEPbR8YakRA4u73opUimaKr0jMD_PEnbL1dBwWJZ6MSNw_VHunbn8M7oZ0VvY-buXmwLU2OSxZFA001aj-FcQP5LW4yZaNYx3Hv8A7Z2W_3lZmAcpv1JXZlHqid5Y_Nr0UhGCHQc6uQWeoOSHGE7xfsAD5v4LLRp9DtvcvvdedmTIByzsyO047xv7oahstpZWGQg7l5wefsauR5_7SUnCa1UbtCpc0qmqix4n1wVSfjZTPs2Zj-hCqtBionCHen2AvXiq1YO-ZnKQDTLbcsdJn1wAujEzpqnmh2WncxCbXXpu9","rs_0ca5cfbf71c2b2e6016a66ccbad2c481908b7da1c961a147aa",{"_657":631},[1150],{"_46":1151,"_93":722},"**Planning refactor and test additions**",{"_663":1153,"_645":1154,"_624":625,"_647":631},1785121981101,{"_648":1155,"_42":1147,"_717":1156,"_93":719},[],[1151],{"_645":1158,"_624":625,"_647":631},{"_669":1159,"_42":-5,"_652":1160,"_368":-5,"_672":1161,"_93":674},"call_57EFkSgR0MtCFvtXx6bwgY50",{"_657":631},{"_501":1162,"_676":-5},[1163,1164],{"_46":787,"_93":680},{"_46":1165,"_93":680},"#!/usr/bin/env node\n\nimport { access, readFile } from 'node:fs/promises'\nimport { constants as fsConstants } from 'node:fs'\nimport { resolve } from 'node:path'\n\nconst errors = []\n\nconst requiredIssueTemplateFiles = [\n '.github/ISSUE_TEMPLATE/bug_report.md',\n '.github/ISSUE_TEMPLATE/feature.md',\n '.github/ISSUE_TEMPLATE/security_hardening.md',\n '.github/ISSUE_TEMPLATE/tech_debt_refactor.md',\n]\n\nconst allowedTemplateLabels = new Set([\n 'bug',\n 'security',\n 'hardening',\n 'backend',\n 'frontend',\n 'ux',\n 'testing',\n 'docs',\n 'refactor',\n 'tech-debt',\n 'starter-packs',\n 'llm',\n 'feature',\n 'automation',\n 'worker',\n 'performance',\n])\n\nconst deprecatedTemplateLabels = new Set([])\n\nasync function fileExists(path) {\n try {\n await access(resolve(path), fsConstants.F_OK)\n return true\n } catch {\n return false\n }\n}\n\nfunction parseLabelsFromFrontMatter(markdown, path) {\n const frontMatterMatch = markdown.match(/^---\\r?\\n([\\s\\S]*?)\\r?\\n---/)\n if (!frontMatterMatch) {\n errors.push(`${path} is missing YAML front matter`)\n return []\n }\n\n const frontMatter = frontMatterMatch[1]\n const labelsLine = frontMatter.match(/^\\s*labels:\\s*\\[(.*)\\]\\s*$/m)\n if (!labelsLine) {\n errors.push(`${path} is missing a labels array in front matter`)\n return []\n }\n\n return labelsLine[1]\n .split(',')\n .map((value) => value.trim().replace(/^['\"]|['\"]$/g, ''))\n .filter((value) => value.length > 0)\n}\n\nasync function validateIssueTemplates() {\n for (const path of requiredIssueTemplateFiles) {\n if (!(await fileExists(path))) {\n errors.push(`Missing required issue template: ${path}`)\n continue\n }\n\n const template = await readFile(resolve(path), 'utf8')\n const labels = parseLabelsFromFrontMatter(template, path)\n\n if (labels.length === 0) {\n errors.push(`${path} must define at least one label`)\n continue\n }\n\n for (const label of labels) {\n if (deprecatedTemplateLabels.has(label)) {\n errors.push(`${path} uses deprecated label \"${label}\"`)\n }\n\n if (!allowedTemplateLabels.has(label)) {\n errors.push(`${path} uses unsupported label \"${label}\"`)\n }\n }\n }\n}\n\nasync function validateIssueTemplateConfig() {\n const configPath = '.github/ISSUE_TEMPLATE/config.yml'\n if (!(await fileExists(configPath))) {\n errors.push(`Missing required issue template config: ${configPath}`)\n return\n }\n\n const configText = await readFile(resolve(configPath), 'utf8')\n if (!/^blank_issues_enabled:\\s*false\\s*$/m.test(configText)) {\n errors.push(`${configPath} must set \"blank_issues_enabled: false\"`)\n }\n}\n\nasync function validateProjectAutomationDocs() {\n if (!(await fileExists('docs/GITHUB_PROJECT_AUTOMATION.md'))) {\n errors.push('Missing required project automation doc: docs/GITHUB_PROJECT_AUTOMATION.md')\n } else {\n const automationText = await readFile(resolve('docs/GITHUB_PROJECT_AUTOMATION.md'), 'utf8')\n const requiredTokens = [\n '`Pending`',\n '`Now`',\n '`Next`',\n '`Blocked`',\n '`Review`',\n '`Done`',\n '`Item added to project`',\n '`Item reopened`',\n '`Item closed`',\n '`Pull request linked to issue`',\n '`Pull request merged`',\n ]\n\n for (const token of requiredTokens) {\n if (!automationText.includes(token)) {\n errors.push(`docs/GITHUB_PROJECT_AUTOMATION.md is missing required token: ${token}`)\n }\n }\n }\n\n if (!(await fileExists('AGENTS.md'))) {\n errors.push('Missing AGENTS.md at repository root')\n return\n }\n\n const agentsText = await readFile(resolve('AGENTS.md'), 'utf8')\n if (!agentsText.includes('docs/GITHUB_PROJECT_AUTOMATION.md')) {\n errors.push('AGENTS.md must reference docs/GITHUB_PROJECT_AUTOMATION.md')\n }\n}\n\nasync function validateParkedStagingGateTriggers() {\n const workflowPath = '.github/workflows/cd-staging-gate.yml'\n if (!(await fileExists(workflowPath))) {\n errors.push(`Missing parked staging workflow: ${workflowPath}`)\n return\n }\n\n const workflowText = await readFile(resolve(workflowPath), 'utf8')\n const lines = workflowText.split(/\\r?\\n/)\n const onIndex = lines.findIndex((line) => line === 'on:')\n if (onIndex < 0) {\n errors.push(`${workflowPath} is missing its top-level on block`)\n return\n }\n\n const triggerLines = []\n for (let index = onIndex + 1; index < lines.length; index += 1) {\n const line = lines[index]\n if (line.length > 0 && !/^\\s/.test(line)) {\n break\n }\n triggerLines.push(line)\n }\n\n const triggerNames = triggerLines\n .map((line) => line.match(/^ {2}([A-Za-z][\\w-]*):\\s*$/)?.[1])\n .filter(Boolean)\n\n if (triggerNames.length !== 1 || triggerNames[0] !== 'workflow_dispatch') {\n errors.push(\n `${workflowPath} is parked and must remain manual-only; expected only workflow_dispatch, found: ${triggerNames.join(', ') || '(none)'}`,\n )\n }\n\n if (workflowText.includes('github.event.release') || workflowText.includes('EVENT_NAME == \"release\"')) {\n errors.push(`${workflowPath} retains unreachable release-event handling after becoming manual-only`)\n }\n}\n\nasync function main() {\n await validateIssueTemplates()\n await validateIssueTemplateConfig()\n await validateProjectAutomationDocs()\n await validateParkedStagingGateTriggers()\n\n if (errors.length > 0) {\n console.error('GitHub operations governance check failed:')\n for (const error of errors) {\n console.error(`- ${error}`)\n }\n process.exit(1)\n }\n\n console.log('GitHub operations governance check passed.')\n}\n\nmain().catch((error) => {\n console.error('GitHub operations governance check crashed:', error)\n process.exit(1)\n})\n\n--- references/tests ---\nrg: package.json: No such file or directory (os error 2)\n.github/workflows/reusable-docs-governance.yml:61: run: node scripts/check-github-ops-governance.mjs\n\n--- checklist target ---\n 85\t- [x] **#1235** — revision-aware proposal diff (preview equals what Apply executes) was delivered by #1280 with regression coverage; the v0.1 ship-gate item is done. *(Checked off 2026-07-25 on the maintainer's explicit instruction — see the rule-3 note in the changelog. GitHub issue #1235 was already closed 2026-07-03.)*\n 86\t- [ ] **#1291** — Adopt agent-harness T3 profile: one-home policy collapse, .codex mirror retirement, skill read-first diet, region maps, review-twin merge, ledger triage cadence. *(Blueprint: sibling checkout `C:/Users/jekyt/source/agent-harness/BLUEPRINT.md` — outside this repo; complements #1138/#1269/#1275/#1276, no duplication.)*\n 87\t- *(Record, already done 2026-07-02:)* re-scope comments posted on #996, #1123/#1139, #1128, #1134 (+#1154 decision), #1135, #1138, #1173, #1175 (+#1174), #1210, #1215, #1222 (+#1227), #1228 — each carries updated finish-or-close ACs.\n 88\t\n 89\t## E. Revival overnight deferrals (added 2026-07-13)\n 90\t\n 91\t- [ ] **#1173** — Apply and verify the required branch-protection settings in GitHub. This is repository-settings work and remains maintainer-only.\n 92\t- [ ] **#1303** — Push the `v0.1.0` release tag only after the maintainer accepts the release deck and its pipeline evidence. Agents may repair the pipeline but must not push the tag.\n 93\t- [ ] **#1482 — Taskdeck name, pre-commercial legal residuals.** *(Supersedes the old \"#1299 trademark check\" line: #1299 shipped with PR #1337 on 2026-07-25 and its AC4 search + cost + recommendation are recorded on the issue.)* What remains is genuinely legal and none of it blocks the free beta: an **attorney registrability opinion** for Classes 9/42 asking about *descriptiveness* (not just conflict), a read on **TASKADE** (live, incontestable US Cl. 42 mark covering task management), the UKIPO/EUIPO coverage gaps (UKIPO hard-blocked automated access, so all GB data is indirect), perishable namespace reservations, and the **keep-or-rename decision before `v0.1.0` (#1303)** — renaming is nearly free pre-tag and expensive after.\n 94\t- [ ] **#1458 project-priority data cleanup — delivered; maintainer record check-off pending.** All 130 formerly unlabeled Taskdeck Issues were classified and verified, the reviewed project-field Apply succeeded 141/141, and the built-in plus three fresh complete audits proved 1,472/1,472 items with zero remaining Priority drift. PR #1488 merged; issue #1458 and both project items are `Done / Priority I`. The checkbox remains open because only the maintainer checks off this file.\n 95\t- [ ] **#1330** — Repair the CI Extended reusable-workflow permission contract; affected PRs remain ineligible while the workflow startup failure is red.\n 96\t- [ ] **#1282 / #1332 / #1335** — Stabilize the required full-suite harness: SQLite concurrency, Redis connect/dispose, and hosted-worker/presence lifecycle isolation. Narrow passes do not clear the recorded full-suite failures.\n 97\t- [ ] **#1338** — Map HTTP MCP and its API-key middleware to the same `/mcp` route before documenting or exposing HTTP transport; the current parameterless mapping serves MCP at an unintended unauthenticated root route.\n 98\t- [ ] **#1343** — Prevent late Home/Today summary responses from overwriting a newer local workspace-mode choice; add deterministic ordering tests and repeated error-recovery E2E proof.\n 99\t- [ ] **#1345 maintainer record check-off** — The code now centrally pins the matched SQLitePCLRaw 2.1.12 family, loads SQLite 3.53.3, enforces the advisory's >= 3.50.2 runtime floor, clears the solution vulnerability audit, preserves the EF model, and passes a self-contained `win-x64` health smoke. The implementation is complete; this checkbox remains human-owned.\n 100\t- [ ] **#1274 / `origin/issue-1274/paper-e2e-axe` at `993f188f`** — Resume the parked Paper E2E/axe re-point from the pushed WIP branch; fix tracked Paper Review blockers #1347/#1348, finish the named first-run/onboarding/smoke and axe coverage, then run the full frontend/E2E gates before opening a PR.\n 101\t- [ ] **#1347 / #1348** — Repair the Paper deep-review enum wire-contract crash and the SQLite-backed similar-past HTTP 500; both were reproduced by the real Paper capture/review path and must not be hidden by frontend fallbacks.\n 102\t- [ ] **#1323 prompt-rail remainder** — Bind the hostile transcript/PDF/image and malformed-response fixtures from PR #1340 to PR #1312's effective prompt/parser path before GEN-04; prove grounded-task-or-empty verdicts and deterministic fallback for schema escapes.\n 103\t- [ ] **#1456 / PR #1457 — Codex deny-floor adapter T4 gate.** **Do not run the posted `/hooks` canaries yet.** The 2026-07-26 audit found red DCO on all four commits, no substantive review of the current head, material drift behind `main`, a v1.6.5 pin behind the installed/producer v1.6.12 floor, and unresolved root/common-directory hook discovery. First repair and synchronize the branch, settle the exact reviewed dispatcher bytes and authoritative hook source, then rerun exact-head CI and two adversarial reviews. Only after those prerequisites may the maintainer trust the project hook in a fresh interactive `/hooks` session and record allow/deny canaries; no agent can perform or substitute for that final gate.\n 104\t- [ ] **Prune the merged agent worktrees.** `git worktree remove` is blocked by the deny floor, so this is human-only and recurs after every wave (upstream: [agent-harness#41](https://github.com/Chris0Jeky/agent-harness/issues/41)). *(Added 2026-07-25.)*\n 105\t\n 106\t ```bash\n 107\t cd /c/Users/jekyt/source/Taskdeck\n 108\t git worktree remove .worktrees/claude-model-routing-canon # docs/model-routing-canonical-pointer\n 109\t git worktree remove .worktrees/claude-sweep-0725 # docs/sweep-2026-07-25\n 110\t git worktree remove .worktrees/codex-1299-licensing-pack # issue-1299/licensing-pack — merged as PR #1337\n 111\t git worktree remove .worktrees/codex-1345-sqlite-native-patch # issue-1345/sqlite-native-patch — merged as PR #1486\n 112\t git branch -d docs/model-routing-canonical-pointer docs/sweep-2026-07-25 issue-1299/licensing-pack issue-1345/sqlite-native-patch\n 113\t ```\n 114\t\n 115\t All four are clean and fully merged into `main`. **Keep** `.worktrees/codex-1456-codex-deny-floor-adapter` (PR #1457 is still open) and `.worktrees/codex-1458-project-priority-pagination` (active #1458 work).\n\n--- recent log ---\naf8bbee (HEAD -> work) Address staging gate review findings\n1ec1743 Sync manual staging gate documentation\n948d570 Disable automatic staging gate release trigger\n2f62c8c Record completed priority cleanup\n8467497 Merge pull request #1488 from Chris0Jeky/issue-1458/project-priority-pagination\ne78a6ef Reconcile project priority cleanup state\nabd820f Document external priority references\n3a221a6 Gate project priority audit in CI\n\n--- remotes ---\n",{"_663":1167,"_645":1168,"_624":625,"_647":631},1785121976939,{"_685":1165,"_686":1169,"_688":1170,"_690":691,"_629":32,"_692":32,"_42":1171,"_694":1172,"_696":697,"_638":114,"_93":698},"/bin/bash -lc \"sed -n '1,260p' scripts/check-github-ops-governance.mjs; printf '\\\\n--- references/tests ---\\\\n'; rg -n \\\"check-github-ops-governance|staging gate|workflow_dispatch.*only|release: \\\\{\\\" scripts .github package.json frontend backend -g '*test*' -g '*.mjs' -g '*.yml' -g '*.yaml' -g 'package.json'; printf '\\\\n--- checklist target ---\\\\n'; nl -ba OUTSTANDING_TASKS.md | sed -n '85,115p'; printf '\\\\n--- recent log ---\\\\n'; git log --oneline --decorate -8; printf '\\\\n--- remotes ---\\\\n'; git remote -v\"",[1173],"exec-3def6d9d-9a0c-4302-81e6-1c9ba57b16e6","19610",{"_686":1174,"_93":701},"sed -n '1,260p' scripts/check-github-ops-governance.mjs; printf '\\n--- references/tests ---\\n'; rg -n \"check-github-ops-governance|staging gate|workflow_dispatch.*only|release: \\{\" scripts .github package.json frontend backend -g '*test*' -g '*.mjs' -g '*.yml' -g '*.yaml' -g 'package.json'; printf '\\n--- checklist target ---\\n'; nl -ba OUTSTANDING_TASKS.md | sed -n '85,115p'; printf '\\n--- recent log ---\\n'; git log --oneline --decorate -8; printf '\\n--- remotes ---\\n'; git remote -v",{"_645":1176,"_624":625,"_647":631},{"_669":1159,"_42":1177,"_705":1178,"_652":1179,"_368":708,"_709":-5,"_638":114,"_93":710},"ctc_0ca5cfbf71c2b2e6016a66ccb5739c81909896602a7a83b18c","const r = await tools.exec_command({cmd:\"sed -n '1,260p' scripts/check-github-ops-governance.mjs; printf '\\\\n--- references/tests ---\\\\n'; rg -n \\\"check-github-ops-governance|staging gate|workflow_dispatch.*only|release: \\\\{\\\" scripts .github package.json frontend backend -g '*test*' -g '*.mjs' -g '*.yml' -g '*.yaml' -g 'package.json'; printf '\\\\n--- checklist target ---\\\\n'; nl -ba OUTSTANDING_TASKS.md | sed -n '85,115p'; printf '\\\\n--- recent log ---\\\\n'; git log --oneline --decorate -8; printf '\\\\n--- remotes ---\\\\n'; git remote -v\",\"workdir\":\"/workspace/Taskdeck\",\"yield_time_ms\":10000,\"max_output_tokens\":30000}); text(r.output);\n",{"_657":631},{"_645":1181,"_624":625,"_647":631},{"_648":-5,"_713":1182,"_42":1183,"_652":1184,"_717":1185,"_93":719},"gAAAAABqZsy1QTGNgLXoDdJW07f3WIQu4iAR_LOGeTlsqy58GEeARuaNMsLN6cLccMMapyhmEUyvhzWElZmHWrcjP8kvUOsBM1VPn1ULf2aS5d4aYrwnuS6HQWUZ7QTf6Gw97gXqUCXw5q2OxXcD2HLP_dI02HWiPQK97ejS39h63plw5xV72WnSg8d_OhWHb-YDVipK_ZwPWBCxTGm0NN0cLv_4pifRpY9jybLwGiajhX5pVnDJu-Q8BMaxIW8pe0VFoTnCmhDp0xFlnhWNAS_v7zNkiVHauFJE7GR-LKoK8PHaozgNIQH4NtSN9tZDTYyr1k0i0420dzBKsRbzeAAmRZJN9-fsCVot1qr1O6IwNm3fcn0bbSTGNa9ovAK7GgNJGtouAqIKrw9JtlJ1pZrIIsmbLnlIkeOpgq4kmD4xqfXYTEOM1c2LSgKCmST4mbzouU-hIjQsktofGePc8alN3lAKpVQFr93c0o6ivk8H1K83ujgtS6LU5TylJYNhr43gmrNfuwa9_bJI5Ui_cs0TAX-kNnj-hu9j-uyFUjpRD3xaqCqx2yR0JGhXVsDa6GtxAp3z1R569DFrF0vtbxlL5Ts7CnPXn8yiNfUVDU_Jf7O5YqE6oENcsTMxkXR6ljVVFTg57Rc_o9FsfMQ5_c9y8ZVnyX7vKX0kz7mCBF1jQx10PXCefIX2ZZ8ITMsxkCwJA9cF6DEqXVxUqpumLTdh1NN99JUB7hAwwkml0gWAOarmuxgaz6nLx_q2pq9jvcQ-oP0almFCh_GoLXsfTCLok4zOT5XLb8wNjgJyb1sWsVYzG6_Nldx6HRCtEY-09E6g4PZrKcNEorSHmSM6STEdk54uevKyohm22sFBCU1wI8P2XkPoMT8C0jtTGShEK07h-DMsoIN9fuxDW1EL8gOQzLIgwGSP75Nq2moGb7HyXjsQOuO4iidhZ7pPXP_sFrnVsg8U7lL8JJ6jJ-cAX5TdpVXnZ1EbcfgbC81Z4at85qeTCI2Q1x3c_ZAlMA4GuoydpotAzQZX","rs_0ca5cfbf71c2b2e6016a66ccb4bbec81909d69a22bffc49b84",{"_657":631},[1186],{"_46":1187,"_93":722},"**Inspecting checker and test existence**",{"_663":1189,"_645":1190,"_624":625,"_647":631},1785121973478,{"_648":1191,"_42":1183,"_717":1192,"_93":719},[],[1187],{"_645":1194,"_624":625,"_647":631},{"_669":1195,"_42":-5,"_652":1196,"_368":-5,"_672":1197,"_93":674},"call_1S8ClZygDM7zmQYo4dwsjweE",{"_657":631},{"_501":1198,"_676":-5},[1199,1200],{"_46":1202,"_93":680},{"_46":1201,"_93":680},"Warning: truncated output (original token count: 50028)\nTotal output lines: 1902\n\nWarning: truncated output (original token count: 180730)\nTotal output lines: 5788\n\n# Outstanding Tasks\n\n**Purpose:** a durable, human-owned checklist of work the maintainer (Chris) wants to keep visible across sessions and agents, so nothing is forgotten between context resets.\n\n**Rules for agents (Claude, Codex, etc.):**\n1. **Read this file at the start of every session** (it is referenced from `CLAUDE.md` and `AGENTS.md` and the SessionStart hook).\n2. **Surface the open items** whenever you give a summary, status update, handoff, or \"what's next\" — list the open (`[ ]`) tasks with their IDs so the maintainer is reminded.\n3. **Only clear/check a task when the maintainer explicitly says it's done.** Do not auto-complete items just because a related PR was opened or you think it's finished. When told an item is complete, change `[ ]`→`[x]` (or remove it) and note the date in the changelog at the bottom.\n4. **Add new outstanding tasks here** when the maintainer asks you to remember something, or when substantial work is deferred. Keep entries short with a one-line \"how\" and a link to the GitHub issue/PR that holds the detail.\n5. Keep this file lean and scannable. Detail lives in the linked issues, not here.\n\nLast reviewed: 2026-07-13\n\n---\n\n## A. Merged PRs (confirmed by post-audit sweep 2026-05-31)\n\n- [x] **PR #1143** — Test loop: `npm test`→`vitest run` + stabilize the MetricsView flake. *(merged 2026-05-31)*\n- [x] **PR #1144** — Docs truth: STATUS↔TESTING_GUIDE contradiction, RFAI spine, broken links. *(merged 2026-05-31)*\n- [x] **PR #1145** — Release scripts aligned with CI flags + stale PKG-01 warning removed. *(merged 2026-05-31)*\n- [x] **PR #1146** — Proposal create returns 409 (not 500) on duplicate idempotency key. *(merged 2026-05-31, closes #1125)*\n- [x] **PR #1147** — `AsSplitQuery` on the multi-collection board read. *(merged 2026-05-31)*\n- [x] **#1126** — Un-skip INV-10/11/12 roadmap-invariant tests with real service assertions. *(PR #1153, merged 2026-05-31)*\n- [x] **#1134** (first slice) — Surface swallowed audit-log failures via shared `AuditLogWriter`. *(PR #1155, merged 2026-05-31)*\n\n## B. Next easy wins (seeded, not yet started)\n\n- [ ] **#1133** (rest) — Bound `NotificationRepository` paging (push ORDER BY+LIMIT to SQL), incremental SignalR board patch instead of full 3-call refetch, FTS-backed card search.\n\n## B2. Surfaced by post-audit correctness sweep (2026-05-31)\n\n- [ ] **Cohort metrics stub** — `AutomationMetricsController.GetCohortMetrics` returns empty data; `CohortDashboard` frontend is wired but always shows \"No cohort data available.\" *How:* build `ICohortMetricsService` with real cohort aggregation once learning-loop data layer design is decided. Tracked in #1142.\n- [ ] **Ollama real streaming** — `OllamaLlmProvider.StreamAsync` does pseudo-streaming (complete-then-drip-by-word). *How:* consume Ollama's `stream:true` API for genuine token streaming when Ollama provider goes beyond prototype.\n- [ ] **#1134 remaining acceptance criteria** — first slice (AuditLogWriter) shipped; 6 remaining criteria still open on the issue.\n\n## C. Strategic / larger tracks (seeded under tracker #1142)\n\n- [ ] **#1123** — v0.1.0 release: a **required revival Phase-1 ship-gate item** under ADR-0044/REVIVAL-07. Exercise the release pipeline, smoke-run the self-contained exe, publish the GHCR image, and fix the documented release-path breakage before strangers are invited. The release smoke step already landed in `release-desktop.yml`. *(Optional-archive framing from 2026-06-13 is superseded.)*\n- [ ] **#1132** — Make the required PR gate enforce security: gitleaks/SAST/dependency scan + CORS fail-closed + single ≥32 JWT floor + global `FallbackPolicy` + bundle-size in the required lane.\n- [x] **#1130** — SQLite local concurrency: enable WAL + `busy_timeout`, fix per-process `Migrate()` race (UI + MCP + CLI share one DB → `SQLITE_BUSY`). *(closed 2026-06-05; ACs 1+3 shipped in PR #1165 / da764b92. AC2 cross-process `Migrate()` serialization → #1164; export/import redesign → #1166.)*\n- [ ] **#1131** — CLI hardening: fresh-machine bootstrap (it crashes without `Connectors:EncryptionKey`) + route CLI mutations through board-access authorization.\n- [x] **#1124** — Core-loop polish: false-green expiry regression test (now asserts a real 409) + #678 dismiss gap (Approved+expired) + #680 provenance-404 console noise. *(closed 2026-06-05; all three fixed in PR #1162 / 77162b2d. Paper-view dismiss affordance → #1161.)*\n- [x] **#1161** — Paper review dismiss affordance (carries #1124's Paper remainder; maintainer 2026-06-05: take it, design-first — propose the affordance before building). *(Maintainer check-off 2026-06-19; delivered via PR #1219, **merged 2026-06-19**; issue #1161 closed.)*\n- [x] **#1164** — Serialize cross-process `Database.Migrate()` (advisory/single-owner lock; carries #1130 AC2). *(Maintainer check-off 2026-06-19; closed on GitHub via PR #1186 / SerializedMigrator.)*\n- [ ] **#1166** — Harden dev-sandbox export/import via the SQLite backup API (carries #1130's export/import follow-up).\n- [ ] **#1138** (rest) — Split the 1300+ line `STATUS.md` into a lean current-reality head + `docs/archive/status-history/`; add a rotation rule; recertify TESTING_GUIDE totals from a green CI run; add a markdown link-checker to nightly.\n- [ ] **#1136** (remainder) — ADR decision **delivered** (ADR-0038, Paper canonical / Legacy frozen; STATUS states the canonical stack) via PR #1207. **Still open:** remove/quarantine the dead paper composables (AC3) — scheduled for the Paper polish wave.\n- [ ] **#1137** — Refocus strategy/roadmap. ADR-0044 + `docs/REVIVAL_PLAN.md` now provide the revival direction and finite wave; pending maintainer check-off after the canonical-doc sync is merged. The 2026-06-13 archive framing is retained only as the checkpoint fallback.\n- [ ] **#1135 / #1140 / #1141 / #1139** — Code-health guardrails + oversized-view decomposition; workspace hygiene + one-command dev-up; i18n/a11y ADR; deployment docs (docker quickstart secret, desktop run docs). *(2026-06-19: **#1135 partial** — paper-night straggler tokens (PR #1216) — checked off by maintainer; guardrail/decomposition half + #1140/#1141/#1139 remain open.)*\n\n> Full audit context and the complete gap inventory: **GitHub issue #1142** (master tracker).\n\n## F. Generalist expansion wave (2026-07-13, ADR-0046 Proposed — extends §E as REVIVAL_PLAN Phase 4)\n\nDecision under ratification: **extend the single app** (artefact intake beyond transcripts, project dossiers, generalist legibility, friends-family channel); the twin generalist app is **deferred behind the GEN-12 evidence gate**, not built. Wave label `generalist`; strictly subordinate to the v0.1 ship gate.\n\n- [ ] **GEN-00 tracker (#1327)** — ratify ADR-0046 + Phase-4 placement + the tracker's decision checklist (SQLite blob storage, consent-gated vision MVP, twin-app deferral). Child issues: #1315–#1326 (GEN-01..12).\n- [ ] **Maintainer at checkpoint:** review GEN-12 (#1326) twin-app gate against friends-family signal (GEN-11 #1325) — recorded decision required, silence is not a close.\n\n## E. Revival wave (2026-07-10 pivot, ADR-0044 — supersedes the archive framing of §D)\n\nDirection: **free open beta → commercial horizon** (`docs/REVIVAL_PLAN.md` is the planning spine; `docs/analysis/2026-07-10_revival_assessment.md` is the evidence base). §D items are re-scoped in place — same work, new purpose (v0.1 ship gate instead of archive gate). Issue IDs below are seeded as the REVIVAL wave; see the tracker for the authoritative list.\n\n- [ ] **REVIVAL-00 tracker (#1311)** — charter + v0.1 ship-gate ratification (amends #1278); wave sequencing. Child issues: #1297–#1310 (REVIVAL-01..14); docs PR: #1296.\n- [ ] **Phase 0 — dogfooding starts now** (#1271, unchanged): real personal use including WhisperX transcripts through the existing transcript capture tab.\n- [ ] **Phase 1 — truth + safety before strangers**: registration gating flag; remove the fake undo timeline; de-stub Today dossier (#1272); Paper fonts + favicon; Paper onboarding/first-board path; README revival rewrite + demo GIF + MCP section; v0.1.0 tag → exercise release pipeline → GHCR image; fix render.yaml; branch protection (#1173); CI keep/kill (#1275); Paper E2E/axe re-point (#1274).\n- [ ] **Phase 2 — transcript engine** (authorized new-surface exception): LLM triage strategy behind `ICaptureTriageService` for transcript sources; chunking + cap raise; triage schema v2 (type/assignee/due + model-derived confidence); Transcript entity + evidence spans; OpenAICompatible provider + true SSE streaming; risk-tiered review prioritization and batch-confirm ergonomics (**never auto-apply or bypass ADR-0003's approve-then-execute gate**); (2b, gated on dogfooding value) audio upload + WhisperX sidecar.\n- [ ] **Phase 3 — slim + launch**: dead-surface amputation (#1276 expanded); MCP packaging + scoped keys + hash-pin wiring (#1154) + explicit multi-user-safe stdio identity (#1309); privacy-respecting beta feedback channel; launch checklist (r/selfhosted, Show HN, awesome-selfhosted, hosted demo).\n- [ ] **Checkpoint (~8 weeks)**: fall back to the §D archive plan only if there is no organic traction **and** dogfooding has not stuck; any mixed outcome requires an explicit maintainer assessment/plan amendment.\n\n## D. Historical archive closeout wave — re-scoped by ADR-0044\n\nAnalysis docs: `docs/PROJECT_TRAJECTORY.md` (strengths + path) and `docs/COURSE_CORRECTION.md` (what must change + ordered plan). These issue titles retain their ARCHIVE-* history, but **nothing in this section independently authorizes archival**: ADR-0044 re-scopes the still-useful work into the revival ship gate and keeps archive only as the checkpoint fallback. Wave source: **#1278** (originally ARCHIVE-00; amended by REVIVAL-00/#1311).\n\n- [ ] **#1278** — originally ARCHIVE-00; now the **v0.1 ship-gate source** amended by REVIVAL-00/#1311: ratify the repurposed exit criteria and revival additions, then use archive only if ADR-0044's checkpoint condition is met. *(Maintainer decision.)*\n- [ ] **#1269** — ARCHIVE-01: codify the two-tier review gate (LIGHT/FULL), issue-intake severity bar, no-new-backend-surface rule.\n- [ ] **#1270** — ARCHIVE-02: backlog triage hour — close ~16 already-decided issues with dated pivot notes. *(Maintainer sign-off on the list.)*\n- [ ] **#1271** — ARCHIVE-03: dogfooding sprint — ≥10 days of real personal use (the pivot's acceptance test; cannot be delegated).\n- [ ] **#1272** — ARCHIVE-04: Today dossier truth — de-stub the fabricated default daily surface (`useTodayDossier.ts` buildStubDossier).\n- [x] **#1273** — capture-triage provenance names the deterministic extractor, delivered by #1283; the v0.1 ship-gate item is done. *(Checked off 2026-07-25 on the maintainer's explicit instruction — see the rule-3 note in the changelog. GitHub issue #1273 was already closed 2026-07-03.)*\n- [ ] **#1274** — ARCHIVE-06: re-point E2E + axe coverage at the Paper UI (currently the least-tested UI).\n- [ ] **#1275** — ARCHIVE-07: CI estate right-sizing — keep/kill/gate per lane + short ADR (nightly red 28 days; mutation red 10+ weeks).\n- [ ] **#1276** — ARCHIVE-08: dead-surface removal — ink-bleed decision, orphaned Paper code, cohorts stub, voice capture, Ollama marking.\n- [ ] **#1277** — originally ARCHIVE-09; now the revival checkpoint/fallback record. Beta-facing README, release tag, and ship-gate checks live in REVIVAL-06/07/14; archive-only edits wait unless ADR-0044's checkpoint condition is met.