Issue map: how the open issues relate, and what blocks what #168

Rebuilt 2026-08-13 over 182 open issues and 38 open pull requests. CLAUDE.md
makes reading this a precondition for filing, and it was a title with an empty body
from 2026-08-04 until now — #683 is the issue about that, and this is the answer to
it.

How to use it

Before filing, find the cluster your defect belongs to below and name at least one
issue from it in the body. "Checked, nothing related" is a fine answer; silence is
not. Then come back and add your number to the cluster, and to the spine if it blocks
something.

Two commands before you write a word — the map is a snapshot and the repository is not:

gh issue list --state open --limit 300 --search "<the words in your title>"
gh issue list --state closed --limit 100 --search "<the same words>"

Search the closed ones too. #659 was filed, worked and merged this week as half of
#437, which had been closed unfixed six days earlier — that is what #687 is about, and
it is the single most expensive mistake this map exists to prevent. A closed issue in
this repository is often closed by hand, with the evidence in a comment and no
closing pull request, so Closes/Refs in a footer is not a reliable signal either
way.

Every issue below appears exactly once, in the cluster that owns it. 48 of the 182
have a pull request in flight — those are marked, and picking one up is duplicated
work.

The clusters

A refusal that quotes the vendor

• Stop logging expected refusals as application errors #19 medium Stop logging expected refusals as application errors
• Make an audit write failure loud, and type record_audit #20 medium Make an audit write failure loud, and type record_audit
• Refuse a malformed sealed payload without naming its contents #21 medium Refuse a malformed sealed payload without naming its contents
• PiiRedactionFilter redacts nothing: it is on the root logger, and the worker never installs it #440 high PiiRedactionFilter redacts nothing: it is on the root logger, and the worker never installs it
• Dashboard error frame sends str(e) of a provider exception to the client #659 medium Dashboard error frame sends str(e) of a provider exception to the client — PR fix(chat): stop sending a provider's own text to the chat panel #675
• A failed agent run still stores the model client's exception text on the run row #676 medium A failed agent run still stores the model client's exception text on the run row — PR fix(agents): store the refusal on a failed run, not the provider #691
• The chat tool_result frame relays a search provider's exception text to the client #681 medium The chat tool_result frame relays a search provider's exception text to the client — PR Name the tool that failed, not the search provider's error #694
• MCP OAuth refusals interpolate an httpx error, so a request URL can reach the user #686 high MCP OAuth refusals interpolate an httpx error, so a request URL can reach the user — PR fix(mcp): stop OAuth refusals quoting the upstream client #693
• The run transcript stores a search provider's exception text on a tool-call row #695 medium The run transcript stores a search provider's exception text on a tool-call row
• A delegated run's row still stores the subagent library's exception text #699 medium A delegated run's row still stores the subagent library's exception text — PR fix(agents): compose a delegated run's stored error, never store the library's #816
• check_task and wait_tasks hand a delegate's provider text to the parent's transcript #819 medium check_task and wait_tasks hand a delegate's provider text to the parent's transcript — PR fix(agents): keep a delegate's provider text out of a status answer #832

Who may do what

• An app admin can suspend, demote and delete their own account, unguarded at both layers #941 medium security An app admin can suspend, demote and delete their own account - no guard at either layer, and two of the three take one click with no confirmation. Same family as change_role can mint a second Owner, bypassing transfer_ownership #672 and change_role lets an Admin demote a peer Admin that remove refuses to remove #700

• Impersonation mints a bearer token onto the clipboard, and nothing it does is attributable to the admin #943 medium security Impersonation mints a bearer token onto the clipboard, carries no actor claim, and cannot be ended - so nothing done with it is attributable to the admin

• Impersonation should be an endable session, not a token on the clipboard #1044 enhancement security Impersonation as an endable session, not a token on the clipboard — the flow half of Impersonation mints a bearer token onto the clipboard, and nothing it does is attributable to the admin #943 — PR feat(admin): make impersonation an endable session, not a token on the clipboard #1435