\n- [x] **#1235** — revision-aware proposal diff (preview equals what Apply executes) was delivered by #1280 with regression coverage; the v0.1 ship-gate item is done. *(Checked off 2026-07-25 on the maintainer's explicit instruction — see the rule-3 note in the changelog. GitHub issue #1235 was already closed 2026-07-03.)*\n- [ ] **#1291** — Adopt agent-harness T3 profile: one-home policy collapse, .codex mirror retirement, skill read-first diet, region maps, review-twin merge, ledger triage cadence. *(Blueprint: sibling checkout `C:/Users/jekyt/source/agent-harness/BLUEPRINT.md` — outside this repo; complements #1138/#1269/#1275/#1276, no duplication.)*\n- *(Record, already done 2026-07-02:)* re-scope comments posted on #996, #1123/#1139, #1128, #1134 (+#1154 decision), #1135, #1138, #1173, #1175 (+#1174), #1210, #1215, #1222 (+#1227), #1228 — each carries updated finish-or-close ACs.\n\n## E. Revival overnight deferrals (added 2026-07-13)\n\n- [ ] **#1173** — Apply and verify the required branch-protection settings in GitHub. This is repository-settings work and remains maintainer-only.\n- [ ] **#1303** — Push the `v0.1.0` release tag only after the maintainer accepts the release deck and its pipeline evidence. Agents may repair the pipeline but must not push the tag.\n- [ ] **#1482 — Taskdeck name, pre-commercial legal residuals.** *(Supersedes the old \"#1299 trademark check\" line: #1299 shipped with PR #1337 on 2026-07-25 and its AC4 search + cost + recommendation are recorded on the issue.)* What remains is genuinely legal and none of it blocks the free beta: an **attorney registrability opinion** for Classes 9/42 asking about *descriptiveness* (not just conflict), a read on **TASKADE** (live, incontestable US Cl. 42 mark covering task management), the UKIPO/EUIPO coverage gaps (UKIPO hard-blocked automated access, so all GB data is indirect), perishable namespace reservations, and the **keep-or-rename decision before `v0.1.0` (#1303)** — renaming is nearly free pre-tag and expensive after.\n- [ ] **#1458 project-priority data cleanup — delivered; maintainer record check-off pending.** All 130 formerly unlabeled Taskdeck Issues were classified and verified, the reviewed project-field Apply succeeded 141/141, and the built-in plus three fresh complete audits proved 1,472/1,472 items with zero remaining Priority drift. PR #1488 merged; issue #1458 and both project items are `Done / Priority I`. The checkbox remains open because only the maintainer checks off this file.\n- [ ] **#1330** — Repair the CI Extended reusable-workflow permission contract; affected PRs remain ineligible while the workflow startup failure is red.\n- [ ] **#1282 / #1332 / #1335** — Stabilize the required full-suite harness: SQLite concurrency, Redis connect/dispose, and hosted-worker/presence lifecycle isolation. Narrow passes do not clear the recorded full-suite failures.\n- [ ] **#1338** — Map HTTP MCP and its API-key middleware to the same `/mcp` route before documenting or exposing HTTP transport; the current parameterless mapping serves MCP at an unintended unauthenticated root route.\n- [ ] **#1343** — Prevent late Home/Today summary responses from overwriting a newer local workspace-mode choice; add deterministic ordering tests and repeated error-recovery E2E proof.\n- [ ] **#1345 maintainer record check-off** — The code now centrally pins the matched SQLitePCLRaw 2.1.12 family, loads SQLite 3.53.3, enforces the advisory's >= 3.50.2 runtime floor, clears the solution vulnerability audit, preserves the EF model, and passes a self-contained `win-x64` health smoke. The implementation is complete; this checkbox remains human-owned.\n- [ ] **#1274 / `origin/issue-1274/paper-e2e-axe` at `993f188f`** — Resume the parked Paper E2E/axe re-point from the pushed WIP branch; fix tracked Paper Review blockers #1347/#1348, finish the named first-run/onboarding/smoke and axe coverage, then run the full frontend/E2E gates before opening a PR.\n- [ ] **#1347 / #1348** — Repair the Paper deep-review enum wire-contract crash and the SQLite-backed similar-past HTTP 500; both were reproduced by the real Paper capture/review path and must not be hidden by frontend fallbacks.\n- [ ] **#1323 prompt-rail remainder** — Bind the hostile transcript/PDF/image and malformed-response fixtures from PR #1340 to PR #1312's effective prompt/parser path before GEN-04; prove grounded-task-or-empty verdicts and deterministic fallback for schema escapes.\n- [ ] **#1456 / PR #1457 — Codex deny-floor adapter T4 gate.** **Do not run the posted `/hooks` canaries yet.** The 2026-07-26 audit found red DCO on all four commits, no substantive review of the current head, material drift behind `main`, a v1.6.5 pin behind the installed/producer v1.6.12 floor, and unresolved root/common-directory hook discovery. First repair and synchronize the branch, settle the exact reviewed dispatcher bytes and authoritative hook source, then rerun exact-head CI and two adversarial reviews. Only after those prerequisites may the maintainer trust the project hook in a fresh interactive `/hooks` session and record allow/deny canaries; no agent can perform or substitute for that final gate.\n- [ ] **Prune the merged agent worktrees.** `git worktree remove` is blocked by the deny floor, so this is human-only and recurs after every wave (upstream: [agent-harness#41](https://github.com/Chris0Jeky/agent-harness/issues/41)). *(Added 2026-07-25.)*\n\n ```bash\n cd /c/Users/jekyt/source/Taskdeck\n git worktree remove .worktrees/claude-model-routing-canon # docs/model-routing-canonical-pointer\n git worktree remove .worktrees/claude-sweep-0725 # docs/sweep-2026-07-25\n git worktree remove .worktrees/codex-1299-licensing-pack # issue-1299/licensing-pack — merged as PR #1337\n git worktree remove .worktrees/codex-1345-sqlite-native-patch # issue-1345/sqlite-native-patch — merged as PR #1486\n git branch -d docs/model-routing-canonical-pointer docs/sweep-2026-07-25 issue-1299/licensing-pack issue-1345/sqlite-native-patch\n ```\n\n All four are clean and fully merged into `main`. **Keep** `.worktrees/codex-1456-codex-deny-floor-adapter` (PR #1457 is still open) and `.worktrees/codex-1458-project-priority-pagination` (active #1458 work).\n- [ ] **Branch from an explicit base.** PR #1477 was closed-as-merged without anyone merging it. Root cause: `feat/1271-dogfooding-instrumentation` (PR #1478) was created with a bare `git checkout -b` **while standing on `fix/1123-release-dry-run`**, so it silently inherited `#1477`'s commit `0ebbf330`. Merging #1478 carried that commit onto `main`, GitHub detected `#1477`'s branch as fully merged and auto-closed it two seconds later, attributing the event to the acting token. The single-parent \"rebase\" appearance was GitHub recording the already-landed commit, not a rebase anyone performed. *How:* always name the base — `git checkout -b main` — and verify with `git log --oneline main..` before pushing. *(Added 2026-07-25. Supersedes an earlier item on this list that wrongly framed this as an unidentified autonomous merger — that alert was mine and it was wrong; caught by Codex on PR #1483.)*\n\n---\n\n## Changelog\n- 2026-07-27 (later): **#1458 shipped and the live project is Priority-clean.** The reviewed Apply succeeded 141/141; its built-in audit, two pre-merge fresh audits, and the final post-merge handoff audit each proved 1,472/1,472 items, 12 visible/non-authoritative external references, and zero remaining drift. PR #1488 merged as `84674979`; issue #1458 and both project items are Done/Priority I. The human-owned checkbox remains unchecked pending maintainer record review.\n- 2026-07-27: **#1458 label remediation and external-reference policy supersede the prior checkpoint below.** The 130 missing Taskdeck Issue labels were classified and verified, and a stable 1,472-item audit found 142 remaining project-field drifts. External Issues are now recorded as visible non-authority rather than rejected: their labels never rank, external-only PRs derive `Priority V`, and canonical body fallback remains available after an external closing reference. No project-field `-Apply` had run at this checkpoint; the unchecked item remains pending a rev…40028 tokens truncated…Wave (Delivered 2026-02-24)\n\nTracking issues:\n- wave tracker: `#254`\n- delivered execution: `#255` to `#260`\n\nAlready-covered pack scenarios (no duplicate implementation issue required):\n- WIP limit enforcement already covered across application/API/E2E.\n- sandbox-gated database import/export rejection outside Development already covered.\n- starter-pack idempotency/conflict safety already covered.\n\nKnowledge transfer applied to existing seeds:\n- `#89`: targeted property/fuzz pilot surfaces (manifest/query/import-export boundaries)\n- `#90`: non-blocking scheduled mutation-lane posture\n- `#106`: dependency/security signal command baseline (`dotnet list package --vulnerable`, `npm audit`)\n- `#168`: CI topology routing for OpenAPI/nightly-quality lanes\n\nDelivered outcomes:\n- `#255` removed residual wall-clock flake vectors and centralized reusable E2E polling helpers\n- `#256` locked drag/drop persistence after full reload into Playwright smoke coverage\n- `#257` centralized representative `400/401/403/404/409` API error-contract assertions\n- `#258` added OpenAPI generation + parse-validation artifacts in CI\n- `#259` codified `docs/GOLDEN_PRINCIPLES.md` with lightweight mechanical enforcement\n- `#260` added the non-blocking nightly-quality workflow for coverage and dependency/security signal artifacts\n\nUseful local checks for this wave:\n\n```bash\nrg -n \"Thread\\\\.Sleep|new Promise\\\\(.*setTimeout\" backend/tests frontend/taskdeck-web/tests/e2e\ndotnet test backend/tests/Taskdeck.Api.Tests/Taskdeck.Api.Tests.csproj -c Release --filter \"FullyQualifiedName~ApiErrorContractApiTests\"\n(cd frontend/taskdeck-web && npx playwright test tests/e2e/smoke.spec.ts tests/e2e/automation-ops.spec.ts tests/e2e/capture-loop.spec.ts --reporter=line)\nnode scripts/check-golden-principles.mjs\nnode scripts/check-docs-governance.mjs\n```\n\nOpenAPI guardrail local checks (`#258`):\n\n```powershell\n./scripts/ci/generate-openapi-artifact.ps1 -OutputPath \"artifacts/openapi/taskdeck-api.json\"\n./scripts/ci/validate-openapi.ps1 -SpecPath \"artifacts/openapi/taskdeck-api.json\"\n```\n\nMalformed-output simulation (deterministic parse failure check):\n\n```powershell\n\"not-json\" | Set-Content -Path artifacts/openapi/invalid-openapi.json\n./scripts/ci/validate-openapi.ps1 -SpecPath \"artifacts/openapi/invalid-openapi.json\"\n```\n\nFollow-up intentionally deferred from this issue:\n- snapshot/diff enforcement against a checked-in OpenAPI baseline remains a future enhancement\n- current guardrail scope is generation + parse/shape validation + CI artifact publication\n\n## Outreach CRM Deferred Wave (Planning, 2026-02-23)\n\nTracking issues:\n- wave tracker: `#262`\n- deferred execution: `#263` to `#268`\n\nReuse links (no duplicate implementation issue):\n- `#75` delivered import-adapter foundation for outreach CSV mapping/dedupe profile\n- `#77` analytics model/dashboards for future outreach scoreboard metrics\n- `#175` first-party starter-pack catalog expansion for outreach blueprint inclusion\n\nPlanned quality expectations when implementation starts:\n- YAML front-matter parser round-trip stability tests (contact fields + timeline preservation)\n- cadence scheduling determinism + throughput-control guardrail tests\n- API/UX regression for contact logging and dashboard action loops\n- E2E coverage for outreach loop: import/apply -> contact update -> cadence proposal -> dashboard action flow\n\n## Coverage Map\n\n- Domain invariants:\n - `backend/tests/Taskdeck.Domain.Tests`\n- Application services:\n - `backend/tests/Taskdeck.Application.Tests`\n - Includes board/card/column/label/auth/authorization/board-access/export-import/history/queue plus automation/archive/chat/ops/log services\n - Includes database export/import guardrail coverage (sandbox gating, payload validation, file replacement)\n - Includes external import-adapter parsing and board upsert orchestration coverage (CSV/outreach profile, dedupe policy, rollback safety path)\n - Includes starter-pack manifest parsing/validation, first-party catalog validity, and apply-planning coverage\n - Includes LLM tool-calling orchestrator coverage (multi-turn loop, timeout, round limits) and read tool schema generation\n - Includes GDPR data export service (user-scoped completeness, versioned payload) and account deletion service (re-auth, confirmation phrase, PII anonymization)\n - Includes board metrics service coverage (aggregation, date range, label grouping)\n - Includes MCP board resource coverage (listing, phantom-user fallback, multi-user scoping)\n - Includes integrations registry service coverage (connector CRUD, enable/disable lifecycle, event logging)\n- HTTP contracts and behavior mappings:\n - `backend/tests/Taskdeck.Api.Tests`\n - Includes core + automation/archive/chat/ops/log/health controllers\n - Includes rate-limit policy coverage (`RateLimitingApiTests`) for burst throttling, retry metadata contract, reset-window recovery, and cross-user boundary behavior\n - Includes security-header baseline coverage (`SecurityHeadersApiTests`) for success/auth-failure paths and HTTPS HSTS posture assertions\n - Includes board-scoped external import endpoint coverage (authz, malformed input, duplicate handling, apply/update flow, rollback safety)\n - Includes outbound webhook API and worker coverage (`OutboundWebhooksApiTests`, `OutboundWebhookDeliveryWorkerTests`) for claim/reload handling, cancellation requeue, and non-success HTTP retry/dead-letter branches\n - Includes `ResultExtensions` mapping tests for standardized API error/status behavior\n - Includes integrations controller coverage (7 endpoints: CRUD + enable/disable, auth enforcement)\n- CLI contracts:\n - `backend/tests/Taskdeck.Cli.Tests`\n- Architecture boundaries:\n - `backend/tests/Taskdeck.Architecture.Tests`\n - Enforces project-reference boundaries between Domain/Application/Infrastructure/API projects\n - Enforces source-layer purity via forbidden namespace imports in Domain and Application source trees\n - Enforces API controller boundary invariants:\n - only `AuthController` and `HealthController` may inherit `ControllerBase` directly\n - protected controllers must declare `[Authorize]`\n - Failure remediation:\n - move forbidden dependencies to the correct layer abstraction/interface\n - route protected HTTP surface through `AuthenticatedControllerBase`\n - add/restore `[Authorize]` on protected controller classes\n- Frontend unit behavior:\n - `frontend/taskdeck-web/src/tests`\n - Components, stores, API modules, composables, utilities\n - Includes shared utility tests for `queryBuilder` and `errorMessage`\n - Includes GitHub OAuth API client and session store coverage (`authApi`, `sessionStore`)\n - Includes board metrics API client and store coverage (`metricsApi`, `metricsStore`)\n- End-to-end journeys:\n - `frontend/taskdeck-web/tests/e2e`\n - Includes deterministic starter-pack fixture bootstrap coverage for `small`, `medium`, and `edge` manifest scenarios\n - Includes unauthenticated SignalR negotiate rejection coverage aligned with the runtime client handshake path\n - Includes dedicated multi-session concurrency regression coverage (`tests/e2e/concurrency.spec.ts`)\n - Includes integrated multi-component verification journeys (`tests/e2e/integrated-verification.spec.ts`) — see `docs/testing/INTEGRATED_VERIFICATION_STRATEGY.md`\n - Includes manual validation slice C E2E coverage: `tests/e2e/validation-automation-proposals.spec.ts` (8 tests), `tests/e2e/validation-chat-bootstrap.spec.ts` (9 tests)\n - Includes manual validation slice D E2E coverage: `tests/e2e/validation-ops-logs-health.spec.ts` (17 tests)\n - Includes manual validation slice E E2E coverage: `tests/e2e/validation-starter-packs.spec.ts`, `tests/e2e/validation-archive-recovery.spec.ts`, `tests/e2e/validation-activity-traceability.spec.ts` (23+ tests)\n - Includes integrated verification E2E coverage: `tests/e2e/integrated-verification.spec.ts` (4 tests covering capture-to-board pipeline, board bootstrap, workspace navigation, auth denial)\n- Load and concurrency API profile:\n - `tests/load/k6/board-heavy-load.js`\n - Includes seeded-user board-heavy read/write load mix and threshold-based regression diagnostics\n\n## Integrated Multi-Component Verification\n\nThe integrated verification program ties automated and manual testing into cross-component scenarios that validate subsystem interactions end-to-end.\n\nKey resources:\n- `docs/testing/INTEGRATED_VERIFICATION_STRATEGY.md` — scenario matrix, release gating criteria, automated/manual split\n- `docs/testing/MANUAL_REHEARSAL_TEMPLATE.md` — standard template for manual verification cycles\n- `frontend/taskdeck-web/tests/e2e/integrated-verification.spec.ts` — automated cross-component E2E journeys\n\nThe strategy defines 18 verification scenarios (V-01 through V-18) across 5 subsystem areas. Scenarios are tiered by severity:\n- **Tier 1** (V-01 to V-04): Critical path — must pass for any release\n- **Tier 2** (V-05 to V-10): High-value cross-cutting — must pass for feature releases\n- **Tier 3** (V-11 to V-18): Extended coverage — recommended for major releases\n\n## Manual Verification\n\nUse `docs/MANUAL_TEST_CHECKLIST.md` for action-by-action manual validation.\nUse `docs/ops/OBSERVABILITY_BASELINE.md` for telemetry dashboard/alert baseline and observability smoke validation.\nUse `docs/testing/MANUAL_REHEARSAL_TEMPLATE.md` for structured manual rehearsal cycles with evidence capture.\n\nDetailed step-indexed validation checklists:\n- Slice A — workspace shell, board lifecycle, keyboard UX: `docs/testing/manual-validation-a-workspace-board-ux.md`\n- Slice B — authz policy, cross-user isolation, API error contracts: `docs/testing/manual-validation-b-authz-contracts.md`\n- Slice C — automation proposals, chat bootstrap, execution safety (45 scenarios): `docs/testing/MANUAL_VALIDATION_SLICE_C_SCENARIOS.md`; rehearsal runbook: `docs/testing/MANUAL_REHEARSAL_RUNBOOK_SLICE_C.md`\n- Slice D — ops CLI, log query/correlation, health telemetry (25 scenarios): `docs/testing/MANUAL_VALIDATION_SLICE_D_SCENARIOS.md`; rehearsal runbook: `docs/testing/MANUAL_REHEARSAL_RUNBOOK_SLICE_D.md`\n- Slice E — starter packs, archive recovery, activity traceability (25 scenarios): `docs/testing/MANUAL_VALIDATION_SLICE_E_SCENARIOS.md`; rehearsal runbook: `docs/testing/MANUAL_REHEARSAL_RUNBOOK_SLICE_E.md`\n\nIntegrated verification program:\n- Cross-component verification strategy (18 scenarios): `docs/testing/INTEGRATED_VERIFICATION_STRATEGY.md`\n- Manual rehearsal template: `docs/testing/MANUAL_REHEARSAL_TEMPLATE.md`\n\n## Thesis Alignment Validation (Capture Realignment)\n\nThis section defines validation expectations for the capture-first direction.\n\nCurrent state:\n- capture MVP loop is shipped end-to-end (`#200` to `#211`)\n- capture loop assertions below are required baseline checks for regression safety\n\nRequired assertions:\n- capture action is fast and deterministic (target under 10 seconds to persisted artifact in normal local conditions)\n- triage path stays proposal-first (no direct board mutation from model output)\n- provenance links are visible from proposal/card surfaces back to capture source\n- error and auth contracts remain stable (`ApiErrorResponse`, `401/403/404` policy)\n\nRecommended execution pairing:\n- automated: API + frontend unit + E2E capture loop (`#210` delivered, retained as active regression path)\n- manual: capture friction/trust checks in `docs/MANUAL_TEST_CHECKLIST.md`\n\n## Incident Rehearsals\n\nManual incident rehearsals complement automated tests by validating diagnosis and recovery workflows against realistic failure conditions. Rehearsals are scheduled monthly (lightweight, ~30 min) and quarterly (deep drill, ~2 hours).\n\nKey resources:\n- `docs/ops/INCIDENT_REHEARSAL_CADENCE.md` -- schedule, rotation, and process\n- `docs/ops/rehearsal-scenarios/` -- scenario templates (health degradation, telemetry gaps, deployment failures)\n- `docs/ops/EVIDENCE_TEMPLATE.md` -- evidence package format\n- `docs/ops/REHEARSAL_BACKOFF_RULES.md` -- how rehearsal findings become tracked issues\n- `docs/ops/rehearsals/` -- completed rehearsal evidence packages\n\nRehearsals are distinct from the automated failure-injection drill suite (`docs/ops/FAILURE_INJECTION_DRILLS.md`). Drills are scripted and CI-runnable; rehearsals are human-driven and focus on diagnosis speed, tooling gaps, and recovery muscle memory.\n\n## Development Sandbox Mode\n\nFor local development only, authorization bypass can be enabled via:\n- `backend/src/Taskdeck.Api/appsettings.Development.json`\n- `DevelopmentSandbox.Enabled = true`\n\nSafety boundary:\n- Sandbox bypass is forced off outside Development environment.\n- Validation and data integrity rules still apply.\n\n## Webhook HMAC Signature Verification Coverage (PR #750, delivered 2026-04-04)\n\nTracking issue: `#726`\n\nNew test coverage:\n- `OutboundWebhookHmacDeliveryTests` (11 tests): header format verification (`sha256=<64-hex>`), HMAC round-trip receiver recompute and match, wrong-key rejection, secret rotation produces different signature, body/content-type matching, large payload (100 kB), timing-safe comparison via `CryptographicOperations.FixedTimeEquals`, determinism, key-differ properties\n\nKey adversarial review findings fixed: secret rotation test was testing different subscriptions (not actual rotation on same subscription); BCL-testing assertions replaced with real domain property tests.\n\n## Webhook Delivery Reliability and SSRF Coverage (PR #756, delivered 2026-04-04)\n\nTracking issue: `#710`\n\nNew test coverage across webhook test suite (78 tests total across 9 files):\n- `OutboundWebhookEndpointGuardTests` (Application.Tests): SSRF guard cases covering private IPv4 ranges and endpoint validation\n- `OutboundWebhookServiceTests` (Application.Tests, 19 tests): service-level webhook subscription and delivery orchestration\n- `OutboundWebhookSignatureTests` (Application.Tests, 8 tests): HMAC signature computation and verification\n- `OutboundWebhookDeliveryWorkerTests` (Api.Tests, 8 tests): worker-level delivery scheduling and retry logic\n- `OutboundWebhookHmacDeliveryTests` (Api.Tests, 11 tests): end-to-end HMAC delivery including header format, round-trip, wrong-key rejection\n- `OutboundWebhooksApiTests` (Api.Tests, 10 tests): API endpoint contract for webhook subscription management\n- `OutboundWebhookDeliveryRepositoryTests` (Api.Tests, 3 tests): repository-level delivery persistence\n- `OutboundWebhookDeliveryTests` (Domain.Tests, 8 tests): domain entity state and transitions\n- `OutboundWebhookSubscriptionTests` (Domain.Tests, 7 tests): subscription domain entity\n\nKey adversarial review fix: `HttpClient` resource leaks across 9 test methods.\n\nManual validation recommended: configure a webhook endpoint with a known secret and verify that (a) the `X-Taskdeck-Webhook-Signature` header (alongside `X-Taskdeck-Webhook-Timestamp`) is present and verifiable with HMAC-SHA256, and (b) a webhook targeting `http://localhost/` or `http://10.0.0.1/` is rejected at the SSRF guard.\n\n## Frontend Regression Test Wave (PRs #742–#745, #748, #743, #744, #754, delivered 2026-04-04)\n\nTracking issues: `#683`, `#680`, `#685`, `#686`, `#687`, `#688`\n\nNew test files:\n- `boardStore.wipLimit.spec.ts` (7 tests): WIP-limit toast deduplication regression for `createCard` and `moveCard`; guards against future double-toast introduction\n- `sessionStore.authToast.spec.ts` (20 tests): auth-flow toast lifecycle — login/register/OAuth failure and success toasts, cross-flow isolation, auto-removal independence; uses real `toastStore` backed by fresh Pinia\n- `router/authGuard.spec.ts` (new): auth guard decision table — unauthenticated redirect, expired-token cleanup, authenticated pass-through, deflection from /login when authenticated, demo mode, 12-route exhaustive table\n- `router/workspaceRouteStability.spec.ts` (new): workspace mode persistence across simulated reloads, hydration drift prevention, `resetForLogout` cleanup\n- `InboxView.spec.ts` (+21 tests): single-item triage action states (per status variant), bulk action bar visibility and count, batchBusy disabled state, select-all behavior; all assertions on DOM state\n\nFrontend suite total after this wave: **1592 passing** (up from 1496 pre-wave).\n\n## Feature, Analytics, MCP, Chat, Testing, and UX Wave (PRs #787–#793, delivered 2026-04-08)\n\nTracking issues: `#78`, `#79`, `#249`, `#576`, `#654`, `#705`, `#717`\n\nNew test coverage (~390+ new tests total):\n\n### Backend\n\n- `MetricsExportServiceTests.cs` (21 unit tests + 5 adversarial-review injection tests): CSV structure validation, all 5 sections, CSV injection prevention vectors including embedded newlines\n- `MetricsExportApiTests.cs` (8 integration tests): auth, cross-user isolation, empty board, date range, Content-Disposition headers\n- `ForecastingServiceTests.cs` (32 tests): validation, authorization, edge cases (zero throughput, no done column, single data point, large card counts, bounce deduplication, history-window-vs-span)\n- `ApiKey` domain tests (11 tests): entity construction, SHA-256 hashing, `tdsk_` prefix, revocation, expiration\n- API key integration tests (20 tests): auth, key lifecycle (create/list/revoke), cross-user isolation, MCP endpoint access\n- `ClarificationDetectorTests.cs` (22 tests + 6 false-positive regression): pattern detection, skip phrases, round counting, prompt building, strong/weak signal split\n- `ChatServiceClarificationTests.cs` (7 tests): service-level clarification flow, round enforcement, skip behavior\n- `ConcurrencyRaceConditionStressTests.cs` (13 tests): queue claim races, card conflicts, proposal approval races, rate limiting, multi-user stress\n- `EntityAdversarialInputTests.cs` (77 FsCheck tests): Board, Card, Column, Label, AutomationProposal with adversarial strings, boundary lengths, GUID validation\n- `JsonSerializationRoundTripFuzzTests.cs` (29 tests): serialize/deserialize identity, GUID format variations, DateTime boundaries, malformed JSON\n- `AdversarialInputApiTests.cs` (80 tests): no 500s from adversarial input across all major endpoints, malformed JSON, wrong content types, concurrent adversarial\n\n### Frontend\n\n- `InboxView.spec.ts` (+7 tests): primitive-driven loading/error/empty state assertions, skeleton detection, retry button\n- `inputSanitization.spec.ts` (16 fast-check tests): card titles, search queries, board names, chat messages, URL encoding, JSON round-trip, Unicode edge cases\n- `storeResilience.spec.ts` (9 fast-check tests): random action sequences on board store, API error handling, adversarial content\n\n### Dependencies added\n\n- Backend: `FsCheck` and `FsCheck.Xunit` (for property-based testing, extending existing pattern)\n- Frontend: `fast-check` (dev dependency, for property-based testing)\n\n### Key adversarial review findings fixed\n\n- **HIGH**: CSV injection via embedded newlines in export (`#787`), throughput double-counting in forecasting (`#790`), false-positive clarification heuristic (`#791`)\n- **MEDIUM**: Key-existence oracle + modulo bias in API key generation (`#792`), capture DTO round-trip test (`#789`), history window denominator (`#790`), CancellationToken forwarding (`#787`)\n- Fixed test quality issues: misleading doc comments, weak assertions, non-thread-safe variables, redundant ARIA roles, missing screen reader announcements\n\nBackend suite total after this wave: **~3,460+ passing** (estimated at time of wave). Frontend suite total: **~1,891 passing** (estimated at time of wave). Combined: **~5,370+** (estimated at time of wave). See [Current Verified Totals](#current-verified-totals-2026-04-25) for latest recertified counts.\n\n### Test expansion wave (`#721`) completion\n\nThis wave delivered the final 2 issues from the rigorous test expansion wave (`#721`):\n- `#705` — Concurrency and race condition stress tests (13 tests)\n- `#717` — Property-based and adversarial input tests (211 tests)\n\n**All 25 of 25 issues in the test expansion wave are now delivered.** Total new tests from the wave: ~1,350+.\n","Script completed\nWall time 0.3 seconds\nOutput:\n",{"_663":1204,"_645":1205,"_624":625,"_647":631},1785121971669,{"_685":1206,"_686":1207,"_688":1208,"_690":691,"_629":517,"_692":32,"_42":1209,"_694":1210,"_696":697,"_638":114,"_93":698},"# Outstanding Tasks\n\n**Purpose:** a durable, human-owned checklist of work the maintainer (Chris) wants to keep visible across sessions and agents, so nothing is forgotten between context resets.\n\n**Rules for agents (Claude, Codex, etc.):**\n1. **Read this file at the start of every session** (it is referenced from `CLAUDE.md` and `AGENTS.md` and the SessionStart hook).\n2. **Surface the open items** whenever you give a summary, status update, handoff, or \"what's next\" — list the open (`[ ]`) tasks with their IDs so the maintainer is reminded.\n3. **Only clear/check a task when the maintainer explicitly says it's done.** Do not auto-complete items just because a related PR was opened or you think it's finished. When told an item is complete, change `[ ]`→`[x]` (or remove it) and note the date in the changelog at the bottom.\n4. **Add new outstanding tasks here** when the maintainer asks you to remember something, or when substantial work is deferred. Keep entries short with a one-line \"how\" and a link to the GitHub issue/PR that holds the detail.\n5. Keep this file lean and scannable. Detail lives in the linked issues, not here.\n\nLast reviewed: 2026-07-13\n\n---\n\n## A. Merged PRs (confirmed by post-audit sweep 2026-05-31)\n\n- [x] **PR #1143** — Test loop: `npm test`→`vitest run` + stabilize the MetricsView flake. *(merged 2026-05-31)*\n- [x] **PR #1144** — Docs truth: STATUS↔TESTING_GUIDE contradiction, RFAI spine, broken links. *(merged 2026-05-31)*\n- [x] **PR #1145** — Release scripts aligned with CI flags + stale PKG-01 warning removed. *(merged 2026-05-31)*\n- [x] **PR #1146** — Proposal create returns 409 (not 500) on duplicate idempotency key. *(merged 2026-05-31, closes #1125)*\n- [x] **PR #1147** — `AsSplitQuery` on the multi-collection board read. *(merged 2026-05-31)*\n- [x] **#1126** — Un-skip INV-10/11/12 roadmap-invariant tests with real service assertions. *(PR #1153, merged 2026-05-31)*\n- [x] **#1134** (first slice) — Surface swallowed audit-log failures via shared `AuditLogWriter`. *(PR #1155, merged 2026-05-31)*\n\n## B. Next easy wins (seeded, not yet started)\n\n- [ ] **#1133** (rest) — Bound `NotificationRepository` paging (push ORDER BY+LIMIT to SQL), incremental SignalR board patch instead of full 3-call refetch, FTS-backed card search.\n\n## B2. Surfaced by post-audit correctness sweep (2026-05-31)\n\n- [ ] **Cohort metrics stub** — `AutomationMetricsController.GetCohortMetrics` returns empty data; `CohortDashboard` frontend is wired but always shows \"No cohort data available.\" *How:* build `ICohortMetricsService` with real cohort aggregation once learning-loop data layer design is decided. Tracked in #1142.\n- [ ] **Ollama real streaming** — `OllamaLlmProvider.StreamAsync` does pseudo-streaming (complete-then-drip-by-word). *How:* consume Ollama's `stream:true` API for genuine token streaming when Ollama provider goes beyond prototype.\n- [ ] **#1134 remaining acceptance criteria** — first slice (AuditLogWriter) shipped; 6 remaining criteria still open on the issue.\n\n## C. Strategic / larger tracks (seeded under tracker #1142)\n\n- [ ] **#1123** — v0.1.0 release: a **required revival Phase-1 ship-gate item** under ADR-0044/REVIVAL-07. Exercise the release pipeline, smoke-run the self-contained exe, publish the GHCR image, and fix the documented release-path breakage before strangers are invited. The release smoke step already landed in `release-desktop.yml`. *(Optional-archive framing from 2026-06-13 is superseded.)*\n- [ ] **#1132** — Make the required PR gate enforce security: gitleaks/SAST/dependency scan + CORS fail-closed + single ≥32 JWT floor + global `FallbackPolicy` + bundle-size in the required lane.\n- [x] **#1130** — SQLite local concurrency: enable WAL + `busy_timeout`, fix per-process `Migrate()` race (UI + MCP + CLI share one DB → `SQLITE_BUSY`). *(closed 2026-06-05; ACs 1+3 shipped in PR #1165 / da764b92. AC2 cross-process `Migrate()` serialization → #1164; export/import redesign → #1166.)*\n- [ ] **#1131** — CLI hardening: fresh-machine bootstrap (it crashes without `Connectors:EncryptionKey`) + route CLI mutations through board-access authorization.\n- [x] **#1124** — Core-loop polish: false-green expiry regression test (now asserts a real 409) + #678 dismiss gap (Approved+expired) + #680 provenance-404 console noise. *(closed 2026-06-05; all three fixed in PR #1162 / 77162b2d. Paper-view dismiss affordance → #1161.)*\n- [x] **#1161** — Paper review dismiss affordance (carries #1124's Paper remainder; maintainer 2026-06-05: take it, design-first — propose the affordance before building). *(Maintainer check-off 2026-06-19; delivered via PR #1219, **merged 2026-06-19**; issue #1161 closed.)*\n- [x] **#1164** — Serialize cross-process `Database.Migrate()` (advisory/single-owner lock; carries #1130 AC2). *(Maintainer check-off 2026-06-19; closed on GitHub via PR #1186 / SerializedMigrator.)*\n- [ ] **#1166** — Harden dev-sandbox export/import via the SQLite backup API (carries #1130's export/import follow-up).\n- [ ] **#1138** (rest) — Split the 1300+ line `STATUS.md` into a lean current-reality head + `docs/archive/status-history/`; add a rotation rule; recertify TESTING_GUIDE totals from a green CI run; add a markdown link-checker to nightly.\n- [ ] **#1136** (remainder) — ADR decision **delivered** (ADR-0038, Paper canonical / Legacy frozen; STATUS states the canonical stack) via PR #1207. **Still open:** remove/quarantine the dead paper composables (AC3) — scheduled for the Paper polish wave.\n- [ ] **#1137** — Refocus strategy/roadmap. ADR-0044 + `docs/REVIVAL_PLAN.md` now provide the revival direction and finite wave; pending maintainer check-off after the canonical-doc sync is merged. The 2026-06-13 archive framing is retained only as the checkpoint fallback.\n- [ ] **#1135 / #1140 / #1141 / #1139** — Code-health guardrails + oversized-view decomposition; workspace hygiene + one-command dev-up; i18n/a11y ADR; deployment docs (docker quickstart secret, desktop run docs). *(2026-06-19: **#1135 partial** — paper-night straggler tokens (PR #1216) — checked off by maintainer; guardrail/decomposition half + #1140/#1141/#1139 remain open.)*\n\n> Full audit context and the complete gap inventory: **GitHub issue #1142** (master tracker).\n\n## F. Generalist expansion wave (2026-07-13, ADR-0046 Proposed — extends §E as REVIVAL_PLAN Phase 4)\n\nDecision under ratification: **extend the single app** (artefact intake beyond transcripts, project dossiers, generalist legibility, friends-family channel); the twin generalist app is **deferred behind the GEN-12 evidence gate**, not built. Wave label `generalist`; strictly subordinate to the v0.1 ship gate.\n\n- [ ] **GEN-00 tracker (#1327)** — ratify ADR-0046 + Phase-4 placement + the tracker's decision checklist (SQLite blob storage, consent-gated vision MVP, twin-app deferral). Child issues: #1315–#1326 (GEN-01..12).\n- [ ] **Maintainer at checkpoint:** review GEN-12 (#1326) twin-app gate against friends-family signal (GEN-11 #1325) — recorded decision required, silence is not a close.\n\n## E. Revival wave (2026-07-10 pivot, ADR-0044 — supersedes the archive framing of §D)\n\nDirection: **free open beta → commercial horizon** (`docs/REVIVAL_PLAN.md` is the planning spine; `docs/analysis/2026-07-10_revival_assessment.md` is the evidence base). §D items are re-scoped in place — same work, new purpose (v0.1 ship gate instead of archive gate). Issue IDs below are seeded as the REVIVAL wave; see the tracker for the authoritative list.\n\n- [ ] **REVIVAL-00 tracker (#1311)** — charter + v0.1 ship-gate ratification (amends #1278); wave sequencing. Child issues: #1297–#1310 (REVIVAL-01..14); docs PR: #1296.\n- [ ] **Phase 0 — dogfooding starts now** (#1271, unchanged): real personal use including WhisperX transcripts through the existing transcript capture tab.\n- [ ] **Phase 1 — truth + safety before strangers**: registration gating flag; remove the fake undo timeline; de-stub Today dossier (#1272); Paper fonts + favicon; Paper onboarding/first-board path; README revival rewrite + demo GIF + MCP section; v0.1.0 tag → exercise release pipeline → GHCR image; fix render.yaml; branch protection (#1173); CI keep/kill (#1275); Paper E2E/axe re-point (#1274).\n- [ ] **Phase 2 — transcript engine** (authorized new-surface exception): LLM triage strategy behind `ICaptureTriageService` for transcript sources; chunking + cap raise; triage schema v2 (type/assignee/due + model-derived confidence); Transcript entity + evidence spans; OpenAICompatible provider + true SSE streaming; risk-tiered review prioritization and batch-confirm ergonomics (**never auto-apply or bypass ADR-0003's approve-then-execute gate**); (2b, gated on dogfooding value) audio upload + WhisperX sidecar.\n- [ ] **Phase 3 — slim + launch**: dead-surface amputation (#1276 expanded); MCP packaging + scoped keys + hash-pin wiring (#1154) + explicit multi-user-safe stdio identity (#1309); privacy-respecting beta feedback channel; launch checklist (r/selfhosted, Show HN, awesome-selfhosted, hosted demo).\n- [ ] **Checkpoint (~8 weeks)**: fall back to the §D archive plan only if there is no organic traction **and** dogfooding has not stuck; any mixed outcome requires an explicit maintainer assessment/plan amendment.\n\n## D. Historical archive closeout wave — re-scoped by ADR-0044\n\nAnalysis docs: `docs/PROJECT_TRAJECTORY.md` (strengths + path) and `docs/COURSE_CORRECTION.md` (what must change + ordered plan). These issue titles retain their ARCHIVE-* history, but **nothing in this section independently authorizes archival**: ADR-0044 re-scopes the still-useful work into the revival ship gate and keeps archive only as the checkpoint fallback. Wave source: **#1278** (originally ARCHIVE-00; amended by REVIVAL-00/#1311).\n\n- [ ] **#1278** — originally ARCHIVE-00; now the **v0.1 ship-gate source** amended by REVIVAL-00/#1311: ratify the repurposed exit criteria and revival additions, then use archive only if ADR-0044's checkpoint condition is met. *(Maintainer decision.)*\n- [ ] **#1269** — ARCHIVE-01: codify the two-tier review gate (LIGHT/FULL), issue-intake severity bar, no-new-backend-surface rule.\n- [ ] **#1270** — ARCHIVE-02: backlog triage hour — close ~16 already-decided issues with dated pivot notes. *(Maintainer sign-off on the list.)*\n- [ ] **#1271** — ARCHIVE-03: dogfooding sprint — ≥10 days of real personal use (the pivot's acceptance test; cannot be delegated).\n- [ ] **#1272** — ARCHIVE-04: Today dossier truth — de-stub the fabricated default daily surface (`useTodayDossier.ts` buildStubDossier).\n- [x] **#1273** — capture-triage provenance names the deterministic extractor, delivered by #1283; the v0.1 ship-gate item is done. *(Checked off 2026-07-25 on the maintainer's explicit instruction — see the rule-3 note in the changelog. GitHub issue #1273 was already closed 2026-07-03.)*\n- [ ] **#1274** — ARCHIVE-06: re-point E2E + axe coverage at the Paper UI (currently the least-tested UI).\n- [ ] **#1275** — ARCHIVE-07: CI estate right-sizing — keep/kill/gate per lane + short ADR (nightly red 28 days; mutation red 10+ weeks).\n- [ ] **#1276** — ARCHIVE-08: dead-surface removal — ink-bleed decision, orphaned Paper code, cohorts stub, voice capture, Ollama marking.\n- [ ] **#1277** — originally ARCHIVE-09; now the revival checkpoint/fallback record. Beta-facing README, release tag, and ship-gate checks live in REVIVAL-06/07/14; archive-only edits wait unless ADR-0044's checkpoint condition is met.\n- [x] **#1235** — revision-aware proposal diff (preview equals what Apply executes) was delivered by #1280 with regression coverage; the v0.1 ship-gate item is done. *(Checked off 2026-07-25 on the maintainer's explicit instruction — see the rule-3 note in the changelog. GitHub issue #1235 was already closed 2026-07-03.)*\n- [ ] **#1291** — Adopt agent-harness T3 profile: one-home policy collapse, .codex mirror retirement, skill read-first diet, region maps, review-twin merge, ledger triage cadence. *(Blueprint: sibling checkout `C:/Users/jekyt/source/agent-harness/BLUEPRINT.md` — outside this repo; complements #1138/#1269/#1275/#1276, no duplication.)*\n- *(Record, already done 2026-07-02:)* re-scope comments posted on #996, #1123/#1139, #1128, #1134 (+#1154 decision), #1135, #1138, #1173, #1175 (+#1174), #1210, #1215, #1222 (+#1227), #1228 — each carries updated finish-or-close ACs.\n\n## E. Revival overnight deferrals (added 2026-07-13)\n\n- [ ] **#1173** — Apply and verify the required branch-protection settings in GitHub. This is repository-settings work and remains maintainer-only.\n- [ ] **#1303** — Push the `v0.1.0` release tag only after the maintainer accepts the release deck and its pipeline evidence. Agents may repair the pipeline but must not push the tag.\n- [ ] **#1482 — Taskdeck name, pre-commercial legal residuals.** *(Supersedes the old \"#1299 trademark check\" line: #1299 shipped with PR #1337 on 2026-07-25 and its AC4 search + cost + recommendation are recorded on the issue.)* What remains is genuinely legal and none of it blocks the free beta: an **attorney registrability opinion** for Classes 9/42 asking about *descriptiveness* (not just conflict), a read on **TASKADE** (live, incontestable US Cl. 42 mark covering task management), the UKIPO/EUIPO coverage gaps (UKIPO hard-blocked automated access, so all GB data is indirect), perishable namespace reservations, and the **keep-or-rename decision before `v0.1.0` (#1303)** — renaming is nearly free pre-tag and expensive after.\n- [ ] **#1458 project-priority data cleanup — delivered; maintainer record check-off pending.** All 130 formerly unlabeled Taskdeck Issues were classified and verified, the reviewed project-field Apply succeeded 141/141, and the built-in plus three fresh complete audits proved 1,472/1,472 items with zero remaining Priority drift. PR #1488 merged; issue #1458 and both project items are `Done / Priority I`. The checkbox remains open because only the maintainer checks off this file.\n- [ ] **#1330** — Repair the CI Extended reusable-workflow permission contract; affected PRs remain ineligible while the workflow startup failure is red.\n- [ ] **#1282 / #1332 / #1335** — Stabilize the required full-suite harness: SQLite concurrency, Redis connect/dispose, and hosted-worker/presence lifecycle isolation. Narrow passes do not clear the recorded full-suite failures.\n- [ ] **#1338** — Map HTTP MCP and its API-key middleware to the same `/mcp` route before documenting or exposing HTTP transport; the current parameterless mapping serves MCP at an unintended unauthenticated root route.\n- [ ] **#1343** — Prevent late Home/Today summary responses from overwriting a newer local workspace-mode choice; add deterministic ordering tests and repeated error-recovery E2E proof.\n- [ ] **#1345 maintainer record check-off** — The code now centrally pins the matched SQLitePCLRaw 2.1.12 family, loads SQLite 3.53.3, enforces the advisory's >= 3.50.2 runtime floor, clears the solution vulnerability audit, preserves the EF model, and passes a self-contained `win-x64` health smoke. The implementation is complete; this checkbox remains human-owned.\n- [ ] **#1274 / `origin/issue-1274/paper-e2e-axe` at `993f188f`** — Resume the parked Paper E2E/axe re-point from the pushed WIP branch; fix tracked Paper Review blockers #1347/#1348, finish the named first-run/onboarding/smoke and axe coverage, then run the full frontend/E2E gates before opening a PR.\n- [ ] **#1347 / #1348** — Repair the Paper deep-review enum wire-contract crash and the SQLite-backed similar-past HTTP 500; both were reproduced by the real Paper capture/review path and must not be hidden by frontend fallbacks.\n- [ ] **#1323 prompt-rail remainder** — Bind the hostile transcript/PDF/image and malformed-response fixtures from PR #1340 to PR #1312's effective prompt/parser path before GEN-04; prove grounded-task-or-empty verdicts and deterministic fallback for schema escapes.\n- [ ] **#1456 / PR #1457 — Codex deny-floor adapter T4 gate.** **Do not run the posted `/hooks` canaries yet.** The 2026-07-26 audit found red DCO on all four commits, no substantive review of the current head, material drift behind `main`, a v1.6.5 pin behind the installed/producer v1.6.12 floor, and unresolved root/common-directory hook discovery. First repair and synchronize the branch, settle the exact reviewed dispatcher bytes and authoritative hook source, then rerun exact-head CI and two adversarial reviews. Only after those prerequisites may the maintainer trust the project hook in a fresh interactive `/hooks` session and record allow/deny canaries; no agent can perform or substitute for that final gate.\n- [ ] **Prune the merged agent worktrees.** `git worktree remove` is blocked by the deny floor, so this is human-only and recurs after every wave (upstream: [agent-harness#41](https://github.com/Chris0Jeky/agent-harness/issues/41)). *(Added 2026-07-25.)*\n\n ```bash\n cd /c/Users/jekyt/source/Taskdeck\n git worktree remove .worktrees/claude-model-routing-canon # docs/model-routing-canonical-pointer\n git worktree remove .worktrees/claude-sweep-0725 # docs/sweep-2026-07-25\n git worktree remove .worktrees/codex-1299-licensing-pack # issue-1299/licensing-pack — merged as PR #1337\n git worktree remove .worktrees/codex-1345-sqlite-native-patch # issue-1345/sqlite-native-patch — merged as PR #1486\n git branch -d docs/model-routing-canonical-pointer docs/sweep-2026-07-25 issue-1299/licensing-pack issue-1345/sqlite-native-patch\n ```\n\n All four are clean and fully merged into `main`. **Keep** `.worktrees/codex-1456-codex-deny-floor-adapter` (PR #1457 is still open) and `.worktrees/codex-1458-project-priority-pagination` (active #1458 work).\n- [ ] **Branch from an explicit base.** PR #1477 was closed-as-merged without anyone merging it. Root cause: `feat/1271-dogfooding-instrumentation` (PR #1478) was created with a bare `git checkout -b` **while standing on `fix/1123-release-dry-run`**, so it silently inherited `#1477`'s commit `0ebbf330`. Merging #1478 carried that commit onto `main`, GitHub detected `#1477`'s branch as fully merged and auto-closed it two seconds later, attributing the event to the acting token. The single-parent \"rebase\" appearance was GitHub recording the already-landed commit, not a rebase anyone performed. *How:* always name the base — `git checkout -b main` — and verify with `git log --oneline main..` before pushing. *(Added 2026-07-25. Supersedes an earlier item on this list that wrongly framed this as an unidentified autonomous merger — that alert was mine and it was wrong; caught by Codex on PR #1483.)*\n\n---\n\n## Changelog\n- 2026-07-27 (later): **#1458 shipped and the live project is Priority-clean.** The reviewed Apply succeeded 141/141; its built-in audit, two pre-merge fresh audits, and the final post-merge handoff audit each proved 1,472/1,472 items, 12 visible/non-authoritative external references, and zero remaining drift. PR #1488 merged as `84674979`; issue #1458 and both project items are Done/Priority I. The human-owned checkbox remains unchecked pending maintainer record review.\n- 2026-07-27: **#1458 label remediation and external-reference policy supersede the prior checkpoint below.** The 130 missing Taskdeck Issue labels were classified and verified, and a stable 1,472-item audit found 142 remaining project-field drifts. External Issues are now recorded as visible non-authority rather than rejected: their labels never rank, external-only PRs derive `Priority V`, and canonical body fallback remains available after an external closing reference. No project-field `-Apply` had run at this checkpoint; the unchecked item remains pending a reviewed Apply and separate zero-drift audit.\n- 2026-07-26: **#1458 corrected the project-priority record and the resumable cleanup path.** The old 1,000-item helper could not prove a project-wide clean result; the complete read-only snapshot reached 1,458/1,458 items and correctly stopped on 130 issues without a Priority label. A preliminary pass saw six PR fallback candidates; the next pass falsely treated merged PR #123 as an unlabeled issue, which re-review caught. The typed rerun ignores that PR and then reaches external Issue `dotnet/efcore#35983`, which GitHub exposes as a closing reference for 12 historical Taskdeck Dependabot PRs because their release-note text links it. The safe default now rejects all cross-repository Issue authority pending any explicit future opt-in; the preliminary PR plan remains retracted pending truthful project-issue labels. No `-Apply` or audit remediation write ran; only PR #1488's own `Review` / `Priority I` project metadata was populated after opening. Added the merged #1345 worktree to the human-prunable block and retained the active #1457/#1458 worktrees. No checkbox was checked in this pass.\n- 2026-07-25 (latest): **PR queue cleared — 8 PRs merged, 1 draft left.** `#1469` (`#1462` frontend pin), `#1471`, `#1472`, `#1477`+`#1481` (`#1123` release rehearsal), `#1478` (`#1271` dogfooding instrumentation), `#1479`, and `#1337` (`#1299` licensing pack — **`#1299` closed by that merge**, residuals → `#1482`). `#1295` **closed as superseded**, with the salvage plan and acceptance criteria recorded on `#1293`. Only `#1457` remains, and its step-by-step human procedure is now on the PR. Repo hardening: force-push and deletion blocked on `main`; 288 truncation-hidden project-priority mismatches synced. Under `#1270`, 12 already-decided issues closed with dated notes — but **`#1270` stays open**, because two of its own acceptance criteria are obsolete against ADR-0044 and REVIVAL_PLAN §6 and must not be run as written. Seeded `#1470` `#1473` `#1474` `#1475` `#1476` `#1480` `#1482` and upstream `agent-harness#56`. Dogfooding baseline measured for the first time and recorded in `docs/dogfooding/LOG.md`: **sustained use has not started**, though the core loop works (17/20 proposals reached Apply). No item below was checked off in this pass.\n- 2026-07-25 (later): **#1273 and #1235 checked off — rule-3 exception, on the maintainer's explicit instruction.** During a guided walkthrough the maintainer reviewed both record-only items and said \"please tick them yourself\". Recorded here because rule 3 reserves check-offs to the maintainer, so the authorization — not the agent's judgement — is what permits these two. Both were delivered long ago (#1273 by #1283, #1235 by #1280 with regression coverage) and **both GitHub issues were already closed on 2026-07-03**; only the checkboxes lagged. No other item was touched, and rule 3 continues to apply to every remaining `[ ]`.\n- 2026-07-25: **Two human-only items added to §E** (no items checked off — rule 3). PR `#1469` closed `#1462` (frontend `approvedRevisionId`, now declared *required*) and the follow-up sweep `#1471` re-hydrated the canonical docs; both merged with green CI. Of the four open PRs, only `#1469` was agent-actionable — `#1295`, `#1337`, and `#1457` are all human-gated, and `#1457`'s `/hooks` trust gate plus the recurring merged-worktree pruning were the two that no file tracked, so they are recorded above. Seeded `#1470` (`DATA_MODEL.md` omits `ApprovedRevisionId`/`DeferredUntil`; stale snapshot figure). Correction on the record: `#1469`'s review comment reported 383 pre-existing spec typecheck errors for `#1468`; the figure by the documented method is **415**, and `#1468`, `#1470`, `#1469` and both canonical docs were corrected.\n- 2026-07-13 (later): **Revival + generalist-expansion wave SHIPPED — 15 PRs merged to `main`** under the maintainer's ratify-and-merge directive. **ADR-0044 / ADR-0045 / ADR-0046 all ratified to Accepted.** Merged: direction docs `#1296` (revival) + `#1328` (generalist); transcript engine `#1312` (REVIVAL-08 M1); GEN wave `#1341`→`#1346` (artefact storage + local text extraction), `#1339` (due-date/label apply — also fixed a latent silent WIP-limit-clear on reorder), `#1340` (threat model), `#1342` (guided nav); REVIVAL wave `#1334`→`#1344` (registration gating + Paper onboarding), `#1329` (fonts), `#1331` (README), `#1333` (Today dossier `#1272`); harness `#1294`; ops `#1336` (overnight human-action + failure-ledger record, `#1327`). Linchpin `#1352` (CI-Extended reusable-workflow permission fix, `#1330`) + dependabot `#1351`/`#1349` were merged first by the maintainer to unblock the deck. Real merge conflicts resolved (workspaceStore latest-request guard, AGENT_INDEX seam-map union, EF migration-snapshot verified clean via `has-pending-model-changes`). Seeded `#1355` (buffered-export blob batching, LOW). **NOT merged — human-gated (still open):** `#1295` (deny-floor overlay — 16 unresolved review threads incl. a CRITICAL, needs remediation) and `#1337` (licensing pack — blocked on trademark clearance). `docs/STATUS.md` + `IMPLEMENTATION_MASTERPLAN.md` synced. Items above are left unchecked pending maintainer sign-off (rule 3), even where a related PR shipped (e.g. `#1272` via `#1333`).\n- 2026-07-13: **Generalist expansion wave seeded (ADR-0046 Proposed).** Maintainer evaluated the artefact-intake research handoff + his twin-generalist-app idea; decision (pending ratification): extend the single app, defer the twin behind an evidence gate. Seeded GEN-00..12 (#1315–#1327, label `generalist`) as REVIVAL_PLAN Phase 4 (\"Every Artefact, Everyone\", v0.4); coordination comments posted on #1304 (dueDateHint apply gap → GEN-05) and #1305 (artefact/Transcript one-home constraint). Added §F above. Capability recon findings: no artefact/blob model exists; inert drop zone already shipped in PaperCaptureComposer; no operation applies due dates; prompt injection undefended beyond schema+review gate; guided/workbench/agent mode scaffold ready for generalist nav.\n- 2026-07-10: **Revival pivot decided (ADR-0044) — archive pivot superseded.** Maintainer decision after the WhisperX prototype + two-track revival analysis (`docs/analysis/2026-07-10_revival_assessment.md`). Direction: free open beta (adoption/feedback/exposure) → commercial horizon; positioning: local-first review-first action-item engine + write-gated MCP gateway; MIT stays MIT. Added §E (revival wave); §D items re-scoped in place as the v0.1 ship gate. Planning spine: `docs/REVIVAL_PLAN.md`. Seeded the REVIVAL issue wave on GitHub.\n- 2026-07-06: **Agent-harness blueprint adopted (step 1).** Estate-wide tiered blueprint landed at `source/agent-harness/`; Taskdeck declared T3 (`.claude/tier.json`). Footgun PR opened: committed `bypassPermissions` → settings.local.json, history-rewriter script fenced human-only. Remaining T3 diet seeded as #1291 (added to §D). Global layer shipped: `~/.claude/CLAUDE.md` laws, argv-aware deny floor (49-case tested), ESTATE.md registry, `~/.claude` now versioned (private repo claude-config).\n- 2026-07-02: **Whole-project analysis delivered + archive closeout wave seeded.** Multi-agent analysis (6 dimensions, 15 claims adversarially verified: 5 confirmed / 10 adjusted / 0 refuted) produced `docs/PROJECT_TRAJECTORY.md` + `docs/COURSE_CORRECTION.md`. Seeded issues #1269–#1278 (ARCHIVE-00..09, new `archive-closeout` label) and posted re-scope comments on 14 existing issues. Added §D above. Central findings: no checkable definition of done existed in the tracked repo; zero organic personal-usage data; the default Paper UI is the least-tested UI; the \"canonical\" exe run path has never been built; ~31% of open issues already decided-closed by the pivot but still open.\n- 2026-06-19 (later): **Merge hold lifted — deck merged.** The maintainer lifted the hold and all four PRs shipped to `main`: **#1220** (canonical-docs reconciliation; 14 Codex rounds + 3 drift sweeps), **#1219** (Paper File-away dismiss, closes #1161), **#1221** (reachable in-app Appearance theme toggle — a Paper-activation prerequisite), **#1225** (StackExchange.Redis + SignalR-backplane semver-major caps). Post-merge STATUS/masterplan sync in PR #1233. Seeded during this work: #1226 (net8.0 upgrade), #1227 (dated-snapshot staleness), #1228 (cd-staging-gate auto-trigger), + the #1195 GDPR caller-audit. Next: the Paper-review de-stubs (last Wave-2 blocker before the default-theme flip) — `onPreviewDiff` in PR #1234.\n- 2026-06-19: **Maintainer check-offs confirmed** — **#1161** (Paper File-away dismiss, PR #1219), **#1164** (cross-process Migrate, PR #1186), **#1189** (Redis lock starvation, PR #1213), **#1198** (dead `ProposalGeneratorV1` removed, PR #1214), and **#1135 partial** (paper-night straggler tokens, PR #1216) marked done. Also: PR #1223 (npm group) merged; PR #1224 (nuget) closed (framework-major bumps rejected per ADR-0039 net8.0 pin); PR #1225 opened (StackExchange.Redis major cap). PRs #1219/#1220/#1221 fully reviewed + green + aged but **merges held by maintainer**. Maintainer decision: revisit net8.0 framework-major upgrade later (issue seeded). ADR-0004 stays \"Accepted\" with the never-implemented note (TenantId never built; isolation is per-UserId/board-access).