• An open WebSocket outlives the revocation of the session that opened it #1437 medium security An open WebSocket outlives the revocation of the session that opened it — found reviewing Impersonation should be an endable session, not a token on the clipboard #1044

• chat: a normal (non-impersonation) session's WebSocket is not closed by sign-out-everywhere (no sid bind) #1501 medium security A normal (non-impersonation) session's WebSocket is not closed by sign-out-everywhere — no sid binds an ordinary access token to a session row, so it hangs on is_active alone — found implementing An open WebSocket outlives the revocation of the session that opened it #1437

• Identity-binding routes are allowed while impersonating, so an admin can attach their own chat identity to somebody's account #1438 medium security Identity-binding routes (channel link, MCP OAuth) are allowed while impersonating — found reviewing Impersonation should be an endable session, not a token on the clipboard #1044

• Organization MCP OAuth starts are allowed while impersonating, binding an admin grant as a member #1490 medium security The organization MCP OAuth starts are the org half of Identity-binding routes are allowed while impersonating, so an admin can attach their own chat identity to somebody's account #1438, left open by its personal-only fix — found fixing Identity-binding routes are allowed while impersonating, so an admin can attach their own chat identity to somebody's account #1438

• Manual personal MCP token entry is allowed while impersonating, storing an admin token as a member's #1492 medium security Manual personal MCP token entry is unguarded under impersonation — the manual-token half of Identity-binding routes are allowed while impersonating, so an admin can attach their own chat identity to somebody's account #1438 — found fixing Identity-binding routes are allowed while impersonating, so an admin can attach their own chat identity to somebody's account #1438

• Manual org MCP token entry is neither refused nor fully audited while impersonating #1521 medium security Manual organization MCP token entry is neither refused nor fully audited under impersonation — the org manual-token corner alongside Organization MCP OAuth starts are allowed while impersonating, binding an admin grant as a member #1490/Manual personal MCP token entry is allowed while impersonating, storing an admin token as a member's #1492 — found fixing Manual personal MCP token entry is allowed while impersonating, storing an admin token as a member's #1492

• Changing a password from Settings does not revoke the account's other sessions #1439 medium security Changing a password from Settings does not revoke the other sessions; only the email reset does — found reviewing Impersonation should be an endable session, not a token on the clipboard #1044

• auth: refresh-token rotation has no reuse/replay detection (kill-family on a spent token) #1519 enhancement security priority:low Refresh-token rotation has no reuse/replay detection (kill-family when a spent token returns) — a defense-in-depth pattern the project never had, orthogonal to chat: a normal (non-impersonation) session's WebSocket is not closed by sign-out-everywhere (no sid bind) #1501, not a regression — found implementing chat: a normal (non-impersonation) session's WebSocket is not closed by sign-out-everywhere (no sid bind) #1501

• PATCH /users/me with {"password": null} returns 500 instead of a 4xx #1497 low Malformed {"password": null} on PATCH /users/me returns 500, not a 4xx — found fixing Changing a password from Settings does not revoke the account's other sessions #1439, pre-existing input-validation defect in the same branch

• Sharing a conversation outside the organization is accepted and unreadable #930 medium Sharing a conversation outside the organization is accepted and unreadable - the share resolves any deployment user, the read refuses on the tenant first (found reading the path for The Share conversation dialog: a member picker instead of an email box, room to breathe, and icons on view/edit #931)

• Access-check spec.skill_ids at publish, like every other reference #6 high Access-check spec.skill_ids at publish, like every other reference

• OAuth sign-in drops the ?returnTo= deep link #135 OAuth sign-in drops the ?returnTo= deep link

• Invitations never reach EXPIRED: the sweep has no caller, and a timed-out one is marked revoked #456 low Invitations never reach EXPIRED: the sweep has no caller, and a timed-out one is marked revoked — PR Expire a stale invitation instead of leaving it pending #667

• InviteLinkCreate.role is unvalidated — an Owner can mint an owner-granting share link #551 medium InviteLinkCreate.role is unvalidated — an Owner can mint an owner-granting share link — PR Validate the role an invite link offers #671