\n- 2026-06-13: **Archive-pivot wave (Waves 0–2) merged — 17 PRs** (see STATUS.md \"Archive-pivot delivery wave\"). Direction is now **finish-for-personal-use → archive** (supersedes ship-first); distribution tracks (#1167 code-signing, #544/#546/#550 GTM, #537/#548 cloud, #540 mobile) are de-scoped and will be closed not-planned in archive closeout. **Maintainer check-off pending** for items this wave appears to deliver: **#1140** (dev-up + clean-workspace scripts, PR #1208), **#1139** AC1 (compose-secret quickstart docs, PR #1205), **#1135** partial (paper-night straggler tokens, PR #1216 — guardrail/decomposition half still open), **#1189** (Redis lock starvation, PR #1213), **#1198** (dead `ProposalGeneratorV1` removed, PR #1214 — follow-up #1215 seeded). Not auto-checked per rule 3. **#1161** (Paper \"File away\" dismiss) built on the #1217 shared-actionability foundation and is in review as PR #1219 (awaiting CI/aging). New issues seeded: #1209, #1215, #1218.\n- 2026-06-05: Maintainer directive — **ship-first**: prioritise the v0.1.0 release-blockers (#1123, #1131, #1132) ahead of #1154 (deferred). Closed #1124 and #1130 as substantially delivered (PRs #1162/#1165); remainders carried by #1161/#1164/#1166. Merge autonomy retained (full adversarial-review + green-CI + aging gate). #1161 to be taken design-first.\n- 2026-05-31 (post-audit): Checked off §A (PRs #1143–#1147 confirmed merged), §B #1126/#1134-first-slice (PRs #1153/#1155 merged). Added §B2 with correctness-sweep findings (cohort stub, Ollama pseudo-streaming, #1134 remaining). Correctness sweep: 31 PRs audited, 0 corruption, 2 issues + 9 nitpicks fixed.\n- 2026-05-31: File created. Seeded from the 2026-05-31 deep audit (tracker #1142). #972 (RFAI tracker) closed; PR #1122 merged; PRs #1143–#1147 opened.\n\n--- STATUS ---\n# Taskdeck Status (Source of Truth)\n\nLast Updated: 2026-07-27\n\nRequired Docs Governance hardening (2026-07-26, `#1492`):\n- **Required CI now enforces failure-ledger projection synchronization.** The reusable Docs Governance job pins Python 3.12 and runs the existing `failure_ledger.jsonl` ↔ `FAILURE_LEDGER.md` synchronization unittest before its governance checks, so a stale checked-in projection fails without any renderer masking it. Local agentic update workflows intentionally render first and then test so a valid hook-appended JSONL entry can be projected; the smoke contract keeps that distinction from drifting.\n\nWindows agent-utility launcher hardening (2026-07-26, `#1487`):\n- **Configured Python-backed agent handlers no longer depend on the unusable Microsoft Store `python` aliases on native Windows.** Configured PowerShell handlers and PowerShell-scoped utility allow-rules use the verified `py -3 -B` launcher; POSIX Bash allow-rules and guidance retain `python3 -B`; and the smoke harness runs child hook scripts through its active `sys.executable -B`. The permission contract asserts five direct utilities plus the renderer synchronization unittest on each platform's actual tool surface. PreToolUse maps a missing launcher or failed policy process to fail-closed exit 2. The native-Windows smoke feeds `Bash` payloads through PowerShell-hosted handlers; it does not prove native PowerShell-tool interception, which remains the T4 gap tracked by [#1497](https://github.com/Chris0Jeky/Taskdeck/issues/1497). No Python installation, global PATH change, or product-runtime packaging is introduced.\n\nPaper-default regression alignment (2026-07-14, `#1274`): authenticated E2E sessions now follow the production Paper default unless a frozen Legacy-selector suite opts out explicitly. The refreshed core lane proves the real capture → Accept → Review → approve/apply → board path and runs the full axe WCAG 2.1 A/AA ruleset against settled Paper Home, Today, Inbox, Review, and a seeded Board, plus Login and functional skip-link keyboard coverage. The global Vitest Legacy pin remains intentional because those component tests assert the frozen Legacy DOM directly. Focused Chromium verification is 37/37 across `accessibility`, `onboarding`, `capture-loop`, `review-proposals`, `first-run`, and `smoke`.\n\nDirection change (2026-07-10, maintainer-decided, **ADR-0044**): **the 2026-06-13 archive pivot is superseded — Taskdeck is being revived** and shipped as a **free open beta** (adoption/feedback/exposure first; the commercial side is developed in parallel by the maintainer). Positioning: the local-first, review-first **action-item engine** — transcripts/notes in, evidence-linked proposals out, applied to a board only on human approval — with the write-gated MCP server as the developer-facing second act. Everything shipped under MIT stays MIT (no retroactive relicensing). The active planning spine is **`docs/REVIVAL_PLAN.md`** (Phase 1 \"truth + safety before strangers\" repurposes the #1278 archive exit criteria as the v0.1 ship gate; Phase 2 is the LLM transcript-triage engine — the largest authorized new-backend-surface slice; Phase 3 is the beta launch; other scoped exceptions include registration gating, feedback/telemetry, and MCP key/identity hardening as enumerated in §7; then a ~8-week traction checkpoint with the archive plan as the documented fallback). New backend surface is authorized only by REVIVAL_PLAN §7 — the Phase-2 transcript-engine grants (ADR-0044) plus the Phase-4 generalist-expansion grants (**ADR-0046, Accepted 2026-07-13**: artefact intake, dossier read model, mode-scoped navigation; tracker `#1327`; the twin generalist app is explicitly deferred behind the GEN-12 `#1326` evidence gate). Evidence base: `docs/analysis/2026-07-10_revival_assessment.md` (7 code-review dimensions, ~25 adversarially verified claims, live-verified market data). Archive-closeout issues #1269–#1278 are re-scoped in place (same work, new purpose); dogfooding (#1271) remains the acceptance test for either path. **Dogfooding is now instrumented (2026-07-25):** `docs/dogfooding/README.md` holds the protocol — a dedicated `TASKDECK_DOGFOOD_DB` so dev/demo/E2E traffic cannot contaminate the signal, `scripts/dogfooding/dogfood-snapshot.py` (read-only; counts and dates only) for objective metrics, `docs/dogfooding/LOG.md` for friction, and a checkpoint rubric fixed before any real usage data existed. Read it before collecting checkpoint evidence, or the evidence will not be comparable. The measured pre-dogfooding baseline is recorded in `LOG.md`: **8 active days, none in the last 28, last activity 2026-04-23, 10 of 13 boards demo/test residue** — sustained use has not started, though the loop itself works (**17 of 20 proposals reached Apply**, counted by `AppliedAt`; a status-based count reads 1/20 because `Dismiss()` overwrites an `Applied` status).\n\n\nSecurity runway slice (2026-07-26, `#1345`):\n- **The inherited HIGH SQLite native advisory is remediated without bypassing Central Package Management.** `Taskdeck.Infrastructure` now directly references the centrally pinned `SQLitePCLRaw.bundle_e_sqlite3` 2.1.12, so bundle, core, provider, and native library resolve as one 2.1.12 family instead of mixing a new native leaf with 2.1.6 managed components. The loaded SQLite runtime is 3.53.3, above the advisory's 3.50.2 security floor; a host-native integration test opens an in-memory database and enforces that floor. The solution vulnerability audit is clean, a fresh database update reports no pending model changes, and a self-contained `win-x64` published API booted against SQLite and returned `/health/ready` HTTP 200.\n\nProject-automation runway slice (2026-07-26, `#1458`):\n- **The ProjectV2 priority helper now establishes completeness instead of trusting a capped sample.** It follows cursor pages to a stable item-count/project-stamp snapshot, uses ordinal identity for GitHub node IDs and cursors, rejects truncated nested connections, treats a positive `-Limit` as a fail-closed ceiling, and derives PR priority from complete repository-aware closing links/body references. Before `-Apply`, it validates all option mappings and rebuilds the complete source-derived plan; any drift aborts before the first write, and a complete post-apply audit remains mandatory. Its authentication-free self-test covers the >1,000-item and failure boundaries.\n- **The live project-priority cleanup is complete.** On 2026-07-27, the 130 previously unlabeled Taskdeck Issues were classified and verified 130/130 with exactly one Priority label (`I=5`, `II=9`, `III=2`, `IV=18`, `V=96`). External Issue references are visible non-authority: their labels never rank, external-only PRs derive `Priority V`, and an external closing Issue still permits same-repository body fallback. After the closing link reduced the plan to 141 real field drifts, the reviewed Apply succeeded 141/141; its built-in audit, two fresh pre-merge audits, and the final post-merge handoff audit each proved 1,472/1,472 items, 12 ignored external references, and zero remaining drift. PR #1488 merged as `84674979`, and issue #1458 plus both project items are `Done / Priority I`.\n\nPR-queue clearing wave (2026-07-25, **8 PRs merged**, and the open-PR queue is down to one human-gated draft):\n- **`#1469` (`#1462`) — the frontend `Proposal` type exposes `approvedRevisionId`,** declared **required** rather than optional because `MapToDto` always assigns it and the API serializes with default options, so an unpinned proposal arrives as an explicit `null` and never an absent key — which also turns a field-by-field rebuild that drops the pin into a compile error. Contract exposure only; no UI claim, per `#1298`. Held against a dead-code sweep by an exported type alias, because `tsconfig.app.json` excludes `src/tests/**` from typecheck (`#1468`, measured at **415** pre-existing errors when the exclusion is lifted).\n- **`#1337` (`#1299`) — the permanent licensing posture is published.** `LICENSING.md` states the MIT-forever commitment for everything already shipped, the never-gated free boundary, and an additive-only posture for any future commercial module; `ee/` is reserved with a separately-licensed placeholder; DCO sign-offs are required in contributor guidance behind a SHA-pinned advisory CI job; MIT is declared in npm and all 11 `.csproj` files. The root `LICENSE` is deliberately unchanged. Name/trademark availability was researched and recorded on `#1299` (**no registered TASKDECK mark found in any register that could be queried** — USPTO, TMview and WIPO, each null result control-validated against a known-hit term; UKIPO's own register hard-blocked automated access, so GB coverage is indirect via TMview, which EUIPO states is not an official register. The real risk is **registrability**, not collision). Pre-commercial legal residuals — attorney registrability/TASKADE opinion, the UKIPO/EUIPO coverage gaps, perishable namespace reservations, and the keep-or-rename decision before `v0.1.0` — are tracked as **`#1482`**.\n- **`#1477` + `#1481` (`#1123`) — the release pipeline is rehearsable without pushing a tag.** `create-release` had no condition and a bare `workflow_dispatch` resolved the version to the literal `refs/heads/main`, whose slashes broke packaging — so the pipeline could not be exercised at all before the one irreversible action `#1303` reserves to the maintainer. A blank-tag dispatch from a **branch** is now an explicit rehearsal (`v0.0.0-dryrun+`, builds, smoke-tests, uploads artifacts, publishes nothing); a tag push, a dispatch naming a tag, **or a dispatch whose ref is itself a tag** publishes. Rehearsed for real: all four platforms green, `create-release` skipped, **0 tags and 0 releases created**. Note the smoke test covers the **three runner-native RIDs** only — `osx-x64` is cross-arch on the arm64 macOS runner and ships with less release evidence than the other three.\n- **`#1478` (`#1271`) — dogfooding is instrumented.** A dedicated `TASKDECK_DOGFOOD_DB` so dev/demo/E2E traffic cannot contaminate the signal, a read-only snapshot script (counts and dates only; safe to paste into an issue), a friction log, and a checkpoint rubric fixed before any real usage data existed. **The measured pre-dogfooding baseline is the finding:** 8 active days, none in the last 28, last activity 2026-04-23, 10 of 13 boards demo/test residue — sustained use has not started. But the loop itself works: **17 of 20 proposals reached Apply**, counted by `AppliedAt`. A status-based count reads 1/20, because `Dismiss()` accepts an already-`Applied` proposal and overwrites `Status` — so filing away a finished item erases the evidence it applied. Seven adversarial review rounds; residual activity-source accuracy questions consolidated on **`#1480`**.\n- **`#1471`, `#1472`, `#1479` — canonical-doc and human-action hygiene:** the `#1462` residual list reconciled across both canonical docs (and a wrong measurement of my own corrected, 383 → **415**); `#1457`'s `/hooks` trust gate and the recurring merged-worktree prune recorded as human-only items, which no file previously tracked; `#1273`/`#1235` checked off on explicit maintainer instruction (a recorded rule-3 exception).\n- **`#1295` CLOSED as superseded, not merged.** The deny-floor overlay failed **13 of 13 of its own bypass tests** and targeted global floor v1.3.0 against an installed 1.6.5. A repo-local overlay is still needed — **11 rule-classes are `allow` at every tier including T4** — so the full salvage plan, with acceptance criteria and the branch's 16 review threads retained as the successor's regression corpus, is recorded on **`#1293`**.\n- **Repository hardening:** `main` previously permitted **force-pushes and deletions**; both are now blocked (deliberately relaxed otherwise — no required checks, no required approvals). The old project-priority helper silently truncated at 1,000 items; a one-off 1,444-item snapshot repaired 288 mismatched fields (`#1474`), but that was not durable proof of a clean project. The complete, fail-closed contract and the remaining label/data gate are tracked by `#1458`.\n- **Backlog triage (`#1270`):** 12 already-decided issues closed with dated pivot notes, after an adversarial pass **bounced 13 of 25 proposed closures** — including `#1123`, the v0.1 ship-gate item. `#1270` itself stays open: two of its own acceptance criteria are obsolete against ADR-0044 and REVIVAL_PLAN §6 and must not be executed as written.\n- **Seeded this wave:** `#1470`, `#1473`, `#1474`, `#1475` (the repo hook denies 6 of 8 *benign* commands), `#1476` (the configured-handler `smoke_test.py` / deny-floor matrix remains ungated; failure-ledger renderer synchronization now runs in Required Docs Governance), `#1480`, `#1482`, plus upstream `agent-harness#56` (`docker exec` is not unwrapped by the global floor at any tier).\n- **Still open — producer/runtime-gated:** `#1457` is ready-for-review but cannot be salvaged in place: all four shared commits lack DCO sign-off, its v1.6.5 dispatcher pin is obsolete, five current Codex threads are unresolved, and no reviewed producer floor is both canonical and deployed. Rebuild a signed replacement from final `main` only after the agent-harness producer/deployment gate converges; then require exact-head automation/reviews followed by a fresh interactive `/hooks` trust session and handler-attributed allow/deny canaries.\n\nOvernight wave (2026-07-23/24, **6 PRs merged** + 3 dependabot PRs — the four feature/substrate PRs below plus `#1447`, the docs sync that recorded the maintainer-merged `#1414` (its content is the 2026-07-18 post-merge comment further down), and `#1448` below; per-PR gate: two independent adversarial review lenses, all-severity findings fixed with posted evidence, full backend suite on the exact head where code changed, required CI green, bot window honored with a content sweep). The wave's own delivery sweep was `#1454`; `#1448`, `#1427`, and dependabot `#1441` merged *after* that sweep ran, so their entries below were added on 2026-07-25:\n- **`#1439` (`#1428`, `#1424`) — the approved revision is pinned at approve time and Apply executes exactly it.** Approve reads the latest saved revision, validates it through the approve-time gates, and persists its id as `AutomationProposal.ApprovedRevisionId` (null pin = approved the original operations; a post-approval raced revision can no longer change what Apply executes — closes the `#1428` race). The migration backfills Approved proposals to their latest revision saved **at or before `DecidedAt`** (an explicit, reviewed reversal of latest-revision parity: the invariant is \"Apply executes exactly what the approver saw\", so a raced post-decision revision is never backfilled; empirically-proven SQLite text-format comparison). Single-proposal read/decide paths return the EFFECTIVE operation set with `Presentation` rebuilt from it (`#1424`); Rejected proposals freeze to the latest revision saved at or before decision time; the MCP terminal stored preview is suppressed whenever an effective revision applies (one payload can no longer carry revision operations beside an original-operations `DiffPreview`). Full suite on head: 7430/0/1. **`#1444` closed this residual:** the review-queue **list** endpoint now returns the same EFFECTIVE operations and rebuilt `Presentation` the single reads do, so a queue card can no longer disagree with the detail view, the diff and Apply. The former \"list maps originals\" boundary existed only to avoid a per-proposal revision query; a two-phase batched read (payload-free metadata for the page, then payloads for the winning revisions only) removes that cost without loading revision payloads the reader will not use, and both read shapes now select through one shared dispatcher. **`#1462` closed the frontend half** (PR `#1469`, merged 2026-07-25): the `Proposal` type in `types/automation.ts` now exposes `approvedRevisionId` (contract only — no UI claim, per `#1298`), declared **required rather than optional** because `MapToDto` always assigns it and the API serializes with default options (bare `AddControllers()`, no `DefaultIgnoreCondition`), so an unpinned proposal arrives as an explicit `null` and never an absent key — which also turns a field-by-field rebuild that drops the pin into a compile error. It is held against a dead-code sweep by an exported type alias because `tsconfig.app.json` excludes `src/tests/**` from typecheck. Remaining tracked residuals: `#1453` (reject-time pin: the `RevisedAt <= DecidedAt` heuristic is not commit-visibility; display-only), `#1464` (the review surfaces' \"recorded operations show the original submission\" caveat is inverted now that list reads are effective-set-aware; terminal proposals only — now unblocked by `#1462`), `#1465` (dismissing a rejected proposal drops its decision-time frozen revision back to the originals), `#1467` (the list resolution is bounded in bytes but not in row count, and reads proposal state and revision rows from two snapshots; display-only), `#1468` (frontend specs are never type-checked — lifting `src/tests/**` from `tsconfig.app.json` and running `npm run typecheck` surfaces **415** pre-existing errors, all of them under `src/tests/`, against a clean baseline of 0), `#1470` (`docs/architecture/DATA_MODEL.md` omits `ApprovedRevisionId` and `DeferredUntil`, and the \"855 lines, 37 entities\" figure describing it is stale — the file is 897 lines, and the figure lives in three historical delivery-ledger entries rather than in the document itself; find them with `grep -rn \"855 lines, 37 entities\" docs/`).\n- **`#1449` (`#1445`) — the nightly k6 Performance Regression Gate is recalibrated to same-code runner variance.** The gate had gone red 3 of 5 nights on an identical main SHA (board-write p95 observed 2.0–3.0 s either side of the old 2200 ms threshold; 2 of the 5 nights passed, and even a passing night cleared the gate by only ~10%). Tail gates moved to global p99 < 5000 ms / board-write p95 < 4500 ms (~1.5–1.7× worst observed-good; calibration evidence inline in the script comment), the 2000 ms measured-capacity warning retained, warning-band edges now pinned by tests (7/7), and every doc/contract mirror synced. The write tail itself (median ~12 ms, p90 1–2 s at 20 VUs — SQLite write convoy) is tracked as `#1446`, including the sub-order-of-magnitude masking window this calibration accepts. **Confirmed on the first post-recalibration night:** the 2026-07-24 06:06Z nightly (run `30071303816`, on `36d563d7`) passed the Performance Regression Gate, against 3 reds in the 5 nights before it. One passing night is not yet a trend — a fresh red is now real signal and should be read from the k6 numbers before any threshold is touched again.\n- **`#1451` (`#1438`) — `AuditLogRepositoryIntegrationTests` moved onto the workerless factory** (`#1391` family): the live `AuditRetentionWorker` startup pass can no longer race the ordering test's backdated seeds in full-suite runs; 6× consecutive class runs green. Seeded `#1452`: no test anywhere exercises the retention worker's real `ExecuteAsync` startup path (pre-existing gap a flake had been masquerading as).\n- **`#1427` (`#1313`) — the LLM quota-reservation lifecycle is hardened, and a client can no longer erase its own billed usage.** The security half (M1): the streaming and non-streaming `ChatService` surfaces plus the extractor now finalize with `CancellationToken.None` and settle in `finally`, so a client that aborts mid-stream after tokens are billed — including the read-one-token-and-disconnect variant — can no longer discard its own usage record (previously client-controllable). Alongside it: a TTL-swept reservation's real billed tokens are recovered into a committed row instead of being silently dropped (F1, idempotent, warns); `ReservationEstimatedTokens` is floored at 1 so a reservation can never be invisible to the token/global budget sums (F2); the capture-triage reservation settles in `finally` (F4); the release paths are pinned by tests (M2) — provider-throw, zero-token, no-LLM bootstrap, board-context-build throw, and a provider yielding only an error event all **release** the reservation, while cancel-after-billed-tokens is pinned to the **opposite** invariant (`StreamResponseAsync_CancelledAfterBilledTokens_ShouldCommitNotRelease`): once tokens are billed, cancellation must commit and must never release, because releasing there is precisely the bypass M1 closes; and reservation cleanup now wraps request/board-context construction, so a setup failure releases instead of leaking until TTL (Codex P2). **The check-then-insert atomicity guarantee is explicitly NOT closed here** — it was proven not closeable in-process (the reservation over-admits even under a global full-span lock, because of cold-start WAL `-shm` read-visibility), so the redesign it needs (eager `-shm` warm-up, or non-snapshot enforcement) is deferred to `#1435` and routed to the maintainer; the concurrency-guarantee tests are skipped pending that issue, which is why this hardening ships green. Merged on the maintainer's explicit merge-with-tracked ruling; residual review P2s tracked as `#1431`.\n- **`#1448` — FRUGALITY MODE is now *in* the Fable overnight manual** (`docs/agentic/OVERNIGHT_LOOP.fable.md`) instead of being re-pasted into each launch prompt, per the enforcement-ladder rule that an amendment surviving two runs belongs in the manual. Its review round also produced a reusable structural lesson: Codex found sampling-exemption classes one at a time across three rounds, and a single allowlist inversion — only pure mechanical-motion packets are sampleable, while suite/CI verdicts and reviewer/settlement packets never are — closed the whole class at once.\n- **Dependabot:** `#1443` (.NET 8.0.28 → 8.0.29 patch train + Test.Sdk 18.8.1) and `#1440` (npm minor-patch group incl. vue 3.5.40) merged green. `#1441` (actions group) was staged green and then **merged on explicit maintainer authorization** — workflow-file PRs remain maintainer-merge-only. `#1442` (pinia 3→4 MAJOR) was genuinely red and is **closed to snooze**; the migration slice it actually needs is tracked as `#1455` rather than rubber-stamped.\n- **Review-bot estate note:** the consumer Gemini Code Assist GitHub integration is sunset (its farewell notice now posts on every PR) and Copilot review is quota-exhausted — Codex is currently the only live external review bot; the in-house two-lens adversarial pass carries correspondingly more weight.\n\n\n\nFrugal wave (2026-07-18, wave #2 — the follow-on to the approve == apply trust-class closure wave below; **2 PRs merged** — per-PR gate: independent adversarial review, all-severity findings fixed, required CI green):\n- **`#1430` (split from `#1379`) — artefact extraction is now bounded by a permit/concurrency gate.** A new `ArtefactExtractionGate` (Application singleton) takes a non-blocking permit before the parse worker spawns and releases it on both the completed and abandoned paths (a runaway parse holds its permit for its full lifetime); saturation ⇒ a pre-parse `TooManyRequests` with no history row and no new thread. The bound is `ExtractionMaxConcurrency` (`int`, default 2, `[Range(1, 64)]`, startup-validated). This is the verified-sound permit half split out of the parked `#1417` extraction-resource-ceiling work; the decompression-bomb containment half is deliberately **not** here — PdfPig 0.1.15 decodes xref streams with a hard-coded provider before any injected ceiling exists, so a provider-injection ceiling is bypassed (proven on `#1417`) — and continues under `#1429`. Adds **ADR-0047** (artefact-extraction resource bounding: permit gate + provider-injection ceiling as ObjStm-covering defense-in-depth with the documented xref gap) and **ADR-0048** (decompression-bomb containment boundary: a memory-capped extraction worker process — Job Object on Windows / cgroup under Docker — reversing the earlier sidecar rejection on the new evidence).\n- **`#1432` (`#1426`) — `ValidatePermissionsAsync` always gates board access, even for an empty operation list.** The engine previously short-circuited an empty operation list to `Result.Success()` with the board half of the access gate skipped (`boardId` forced to `null`), silently treating an operation-less proposal as permitted and forcing every new consumer to bolt on its own board-access fallback (the `#1415`/`#1425` trap). Now the full requester/board access gate always runs; only the per-operation contract validator is skipped when the list is empty. Emptiness itself is still **not** rejected here by design (a legitimate transient shape for revise-into-validity, `#1423`) — the \"at least one operation\" rejection stays with the structure gate, which runs before permissions in every approve/apply/diff/executor chain, so **approve == apply is unchanged** and the change is strictly additive restriction (a previously-`Success` empty-op result can only become a denial). Chosen over forbidding zero-op proposals at create, which would break the create-empty-then-revise flow `#1423` pins.\n- **Nightly k6 confirmed GREEN:** the first nightly run after the `#1359` repair (run `29632619187` on `326b6b5b`) passed, and the `#1359` failure-ledger row was flipped to resolved (commit `4fdae133`).\n- **Seeded this wave:** `#1429` (memory-capped extraction worker process — the ADR-0048 containment boundary), `#1431`, `#1433`, `#1434`, `#1435`, `#1436`. `#1427` (LLM quota-reservation robustness hardening, `#1313`) sat in the final review gate at the close of this wave and **has since shipped** — see the 2026-07-23/24 wave above; its atomicity redesign remains open as `#1435`.\n- **Standing human-gated holds:** `#1337` (licensing pack — blocked on human-only trademark/name clearance) and `#1295` (deny-floor overlay). On 2026-07-25 the maintainer dispositioned `#1295` explicitly: **keep the evidence, return the PR to draft, retain the human gate, and do not revive it in place.** The branch is conflicting and hundreds of commits behind `main`, all 16 review threads remain unresolved (11 still current, including command-wrapper, root-delete, SQL/container, npm-executor, and Windows parsing bypasses), and its delegation model targets a global floor version the installed floor has long since moved past — so its old green checks establish nothing about current behavior. If `#1293` proceeds, the smallest Taskdeck-specific overlay is to be rebuilt from current `main` once the chosen agent-harness floor is itself reviewed and stable; conflict churn on the ancient branch is not the path.\n\nApprove == apply trust-class closure wave (2026-07-18, **6 PRs merged** — per-PR gate: independent adversarial review, all-severity findings fixed, required CI green): closes the \"a user approves or previews something the executor will then refuse\" (preview == apply) trust-violation class on the server, across the diff, approve, and MCP surfaces (the `#1370`→`#1374`, `#1376`→`#1395`, `#1398` chain).\n- **`#1413` (`#1398`) — the proposal diff now runs Apply's permission/existence gates.** `GetProposalDiffAsync` (both the revised-payload and original-operations paths, before the cached-`DiffPreview` fast-path return) now calls the same `ValidatePermissionsAsync` Apply calls: requester-exists → `404`, board-exists → `404`, board-access → `403`, then the operation-contract validator. Closes the third and last asymmetry from the `#1395` parity round — a reviewer whose board access was revoked (or whose board/requester was deleted) mid-review previewed a clean `200` then failed at Apply. Status-agnostic on purpose: terminal proposals no longer disclose stored board-derived content on preview — access errors (`403`/`404`) surface once the earlier structure/expiry gates pass (a preview denial, stricter than Apply's idempotent short-circuit); an expired, access-revoked proposal still reports expiry first (pinned by `GetProposalDiffAsync_ShouldReportExpiry_NotForbidden_WhenExpiredAndAccessRevoked`).\n- **`#1423` (`#1416`) — Approve runs Apply's structure + permission/contract gates before committing the transition.** `ApproveProposalAsync` validates the effective (revision-aware) operation set: structure → `400`, expiry → `409` (the existing domain-transition contract, deliberately not the diff path's `400` shape), permissions/contract → `400`/`403`/`404`. A zero-op or access-revoked proposal that used to approve `200` and only fail at Apply now fails at approve. Gate ordering (structure → expiry → permissions) mirrors diff/apply; only `PendingReview` runs the gates. Seeded `#1424` (approve/get DTO returns original ops even when a revision exists).\n- **`#1425` (`#1415`) — the MCP `proposal_detail` preview is gated through the diff path.** It no longer emits the raw stored `DiffPreview`: open proposals route through the fully-gated `GetProposalDiffAsync`; decided/terminal proposals serve the stored preview but re-check requester/board access via a new `GetTerminalProposalStoredPreviewAsync` seam, so a reviewer who lost board access is denied the stored preview instead of reading stale board contents through it. The payload gains a `diffPreviewSource` provenance marker (`\"live\"` vs `\"stored\"`).\n- **`#1421` (`#1403`) — SQLite timestamp bounds are parameterized so zero-fraction boundary rows compare correctly.** EF trims trailing fraction zeros (a whole-second instant stores as `...00:00:00+00:00`, no `.`), so the old fixed-width `.fffffff` bound strings mis-sorted at the exact boundary tick. `AuditLogRepository` (`CountByDateAsync`/`DeleteOldEntriesAsync`/`BuildSqliteQueryAsync`) and `OAuthAuthCodeRepository` (`DeleteExpiredAsync`/`TryConsumeAtomicAsync`) now pass `DateTimeOffset` predicates, UTC-normalized (`.ToUniversalTime()`) so the offset-preserving mapping can't mis-compare non-UTC bounds. Seeded `#1422` (repo-wide sweep of remaining timestamp seams).\n- **`#1420` (`#1409`) — removed the dead `ApiKeyService.ValidateKeyAsync` usage-recording path** and its `ApiKey.RecordUsage()` domain helper (zero production callers; a dual-writer trap — MCP auth records usage via `ApiKeyMiddleware`'s `ExecuteUpdateAsync`). `LastUsedAt` is untouched.\n- **`#1419` (`#1418`) — test isolation:** `WorkspaceApiTests` moved onto `HostedWorkerDisabledTestWebApplicationFactory` so the live capture-lane worker can't claim a seeded `Processing` row mid-test (the `#1335` boundary). Test-only.\n\nOvernight correctness + test-reliability wave #2 (2026-07-17, **7 PRs merged** — per-PR gate: independent adversarial review, all-severity findings fixed, required CI green; the late-evening/overnight follow-on to the 11-PR sweep below):\n- **`#1394` (`#1335`) — hosted-worker test-isolation factory.** A new `HostedWorkerDisabledTestWebApplicationFactory` strips app-assembly hosted services from the test host via a shared predicate (also asserted by a dedicated guard test); adopted by `LlmQueueRepositoryIntegrationTests`, `OutboundWebhookDeliveryRepositoryTests`, `AutomationProposalRepositoryIntegrationTests`, and a new `ProcessNextClaimRaceTests` (split out from `QueueClaimRaceTests`, whose CaptureTriage cases need live workers). Kills the hosted-worker pre-emption flake family in full-suite runs.\n- **`#1391` (`#1383`) — AuditRetention integration determinism.** `AuditRetentionRepositoryIntegrationTests` adopts the workerless factory and is hardened (`BackdateEntryAsync` asserts affected==1, InvariantCulture, `ReloadAsync` read-back) — root cause was the live `AuditRetentionWorker` startup pass (90-day cutoff) racing 100/200-day backdated seeds. Empirically pinned the EF SQLite `DateTimeOffset` storage format: `yyyy-MM-dd HH:mm:ss.FFFFFFFzzz` (trailing zeros trimmed).\n- **`#1392` (`#1332`) — deterministic Redis dispose-vs-connect seam.** `RedisCacheServiceTests` now reaches the connect seam through a dedicated named background `Thread` instead of `Task.Run` (eliminates the thread-pool-saturation flake) and disposes its `ManualResetEventSlim`s. Test-only.\n- **`#1395` (`#1376`) — proposal diff now runs apply's structure and expiry gates on every path.** `AutomationProposalService.GetProposalDiffAsync` runs the same gates apply runs (structure, then expiry) on all diff paths including the cached-`DiffPreview` fast path — expired → `400` \"Proposal has expired\", zero-op → `400` \"Proposal must contain at least one operation\" (was `200`/`404`). Extends the `#1374` preview==apply parity contract for the structure/expiry/cached-preview paths; full parity still excludes apply's `ValidatePermissionsAsync` access/existence gates (tracked below). Seeded `#1397` (frontend expired/zero-op preview UX + coverage) and `#1398` (fold `ValidatePermissionsAsync` access/existence gates into diff — the third asymmetry).\n- **`#1396` (`#1387`) — buffered account-export extraction-history N+1 removed.** A new `IArtefactExtractionRepository.GetByArtefactsForUserAsync` batch method (user-scoped IN query, 900-id cap, SQLite TEXT-ordering parity with the old paged path) is fed by the export's 500-id chunks. Seeded `#1399` (the streaming-path N+1, which needs a streaming-safe design).\n- **`#1400` (`#1393`) — production timestamp culture-invariance.** InvariantCulture on 5 hand-built SQLite timestamp string sites (`AuditLogRepository` CountByDateAsync/DeleteOldEntriesAsync + `DateOnly.Parse`; `OAuthAuthCodeRepository` TryConsumeAtomicAsync/DeleteExpiredAsync, now also `.UtcDateTime`-normalized; `KnowledgeFtsSearchService` CreatedAt parse) with hostile-culture regression tests. Seeded `#1403` (the fixed-digit vs EF-trimmed boundary residual).\n- **`#1401` (`#1384`) — MCP per-key rate budget charged once, at the right point.** The 60/min per-key budget is now spent inside `ApiKeyMiddleware` immediately after key resolution, BEFORE the Users lookup + `UpdateLastUsedAsync`, so valid over-quota keys no longer drive auth-stage DB work; the endpoint-stage policy is removed (one budget, checked once) across both co-hosted and standalone pipelines; the `#1381` pre-auth-IP-budget semantics and the `429` contract are preserved. Seeded `#1402` (`UpdateLastUsedAsync` silently never persists — a swallowed EF translation failure) and `#1404` (stale-owner-key IP-budget escape).\n- **Seeded this wave:** `#1397`, `#1398`, `#1399`, `#1402`, `#1403`, `#1404`. **Still open — NOT shipped:** `#1386` (wave-1 final review round) plus the standing human-gated holds `#1295` (deny-floor overlay), `#1337` (licensing pack), and `#1359`.\n\nOvernight substrate + correctness wave (2026-07-17, **11 PRs merged** — per-PR gate: independent adversarial review, all-severity findings fixed, required CI green; full backend suite reported 7223 passed / 0 failed / 1 skipped post-`#1373`):\n- **`#1373` (`#1282`) — the API test factory now mirrors production SQLite settings.** A new shared `UseTaskdeckSqlite` registration helper in Infrastructure is used by BOTH production DI and the integration test factory, so WAL/busy-timeout drift between them is now structurally impossible; retires the `test/sqlite-concurrency` ledger flake.\n- **`#1375` (`#1298`, REVIVAL-02 Phase-1 ship gate) — removed the fake Paper review undo timeline** and replaced the reversibility copy with factual apply-risk guidance (\"Apply considerations\"), while the confidence label now renders \"Operation safety\"; the stable side-effect wire shapes are preserved for GP-03. Full contract detail is in the 2026-07-17 REVIVAL-02 note directly above — not duplicated here.\n- **`#1374` (`#1370`; seeded `#1376`) — proposal preview aligned with apply for reorder/collision/structure.** The clamped reorder position is surfaced in the diff, create-card id collisions fail at validation with a stable `409`, and a shared `ProposalOperationStructureValidator` runs before original-proposal diffs (one source of truth with Apply). A true preview==apply parity contract test was added.\n- **`#1372` (`#1367`) — the standalone MCP host-security guard now mirrors `HostFilteringMiddleware` exactly.** It fails closed on all zero-host `AllowedHosts` shapes (`\";\"`, `\";;\"`, blank) while preserving port-suffixed / whitespace-bearing literals; a new in-process standalone-host integration test carries a mutation proof.\n- **`#1377` (`#1357`) — the concurrent-migrator test asserts final schema state** (any-`SqliteException` collision signature, at most one fault, exact `__EFMigrationsHistory` equivalence) instead of no-throw; adds a deterministic fail-open collision test and an `AcquireLock` exclusivity contract test (internal seam). Retires the windows-latest migrator flake.\n- **`#1378` (`#1369`; `#1379` expanded to a hard wiring gate) — artefact extraction is bounded by a wall-clock budget** (`Artefacts:ExtractionTimeoutSeconds`, default 30s) with warning-bearing `extraction-timeout` history rows and abandoned-task handling; real PdfPig / plain-text extractors are exercised through the budgeted path.\n- **`#1362` (`#1274`, P-I ship gate; seeded `#1363` earlier, `#1380`, `#1382`) — core E2E is re-pointed at Paper-default sessions** with explicit frozen-Legacy opt-outs (builds on the 2026-07-14 Paper-default alignment paragraph above, which it does not restate). Adds full axe WCAG 2.1 A/AA on Home/Today/Inbox/Review/seeded Board/Login, a real capture → review → apply lane with a hard-asserted confirmation dialog, a `PaperBoardCard` nested-interactive fix + focus-follows-selection, `--faint` token contrast floors, and a Boards shortcut ledger.\n- **`#1366` (`#1365`, `#1371`) — the presence stress test proves join/leave broadcast delivery** (not just tracker membership) with fail-closed controls; 15/15 consecutive runs post-`#1373` parity.\n- **`#1385` (`#1355`) — buffered account-export artefact blob loads are now batched.** A new `SourceArtefactRepository` batch blob-load feeds the buffered GDPR export in bounded chunks (idiomatic `Chunk()`), with a batch-id-count guard against the SQLite parameter limit (pass-side boundary pinned at 900 ids) and export-JSON round-trip + missing-blob contract tests. Closes the LOW efficiency finding seeded from the `#1341` security review.\n- **`#1381` (`#1368`) — the MCP pre-auth per-IP limiter is now a failure budget with admission control.** Budget is spent only on authentication failures (successful auth never consumes, so multiple keys behind one egress address keep independent per-key budgets); an exhausted address is rejected before the API-key lookup via non-consuming inspection; a per-IP concurrency gate (`RateLimiting:McpAuthenticationPerIpConcurrency`, default 16) caps in-flight pre-auth work; consumption is abort-proof (an auth-failed marker set before the 401 write is consumed in a `finally`, so abort-storms still spend budget); trusted forwarded headers now also apply to the standalone MCP host (default OFF — XFF is never trusted from an unknown peer).\n- **`#1390` — same-night hotfix of the `#1377` fail-open collision test.** The barrier design flaked an unrelated PR in the opposite direction of the flake it covered (run 29552875836: fast runners let the winner finish the whole chain before the loser applied anything, failing the required-collision assertion). The test now stages the interception structurally — migrator A runs alone until `__EFMigrationsHistory` polling proves it mid-chain, then B is released — and a pathological staging miss passes gracefully with a loud `WARNING: STAGING MISSED` diagnostic, so the test can never flake an unrelated PR again.\n- **Seeded follow-ups:** `#1376`, `#1379`, `#1380`, `#1382`, `#1383` (AuditRetention flake), `#1384`, `#1387`, `#1388`. **Still open — NOT shipped:** `#1386` (final review round in flight), plus the standing human-gated holds `#1295` (deny-floor overlay), `#1337` (licensing pack), and `#1359`.\n\nRevival + generalist-expansion wave delivery (2026-07-13, **15 PRs merged** — the revival/GEN direction is now live on `main`; per-PR review gate: independent adversarial reviews, all-severity findings fixed, real merge conflicts resolved, required CI green after the `#1352` CI-Extended fix):\n- **Direction ratified:** `#1296` (ADR-0044 revival pivot — open-beta direction + REVIVAL_PLAN spine + canonical doc sync), `#1328` (ADR-0046 generalist expansion — artefact intake + dossiers, Phase 4; the twin generalist app stays deferred behind the GEN-12 `#1326` evidence gate), `#1312` (ADR-0045 LLM transcript-triage engine, REVIVAL-08 M1). **ADR-0044 / ADR-0045 / ADR-0046 are all now Accepted.**\n- **Generalist expansion (GEN wave, ADR-0046):** `#1341` GEN-01 artefact-storage foundation (immutable user-owned `SourceArtefact` + blobs; claims-scoped, IDOR-safe upload/download/delete with a race-safe in-transaction board-access recheck; streaming size caps preserving HTTP 413; magic-byte content validation; FK cascade + GDPR export/delete — independently security-reviewed, no CRITICAL/HIGH) → `#1346` GEN-02 bounded local text extraction (plain-text / Markdown / PdfPig, immutable warning-bearing extraction history); `#1339` GEN-05 apply due dates + labels from proposals (closes the extract-but-unappliable gap — also fixed a latent bug where a tautological guard silently cleared a column's WIP limit on *every* reorder, and made proposal reorder atomic/lossless with the destination position shown in the approval diff); `#1340` GEN-09 untrusted-artefact threat model + injection canaries; `#1342` GEN-10 generalist-friendly guided navigation.\n- **Revival (ADR-0044):** `#1334` REVIVAL-01 registration gating by deployment mode (Open / InviteOnly / Closed; operator-minted bootstrap invite; new `AddRegistrationGating` migration) → `#1344` REVIVAL-05 Paper first-run onboarding (real capture → reviewed proposal → board-apply milestone; fail-closed registration availability; theme-aware on-ember CTA contrast + restored Legacy focus ring); `#1329` REVIVAL-04 self-hosted Paper fonts + branding metadata; `#1331` README rewrite for the revival beta; `#1333` de-stubbed the fabricated Today dossier (`#1272`, latest-request-wins guard).\n- **Infra / harness / ops:** the maintainer first merged the linchpin `#1352` (systemic CI-Extended reusable-workflow permission `startup_failure`, `#1330`) plus dependabot `#1351` / `#1349` to unblock the deck; this session then merged `#1294` (harness T3 region maps + skill read-first diet, `#1291`) and `#1336` (overnight human-action + failure-ledger record, `#1327`).\n- **MCP HTTP security boundary (`#1338`):** standalone and co-hosted Streamable HTTP now share the only `MapMcp(\"/mcp\")` registration; API-key auth, telemetry, user-scoped resources, pre-authentication IP throttling, and opaque-key-ID rate limiting run on that exact route, while `/` is no longer an alternate MCP endpoint. The route explicitly disables browser CORS. Standalone defaults to loopback and replaces blank or any-host configuration (`*`, `0.0.0.0`, `[::]`, including mixed lists) with an exact loopback allowlist; remote binds require explicit host configuration and TLS termination.\n- **Seeded follow-up:** `#1355` (batch the buffered-export artefact blob loads — LOW efficiency finding from the `#1341` security review). **Human-gated, NOT merged:** `#1295` (deny-floor overlay — 16 unresolved review threads including a CRITICAL, needs remediation) and `#1337` (licensing pack — blocked on human trademark clearance).\n\n\n\n\n\n\n\nWave-6 backend + run-story delivery (2026-06-26, **3 PRs merged**; full review gate per PR — independent adversarial reviews, all-severity findings fixed, Codex bot threads resolved, fresh green CI + aging):\n- **`#1236` (`#1195`) — bounded the `LlmQueueToProposalWorker` status reads at the database.** Replaced the unbounded `GetByStatusAsync` worker reads with **type-aware in-query bounded reads** (`GetOldestPendingNonCaptureAsync` / `GetOldestProcessingCaptureAsync` + `CountPendingNonCaptureAsync` / `CountProcessingCaptureAsync` for true backlog telemetry). Two adversarial reviews + Codex independently caught a **HIGH starvation regression** in the original generic-limit design (bounding raw status before the request-type filter lets older untriaged capture rows starve non-capture automation work) → re-architected to predicate-in-query bounded reads (SQLite raw-SQL `ORDER BY CreatedAt ASC LIMIT` + in-memory re-sort). The unbounded `GetByStatusAsync` is kept for full-set callers (health gauge, OpsCli) and is **GDPR-safe** (delete/export use `GetByUserAsync`). Seeded `#1237` (remaining unbounded Pending reads in `LlmQueueService`/`OpsCliService`).\n- **`#1238` (`#1193`) — paged `CaptureService.ListAsync` from the database.** New capture-only `GetCapturesByUserAsync(userId, limit, offset)` (newest-first `ORDER BY CreatedAt DESC, Id`, SQLite raw + EF) replaces loading the user's entire `LlmRequest` history then filtering/paging in memory; a fetch-until-enough loop with a `seenIds` dedup guard keeps filtered queries correctly filled across OFFSET page boundaries. `GetByUserAsync` untouched → GDPR-safe. Seeded `#1239` (push board/status filters into SQL).\n- **`#1240` (`#1131`) — made the self-contained desktop exe runnable without manually supplying a connector key.** `ShouldAutoGenerateConnectorKey(isProd, isHeadless) => !isProd || !isHeadless`: a desktop install (Production, not headless) auto-generates + persists the connector encryption key to `appsettings.local.json`; **headless Production (CI / container / Terraform) still hard-fails** without a supplied stable key (`backend.Dockerfile` sets `TASKDECK_HEADLESS=true` so every container image is classified headless). The AWS single-node Terraform `user_data` generates+persists the key onto the durable EBS data volume (refusing to regenerate when a DB already exists without a key), `scripts/backup.sh`/`restore.sh`/`restore.ps1` keep the key paired with the database, and a deep review loop hardened the persistence path against silent key loss (reuse a masked persisted key instead of overwriting it; self-heal a corrupt local config; case-insensitive + provider-lenient reads; read-vs-parse error separation; owner-only ACL on the restored key). **`ADR-0041`** records the decision. ~15 distinct review findings (1 HIGH + many P2) across 6 Codex rounds + a 2-lens adversarial sweep, all fixed with tests.\n- **ADR added on main:** `ADR-0041` (desktop connector-key auto-generation; headless Production excluded).\n- **Seeded follow-ups:** `#1237` (bound remaining unbounded Pending reads) **— shipped (`#1250`)**; `#1239` (push capture board/status filters into SQL) **— board pre-filter shipped 2026-06-30 (`#1254`); the status filter stays in-service (provenance-derived), so `#1239` remains open for that portion**. Shipped from earlier: `#1241` (Windows ACL on the desktop key file) **— 2026-07-02 (`#1263`)**. Still open from earlier: `#1242` (relocate persisted secrets to the durable app-data location).\n\nCanonical UI + historical archive period (2026-06-13; direction superseded 2026-07-10):\n- **Historical direction only:** from 2026-06-13 until ADR-0044 on 2026-07-10, the project direction was finish-for-personal-use, then archive, with no distribution. **That posture no longer controls execution.** The revival direction at the top of this file and `docs/REVIVAL_PLAN.md` are authoritative; previously de-scoped distribution work is re-triaged only where the ratified REVIVAL wave admits it.\n- **Paper is the canonical UI AND now the DEFAULT theme** per **ADR-0038** — the **Wave-3 default-theme flip shipped 2026-06-27**: `paperThemeStore` defaults to `'paper'` (was `'off'`), the storage key is bumped to `td.paper.mode.v2` with a one-time migration (a deliberate pre-flip `paper`/`paper-night`/`auto` choice carries over; a stored `'off'` — the old default / never-opted-in — and absent/invalid fall through to the new `'paper'` default), and the legacy `.td-*`-selector E2E specs pin Legacy via `authSession` (`td.paper.mode.v2='off'`). Legacy stays reachable through the Appearance toggle. **Activation prerequisites shipped earlier (2026-06-19):** the `#1161` \"File away\" dismiss affordance (`#1219`), the shared review-actionability composable (`#1217`), light-theme straggler tokenization (`#1216`), and a **real in-app Appearance theme toggle** (`#1221`, `AppearanceSettingsView` at `/workspace/settings/appearance` — off / paper / paper-night / auto) which replaces the unlinked `/styleguide/paper` route as the reachable Legacy escape hatch. **Paper-review de-stubs now shipped (2026-06-27):** `onPreviewDiff` (`#1234`), plus `onDefer` (snooze 1h — net-new `DeferredUntil` timing field + `POST /api/automation/proposals/{id}/defer`, the proposal leaves the queue and resurfaces without expiring, **ADR-0042**) and `onReportBadSuggestion` (net-new content-free `ProposalFeedback` table + `POST /api/automation/proposals/{id}/feedback`, orthogonal feedback that never changes status, **ADR-0043**) — **which unblocked the Wave-3 default-theme flip, now shipped (see above).** **All new frontend UX work targets the Paper views; Legacy is frozen** (no new fixes). The ~26 routes without Paper variants keep rendering Legacy views inside the Paper shell after a contrast pass.\n\nArchive-pivot delivery wave (2026-06-13, **17 PRs merged** across Waves 0–2, including 2 follow-on dependabot bumps `#1211`/`#1212`; **plus 4 follow-on PRs merged 2026-06-19** — `#1219`/`#1220`/`#1221`/`#1225`, see the \"Merged 2026-06-19\" sub-section below — for **21 total**; full review gate per PR — 2 independent adversarial reviews, all-severity findings fixed, Gemini/Codex/Copilot bot threads resolved, fresh green CI + aging):\n- **Wave 0 — PR deck cleared (7 PRs):** dependabot npm `#1202` + nuget `#1203` group bumps; automation-chat composable cleanup `#1199` (isDisposed guard on the unguarded `loadBoardOptions().then()` continuation); false-green E2E re-enabled on real Paper selectors `#1197` (the 7 `fixme`'d specs cover features that exist under Paper — paper-night class, dark-Paper toggle, PaperShortcutsOverlay, workspace-mode selector); queue-claim race fix `#1200` (the raw-SQL claim now `Reload()`s so the returned DTO shows Processing instead of a stale Pending identity-map entity — seeded `#1209` for the remaining non-capture stuck-in-Processing sweeper gap); **SDK pin + Central Package Management `#1196` (ADR-0039)** — carried the `#1203` NuGet bumps into `Directory.Packages.props` and copied `global.json` into the backend Dockerfile; **ExpiresAt UTC convention `#1201` (ADR-0040)** — global `ConfigureConventions` DateTimeOffset materialization so SQLite reads come back UTC.\n- **Wave 1 — decision + cheap foundations (3 PRs):** **ADR-0038 ratified — Paper is the canonical UI, Legacy frozen `#1207`** (STATUS + masterplan now state the canonical stack; storage-key migration deferred to the Wave-3 flip); `#1139` AC1 compose-secret quickstart docs `#1205` (README + `docs/ops/DEPLOYMENT_CONTAINERS.md` now name BOTH required secrets, since compose aborts on a missing `TASKDECK_CONNECTORS_ENCRYPTION_KEY`); `*.migrate.lock` gitignored + `.dockerignore` mirror `#1204` (the SerializedMigrator sidecar no longer dirties `git status` on every startup).\n- **Wave 2/6 — Paper activation prerequisites + backend quality (5 PRs):** paper-night straggler tokenization `#1216` (`#1135` — KeyboardShortcutsHelp border + full-opacity WCAG focus ring; seeded `#1218` for the repo-wide `focus:ring-primary/50` contrast sweep); **shared review-actionability composable `#1217`** — extracted `isProposalApplyActionable` / `isProposalRejectActionable` / `isProposalApproveActionable` / `isProposalDismissable` / `isProposalStale` as pure functions in `useReviewProposals` so Paper and Legacy can never drift at the 24h-stale or Approved+expired boundaries (the `#1124` bug class is now fixed once, not twice), and de-stubbed the fabricated `4s · 1.2k tokens` author metadata in favour of the real `/confidence` value; dead-code removal `#1198`/`#1214` (see below); Redis lock-starvation fix `#1213` (`#1189` — dropped the in-lock retry loop and the 3s blocking Connect inside the lock; single attempt per throttle window → null/no-cache fallthrough, proven by deterministic regression guards); **one-command dev-up + clean-workspace scripts `#1208` (`#1140`)** — `dev-up.ps1/.sh` (dependency check, `%LOCALAPPDATA%` DB path to fix the CWD-dependent `taskdeck.db`, port-bound API via `--no-launch-profile --urls`, `/health/ready` poll, npm dev, optional `-Seed demo/demo123`) and `clean-workspace.ps1/.sh` (stray DBs/migrate-locks/logs, process-held-DB refusal), with recursive process-tree kill, live-PID-file refusal, and a `.migrate.lock` guard against deletion during an active migration; the dev-up DB-pinning path was live-smoke-verified before merge.\n- **ADRs added on main:** `ADR-0038` (Paper UI canonical / Legacy frozen), `ADR-0039` (Central Package Management, SDK pin, 8.x dependency alignment), `ADR-0040` (global UTC DateTime materialization for SQLite).\n- **Seeded follow-ups:** `#1209` (no sweeper recovers non-capture `LlmRequests` stuck in Processing) **— shipped 2026-06-30 (`#1256`)**; `#1215` (`FieldVerifier`/`DeterministicPreExtractor` registered-but-unconsumed after V1 removal) **— removed as dead code 2026-07-04 (V2 generator cancelled by the archive pivot; the transitively-orphaned `FuzzyTextMatcher`, `FieldVerificationResult`, `ExtractedEntity`, and the `Microsoft.Recognizers.Text` packages were swept with it)**, `#1218` (repo-wide focus-ring contrast sweep) **— shipped 2026-07-02 (`#1265`)**.\n- **Merged 2026-06-19** (maintainer lifted the merge hold; all four shipped to `main` after 2 independent adversarial reviews, all-severity findings fixed, fresh green CI):\n - `#1219` (`#1161`) — Paper review \"File away\" dismiss affordance built on the `#1217` shared-actionability foundation (per-proposal filing rail in terminal states + bulk \"File away N settled\" + dual-purpose ⌫). Closes `#1161`.\n - `#1221` — reachable in-app **Appearance** theme toggle (`AppearanceSettingsView` at `/workspace/settings/appearance`; off / paper / paper-night / auto), the reachable Legacy escape hatch that replaces the unlinked `/styleguide/paper` route — a Paper-activation prerequisite.\n - `#1220` — canonical-docs reconciliation with the archive-pivot direction (14 Codex review rounds + 3 multi-agent drift sweeps; ~70 banner-vs-reality edges fixed).\n - `#1225` — `StackExchange.Redis` + `Microsoft.AspNetCore.SignalR.StackExchangeRedis` semver-major caps (dormant Redis under the archive pivot).\n\nDead-code removal (2026-06-13, `#1198`): deleted the unused `ProposalGeneratorV1` — the `IProposalGenerator` interface (incl. its V1-only `ProposalGenerationResult`/`GeneratedProposal` result DTOs), its sole DI registration, and its test class — after confirming **zero consumers** inject `IProposalGenerator` (the only non-definition reference was the DI line). This resolves the tracked partial-entity-tracking bug in `#1198` by removing the unreachable code path rather than patching it. The shared `FieldVerifier`/`IFieldVerifier` and `DeterministicPreExtractor`/`IDeterministicPreExtractor` utilities (V1 was their only consumer but each has standalone tests and DI registration) are retained for a future V2 generator. Build clean, Proposal-filtered backend tests green.