• Agent draft can't be published by a builder who can't add a model #591 medium Agent draft can't be published by a builder who can't add a model — PR feat(onboarding): first-run tour, guided flows #624

• change_role can mint a second Owner, bypassing transfer_ownership #672 medium change_role can mint a second Owner, bypassing transfer_ownership — PR fix(permissions): stop change_role handing out the owner role #697

• Invitation role ceiling is keyed on the literal 'admin', so only built-in Admins are capped #696 medium Invitation role ceiling is keyed on the literal 'admin', so only built-in Admins are capped — PR fix(permissions): cap the invitable role by what the requester holds #1019, merged

• The role pickers offer roles the caller cannot assign, and the service refuses them after the fact #1028 low frontend The role pickers offer roles the caller cannot assign, and the service refuses them after the fact — the client half of Invitation role ceiling is keyed on the literal 'admin', so only built-in Admins are capped #696 and change_role lets an Admin demote a peer Admin that remove refuses to remove #700, found reviewing fix(permissions): cap the invitable role by what the requester holds #1019

• change_role lets an Admin demote a peer Admin that remove refuses to remove #700 low change_role lets an Admin demote a peer Admin that remove refuses to remove

• invite_only cannot honour a shareable link with no address or domain #916 low invite_only cannot honour a shareable link with no address or domain: the register request carries no token, so the policy can only match an invitation against the submitted address (found reviewing fix(builder): configure an agent in one place, and stop guessing at what a reader sees #914, which added the sign-up policy)

• ASK_ALL is not restored on resume, so a rejected tool call can execute #1326 high security ASK_ALL is not restored when a parked run resumes, so a tool gated only by the conversation's approval mode and then rejected can reach its handler (found reviewing feat(approvals): a per-conversation approval mode in the chat #1295, which added the mode)

• A conversation cannot be shared past the first page of members #1335 high frontend A conversation cannot be shared past the first page of members: the picker The Share conversation dialog: a member picker instead of an email box, room to breathe, and icons on view/edit #931 made the only path fetches one page of 50 and Sharing a conversation outside the organization is accepted and unreadable #930's tightening removed the address field that used to be the escape hatch

Channels and bots

• Surface parity: what /chat offers that the raw WebSocket and the Public API do not #936 Surface parity: what /chat offers that the raw WebSocket and the Public API do not - the API cannot attach a file and never fills parked, the socket has no environment_id, no ask_user and no compaction notice. Deliverable is a parity table in docs/channels.md that a test holds true

• Refuse a Telegram webhook that carries no secret #4 high Refuse a Telegram webhook that carries no secret

• Other channels setup (websocket, frontend, etc.) #39 Other channels setup (websocket, frontend, etc.) — PR feat(channels): surface parity, the socket as an integration, and a hosted chat page #634

• Telegram setup #42 Telegram setup

• Slack setup #43 Slack setup

• Workspaces: a user-scoped workspace from Slack or Telegram is invisible to the linked account #131 Workspaces: a user-scoped workspace from Slack or Telegram is invisible to the linked account

• Offer the widget's WebSocket as an integration, not only as documentation #516 Offer the widget's WebSocket as an integration, not only as documentation — PR feat(channels): surface parity, the socket as an integration, and a hosted chat page #634

• A hosted chat page: reach an agent by link, with no login and no site of your own #517 A hosted chat page: reach an agent by link, with no login and no site of your own — PR feat(channels): surface parity, the socket as an integration, and a hosted chat page #634

• Visual map: four directions around the agent, and a node per subagent #518 Visual map: four directions around the agent, and a node per subagent

• Telegram polling and Mattermost webhook bypass parse_incoming, dropping attachments #547 high Telegram polling and Mattermost webhook bypass parse_incoming, dropping attachments — PR fix(channels): parse every inbound transport with one parser #698

• Three channel webhook routes drift on a missing secret: 500 (Slack) vs 403 (others) #555 medium Three channel webhook routes drift on a missing secret: 500 (Slack) vs 403 (others)