\n\nSecurity gate + hardening epic (2026-06-05/06, 5 PRs merged; **2 independent adversarial reviews per PR** plus Gemini/Codex bot reviews, all findings of every severity fixed or tracked, merges gated on green CI + aging):\n- **#1132 (security gate + config hardening) delivered across 4 PRs**: a single ≥32-char JWT secret floor (`JwtSettings.MinSecretKeyLength`) with **fail-fast** registration (throws instead of silently no-op'ing auth) + CORS that **fails closed** in Production when no origins are configured (`#1169`, AC2/AC3); required **secret/dependency/SAST scans + the bundle-size budget promoted into the PR merge gate** (`#1170`, AC1/AC5), with **phased enforcement** per **ADR-0035** (gitleaks + bundle enforcing; dependency + SAST advisory pending baseline remediation) and the pre-existing Semgrep `pkg_resources`/`setuptools-82` crash fixed; a global default-deny `AuthorizationOptions.FallbackPolicy = RequireAuthenticatedUser` with an explicit `[AllowAnonymous]` audit (SPA fallback opt-out; the API-key MCP path now sets an authenticated principal in `ApiKeyMiddleware`) per **ADR-0036** (`#1176`, AC4).\n- **#1133 (backend query perf, first slices — `#1171`)**: `NotificationRepository.GetByUserIdAsync` now pushes ORDER BY + LIMIT/OFFSET into SQL (SQLite raw-SQL path for `DateTimeOffset` ordering, fully parameterized, negative-clamp guard) instead of materializing every row; `.AsSplitQuery()` on `CardRepository` collection reads. SignalR-incremental-refetch and FTS card-search remain open on `#1133`.\n- **#1131 AC1 (CLI hardening — `#1177`)**: the CLI provisions a connector encryption key on first run (CSPRNG 256-bit, atomic merge-preserving write under a cross-process mutex, `0600` perms, stderr-only diagnostics) so `taskdeck boards list` works on a clean machine; guarded the `Mutex` ctor against locked-down hosts and honored the documented `TASKDECK_CONNECTORS__ENCRYPTIONKEY` override. CLI authorization routing is **#1131 AC2** (deferred).\n- **New ADRs**: `ADR-0035` (required security-scan merge gate), `ADR-0036` (default-deny authorization fallback). **Seeded follow-ups**: `#1172` (AccountDeletion notification paging), `#1173` (branch-protection registration of the new check contexts — a repo-settings action), `#1174` (per-advisory dependency allowlist / break-glass), `#1175` (security-baseline remediation incl. the `NuGet.CommandLine`-via-Recognizers.Text transitive, then flip dependency/SAST to enforcing), `#1178` (apply the CLI's `0600` + guarded-mutex hardening to the API `FirstRunBootstrapper`).\n\nPost-audit correctness sweep (analysis 2026-05-31; landed as reviewed PR 2026-06-04): audited all 31 PRs merged since 2026-05-28 for CC 2.1.154–2.1.158 tool-channel corruption fallout. Results: **0 SUSPECT, 0 NO-OP, 31 CLEAN** — no corruption artifacts. Full build/test suite green (6,735 BE + 3,662 FE tests). Fan-out correctness review (4 agents, 219 tool calls) found 2 issues + 9 nitpicks, all addressed:\n- **Fixes applied**: `useGlobalSearch` dispose-race guard on the success, catch, and finally branches (no reactive writes after teardown); `useCaptureQueueSync` fire-and-forget replays switched to `void replayQueue()` (replayQueue wraps its body in try/catch/finally and logs internally, so the prior empty `.catch(() => {})` was dead code); Ollama `appsettings.json` BaseUrl changed from empty string to `null` with a clearer validation message pointing at the real `Llm:Ollama:BaseUrl` section; `RoadmapInvariantTests` placed in a named xUnit `[Collection]` so any future TelemetryGuard-mutating test class in the same assembly stays serialized with INV-11; `AutomationMetricsController` TODO comment replaced with honest stub note referencing `#1142`.\n- **PR #1160 review fixes**: two independent adversarial passes plus Gemini/Codex/Copilot bot reviews refined the sweep — the dispose-race guard was extended to the catch paths, the dead replay `.catch` became `void`, and the Ollama hint was corrected from the non-existent `LlmProviders:` path to `Llm:Ollama:BaseUrl`.\n- **Documented**: `AutomationMetricsController.GetCohortMetrics` is a stub returning empty data — `CohortDashboard` frontend works but will show \"No cohort data available\" until `ICohortMetricsService` ships (tracked in `#1142`). `OllamaLlmProvider.StreamAsync` uses pseudo-streaming (complete-then-drip), not Ollama's native streaming API.\n\nCleanup/hardening wave (2026-05-31, 8 PRs merged, 2 issues closed; 2 adversarial review passes per PR with all findings of every severity fixed and all bot threads resolved):\n- **Open-PR backlog cleared** (`#1143`–`#1147`): non-watch `vitest run` + MetricsView flake fix (`#1143`), docs-truth corrections (`#1144`), CI-aligned release scripts + stale PKG-01 warning removed (`#1145`), duplicate operation idempotency-key now returns **409 not 500** (`#1146`), `AsSplitQuery` on the multi-collection board read (`#1147`).\n- **Proposal endpoint hardened** (`#1125`/`#1151`): new `ProposalOperationInputValidator` rejects malformed operation input (markup/binary `actionType`/`targetType`, non-JSON / oversized / over-nested `parameters`) with **400** at the shared create path, using a permissive identifier-format check so it never rejects legitimate planner/chat/capture/MCP operations. Adversarial review caught a self-introduced HIGH (a null `operations` element → 500) which was fixed before merge.\n- **Roadmap invariants enforced** (`#1126`/`#1153`): INV-10 (MCP hash-pin), INV-11 (TelemetryGuard), INV-12 (provenance source spans) un-skipped with real assertions against the shipped services; only INV-09 (DataFlowRegistry, genuinely unbuilt) remains skipped. Surfaced that `McpToolDefinitionHashService` is registered but **not wired into the MCP runtime** (tracked `#1154`).\n- **Swallowed audit failures surfaced** (`#1134` first slice / `#1155`): the 4 copy-pasted empty-catch `SafeLogAsync` (Board/Card/Column/Label) now route through a shared `AuditLogWriter` that logs at **Warning** on a thrown exception or a returned failed `Result`, keeping the never-crash intent.\n- Seeded follow-ups: `#1149` (idempotency-key contract ADR), `#1150` (packaging-doc trim drift), `#1152` (Queue/V1 validator bypass), `#1154` (MCP hash wiring). `#1134` stays open for its remaining 6 acceptance criteria.\n\nContinuous-cycle wave (2026-05-29, 19 PRs merged, zero open PRs): cleared the entire open-PR backlog with two adversarial reviews per PR and all findings (all severities, including bot comments) addressed.\n- **RFAI roadmap complete**: RFAI-11 (`#983`/`#1079`, ambient channel — VS Code extension + voice prototype; voice composable is tested but not yet wired into any UI component) and RFAI-12 (`#984`/`#1080`, Ollama provider, ProvenanceDrawer, cohort dashboard shell) delivered. All 12 RFAI issues now shipped. **Note:** `CohortDashboard` frontend is wired but backend returns empty data (stub); `OllamaLlmProvider.StreamAsync` uses pseudo-streaming; `useVoiceCapture` has no UI integration yet. These are tracked in `OUTSTANDING_TASKS.md`.\n- **Composable hardening**: unhandled promise rejections (`#1093`/`#1095`), cleanup/memory-leak fixes with `onScopeDispose` (`#1094`/`#1104`), FilterPanel aria-labels (`#1097`/`#1098`).\n- **Identity/authz hardening**: an audit confirmed all 42 API controllers are claims-first with zero bypass risk; migrated `TelemetryController`/`EgressDisclosureController` onto `AuthenticatedControllerBase` (`#1109`/`#1111`) and added architecture guards enforcing per-action `[Authorize]`/`[AllowAnonymous]` (`#1110`/`#1116`).\n- **Dependency wave**: nuget/npm minor-patch groups, YamlDotNet 18, and a dotnet group (EF8/9 split fixed) merged; FluentAssertions moved to the free **7.x** line (`#1088`) instead of paid v8; durable dependabot `ignore` rules added for EF Core and FluentAssertions majors (`#1112`, `#1118`) so those churns stop recurring.\n- **Housekeeping** (`#1092`): STATUS.md contradiction fixed; v-for key stability (`#1107`/`#1108`); 112 stale stashes cleared and stale branches pruned.\n
\nStatus Owner: Repository maintainers\nAuthoritative Scope: Current implementation, verified test execution, and active phase progress\nCompanion Active Docs:\n- `docs/STATUS.md`\n- `docs/IMPLEMENTATION_MASTERPLAN.md`\n- `docs/TESTING_GUIDE.md`\n- `docs/MANUAL_TEST_CHECKLIST.md`\n- `docs/GOLDEN_PRINCIPLES.md`\n\n## Project Summary\n\nTaskdeck is a local-first execution system for developers, built with a .NET 8 backend and a Vue 3 frontend.\nCore board workflows are stable, and advanced slices are implemented for automation proposals, chat, ops/log querying, archive recovery, and worker health reporting.\n\nRebranding thesis (2026-02-23):\n- capture should be near-zero friction\n- automation should remain review-first and provenance-visible\n- product value is reducing maintenance overhead, not maximizing opaque autonomy\n\nBulk merge wave (2026-05-16, PRs `#1055`–`#1074`, 15 PRs, all with 2+ rounds of adversarial review):\n- **Security hardening** (3 PRs): redirect handler buffer/header filtering (`#1055`), hardcoded encryption key removal + RBAC on abuse endpoints (`#1067`, SEC-31/SEC-32), health endpoint exception detail suppression (`#1068`, SEC-33)\n- **Test coverage** (2 PRs): MFA, API Keys, Board Access controller tests (`#1069`, TST-62), ConnectorProviders API + useAutomationChat composable tests (`#1072`)\n- **RFAI feature delivery** (5 PRs): `IProposalGenerator`/`FieldVerifier`/`ProposalGeneratorV1` (`#1071`, RFAI-03), revision endpoints + edit-before-approve flow (`#1058`, RFAI-04), Paper Review deep-dive frontend wiring (`#1062`, RFAI-05), egress disclosure API endpoint (`#1073`, RFAI-08), privacy insights API for proposal outcome cohorts (`#1074`, RFAI-08)\n- **PAPER frontend** (2 PRs): Today dossier real backend API wiring (`#1056`, PAPER-08), narrow companions with sidebar variants + board snap scroll (`#1057`, PAPER-11)\n- **Dependency updates** (3 PRs): `actions/dependency-review-action` 4→5 (`#1059`), npm minor/patch group 11 updates (`#1060`), NuGet minor/patch group 4 updates (`#1061`)\n- Post-merge verification: 6,532 backend tests pass (0 failures), 3,267 frontend tests pass (0 failures), both builds clean\n- Roadmap v4 RFAI progress: RFAI-01 through RFAI-09 now fully delivered (9 of 12 issues); remaining: RFAI-10 (PWA share-target), RFAI-11 (ambient channel), RFAI-12 (learning loop UI + beta gate)\n- PAPER progress: PAPER-03 (shell), PAPER-08 (today dossier), PAPER-11 (narrow companions) now delivered; remaining: PAPER-05 (board/kanban surface)\n\nPost-merge follow-up (2026-05-17, PRs `#1076`–`#1078` and `#1082`–`#1084`, 6 PRs merged after the bulk wave; `#1079`/`#1080` remain open):\n- **RFAI-10** (`#982`/`#1078`): PWA share-target quick capture with offline queue, browser extension prototype, share captures preserved after auth rejection, ambiguous POST provenance fail-closed; issue closed\n- **PAPER-05** (`#1001`/`#1083`): Paper board card drag E2E test with audit-log assertion\n- **Bug fix** (`#1077`): Encoding artifact in PaperBoardCard drag handle\n- **Test coverage** (`#1076`, `#1082`, `#1084`): MFA setup 409-Conflict integration test (`#1076`, TST-63), composable unit tests for inkBleed, reviewKeymap, useInboxOrchestrator, useReviewProposals\n- Roadmap RFAI progress: 10 of 12 delivered; 2 remaining (RFAI-11 `#1079`, RFAI-12 `#1080`)\n- PAPER progress: all 4 PAPER issues now delivered (PAPER-03, PAPER-05, PAPER-08, PAPER-11)\n\nAgentic operating layer expansion (2026-05-11):\n- Taskdeck now has a shared agentic protocol layer under `docs/agentic/` for blocker-question batching, failure/workaround capture, guide-update promotion rules, and skill routing.\n- `autodoc/AGENT_INDEX.md` is the fast agent seam map for low-context orientation, context traps, and verification hints; it is a pointer layer, not canonical product truth.\n- Codex and Claude skill mirrors now include `taskdeck-question-batch`, `taskdeck-failure-capture`, and `taskdeck-interface-map`.\n- Claude project hooks now route dangerous shell-command checks and failed-tool capture through `scripts/agent_hooks/`, while preserving existing Taskdeck-specific pre-commit and PR-review reminders.\n- Codex and Claude tool parity is explicit in `docs/agentic/AGENT_TOOL_PARITY.md`; Claude `.mcp.json` now mirrors the shared MCP baseline with OpenAI docs, GitHub, Context7, Playwright, Chrome DevTools, and Docker gateway access.\n\nPaper backend gap delivery (2026-05-05, PRs `#1031`--`#1040`, 10 of 10 issues `#1015`--`#1024`):\n- 10 Paper backend gaps delivered or merge-ready with two rounds of adversarial review per PR; ~480 new backend tests across the delivered set; bot review findings (Gemini Code Assist + Codex connector) addressed on delivered PRs\n- **Today dossier backends** (4 endpoints on `TodayController`, required by PAPER-08 `#1004`):\n - Cadence aggregation (`#1015`/`#1031`): `GET /api/today/cadence?date=` returns 24-hour activity buckets with first/peak/last action timestamps; `CadenceBucket` and `CadenceSnapshot` value objects with cached `Empty()` singleton; queries `IAuditLogRepository`; 26 tests\n - Streak query (`#1016`/`#1032`): `GET /api/today/streak?days=90` returns 90-day streak with intensity buckets (quartile-based) and current/longest streak lengths; `StreakDay`/`StreakResult` value objects; server-side `GROUP BY` via `CountByDateAsync` (replaced 100k entity load after review); 61 tests\n - Seal day action (`#1017`/`#1037`): `POST /api/today/seal` and `GET /api/today/seal?date=` for idempotent day-sealing with `DailySnapshot` entity; EF Core migration with unique index on `(UserId, Date)`; `UnitOfWork` unique constraint handler for concurrent seals; CancellationToken threaded through all layers after review; 28 tests\n - Line for tomorrow (`#1018`/`#1035`): `GET /api/today/tomorrow-note?date=` and `PUT /api/today/tomorrow-note` for autosave-friendly upsert; `TomorrowNote` entity (500 char max); 204 NoContent for missing notes; concurrent upsert race-condition handling via `UnitOfWork`; 25 tests\n- **Review deep-dive backends** (6 endpoints on `AutomationProposalsController`, required by PAPER-06 `#1002`):\n - Provenance rows (`#1019`/`#1039`): `GET /api/automation/proposals/{id}/provenance` returns `ProvenanceRowDto[]` with icon/key/value/weight; 26-entry icon map; weight bucketing from `ProvenanceField` confidence; FK migration added after review; `Math.Round` for confidence display; 41 tests\n - Side-effect analysis (`#1020`/`#1033`): `GET /api/automation/proposals/{id}/side-effects` returns 7-category breakdown (Cards/Subtasks/Comments/Activity/Notifications/Webhooks/Calendar) with active/passive tone and risk-based reversibility window (6h default, 3h for Critical); review fixed target-type checks and webhook-without-operations logic; 66 tests *[2026-07-17: the `windowMs` field is legacy review-attention metadata, not an undo capability — no revert endpoint exists; copy/semantics reframed to apply-risk guidance by REVIVAL-02 `#1298`, wire shape unchanged]*\n - Confidence breakdown (`#1021`/`#1036`): `GET /api/automation/proposals/{id}/confidence` returns 4-component weighted breakdown (Pattern match 0.30, Reach 0.20, Reversibility 0.35, Recency 0.15) with threshold and explanatory note; review fixed reach formula, promoted weights to static field, removed unused userId; 63 tests\n - Conflict detection (`#1022`/`#1040`): `GET /api/automation/proposals/{id}/conflicts` returns tone-classified Warn/Info/Ok rows for stale data, missing targets, projected WIP overflow, duplicate pending proposals, high-risk operations, outbound webhooks, active comments, multi-op card conflicts, and positive capacity/fresh-data signals; review fixed create-card false positives, JSON ValueKind guards, projected WIP accounting, missing-column detection, webhook event mapping, soft-deleted comment counts, and entity caching; 78 tests\n - Card history ledger (`#1023`/`#1034`): `GET /api/automation/proposals/{id}/history` returns per-card touch history with serial/event/age/status; bounded at 200 entries/card and 500 total; review fixed duplicate dedup, JSON property parsing, GUID single-pass, `InvariantCulture` formatting; 42 tests\n - Similar past decisions (`#1024`/`#1038`): `GET /api/automation/proposals/{id}/similar-past` returns 3 nearest-neighbour prior decisions with apply rate; board-scoped query (review fixed userId filter that excluded non-caller proposals); 200-proposal lookback limit; UTC week formatting; 50 tests\n- New EF Core migrations: `AddDailySnapshots`, `AddTomorrowNotes`, `AddProvenanceEntities`, `AddProposalProvenanceForeignKey`, `ExtendProposalOutcomesForMetrics`\n- New repository methods: `IAuditLogRepository.CountByDateAsync`, `IAutomationProposalRepository.GetTerminalByActionTypeAsync`, `IAutomationProposalRepository.GetPendingByOperationTargetAsync`, `ICardCommentRepository.CountByCardIdAsync`\n\nRoadmap v4 second-wave delivery (2026-04-25, PRs `#989`--`#994` + `#995`):\n- RFAI-02 (`#974`/`#989`): `IntentEnvelopeV1` domain spine with `SourceBlock`/`SourceSpan`, `IntentCandidate`, `EvidenceLink`, `TaskdeckProposalBatch`, `IIntentEnvelopeFactory` application interface, `IChatClient` adapter spike, handwritten `proposal-batch.v1.schema.json`; 117 tests; adversarial review fixed partial-write status transition bug, span length consistency, evidence fabrication prevention, nullable schema fields\n- RFAI-06 (`#978`/`#990`): `IVectorIndex` and `IEmbeddingGenerator` application interfaces, `InMemoryVectorIndex` (cosine similarity + SIMD), `InMemoryEmbeddingGenerator` (FNV-1a hash), `EmbeddingBackfillService` with batch processing and stale vector pruning, `FallbackSemanticSearchService`, `EmbeddingBackfillWorker`; 61 tests; adversarial review fixed batch API usage, stale vector cleanup, unbounded memory growth\n- RFAI-05 (`#977`/`#991`): `ConfidenceScore` value object, `FieldConfidence`, `SelfConsistencyQuota`, `SelfConsistencyPolicy`, `ConfidenceBucket`/`ConfidenceSource` enums, `ConfidenceAggregator`, `BrierScoreCalculator`; 136 tests; adversarial review fixed hash/equality contract violations, non-finite value rejection, BrierScore input validation\n- RFAI-08 (`#980`/`#992`): `TelemetryGuard` with allowlist-based metric validation and ReDoS-safe regex, `EgressRegistry` with wildcard host matching and thread safety, `InsightMetric`/`InsightCohort` content-free records, eval harness framework (`IEvalCase`, `EvalRunner`, 12 seed cases); 108 tests; adversarial review fixed wildcard matching, thread safety, volatile field, unsupported type rejection; CI failure was pre-existing flaky test (fixed in `#995`)\n- RFAI-03 (`#975`/`#993`): `ProposalProvenance`, `ProvenanceField` (extractive/inferred with confidence), `FieldVerificationResult`, `ProposalOutcome` (content-free decision ledger), `FuzzyTextMatcher` (Levenshtein sliding-window), `DeterministicPreExtractor` (Microsoft.Recognizers.Text), EF Core migration for `ProposalOutcomes`; 139 tests; adversarial review fixed verification-status/confidence consistency, provenance parent-ID validation, unbounded query limit\n- RFAI-04 (`#976`/`#994`): `ProposalRevision` entity (immutable revision chain), `IProposalCompiler` interface, `CompilerValidationResult`, `OperationRisk` value object, `OutcomeType` enum, `UnsupportedOperationFailure`, `IProposalRevisionService`, EF Core migration for `ProposalRevisions` and `ProposalOutcomes`; 70 tests; adversarial review fixed DateTime→DateTimeOffset alignment, redundant cast, documented TOCTOU race\n- Flaky CI test fix (`#995`): `Presence_RapidJoinLeave_EventuallyConsistent` replaced exact-count polling with stabilization-based assertions and range checks; timeout increased from 20s to 30s\n\nCurrent constraints are mostly hardening and consistency:\n- _(Historical — superseded first by the 2026-06-13 archive pivot and then by the 2026-07-10 revival pivot; the active execution order is `docs/REVIVAL_PLAN.md`, not `#972`.)_ `taskdeck-12-week-roadmap-v4.md` had been promoted from research input into the near-horizon planning spine via tracker `#972` and child issues `#973`--`#984` (RFAI complete 2026-05-29). The product framing it carried remains valid and unchanged: automation-originated board writes must stay proposal-first, manual board UI writes stay direct and auditable as user-manual activity, and outbound data flow must be guarded separately through the EgressEnvelope/disclosure/MCP-hash/telemetry controls.\n- Roadmap v4 execution progress: **RFAI-01 through RFAI-12 fully delivered (12 of 12 issues — roadmap complete)**; RFAI-10 PWA share-target merged in `#1078`, RFAI-11 ambient channel in `#1079`, RFAI-12 learning loop in `#1080` (2026-05-29).\n- Codex and Claude high-autonomy issue execution now have first-class local guidance: `.codex/README.md`, `.codex/memories/00_ACTIVE.md`, `.codex/skills/README.md`, `.claude/README.md`, `.claude/skills/README.md`, `docs/tooling/CODEX_AUTONOMY_RUNBOOK.md`, generalized worktree protocol, PowerShell git/worktree guards, GitHub helper scripts, Project v2 priority audit/sync support, and dedicated skills for batch orchestration, worktree issue workers, PR review loops, CI/conflict recovery, question batching, failure capture, and interface-map maintenance. A reusable Gitleaks workflow syntax issue in the summary heredoc has been corrected after the workflow began failing before job creation.\n- ~~**security bug discovered 2026-04-03**: `#722` (SEC-20) — `ChangePassword` endpoint does not verify caller identity~~ **RESOLVED** (`#722`/`#732`, 2026-04-04): `ChangePassword` now derives userId exclusively from JWT claims; `[Authorize]` enforced; `UserId` removed from request body; `AuthController` inherits `AuthenticatedControllerBase`; 5 integration tests proving the fix\n- security and identity behavior is converging but still not uniform across all controller families\n- some UX/operator surfaces are functional but not yet keyboard-first or discoverability-first\n- LLM flow now supports config-gated `OpenAI` and `Gemini` providers with deterministic `Mock` fallback for safe local/test posture; degraded provider responses are now structurally distinct (`messageType: \"degraded\"` + `degradedReason`) and the health endpoint supports opt-in probe verification (`?probe=true`); chat-to-proposal pipeline improvements delivered: `LlmIntentClassifier` now uses compiled regex patterns with word-distance matching, stemming/plurals, broader verb coverage, and negative context filtering for negations and other-tool questions (`#571`); parse failures now return structured hint payloads with closest-match suggestions and a frontend hint card with \"try this instead\" pre-fill (`#572`); dedicated classifier and chat-to-proposal integration test coverage added (`#577`); LLM-assisted instruction extraction now delivered (`#573`): OpenAI and Gemini providers request structured JSON output with a system prompt describing supported instruction patterns, parse the response into `LlmCompletionResult.Instructions`, and fall back to the static `LlmIntentClassifier` when structured parsing fails; `ChatService` iterates LLM-extracted instructions (supporting multiple proposals from a single message) and falls back to raw user message parsing when no instructions are extracted; Mock provider unchanged for deterministic test behavior; multi-instruction batch parsing now delivered (`#574`): `ParseBatchInstructionAsync` splits multiple natural-language instructions into individual planner calls, `ChatService` routes multi-instruction messages through batch parsing to generate multiple proposals from a single chat message; board-context LLM prompting now delivered (`#575`, expanded in `#617`): `BoardContextBuilder` constructs bounded board context (columns, card IDs, titles, labels) grouped per column and appends it to system prompts across OpenAI and Gemini providers via `LlmSystemPromptBuilder`; card IDs are included as first-8 hex chars so the LLM can generate `move card ` instructions; context budget increased to 4000 chars with single-query card fetch; **remaining gap**: conversational refinement (`#576`) remains undelivered; analysis at `docs/analysis/2026-03-29_chat_nlp_proposal_gap.md`\n- managed-key shared-token abuse-control strategy is now explicitly seeded in `#235` to `#240` before broad external exposure\n- testing-harness guardrail expansion from `#254` to `#260` is shipped; remaining work is normal follow-up hardening rather than the original wave\n- rigorous test expansion wave seeded 2026-04-03 (`#721` tracker, 22 issues `#699`–`#726`): systematic codebase audit identified 25+ untested infrastructure repositories, zero tests on the central worker, 6 controllers with untested HTTP surfaces, and no golden-path integration test for the capture → proposal → board pipeline; execution is tracked in `docs/TESTING_GUIDE.md`; first delivery: infrastructure repository integration tests (`#699`/`#730` — 77 tests across 7 repo classes against real SQLite); **major wave delivery 2026-04-04** (PRs `#732`–`#739`, 8 issues, ~300 new tests): SEC-20 ChangePassword fix (`#722`/`#732`), golden-path capture→board integration test (`#703`/`#735` — 7 tests proving full pipeline), cross-user data isolation tests (`#704`/`#733` — 38 tests across all major API boundaries), LlmQueueToProposalWorker integration tests (`#700`/`#734` — 24 tests, previously zero coverage), controller HTTP integration tests (`#702`/`#738` — 67 tests covering 6 untested controllers, found 2 pre-existing bugs), proposal lifecycle edge cases (`#708`/`#736` — 74 tests for state machine/expiry/race conditions), OAuth/auth edge cases (`#707`/`#737` — 44 tests, found and fixed `Substring` overflow bug in `ExternalLoginAsync`), MCP full resource/tool inventory (`#653`/`#739` — 9 resources + 11 tools with 42 tests, GP-06 compliant, user-scoping gap fixed during review); **second wave delivery 2026-04-04** (PRs `#740`–`#755`, 8 issues, ~586 new tests with two rounds of adversarial review, 47 review-fix commits): domain entity state machine exhaustive tests (`#701`/`#740` — 174 tests across 7 entities: CommandRun, ArchiveItem, ChatSession, UserPreference, NotificationPreference, CardLabel, CardCommentMention), SignalR hub and realtime integration tests (`#706`/`#751` — 19 tests covering auth, presence lifecycle, multi-user, authorization, edge cases), LLM provider abstraction and tool-calling edge cases (`#709`/`#747` — 101 tests across orchestrator, provider, classifier, registry), data export/import round-trip integrity tests (`#713`/`#752` — 64 tests covering JSON, CSV, GDPR, database, cross-format validation), API error contract regression and boundary validation (`#714`/`#753` — 57 tests across 7 endpoint families with GP-03 contract enforcement), archive and restore lifecycle integration tests (`#715`/`#755` — 74 tests: 45 domain + 29 API covering state machine, cross-user isolation, conflict detection, audit trail), board metrics and analytics accuracy verification (`#718`/`#749` — 61 tests: 51 service + 10 controller covering throughput, cycle time, WIP, blocked cards, done-column heuristic), notification delivery, deduplication, and preference filtering (`#719`/`#746` — 36 tests covering all 5 notification types, deduplication, preference filtering, cross-user isolation, batch operations)\n- MVP dogfooding flow now supports canonical checklist bootstrap in chat (proposal-first, board-scoped); broader template coverage remains future work\n- collaborative editing now includes board/card presence visibility and conflict-hinting guardrails for stale card writes\n- card collaboration now includes threaded comments with mention-linked notifications and moderation-aware edit/delete guardrails\n- capture/inbox realignment is now shipped for the CAP MVP loop (`#200` to `#211`); logging redaction guardrails are delivered in `#212`, and long-list virtualization for inbox/activity views is delivered in `#213`\n- frontend interaction latency budgets and instrumentation are delivered in `#250`: performance mark composable, route-transition/board/inbox/review/home/diff instrumentation, lazy route splitting, and documented thresholds in `docs/PERFORMANCE_BUDGETS.md`\n- post-demo-expansion planning is now explicitly biased toward product legibility before new surface breadth: novice-first entry, board-context continuity, readable review flows, and stronger in-app guidance take precedence over broad autonomy work\n- cold first-run now has launch-criteria proofing beyond route teaching; guided `Home`, durable workspace modes, review-first automation routing, the recoverable `Today` onboarding path, board-centered review/capture handoff, key-route contextual help, and the novice-first docs/help-center stack (root entry docs, chaptered manual, and page-level help/workflow guides) are now shipped, and the dedicated first-run smoke plus launch-criteria guardrail is delivered in `#328`\n- Saul-facing demo reconciliation is now explicit: the core `Home -> Inbox/Capture -> Review -> Board` proof is shipped, the business-facing substrate/trust-cue/hero-path slices are delivered through `#354` plus demo-critical follow-through from `#326` and `#330`; the rehearsal contract is now codified in `docs/product/SAUL_DEMO_REHEARSAL_CONTRACT.md` (`#355`), and the GTM baseline was delivered in `#216` with a timed demo script (`docs/product/DEMO_SCRIPT.md`), thesis-aligned landing copy (`docs/product/LANDING_COPY.md`), and beta intake workflow/cadence (`docs/product/BETA_INTAKE_WORKFLOW.md`) _(caveat — landing copy + beta intake are now **not-in-use per the 2026-06-13 archive pivot** (GTM retired); `DEMO_SCRIPT.md` stays a live demo asset)_\n- demo rehearsal walkthrough (2026-03-27) confirmed the core loop is visually correct but surfaced 9 runtime issues in seed tooling, scenario runner, and DX ergonomics; two are blockers for one-command deterministic rehearsal: seed re-run 409 conflicts (`#387`) and `--skip-llm` proposal alias resolution failure (`#389`); tracked in `#395` with analysis in `docs/analysis/2026-03-27_demo-rehearsal-runtime-issues.md`\n- fresh-registration manual test (2026-03-29) surfaced 2 P0 blockers and 16 additional bugs/observations spanning data isolation, board stability, dark-mode theming, chat utility, and UX polish; full findings at `docs/analysis/2026-03-29_manual_testing_consolidated_findings.md`; P0 blockers: queue data not scoped to the authenticated user (`#508`), board auto-switching on multi-board accounts (`#509`); P1 issues tracked in `#510` through `#515`; P2/P3 in `#516` through `#524`; **no external user onboarding should occur until `#508` is resolved**; two bugs from this session now resolved: activity audit trail not recording board mutations (`#521`, fixed — audit logging wired for all board/card/column/label mutations with `SafeLogAsync` resilience wrapper), archive board 30-second freeze (`#519`, fixed — navigation before reactive state teardown prevents cascading re-renders)\n- _(**Superseded 2026-06-13** by the archive pivot — the cloud/mobile/distribution pillars and the `v0.1.0`→`v1.0.0` GA versioning plan below are **de-scoped**; see the Direction note at the top of this file. Kept as a historical record.)