• chat_type vocabulary differs per adapter, so the column holds mixed vocabularies #556 medium chat_type vocabulary differs per adapter, so the column holds mixed vocabularies

• Lift the channel transport boilerplate into base.py helpers #565 low Lift the channel transport boilerplate into base.py helpers

• A widget update sending theme: null answers 500 on a NOT NULL column #637 low A widget update sending theme: null answers 500 on a NOT NULL column — PR feat(channels): surface parity, the socket as an integration, and a hosted chat page #634

• A channel bot past 200 messages is reminded of the thread's first 200, not its last #638 medium A channel bot past 200 messages is reminded of the thread's first 200, not its last — PR feat(channels): surface parity, the socket as an integration, and a hosted chat page #634

• A group channel refuses every sender who never linked an account, and require_link decides nothing #639 A group channel refuses every sender who never linked an account, and require_link decides nothing — PR feat(channels): surface parity, the socket as an integration, and a hosted chat page #634

• Two copies of "an anonymous surface runs as its publisher": embed_session and channels/mentions #640 Two copies of "an anonymous surface runs as its publisher": embed_session and channels/mentions — PR feat(channels): surface parity, the socket as an integration, and a hosted chat page #634

• A channel thread stays visible to somebody removed from the channel #641 A channel thread stays visible to somebody removed from the channel

• The cookie banner covers Send on a hosted page, and its copy is untrue there #644 medium The cookie banner covers Send on a hosted page, and its copy is untrue there — PR feat(channels): surface parity, the socket as an integration, and a hosted chat page #634

• Every agenticos cmd channel-* command fails: the CLI builds ChannelBotService with no organization, and three of them report it as "Bot not found" #1350 high Every agenticos cmd channel-* command fails - the CLI builds ChannelBotService with no organization, and three of the five report it as "Bot not found" (found setting a Slack bot up from scratch)

• A Slack bot whose Socket Mode connection never starts looks healthy on /channels - the only evidence is a log line #1351 medium frontend A Slack bot whose Socket Mode connection never starts looks healthy on /channels - the only evidence is a log line. Narrowed by PR docs: rebuild the site, add the galleries, and close eleven issues #1344, which badges an absent xapp- token; a present-but-rejected one is still silent

• slack-sdk is declared without the [socket-mode] extra, so Socket Mode works only while aiohttp arrives transitively #1352 low dependencies slack-sdk is declared without the [socket-mode] extra, so Socket Mode works only while aiohttp arrives transitively - and the guarded import means no test would catch its removal

• A bot mentioned in a thread it has no record of answers as if the thread were empty - nothing backfills the earlier turns #1353 medium A bot mentioned in a thread it has no record of answers as if the thread were empty - nothing backfills the earlier turns, and read_channel_history is bound to the channel rather than the thread (found verifying PR docs: rebuild the site, add the galleries, and close eleven issues #1344 in a real workspace)

• Mattermost webhook transport answers every post, unlike the stream transport #662 medium Mattermost webhook transport answers every post, unlike the stream transport — PR fix(channels): gate a Mattermost webhook post the way the stream is #685

• A Mattermost webhook bot has no server URL, so its attachments cannot be fetched #692 medium A Mattermost webhook bot has no server URL, so its attachments cannot be fetched

• Refuse a deactivated member's channel turn instead of running it at their old role #1427 high security Refuse a deactivated member's channel turn instead of running it at their old role - _membership_context reads the role off member_repo.get where publisher_context was hardened to get_active; not fixed by PR feat(spec)!: an MCP binding says whose account it speaks through #1392, land after it (2026-09-03 channels audit)

• Bound the router's chat-lock and rate-bucket maps, which grow per Slack message #1428 medium Bound the router's _chat_locks / _rate_buckets, which grow per top-level Slack message and were named in Add row locks to four check-then-act races #17 but never evicted (2026-09-03 channels audit)

• Render a channel chart off the event loop #1429 medium Render a channel chart off the event loop - drawn_chart → Pillow render_chart_png runs synchronously in the async turn (2026-09-03 channels audit)

• One supervised reconnect loop for the three adapters; Telegram retries a bad token forever #1430 medium One supervised reconnect loop for the three adapters; Telegram has no config-error branch and retries a bad token forever (2026-09-03 channels audit)

• Re-stamp the Telegram polling heartbeat so a quiet bot does not read unknown #1431 low Re-stamp the Telegram polling heartbeat - the Telegram half A Slack bot whose Socket Mode connection never starts looks healthy on /channels - the only evidence is a log line #1351 named but did not do (2026-09-03 channels audit)

• Make the channel chart dispatch exhaustive over ChartType, and fix the skill's claim that the renderer is gone #1432 low An area chart renders as a line chart in channels, and the channel-bot skill says chart_png.py is gone (2026-09-03 channels audit)

• Couple jwt_linked to require_link, or retire the mode value that decides nothing #1433 low Couple jwt_linked to require_link, or retire the mode value that decides nothing since A group channel refuses every sender who never linked an account, and require_link decides nothing #639 (2026-09-03 channels audit)

• Channels hygiene: seven small items from the 2026-09-03 audit #1434 low Channels hygiene: seven small items from the 2026-09-03 audit (Slack payload-URL fetch, router.py Any, dead list_platforms, client lifecycle, getattr setup hooks, encode_untrusted parity, two duplicated router shapes)

• Gate /new, /project and /unlink on the same link admission as a turn #1455 severity:low Gate /new, /project and /unlink on the same link admission as a turn - pre-existing since A group channel refuses every sender who never linked an account, and require_link decides nothing #639, found reviewing fix(channels): make the jwt_linked mode require a link on its own #1454

• Refuse a deactivated linked sender before attachments are stored and transcribed #1456 severity:low security Refuse a deactivated linked sender before attachments are stored and transcribed - moves fix(channels): refuse a deactivated member's channel turn #1436's run-level refusal earlier, found reviewing fix(channels): make the jwt_linked mode require a link on its own #1454

• A crashed channel turn leaves its attachments orphaned in chat_files #1503 low A crashed channel turn leaves its attachments orphaned in chat_files — found unifying the router turn paths (Unify the mention and default turn paths' refusal-and-crash handling in the channel router #1459), same A successful channel turn never links its ChatFile rows to a message #690 class

• Thread backfill under jwt_linked quotes unlinked authors into the prompt #1457 severity:low Thread backfill under jwt_linked quotes unlinked authors into the prompt - generalises the whitelist backfill filter, found reviewing fix(channels): make the jwt_linked mode require a link on its own #1454

• Unify the mention and default turn paths' refusal-and-crash handling in the channel router #1459 enhancement Unify the mention and default turn paths' refusal-and-crash handling - the try/except half split out of Channels hygiene: seven small items from the 2026-09-03 audit #1434 (2026-09-03 channels audit)

• A room thread nobody linked an account in is writable by any member #701 low A room thread nobody linked an account in is writable by any member