_ platform expansion strategy (2026-03-29) covered four strategic pillars: market adoption (`#544`), packaging/distribution (`#532`), cloud/collaboration (`#537`), and mobile platform (`#540`); master strategy tracker at `#531`; strategy documents at `docs/strategy/`; release versioning plan: `v0.1.0` (self-contained exe) → `v0.2.0` (hosted cloud) → `v0.3.0` (PWA/mobile) → `v0.4.0` (collaboration) → `v0.5.0` (platform maturity) → `v1.0.0` (GA)\n- hands-on UX testing (2026-03-31) surfaced 8 areas of feedback spanning review, inbox, today, home, board, notifications, and LLM chat; 2 P1 issues (capture triage fails on natural-language text `#614`, chat response truncation showing raw JSON `#616`), 11 P2 usability/visual-coherence issues (`#611`–`#613`, `#615`, `#617`, `#620`, `#622`, `#624`–`#627`), and 4 P3 polish/strategic items (`#618`–`#619`, `#621`, `#623`); tracker at `#628`; full analysis at `docs/analysis/2026-03-31_manual_testing_ux_feedback.md`; cross-cutting themes: progressive disclosure needed across review/today/notifications, semantic color vocabulary for status tags, capture pipeline needs LLM-assisted extraction, and chat needs tool-calling/function-calling architecture; LLM tool-calling spike (`#618`) and MCP server spike (`#619`) seeded for strategic planning\n- UX feedback wave 1 delivered (2026-03-31): 6 of 17 issues from `#628` resolved — sidebar footer pinned (`#623`), card drag layout shift eliminated (`#621`), starter-pack modal migrated to design tokens (`#612`), capture triage error messages surfaced with retry hint (`#615`), board context expanded with card IDs for LLM chat (`#617`, N+1 query fixed), review proposal cards now use collapsible detail sections with risk color-coding and keyboard-accessible links dropdown (`#626`)\n- UX feedback wave 2 delivered (2026-03-31): 5 additional issues resolved — both P1 blockers closed: capture triage now handles dash-separated (` - `) and semicolon-delimited text with first-segment context hints and single-sentence fallback (`#614`), chat JSON array truncation detection extended to `[`-started responses with degraded message UX (`#616`); P2: notification list now has type-colored left borders, type badges, smart same-type grouping, time-based section headers, and batch \"Mark all read\" with board-scoped optimistic update (`#625`); P4: global search endpoint now supports `maxResults`/`offset` pagination with `hasMore`/`totalCardCount` response fields and frontend \"Load more\" in command palette (`#610`); ops: `ci-extended.yml` now auto-triggers on `.csproj`/workflow/deploy/script changes, PR template and AGENTS.md updated (`#608`); remaining open from `#628`: 0 P2 (~~`#613`~~ delivered in `#665`), 2 P3 strategic spikes (`#618`, `#619`) both completed with implementation waves delivered (Phase 1+2 for tool-calling `#647`, Phase 1 for MCP `#648`)\n- LLM tool-calling spike (`#618`) completed (2026-04-01): architecture document at `docs/spikes/SPIKE_618_COMPLETED.md`; decided on custom implementation over Semantic Kernel (~800 LOC, zero new dependencies), extending `ILlmProvider` with `CompleteWithToolsAsync`, 11 tools (5 read + 6 write, writes always produce proposals per GP-06), new `ToolCallingChatOrchestrator` with multi-turn loop (max 5 rounds, 60s timeout), Mock provider with pattern-based dispatch, ~$0.00088 per 3-round conversation on GPT-4o-mini; implementation tracker at `#647` with phase issues `#649` (read tools + orchestrator — delivered), `#650` (write tools + proposals — delivered), `#651` (Phase 3 refinements — delivered, PR `#773`)\n- LLM tool-calling Phase 1 delivered (`#649`, 2026-04-01): `CompleteWithToolsAsync` added to `ILlmProvider` with OpenAI, Gemini, and Mock implementations; 5 read tool executors (`list_board_columns`, `list_cards_in_column`, `get_card_details`, `search_cards`, `get_board_labels`) in Application layer; `ToolCallingChatOrchestrator` with multi-turn loop (max 5 rounds, 30s/round, 60s total timeout) and graceful degradation to single-turn on failure; Mock provider uses pattern-matching dispatch table for deterministic simulation; SignalR `ToolStatusEvent` integration for intermediate state streaming; `ChatService` delegates to orchestrator for board-scoped sessions with automatic single-turn fallback; 67 new tests\n- LLM tool-calling Phase 2 delivered (`#650`/`#731`, 2026-04-03): 6 write tool executors (`propose_create`, `propose_move`, `propose_archive`, `propose_update`, `propose_bulk_move`, `propose_create_column`) in Application layer; EF migration adds `ToolCallMetadataJson` for provenance; orchestrator now serves 11 tools (5 read + 6 write); writes always produce proposals per GP-06; frontend tool-status indicators show write-tool progress via SignalR\n- Double LLM call eliminated (`#672`/`#727`, 2026-04-03): `ChatService` reuses the orchestrator's text response when no tools are called instead of making a second LLM call; halves latency for non-tool chat messages; remaining follow-up items: argument replay (`#673`)\n- MCP server spike (`#619`) completed (2026-04-01): architecture document at `docs/spikes/SPIKE_619_COMPLETED.md`; decided on official MCP C# SDK (`ModelContextProtocol` v1.2.0), embedded in API process with `--mcp` startup flag, stdio transport first (Claude Code/Cursor), 9 resources under `taskdeck://` URI scheme, 9 tools (2 read + 5 write + 2 proposal management, `approve_proposal` intentionally excluded), API key auth (`tdsk_` prefix) for remote HTTP transport, write tools return proposal IDs for review-first compliance; implementation tracker at `#648` with phase issues `#652` (minimal prototype), `#653` (full inventory), `#654` (HTTP + auth), `#655` (production hardening, deferred)\n- MCP minimal prototype delivered (`#652`/`#664`, 2026-04-01): `ModelContextProtocol` NuGet v1.2.0 added; `IUserContextProvider` interface in Application layer with `StdioUserContextProvider` implementation; `BoardResources` class with `[McpServerResource]` for `taskdeck://boards` resource returning compact JSON (id, name, columnCount, cardCount, isArchived, updatedAt); `--mcp` startup flag in `Program.cs` selects stdio host builder skipping web server overhead; 11 integration tests covering shape, archived exclusion, counts, empty results, and multi-user scoping\n- UX feedback wave 3 delivered (2026-04-01): review proposal card UX improved (`#613`/`#665`) — sticky action footer with `position: sticky; bottom: 0` keeps action buttons visible regardless of card content length, cards constrained to `max-height: 70vh` (80vh mobile) with internal scrolling, detail section heights capped at `12rem`\n- GDPR data portability delivered (`#83`/`#666`, 2026-04-01): `DataExportService` exports all user-scoped data as versioned JSON package (boards, notifications, captures, proposals, chat sessions, audit trail, preferences); `AccountDeletionService` with password re-authentication + confirmation phrase safeguard, PII anonymization (username/email/password), `BoardAccess` cleanup, sole-owner guard, transactional rollback on partial failure; `DataPortabilityController` with `[Authorize]` + `[ResponseCache(NoStore = true)]`; PII-free audit logging at request and completion stages; 32 tests; follow-up items: export streaming for large datasets (`#670`); JWT invalidation after deletion delivered (`#671`/`#698`+`#728`)\n- Board metrics dashboard delivered (`#77`/`#667`, 2026-04-01): `BoardMetricsService` computes throughput (audit-log-based card completion), cycle time (creation-to-done via audit), WIP (cards per column), and blocked card count/duration; `MetricsController` with date range, board, and label filters; done column resolved by name heuristic (done/complete/finished/shipped/etc.) with positional fallback; frontend dashboard at `/workspace/metrics` with CSS bar charts, summary cards, tables, board selector, date picker, loading/error/empty states; lazy-loaded route + sidebar nav link; 24 backend + 22 frontend tests; SQL-level filtering follow-up delivered (`#675`/`#724`)\n- GitHub OAuth frontend integration delivered (`#539`/`#668`, 2026-04-01): conditional \"Sign in with GitHub\" button in LoginView based on `/api/auth/providers` response; OAuth code exchange flow with demo-mode gating, array-safe query param extraction, and awaited URL cleanup; session store action with error handling and toast notifications; open redirect prevention on both backend (`Url.IsLocalUrl`) and frontend (`sanitizeInternalRedirect`); follow-up: distributed auth code store, PKCE, account linking (`#676`)\n- Hardening and UX wave delivered (2026-04-03, PRs `#691`–`#698`): 9 issues resolved across 8 PRs with adversarial review follow-through:\n - **P1 bug fixed** (`#681`/`#691`): Archive, Activity, Ops, and Access workspace routes no longer silently redirect to Home — feature flags for shipped surfaces now default to `true`; 5 new router guard tests\n - **Expired proposal handling** (`#678`+`#690`/`#696`): Review no longer presents expired proposals as \"Approved, ready to apply\"; expired proposals show distinct status badge with dismiss/clear action; client-side expiry detection with 60-second reactive clock covers proposals the housekeeping worker hasn't transitioned yet; 9 new tests\n - **Chat card ID continuity** (`#677`/`#695`): new `CardIdPrefixResolver` resolves 8-char hex prefixes to full GUIDs via board-scoped prefix matching; wired into `AutomationPlannerService` (6 call sites) and `NaturalLanguageInstructionExtractor`; full GUIDs pass through without DB hits; 15 new tests\n - **Human-readable proposal diffs** (`#682`/`#697`): `GetProposalDiffAsync` now batch-loads cards and columns (2 queries) and resolves operation targets to names; falls back to raw GUID when resolution fails; frontend diff panel with ARIA label and word-wrapping; 4 new tests\n - **Dark theme label manager** (`#684`/`#692`): 22 light-theme Tailwind classes replaced with design-token equivalents following ColumnEditModal pattern; 2 new tests\n - **Chat health banner three-state** (`#679`/`#693`): `verificationStatus` field (`unverified`/`verified`/`failed`) added to health DTO; banner shows amber for configured-but-unverified, green for verified, red for failed; 6 new tests\n - **OpenAI strict mode + loop detection** (`#674`/`#694`): `strict: true` added to OpenAI tool schemas; SHA256-based loop detection in orchestrator aborts when consecutive rounds have identical tool-call fingerprints (with error-retry bypass for transient failures); 10 new tests\n - **JWT invalidation after account deletion** (`#671`/`#698`): `TokenInvalidatedAt` field on User entity with EF migration; `TokenValidationMiddleware` checks `IsActive` and compares token `iat` against invalidation timestamp on every authenticated request; `AccountDeletionService` sets invalidation timestamp during deletion; whole-second precision truncation matches JWT `iat` granularity; ADR-0021 documents the design decision; 9 new tests\n- Post-hardening delivery wave (2026-04-03, PRs `#724`–`#731`): 6 issues resolved across 6 PRs:\n - **SQL-level board metrics filtering** (`#675`/`#724`): `BoardMetricsService` now uses SQL-level filtering via new repository methods (`GetForMetricsAsync`, `CountCardsByColumnAsync`, `GetBlockedByBoardIdAsync`) instead of in-memory filtering; frontend `Math.max(...spread)` replaced with `reduce` for empty-array safety\n - **Double LLM call elimination** (`#672`/`#727`): `ChatService` reuses the orchestrator's text response when no tools are called, halving latency for non-tool chat messages\n - **JWT invalidation hardening** (`#671`/`#728`): `ActiveUserValidationMiddleware` checks user active status on every authenticated request with 30-second in-memory cache; cache invalidated on deletion/deactivation\n - **Expired proposal review UX** (`#678`+`#690`/`#729`): `IsExpired` flag on `ProposalDto`, domain `CanBeDismissed` method, expired proposals rendered distinctly in Review with dismiss action and disabled apply/approve buttons\n - **Infrastructure repository integration tests** (`#699`/`#730`): 77 new tests across 7 repository classes against real SQLite; found and fixed a real `LlmQueueRepository` ordering bug\n - **LLM write tools and proposal integration** (`#650`/`#731`): 6 write tool executors (`propose_create`, `propose_move`, `propose_archive`, `propose_update`, `propose_bulk_move`, `propose_create_column`), EF migration for `ToolCallMetadataJson`, orchestrator now serves 11 tools total (5 read + 6 write), frontend tool-status indicators for write operations\n- Security + testing + MCP delivery wave (2026-04-04, PRs `#732`–`#739`): 8 issues resolved across 8 PRs with two rounds of adversarial review:\n - **SEC-20 ChangePassword identity bypass fixed** (`#722`/`#732`): userId now derived exclusively from JWT claims; `[Authorize]` enforced; `UserId` removed from request body; `AuthController` refactored to inherit `AuthenticatedControllerBase`; 5 new integration tests\n - **Golden-path integration test** (`#703`/`#735`): 7 tests exercising full capture → triage → proposal → review → board pipeline; validates card title, column placement, provenance chain, multi-operation atomicity, cross-user isolation, audit trail, and triage failure determinism\n - **Cross-user data isolation tests** (`#704`/`#733`): 38 integration tests across all major API boundaries (boards, columns, cards, captures, proposals, notifications, audit trails, chat sessions, knowledge docs, webhooks, board exports, labels, board access controls); includes shared-board grant/scope/revocation tests; adversarial review caught and fixed 3 false-positive tests and missing precondition assertions\n - **LlmQueueToProposalWorker integration tests** (`#700`/`#734`): 24 tests covering happy path, empty queue, transient/permanent error, retry/backoff, cancellation, fair-batch interleaving, already-claimed items, and capture triage paths; adversarial review fixed fake repository status-tracking and race condition simulation\n - **Controller HTTP integration tests** (`#702`/`#738`): 67 tests covering 6 previously-untested controllers (DataPortability, AbuseContainment, Metrics, Search, AgentProfiles, AgentRuns) + 17 new authz regression matrix entries; discovered 2 pre-existing bugs (agent list 500, empty board export); adversarial review fixed weak assertions and resource leaks\n - **Proposal lifecycle edge cases** (`#708`/`#736`): 74 tests (42 domain + 25 application + 7 api) covering expiry timing boundaries, double-apply prevention, comprehensive state machine violations, dismissal edge cases, operation mutation guards, batch expiry, worker-vs-manual race conditions; adversarial review fixed clock-resolution flakiness and added 5 new edge case tests\n - **OAuth/auth edge case tests** (`#707`/`#737`): 44 tests covering login/registration edge cases, token validation (malformed/expired/wrong-key/missing-claims), OAuth code exchange, open redirect prevention, middleware enforcement; **found and fixed production bug**: `ExternalLoginAsync` `Substring(0, 50)` overflow for short usernames\n - **MCP full resource and tool inventory** (`#653`/`#739`): 9 resources under `taskdeck://` URI scheme + 11 tools (2 read + 6 write + 3 proposal management); all write tools produce proposals per GP-06; `approve_proposal` intentionally excluded; 42 MCP-specific tests; **adversarial review found and fixed user-scoping gap** on proposal resources/tools\n- Post-adversarial-review hardening and test expansion wave (2026-04-04, PRs `#741`–`#756`, 9 issues):\n - **Product telemetry taxonomy** (`#341`/`#741`): `docs/product/TELEMETRY_TAXONOMY.md` defines 35+ named events across 7 categories (Capture, Proposal/Review, Board, Auth, Navigation, Agent, Error) with `noun.verb` naming convention, universal envelope, privacy guardrails (bucketed counts, no PII), and R1/R2/R3 launch gate anchors. The recording surface **is implemented** (`TelemetryController` `POST /api/telemetry/events` + `GET /api/telemetry/config`, backed by `TelemetryEventService` with event-name **format** validation (the `noun.verb` regex — not membership in the taxonomy registry) and a property-key allowlist) but is **opt-in and OFF by default** (`TelemetrySettings.Enabled = false`); recorded events are currently logged rather than persisted/forwarded. _(The R1/R2/R3 launch-gate anchors are de-scoped by the archive pivot; syncing the backend allowlist/registry to the full taxonomy remains open — see `docs/product/TELEMETRY_TAXONOMY.md`.)_\n - **Board header presence label fixed** (`#683`/`#744`): `normalizePresenceMembers()` in `BoardView.vue` now replaces current user's SignalR `displayName` with locally-known username, eliminating email/username flip on card open; 3 new tests\n - **Manual card provenance empty state** (`#680`/`#754`): `cardsApi.getCardProvenance()` now returns null only for \"Capture provenance not found\" 404s (not all 404s); CardModal shows \"No capture provenance available.\" with `loadedCaptureProvenanceCardId` guard against flash; 4 new tests; adversarial review caught and fixed 3 bugs (overly broad 404 catch, global Axios log-level regression, empty-state flash)\n - **WIP-limit duplicate toast regression** (`#686`/`#745`): 7 regression tests in `boardStore.wipLimit.spec.ts` guard against future double-toast on WIP limit violations for createCard and moveCard\n - **Auth-flow toast regression coverage** (`#685`/`#742`): 20 tests in `sessionStore.authToast.spec.ts` covering login/register/OAuth failure and success toast lifecycle, isolation, and auto-removal; adversarial review fixed timer leak, mock isolation, and inverted assertion\n - **Route and workspace-state stability** (`#687`/`#748`): `authGuard.spec.ts` (auth guard decision table) and `workspaceRouteStability.spec.ts` (mode persistence, hydration drift, resetForLogout) with 16-case exhaustive guard table; also fixed pre-existing `AuthControllerEdgeCaseTests.cs` compile error\n - **Inbox triage action visibility** (`#688`/`#743`): 21 new tests in `InboxView.spec.ts` covering single-item triage action states and bulk action bar visibility with DOM-level assertions\n - **Webhook HMAC signature verification** (`#726`/`#750`): 11 tests in `OutboundWebhookHmacDeliveryTests.cs` covering header format, HMAC round-trip, wrong-key rejection, secret rotation, large payload, and timing-safe comparison; adversarial review fixed rotation test and replaced BCL-testing stubs with real domain property tests\n - **Webhook delivery reliability and SSRF boundary** (`#710`/`#756`): 78 webhook tests across 9 files (endpoint guard, service, signature, delivery worker, HMAC delivery, API, repository, domain delivery, domain subscription); SSRF coverage via `OutboundWebhookEndpointGuardTests` includes private IPv4/IPv6 ranges; delivery reliability covers retry/backoff, dead-letter, concurrent delivery, HMAC at worker boundary; `HttpClient` resource leak fixed in tests\n- Tech-debt, security, and feature hardening wave (2026-04-04, PRs `#765`–`#770`, `#776`, 7 issues, ~32 new backend tests + 33 new frontend tests, two rounds of adversarial review per PR):\n - **Agent API 500 fix** (`#758`/`#776`): root cause was `DateTimeOffset` ORDER BY failing in SQLite; `AgentProfileRepository` fixed with materialize-then-sort; `AgentRunRepository` upgraded to `IsSqlite()` + `FromSqlInterpolated` pattern for SQL-level ORDER BY + LIMIT; 2 previously-skipped tests un-skipped; round 2 review caught and fixed the load-all-before-limit performance issue in `AgentRunRepository`\n - **DataExport exception logging** (`#759`/`#766`): `ILogger` added to `DataExportService` and `AccountDeletionService` with `LogError` in previously-silent catch blocks; round 2 review added `OperationCanceledException` filter to avoid monitoring noise and changed rollback to `CancellationToken.None` for reliability; 3 new tests\n - **Streaming chat token usage** (`#763`/`#768`): `LlmTokenEvent` extended with `TokensUsed`, `Provider`, and `Model` fields; all 3 LLM providers (Mock, OpenAI, Gemini) populate usage on final stream event; `ChatService.StreamResponseAsync` now persists assistant `ChatMessage` with token usage and records quota via `ILlmQuotaService.RecordUsageAsync` (matching non-streaming path); 4 new/updated tests\n - **EF Core version alignment** (`#760`/`#767`): downgraded `Microsoft.EntityFrameworkCore`, `.Sqlite`, `.Design`, and `.Tools` from 9.0.14 to 8.0.14 across Infrastructure and Api projects; removed EF9-only `PendingModelChangesWarning` suppression; replaced stale `Microsoft.AspNetCore.Http` 2.3.9 with `FrameworkReference Include=\"Microsoft.AspNetCore.App\"`; round 2 review added `PrivateAssets=\"all\"` to Design package; migration snapshot `ProductVersion: \"9.0.14\"` is metadata-only, self-corrects on next migration\n - **Frontend HTTP interceptor and auth guard tests** (`#725`/`#765`): 33 new tests across 2 files — `http.spec.ts` (19 tests: token injection, 401 handling, demo mode, X-Request-Id, error propagation) and `routerIntegration.spec.ts` (14 tests: auth guards, feature flags, legacy redirects, expired token handling); `axios-mock-adapter` added as dev dependency; round 2 review fixed CI-breaking ESLint `no-import-assign` with `vi.hoisted` pattern, `window.location` restoration leak, and inaccurate docstring\n - **OAuth token lifecycle tests** (`#723`/`#769`): 19 integration tests covering auth code store (valid exchange, expiry, replay prevention, concurrent atomicity, cleanup), JWT lifecycle (expiry, wrong key, garbage token, deactivated user, re-issue after password change), SignalR query-string auth (3 tests), and GitHub OAuth config (2 tests); round 2 review fixed redundant ternary, `HttpClient` resource leak in concurrent test, misleading SignalR test names, and weak string-contains assertion\n - **Tool argument replay** (`#673`/`#770`): `Arguments` field (`JsonElement`) added to `ToolCallResult` with backward-compatible default; orchestrator passes original arguments through; OpenAI uses `GetRawText()` and Gemini uses inline `Arguments` object in synthetic replay messages instead of hardcoded `\"{}\"` / `new { }`; falls back to empty when `ValueKind == Undefined`; `GeminiLlmProvider.BuildToolCallingPayload` promoted to `internal` for testability; 6 new tests\n\n- Dependency hygiene, accessibility, tool-calling refinements, streaming, and test coverage wave (2026-04-04, PRs `#771`–`#779`, 8 issues, ~258 new tests with two rounds of adversarial review per PR):\n - **Vendored dependency cleanup** (`#761`/`#771`): removed `vendor/ws-7.5.10.tgz` file and orphaned Dockerfile `COPY vendor/` line; `ws` now resolves from npm registry as `^7.5.10`; no-op `p-limit@3.0.2` override removed; adversarial review caught stale STATUS.md and MASTERPLAN docs references and updated them\n - **Accessibility lint: 105 warnings → 0** (`#762`/`#779`): form label associations (`for`/`id` pairs, `aria-label`), keyboard event companions for click handlers, `role=\"dialog\"` + `aria-modal` + Escape handler on modal backdrops, redundant-role removals; `--max-warnings 20` CI threshold enforced; adversarial review found and fixed 2 CI regressions: `TdTooltip.vue` Vue-Fragment breakage (9 failing tests) and invalid `tabindex=\"-1\"` on `role=\"option\"` items; 2 non-blocking ARIA follow-up items filed\n - **Tool-calling Phase 3 refinements** (`#651`/`#773`): `LlmToolCallingSettings` DI singleton with `Enabled` (default `true`) and `MaxToolResultBytes` (default 8 000) config keys; `ChatService` bypasses orchestrator when disabled; `TruncateToolResult` enforces UTF-8 byte budget via binary search with zero heap allocations in the search loop; cost tracking DI wiring completed; 17 new tests; adversarial review caught byte-budget contract violation when `maxBytes < marker length` and replaced O(n) loop with correct binary search\n - **Export streaming for large datasets** (`#670`/`#774`): new `GET /api/account/export/stream` endpoint streams JSON response body via `Utf8JsonWriter` — memory usage is constant regardless of dataset size; N+1 chat-message count query fixed with `CountBySessionIdsAsync` (single GROUP BY query, 500-session windows to respect SQLite 999-param limit); backward-compatible with original `/export` endpoint; 15 tests; adversarial review caught `ToErrorActionResult()` crash when called after `Response.HasStarted`; streaming HTTP 200 partial-response limitation documented in controller comment\n - **Frontend view vitest coverage** (`#716`/`#775`): 83 new tests for 6 previously-untested views (LoginView, RegisterView, BoardsListView, ExportImportView, SavedViewsView, DevToolsView) with DOM-level assertions for loading/error/empty states, user interactions, and form validation; adversarial review fixed 3 ESLint errors (CI blocker: unused vars, invalid `[key]` selector) and added 3 missing OAuth callback path tests\n - **Pinia store integration tests** (`#711`/`#777`): 91 new tests across 6 stores (boardStore, captureStore, workspaceStore, queueStore, notificationStore, sessionStore) mocking HTTP layer rather than API modules, exercising real API client code; covers boardStore auto-switch regression (`#509`), queueStore data isolation (`#508`); adversarial review fixed fake timer leak, unreliable microtask drain, and 4 `as never[]`/`as never` type bypasses defeating integration test value\n - **Resilience and degraded-mode tests** (`#720`/`#778`): 34 new tests (18 backend + 16 frontend) covering ChatService LLM provider failure/fallback, worker crash/retry/cancellation/max-retries, frontend store error states, SignalR reconnect polling fallback; adversarial review fixed unused import (CI blocker), double-invocation anti-pattern, and 150ms timing race widened to 500ms\n - **E2E error state expansion** (`#712`/`#772`): 25 new Playwright scenarios across 3 spec files (`error-recovery.spec.ts`, `multi-board.spec.ts`, `edge-journeys.spec.ts`) using `page.route()` for deterministic error injection without live backend dependency; adversarial review fixed unused import (CI blocker), route glob missing query-param suffix, 3 vacuous soft-assertion blocks replaced with unconditional assertions\n\n- Feature, analytics, MCP, chat, testing, and UX expansion wave (2026-04-08, PRs `#787`–`#793`, 7 issues, ~390+ new tests with two rounds of adversarial review per PR):\n - **Exportable analytics CSV** (`#78`/`#787`): `MetricsExportService` with schema-versioned CSV export, CSV injection protection (leading-char and embedded-newline sanitization), UTF-8 BOM for Excel compatibility; `GET /api/metrics/boards/{boardId}/export` endpoint with date range/label filters and `Content-Disposition` attachment header; frontend \"Export CSV\" button in MetricsView with error toast; `ADR-0022` defers PDF export; 29 tests (21 unit + 8 integration); adversarial review caught and fixed embedded-newline injection vector (HIGH), missing CancellationToken forwarding, and silent frontend error swallowing\n - **Forecasting and capacity-planning service** (`#79`/`#790`): `ForecastingService` with rolling-average throughput from