Files a turn writes

• One file viewer, not four: the chat file dialog is the poorest of them #136 One file viewer, not four: the chat file dialog is the poorest of them
• Workspaces: an owner column, a link to the conversation, and Open into a skills-style browser #137 Workspaces: an owner column, a link to the conversation, and Open into a skills-style browser
• All files: no search, no sort, six icons and no preview #138 All files: no search, no sort, six icons and no preview — PR feat(chat): search, sort and previews on the All files grid #828
• A file card shows no thumbnail for an image #827 A file card shows no thumbnail for an image — the half of All files: no search, no sort, six icons and no preview #138 that costs a request per tile — PR feat(chat): search, sort and previews on the All files grid #828, alongside All files: no search, no sort, six icons and no preview #138: the listing carries a scaled data: URI, so it costs no request at all
• Chat uploads are capped at a hardcoded 10MB while every setting says 50 #498 medium Chat uploads are capped at a hardcoded 10MB while every setting says 50
• A workspace file has no modified time, so the file viewer's header cannot show one #500 A workspace file has no modified time, so the file viewer's header cannot show one
• An answered ask_user question leaves no trace in the transcript #502 medium An answered ask_user question leaves no trace in the transcript
• A non-mention channel message with attachments stores every file twice #660 medium A non-mention channel message with attachments stores every file twice — PR fix(channels): fetch a message's attachments once, not per path #684
• A channel turn refused before the run orphans its ChatFile rows #661 low A channel turn refused before the run orphans its ChatFile rows — PR Delete the files a refused channel turn stored #689
• A successful channel turn never links its ChatFile rows to a message #690 low A successful channel turn never links its ChatFile rows to a message — PR Link a channel turn's files to the message it wrote #703
• A caption-less image on a workspace-less agent records no user turn #704 low A caption-less image on a workspace-less agent records no user turn
• A chat turn can link another user's file to its own message #706 medium A chat turn can link another user's file to its own message
• An attachment the router cannot read is silence to the model, so the agent denies the file #746 low An attachment the router cannot read is silence to the model, so the agent denies the file (found working A caption-less image on a workspace-less agent records no user turn #704)
• A malformed file id off the socket reads as a server error, not a refusal #749 low A malformed file id off the socket reads as a server error, not a refusal (found working A chat turn can link another user's file to its own message #706)
• A blank user turn is still written by the streaming socket when files arrive with no words #750 low A blank user turn is still written by the streaming socket when files arrive with no words (found reviewing fix(chat): name a caption-less turn's files in its user message #747, the A caption-less image on a workspace-less agent records no user turn #704 fix) — PR Name a blank streaming turn's files in its user message #751, stacked on fix(chat): name a caption-less turn's files in its user message #747

The frontend's own API surface

• Encode the avatar proxy's path segment #13 high Encode the avatar proxy's path segment
• Encode every interpolated segment in the hand-rolled proxies #30 medium Encode every interpolated segment in the hand-rolled proxies
• Proxy routes discard the backend's refusal reason, showing a generic 'Backend API error' #546 high Proxy routes discard the backend's refusal reason, showing a generic 'Backend API error' — PR fix(api): answer a refusal with the backend's reason, not a generic #668
• The backendFetch route family omits no-store, so a refetch-after-write can be served stale #553 medium The backendFetch route family omits no-store, so a refetch-after-write can be served stale
• rating-buttons hand-rolls two fetch calls instead of a lib client and a hook #563 medium rating-buttons hand-rolls two fetch calls instead of a lib client and a hook
• Collapse the backendFetch forwarder family (~40 routes) into platformProxy #564 low Collapse the backendFetch forwarder family (~40 routes) into platformProxy
• Toast layer still reads .message off ApiError at ~25 sites, bypassing BFF code resolution #655 low Toast layer still reads .message off ApiError at ~25 sites, bypassing BFF code resolution
• Three proxy routes echo the backend's content type, and one of them can serve HTML #702 high Three proxy routes echo the backend's content type, and one of them can serve HTML
• Frontend: NEXT_PUBLIC_* are baked at build time, so a published frontend image cannot exist #1544 enhancement frontend NEXT_PUBLIC_* are build arguments, so one frontend image carries one deployment's hostnames - read PUBLIC_API_URL, PUBLIC_WS_URL, PUBLIC_SITE_URL, CHAT_MAX_UPLOAD_SIZE_MB and OAUTH_PROVIDERS at runtime through a context, the way BrandingProvider does; NEXT_PUBLIC_RAG_ENABLED is read by nothing. Blocks Publish the backend and frontend images to GHCR on every release, and make docker compose up pull them #1545