audit log card-move events, standard-deviation confidence bands (optimistic/expected/pessimistic), average cycle time from creation-to-done; `GET /api/forecast/board/{boardId}` endpoint with documented assumptions and data-point count; frontend forecast section in MetricsView showing estimated completion, confidence range, and caveats; 32 tests; adversarial review caught and fixed throughput double-counting when cards bounce Done→InProgress→Done (HIGH), history-window calculation using wrong denominator, and regex compiled fresh on every call\n - **MCP HTTP transport and API key authentication** (`#654`/`#792`): `ApiKey` domain entity with `tdsk_` prefix and SHA-256 hashing at rest; EF Core migration for `ApiKeys` table with unique `KeyHash` index; `ApiKeyMiddleware` for Bearer token validation on `/mcp` path; `HttpUserContextProvider` maps API key → user for claims-first identity; `ApiKeysController` REST endpoints (create/list/revoke) with JWT auth; `MapMcp()` HTTP transport alongside REST endpoints via `ModelContextProtocol.AspNetCore`; rate limiting per API key (60 req/60s); 31 tests (11 domain + 20 integration); adversarial review caught and fixed key-existence oracle via differentiated error messages (MEDIUM), modulo bias in key generation, and bare catch block\n - **Conversational refinement loop** (`#576`/`#791`): `ClarificationDetector` with strong/weak signal pattern split for ambiguity detection, max 2 clarification rounds before best-effort, skip-phrase detection (\"just do your best\"); `ChatService` integration tracking clarification state and injecting system prompt guidance; Mock provider simulates clarification for deterministic testing; frontend clarification badge and \"Skip, just do your best\" button in AutomationChatView; 41 tests (22 detector + 7 service + 6 false-positive regression + domain); adversarial review caught and fixed false-positive heuristic classifying normal LLM responses as clarification (HIGH)\n - **Concurrency and race condition stress tests** (`#705`/`#793`): 13 stress tests in `ConcurrencyRaceConditionStressTests.cs` covering queue claim races (double-triage, stale timestamp, batch concurrent), card update conflicts (concurrent moves, stale-write 409, last-writer-wins), column reorder race, proposal approval races (double-approve, approve+reject, double-execute), rate limiting under load (burst beyond limit, cross-user isolation), and multi-user board stress; uses `SemaphoreSlim` barriers with `WaitAsync` for true simultaneity and separate `HttpClient` per task; SQLite write serialization limitations documented; proposal decision losers now return `409 Conflict` via proposal `UpdatedAt` optimistic concurrency; adversarial review fixed misleading doc comments, tightened weak assertions, and replaced non-thread-safe variables with `ConcurrentDictionary`\n - **Property-based and adversarial input tests** (`#717`/`#789`): 211 tests across 5 files — 77 FsCheck domain entity tests (adversarial strings: unicode, null bytes, BOM, ZWSP, RTL override, surrogate pairs, XSS, SQL injection; boundary lengths; GUID/position validation), 29 JSON serialization round-trip fuzz tests (GUID format variations, DateTime boundaries, malformed JSON, large payloads), 80 API adversarial integration tests (no 500s from any adversarial input across board/card/column/capture/auth/search endpoints, malformed JSON, wrong content types, concurrent adversarial requests), 16 fast-check frontend input sanitization property tests, 9 store resilience property tests; `fast-check` added as frontend dev dependency; adversarial review fixed capture payload round-trip testing wrong DTO and null handling inconsistency in FsCheck generators\n - **Inbox premium primitives** (`#249`/`#788`): `InboxView.vue` reworked to use shared UI primitive components — `TdSkeleton` for loading states, `TdInlineAlert` for errors, `TdEmptyState` for empty list, `TdBadge` for status chips, `TdSpinner` for detail refresh; ~65 lines of redundant CSS removed; 7 new vitest tests; adversarial review fixed skeleton screen reader announcements (added `role=\"status\"` and sr-only labels) and redundant `role=\"alert\"` nesting\n- Ephemeral integration databases via Testcontainers (`#91`): `Taskdeck.Integration.Tests` project with `Testcontainers.PostgreSql` and `Npgsql.EntityFrameworkCore.PostgreSQL` packages; `PostgresContainerFixture` manages a shared ephemeral PostgreSQL container per xUnit collection; each test method gets its own isolated database (no cross-test contamination); schema created via `EnsureCreated()` from the EF Core model for PostgreSQL provider parity; 20 integration tests across 7 test classes covering Board CRUD, Card operations, Proposal lifecycle, per-test isolation verification, and sequential operation validation; CI workflow at `reusable-container-integration.yml` in ci-extended lane (label: testing); guide at `docs/testing/TESTCONTAINERS_GUIDE.md`\n\n- Mutation testing pilot now delivered (`#90`): Stryker.NET targeting `Taskdeck.Domain` (backend) and Stryker JS targeting `captureStore`/`boardStore` (frontend); non-blocking weekly CI lane (`.github/workflows/mutation-testing.yml`); policy and triage guidance at `docs/testing/MUTATION_TESTING_POLICY.md`; 60% low / 80% high thresholds with 0% break (triage signal, not enforcement gate); scope expansion roadmap covers Application layer and additional frontend stores\n\n- Supplementary test depth wave (2026-04-13, PRs `#821`–`#826`, ~429 new tests with two rounds of adversarial review per PR):\n - **Frontend store integration tests** (`#711`/`#821`): 88 new tests across 6 files — chatApi integration (22), boardStore column reorder/conflict (11), queueStore polling/transitions (12), sessionStore OIDC/SSO (14), notificationStore realtime (15), workspaceStore mode persistence (14); mocks HTTP layer (not API modules) to test full store → API → HTTP chain; round 2 review fixed missing in-memory state assertions, incorrect resetForLogout test comment, and 12 weak `rejects.toBeDefined()` assertions replaced with type-specific matchers\n - **E2E scenario expansion** (`#712`/`#822`): 20 new Playwright scenarios across 5 spec files — onboarding (5), review proposals (3), capture edge cases (4), keyboard navigation (4), dark mode (4); 17 passing, 3 gracefully skipped (dark mode toggle not present in current UI); round 2 review fixed missing `baseURL` in browser context (critical), brittle CSS selectors replaced with `getByLabel`, no-op assertions, unreliable `body.click()` defocusing, and misleading header comments\n - **Resilience and degraded-mode behavior tests** (`#720`/`#823`): 30 new tests across 3 files — LLM provider resilience (13: garbage/empty/missing-choices/429/timeout for OpenAI and Gemini, probe unhealthy), queue accumulation resilience (3: accumulation without corruption, item processability, rapid concurrent captures), frontend slow-API/storage resilience (14: loading states, throttle dedup, corrupted localStorage/token handling); round 2 review fixed CI-breaking unused import, unhandled promise rejections, contradictory test name, and misleading JWT comment\n - **Property-based and adversarial input tests** (`#717`/`#824`): 162 new tests across 8 files — domain property tests (93: ChatSession, ChatMessage, Notification, KnowledgeDocument, WebhookSubscription with adversarial strings, boundary lengths, state machine exhaustion), application fuzz tests (19: JSON round-trip for chat/notification DTOs), API adversarial tests (50: raw JSON with adversarial positions, XSS/injection payloads, unicode blocks, extra unknown fields, control chars); round 2 review fixed silent 500-skip, fake `[Property]` on deterministic tests, 7× copy-pasted generators replaced with shared adversarial generator (~45 vectors), and misleading URL trim comment\n - **Concurrency and race condition stress tests** (`#705`/`#825`): 22 new tests across 7 files — queue claim races (4), card update conflicts (5), proposal approval races (4), webhook delivery concurrency (2), board presence concurrency (2), rate limiting (3), cross-user isolation stress (2); uses `SemaphoreSlim` barriers for true simultaneous execution; SQLite write serialization limitations documented; round 2 review fixed critical thread-pool deadlock (blocking `Barrier.SignalAndWait` in async lambdas), cross-user isolation race condition, silent pass on broken rate limiting, and 2 data-loss-hiding weak assertions\n - **Frontend view and component coverage gaps** (`#716`/`#826`): 107 new tests across 8 files — ArchiveView (11), MetricsView (16), BoardView (12), ReviewView (10), AutomationChatView (16), CardItem (21), BoardCanvas (12), BoardActionRail (9); covers loading/error/empty states, user interactions, ARIA attributes, drag events; round 2 review fixed CI-blocking unused import, DOM pollution (missing afterEach cleanup), incorrect generic type, and misleading test name\n\n- Manual validation and verification program delivery (2026-04-15, PRs `#837`–`#841`):\n - **TST-09 manual validation slice C** (`#132`/`#839`): 45-scenario catalog for automation proposals, chat bootstrap, and execution safety in `docs/testing/MANUAL_VALIDATION_SLICE_C_SCENARIOS.md`; 17 Playwright E2E tests across 2 spec files (`validation-automation-proposals.spec.ts` with 8 tests, `validation-chat-bootstrap.spec.ts` with 9 tests); manual rehearsal runbook at `docs/testing/MANUAL_REHEARSAL_RUNBOOK_SLICE_C.md`\n - **TST-10 manual validation slice D** (`#133`/`#837`): 25-scenario catalog for ops CLI, log query/correlation, and health telemetry in `docs/testing/MANUAL_VALIDATION_SLICE_D_SCENARIOS.md`; 17 Playwright E2E tests in `validation-ops-logs-health.spec.ts`; operator rehearsal runbook at `docs/testing/MANUAL_REHEARSAL_RUNBOOK_SLICE_D.md`\n - **TST-11 manual validation slice E** (`#134`/`#840`): 25-scenario catalog for starter packs, archive recovery, and activity traceability in `docs/testing/MANUAL_VALIDATION_SLICE_E_SCENARIOS.md`; 23+ Playwright E2E tests across 3 spec files (`validation-starter-packs.spec.ts`, `validation-archive-recovery.spec.ts`, `validation-activity-traceability.spec.ts`); rehearsal runbook at `docs/testing/MANUAL_REHEARSAL_RUNBOOK_SLICE_E.md`\n - **TST-12 integrated verification program** (`#135`/`#838`): 18-scenario cross-component verification strategy in `docs/testing/INTEGRATED_VERIFICATION_STRATEGY.md`; 4 Playwright E2E tests in `integrated-verification.spec.ts` covering full capture-to-board pipeline, board bootstrap, workspace navigation, and auth denial; manual rehearsal template at `docs/testing/MANUAL_REHEARSAL_TEMPLATE.md`; release gating criteria documented; `docs/TESTING_GUIDE.md` updated with cross-references\n - **INT-06 integrations registry foundation** (`#340`/`#841`): full-stack integrations registry with domain entities (`IntegrationConnector`, `ConnectorEvent` with `ConnectorType`/`ConnectorDirection`/`ConnectorStatus` enums), application service (`IntegrationRegistryService` with `IIntegrationConnectorRepository`/`IConnectorEventRepository`), EF Core infrastructure (repositories + `AddIntegrationConnectorsAndEvents` migration), API (`IntegrationsController` with 7 endpoints — CRUD + enable/disable, all `[Authorize]`), frontend (`IntegrationsView.vue` at `/workspace/integrations` with `integrationStore` and `integrationsApi` with enum normalization), connector taxonomy (inbound/context/outbound per GP-06 — inbound connectors route through capture), architecture documentation at `docs/architecture/INTEGRATIONS_REGISTRY.md`; 60 new tests (24 domain + 12 application + 15 API + 9 frontend)\n - Tracker closures: 6 completed trackers closed — `#721` (TST-54 rigorous test expansion wave), `#647` (LLM-05 tool-calling), `#648` (MCP-00 server), `#329` (MVP-03 secondary follow-through), `#242` (UI-00 premium UI wave), `#235` (SEC-15 managed-key threat model)\n\n- Post-validation documentation sweep (2026-04-16, PR `#844`):\n - **Wave index and delivery annotations sweep** (`#844`): updated `#107` wave execution index with 126/129 completed items checked; added \"(delivered)\" annotations to ~100+ items across Stages 2--5 in `ISSUE_EXECUTION_GUIDE.md`\n - Note: PRs `#822`, `#841`, `#877`--`#880`, `#882` remain open and are not yet merged; their contents will be documented here upon merge\n\n- Production hardening wave from AUDIT.md findings (2026-04-22, PRs `#902`–`#913`, 12 PRs covering 10 tracked audit issues plus 2 CI stabilisation fixes):\n - **PERF-13 SQL-level AuditLog filtering** (`#849`/`#903`): `AuditLogRepository.QueryAsync` SQLite branch now uses `BuildSqliteQueryAsync` that pushes `userId`/`boardId`/`source`/`level` filters plus `ORDER BY`/`LIMIT` into a parameterised raw SQL query; board-scoped filter uses `EXISTS` subqueries (matching `GetByBoardAsync`) to avoid the SQLite `SQLITE_MAX_VARIABLE_NUMBER` limit and removes 3 extra round-trips from `ResolveBoardScopedEntityIdsAsync` for SQLite; non-SQLite providers continue to use in-memory pagination with `Contains()`\n - **PERF-11 WorkspaceService sync-over-async removal** (`#847`/`#904`): replaced `.Result` in `GetOnboardingForPreferenceAsync` with sequential `await`; parallel `Task.WhenAll` branches in `GetHomeAsync`/`GetTodayAsync` intentionally reverted to sequential awaits in round 2 review because all repositories share the scoped `DbContext` via `IUnitOfWork` (EF Core `DbContext` is not thread-safe)\n - **SEC-26 SSRF protection for webhook and LLM provider URLs** (`#850`/`#905`): new `SsrfProtectionService` in Application layer with `ValidateUrl`/`ValidateUrlWithDnsAsync`/`ValidateLlmProviderUrl` methods wrapping `OutboundWebhookEndpointGuard`; explicit cloud metadata hostname blocking (`metadata.goog`, `metadata.google.internal`, Alibaba Cloud `100.100.100.200`, AWS IMDSv2 IPv6 `fd00:ec2::254`); LLM provider selection policy now calls `ValidateLlmProviderUrl` for `OpenAi`/`Gemini` `BaseUrl` (rejects private IPv4/IPv6, cloud metadata, non-HTTPS) with `allowLocalhostEndpoints` toggle for Development + `AllowLiveProvidersInDevelopment` (enables Ollama/LM Studio); OpenAI + Gemini `HttpClient` registrations now use `OutboundWebhookConnectCallback` for DNS-rebinding defense and `AllowAutoRedirect = false`; 83 `SsrfProtectionServiceTests` covering private IPv4 (`127/8`, `10/8`, `172.16/12`, `192.168/16`), IPv6 ranges (`::1`, `fc00::/7`, `fe80::/10`), IPv4-mapped IPv6, decimal/hex/octal IP bypass attempts, and HTTPS enforcement\n - **TST-58 CLI test discovery + shared harness** (`#853`/`#906`): added missing `[Fact]`/`[Theory]` attributes across CLI test files; extracted shared `CliTestHarness` (replaced ~90-line duplicated harness in 5 files); `AppContext.BaseDirectory` dll lookup replaces fragile repo-tree walk; 30-second process timeout via `CancellationTokenSource`; `[Collection(\"Console Tests\")]` for `Console.Out` thread safety; `InternalsVisibleTo` added so internal CLI types can be unit-tested; CLI test suite now totals ~78 tests across 10 files (ArgParser 15, ApiKey 12, Cards 11, Columns 10, Boards 7, ConsoleOutput 7, CliActorIdentity 5, ExitCodes 4, CliJsonContract 4, CommandDispatcher 3)\n - **OPS-27 startup configuration validation** (`#863`/`#908`): data annotations (`[Required]`, `[Range]`, `[MinLength]`, `[RegularExpression]`, `[Url]`) on 15 settings classes (`JwtSettings`, `WorkerSettings`, `CacheSettings`, `RateLimitingSettings`, `LlmProviderSettings`, `OpenAiProviderSettings`, `GeminiProviderSettings`, `ObservabilitySettings`, `SentrySettings`, `SecurityHeadersSettings`, `TelemetrySettings`, `LlmQuotaSettings`, `LlmToolCallingSettings`, `AbuseDetectionSettings`, `MfaPolicySettings`); 4 cross-property `IValidateOptions` validators (`WorkerSettingsValidator` for `RetryBackoffSeconds.Length >= MaxRetries`, `JwtSettingsValidator` for secret length, `SentrySettingsValidator` for `Dsn` when `Enabled`, `RateLimitingSettingsValidator` for nested policy ranges); `ValidateDataAnnotations()` + `ValidateOnStart()` wiring via new `RegisterValidatedOptions` helper; `LlmProvider`/`CacheProvider` regex patterns use `(?i)` case-insensitive flag to match runtime comparison; `RateLimitPolicySettings` exposes range constants to prevent data-annotation/validator divergence; `JwtSettings.SecretKey` intentionally not `[Required]` because `FirstRunBootstrapper` generates it; 34 new `OptionsValidationTests`\n - **PERF-12 board list pagination** (`#848`/`#909`): new `PaginatedResult` DTO (`items`/`totalCount`/`hasMore`/`offset`/`limit`); `BoardService.ListBoardsPaginatedAsync` applies authorization filter before pagination so `totalCount` reflects only authorised boards; `BoardRepository.SearchIdsAsync` sorts by `CreatedAt DESC` with `Id` as deterministic tiebreaker so page boundaries do not overlap across calls; `GET /api/boards` accepts `offset`/`limit` query parameters (default `limit=50`, server-clamped to `[1, 200]`); frontend `boardsApi.getBoards` delegates to new `getBoardsPaginated` and unwraps `.items` for backward compatibility; archive-recovery E2E fix: unwrap `.items` from paginated response; 11 new `BoardPaginationApiTests` (default pagination, empty, offset beyond total, zero limit clamp, cross-user isolation, full-page iteration)\n - **SEC-30 file import content validation** (`#860`/`#910`): new `FileContentValidator` in Application layer with `ValidateTextContent` (binary/null-byte/C1-control detection; blocks all C1 controls including `0x91-0x94`/`0x96-0x97` because in UTF-16 they are genuine control chars, not Windows-1252 smart quotes — real smart quotes decode to `U+2018-U+201D`), `ValidateJsonContent` (BOM-aware parse + magic-byte check against SQLite `SQLite format 3\\0`), and character-based limits (renamed from `MaxMarkdownContentBytes` → `MaxMarkdownContentChars` to match `NoteImportService` CJK-safe semantics); `NoteImportController` (markdown + web clip), `ExternalImportsController` (CSV), and `ExportController` (board JSON) now validate content before it reaches the service layer; board JSON re-import passes `maxBytes: 0` to preserve round-trip portability for large exports; 52 `FileContentValidatorTests` covering text/JSON/binary/BOM/C1-control/size-limit/Unicode edge cases\n - **SEC-27 dev JWT secret removal and unconditional bootstrap** (`#851`/`#911`): removed hardcoded `Jwt:SecretKey` from `appsettings.Development.json`; `FirstRunBootstrapper.EnsureJwtSecret` now runs unconditionally in all environments (including Development and CI/headless) after round 2 review — the original headless guard caused CI auth failures because `GITHUB_ACTIONS=true` made `IsHeadlessEnvironment()` return `true` and the subsequent `AddTaskdeckAuthentication` short-circuited without registering auth services; non-JWT bootstrap checks consolidated into a single early-return; `TestWebApplicationFactory` now provides its own in-memory JWT secret so API tests are environment-independent; `IOException` fallback catches parallel-test contention on `appsettings.local.json`; `CONTRIBUTING.md` documents auto-generation, `dotnet user-secrets`, and `Jwt__SecretKey` env-var alternatives; `CONFIGURATION_REFERENCE.md` and `SECRETS_MANAGEMENT_BASELINE.md` updated to match\n - **OPS-28 EF Core migration bootstrap verification** (`#864`/`#907`): 5 `MigrationBootstrapTests` verifying fresh-database migration integrity — full chain applies cleanly, all expected tables created (verified via reflection from `DbContext` DbSets rather than hardcoded list so tests auto-adapt), `Migrate()` is idempotent, no pending migrations after full apply, `HasPendingModelChanges()` reports no drift (detects real model/snapshot divergence, not just missing migration files), and all migration timestamps are distinct; `GetUserTables()` uses `OpenConnection()`/`CloseConnection()` instead of disposing the `DbContext`-owned connection; workflow guide at `docs/platform/EF_MIGRATION_WORKFLOW.md` (add/apply/revert/script migrations, bootstrap verification, SQLite troubleshooting); round 2 review surfaced real model drift: `ExternalLoginConfiguration` declared a `HasOne` FK with cascade delete but the original `AddExternalLogins` migration did not create the FK constraint — captured in new migration `AddExternalLoginsUserForeignKey` (SQLite table-rebuild) so the snapshot and model agree; `ProductVersion` bumped `8.0.25` → `8.0.26` to match installed EF packages\n - **CI-02 Gitleaks secrets detection** (`#871`/`#902`): `.gitleaks.toml` extends default rules with project-specific allowlists (test fixture secrets, dev placeholders, CI-only config strings, JWT test keys, fake LLM API keys, OAuth test fixtures); `.gitleaksignore` for per-finding fingerprint suppression; reusable workflow `reusable-gitleaks.yml` with configurable `scan-mode` (`pr`/`full`) and `fail-on-findings` toggle, `gitleaks/gitleaks-action` pinned to commit SHA `ff98106e` (not a mutable tag) for supply-chain safety; `ci-extended.yml` runs a non-blocking advisory PR scan on every PR; `ci-release.yml` runs a blocking full-history scan via the CLI (event-agnostic, works on `release` events that the GitHub Action does not support); SARIF artefacts uploaded for review; CI topology comment in `ci-required.yml` updated\n - **CI stabilisation — ActivityView test flake on Windows** (`#912`, no issue): `ActivityView.spec.ts` `seedBoards()` previously called `new Date().toISOString()` twice in immediate succession and relied on stable sort preserving declaration order when both timestamps resolved to the same millisecond; on `windows-latest` the second call advanced past the first more often, making the component's `updatedAt DESC` sort pick `board-2` instead of `board-1` as the default selection and breaking downstream `fetchBoard` assertions; fix assigns explicit ordered ISO timestamps (`board-1 = 2025-01-02`, `board-2 = 2025-01-01`) so sort order is deterministic regardless of `Date` resolution\n - **CI stabilisation — cross-process FirstRunBootstrapper write serialisation** (`#913`, no issue): parallel xUnit test processes racing on `appsettings.local.json` read-modify-write produced invalid trailing `}` after valid JSON (`File.WriteAllText` is not atomic across processes); fix serialises the read-modify-write with a named cross-process mutex (hashed from the absolute config path) and stages new contents in a sibling temp file that is atomically moved over the destination so no partial file is ever visible to another process; surfaced by `#911` removing the headless early-return around `EnsureJwtSecret`\n\n- CI/hardening, frontend decomposition, ops, and documentation wave (2026-04-22, PRs `#914`--`#924`, 10 issues):\n - **OPS-30 monitoring and alerting rules** (`#868`/`#914`): `docs/ops/ALERTING_RULES.md` (356 lines, 10 alert rules) with severity-tiered thresholds — P1: 5xx rate >1%, worker heartbeat >5min, DB connectivity loss, health endpoint failure; P2: p95 latency >2s, disk >80%, memory >85%, queue backlog >100, CPU >80%, SignalR/Redis degradation; integration paths for Grafana, CloudWatch, and PagerDuty documented; `docs/ops/README.md` and `docs/ops/OBSERVABILITY_BASELINE.md` updated with cross-links\n - **CI-01 SAST scanning with Semgrep** (`#870`/`#915`): `.semgrep/taskdeck-csharp.yml` (5 custom C# rules) and `.semgrep/taskdeck-typescript.yml` (5 custom TypeScript rules); `scripts/ci/summarize-sast-findings.mjs` for human-readable finding summaries; `.github/workflows/reusable-sast-scanning.yml` wired into `ci-extended` (label: `security`) and `ci-nightly`; advisory mode by default with enforceable option; ADR-0031 documents the SAST scanning decision\n - **TST-61 database migration validation in CI** (`#869`/`#916`): `scripts/ci/validate-migrations.sh` for CI migration chain validation; `.github/workflows/reusable-migration-validation.yml` wired into `ci-required` as a parallel job; `docs/platform/EF_MIGRATION_WORKFLOW.md` updated with CI validation section\n - **DOC-08 data model reference with ERD** (`#875`/`#917`): `docs/architecture/DATA_MODEL.md` (855 lines, 37 entities, Mermaid ERD) covering all domain entities with relationships, field types, and constraints; cross-linked from 5 API docs (BOARDS, CAPTURE, CHAT, WEBHOOKS, AUTHENTICATION)\n - **CI-03 performance regression gate** (`#872`/`#918`): k6 thresholds (p95 <2s, error rate <1%); `scripts/ci/check-bundle-size.mjs` and `scripts/ci/check-k6-thresholds.mjs` for deterministic threshold enforcement; `.github/workflows/reusable-performance-regression-gate.yml` wired into `ci-extended` (label: `performance`) and `ci-nightly`; `docs/PERFORMANCE_BUDGETS.md` updated with CI gate thresholds\n - **FE-20 session timeout warning** (`#861`/`#919`, backend `#933`/`#939`): `useSessionTimeout.ts` composable (245 lines) with configurable warning-before-expiry, countdown timer, and extend/logout actions; `SessionTimeoutWarning.vue` wired into `App.vue`; backend `POST /api/auth/refresh` endpoint now implemented with `[Authorize]` gate, JWT-claims-only user ID, `TokenRefreshPerUser` rate limiting (5/60s), and `TokenInvalidatedAt` enforcement; 19 frontend tests + 10 backend integration tests\n - **FE-18 decompose AutomationChatView** (`#859`/`#920`): 1,523 lines reduced to 235-line shell + 7 components (`ChatHeroHeader`, `LlmHealthStatusBar`, `ChatSessionSidebar`, `ChatMessageList`, `ChatParseHintCard`, `ChatToolCallDetails`, `ChatComposeBar`) + `useAutomationChat` composable (394 lines); all components under 400 lines\n - **FE-17 decompose InboxView** (`#858`/`#921`): 1,527 lines reduced to 222-line shell + `InboxListPanel`, `InboxDetailPanel`, `useInboxOrchestrator` composable, and `inboxUtils`; all existing tests pass without modification\n - **FE-16 decompose ReviewView** (`#856`/`#923`): 1,659 lines reduced to 148-line shell + 6 components (`ReviewHeader`, `ReviewSummaryCards`, `ReviewEmptyState`, `ReviewProposalCard`, `ReviewProposalActions`, `ReviewProposalDetails`) + 2 composables (`useReviewProposals`, `useReviewActions`); all 45 existing ReviewView tests pass without modification\n - **HARD-01 circuit breaker for external API calls** (`#876`/`#924`): Polly circuit breakers on OpenAI, Gemini HTTP clients, and OAuth backchannel; `CircuitBreakerStateTracker` singleton and `CircuitBreakerSettings` config class; health endpoint reports circuit breaker state as degraded (not 503); 23 tests; ADR-0032 documents the circuit breaker decision\n- Docs, CI hardening, and bug-fix wave (2026-04-23, PRs `#936`–`#942`): 7 PRs across docs cleanup, bug fixes, and CI hardening:\n - **Docs cleanup** (`#934`/`#936`): removed legacy `TASKDECK_E2E_DB` env var prefix from Playwright commands across 5 docs; annotated duplicate `#326` follow-up relationship; removed redundant `TASKDECK_E2E_API_CORS_ORIGINS` env var from fallback commands\n - **UTF-8 mojibake fix** (`#929`/`#937`): 109 encoding fixes in `STATUS.md` — 46 em dashes, 17 en dashes, 46 right arrows replaced from CP1252→UTF-8 double-encoding artifacts\n - **Redundant migration no-op** (`#932`/`#938`): `AddExternalLoginsUserForeignKey` migration made no-op — FK was already added by earlier `AddTokenInvalidatedAt` migration\n - **Auth refresh endpoint** (`#933`/`#939`): `POST /api/auth/refresh` with `[Authorize]`, JWT-claims user ID, `TokenRefreshPerUser` rate limiting (5/60s), `TokenInvalidatedAt` enforcement; 10 integration tests; completes FE-20 session timeout backend\n - **Test count recertification** (`#930`/`#940`): TESTING_GUIDE.md updated with verified counts — backend 4,979, frontend unit 2,607, combined 7,586+ (subsequently recertified to 5,060/2,805/7,865+ in `#970`/`#987`)\n - **UserPreferences race fix** (`#931`/`#941`): replaced try-catch-retry (~105 lines) with atomic `INSERT OR IGNORE` SQLite upsert (~15 lines) in `UserPreferenceRepository`; 4 concurrency tests added\n - **Pre-existing CI fix** (`#942`): resolved 5 API Integration test failures — `Connectors:EncryptionKey` added to Production-mode test configuration; MCP telemetry test assertion index corrected\n- Mobile, security, legal, and testing expansion wave (2026-04-23, PRs `#944`–`#949`):\n - **FE-19 mobile-responsive board, toolbar, and dialog** (`#860`/`#944`): board view stacks columns vertically on ≤640px viewports with page-level scroll; `TdDialog` becomes full-bleed at ≤640px with `100dvh` height and stacked footer actions (cascades to all consumers: CardModal, BoardSettingsModal, LabelManager, StarterPackCatalog, KeyboardHelp); board toolbar and action rail enforce 44×44px tap targets on mobile; `ColumnLane` uses `--td-font-lg` token for 16px font-size to prevent iOS zoom; new `@mobile` Playwright test; WCAG 2.4.3 dialog footer tab-order fix; adversarial review addressed scoped slot CSS penetration and overflow-x interaction\n - **SEC-29 CSP style-src tightening (partial)** (`#855`/`#945`): removed `'unsafe-inline'` from `style-src` in API CSP entirely; added `style-src-elem 'self'` in reverse-proxy CSP to block inline `