English in every locale

• DOM keyboard constants parked in en.json — a translator can silently break Enter-to-submit #549 high DOM keyboard constants parked in en.json — a translator can silently break Enter-to-submit — PR fix(chat): compare DOM key literals, not catalog values #669
• BFF route payloads and the workspace step detail reach the toast in English #603 low BFF route payloads and the workspace step detail reach the toast in English — PR fix(i18n): resolve BFF refusal codes and step details in the locale #654
• fix(frontend): Polish diacritics fall back to the system font — vendored subsets are latin only #606 low fix(frontend): Polish diacritics fall back to the system font — vendored subsets are latin only — PR fix(frontend): render Polish diacritics in the brand fonts #652
• Twelve local next-intl mocks model t but not t.rich #612 low Twelve local next-intl mocks model t but not t.rich
• A Polish page still declares itself English: <html lang> is hard-coded #619 low A Polish page still declares itself English: is hard-coded — PR fix(i18n): declare <html lang> from the active locale #646
• timeAgo formats a date older than a week as en-US in every locale #621 low timeAgo formats a date older than a week as en-US in every locale — PR fix(i18n): format timeAgo's date fallback in the active locale #651
• The Builder is untranslated under pl: agents is 0 of 508 keys #643 The Builder is untranslated under pl: agents is 0 of 508 keys
• formatDate, formatDateTime and formatCurrency still format as en-US in every locale #649 low formatDate, formatDateTime and formatCurrency still format as en-US in every locale — PR Format an absolute date in the active locale #673
• check-i18n misses prose whose first word is hyphenated ("Sign-in failed") #656 low check-i18n misses prose whose first word is hyphenated ("Sign-in failed") — PR fix(i18n): read a hyphenated first word as prose, not a label #677
• check-i18n misses prose whose first word is an acronym ("API keys are stored in the vault") #678 low check-i18n misses prose whose first word is an acronym ("API keys are stored in the vault") — PR fix(frontend): detect prose after leading acronyms #688

Ingestion and retrieval

• Sync source credentials are pasted into a JSONB column, encrypted by the one second mechanism the vault was meant to replace #937 security Sync source credentials are pasted into sync_sources.config and encrypted by app/core/crypto.py - the one second mechanism the vault was meant to replace, surviving because organization_id is nullable. Blocks Which sync connectors after Google Drive and S3 - decide the list and the order #938

• Which sync connectors after Google Drive and S3 - decide the list and the order #938 Which sync connectors after Google Drive and S3 - decided, PR docs(rag): decide which sync connectors follow Drive and S3 #989: the list is cut to Sync connector: import and synchronize websites and sitemaps #984 → Sync connector: synchronize SharePoint and OneDrive #985 → Sync connector: Confluence spaces #986 → Sync connector: import and synchronize Git documentation #987, then Generalize S3Connector to an object store, before Azure Blob and GCS #988; Notion, Slack and email are decided against. The cross-connector permissions answer is in docs/file-processing.md, and A sync source's wizard never says who will be able to read what it ingests #982/A sync source is created, repointed and deleted with no audit entry #983 are what it still owes

• A connector sync ignores sync_mode and duplicates every document on every run #990 high A connector sync ignored sync_mode entirely and inserted a duplicate of every document on every run - done, 0.0.216. Review of the fix found the basename collision in existing_document, the delete-before-insert replacement order and the missing updated count

• Documents ingested by a connector sync are invisible to every per-document surface #992 high A connector sync created no rag_documents row, so its documents were searchable and invisible - done, 0.0.217. Review found the delete that did not delete (delete_document's optional ingestion_service, reachable today for an uploaded document from the Documents tab), the row written after the ingest, app-scoped collections skipped by an equality test, and both models unrecorded

• A synced file's error row is never retired by the sync that succeeds #996 low A synced file's error row is never retired by the sync that succeeds - retirement matches vector_document_id and a failed parse writes none. Needs a source_path column on rag_documents: matching by filename would delete the other row when a bucket holds two keys of one basename, which is the collision A connector sync ignores sync_mode and duplicates every document on every run #990 removed on the vector side. The column also lets the Documents tab say where a document came from (found reviewing fix(rag): record a document row for what a connector sync ingests #995)

• The local-directory sync writes its document row after indexing, and only on success #997 low The local-directory sync writes its document row after indexing and only on success, so it keeps the exposure Documents ingested by a connector sync are invisible to every per-document surface #992 removed from the connector path and a file that failed to parse leaves no row and no reason (found reviewing fix(rag): record a document row for what a connector sync ingests #995)

• Sync connector: import and synchronize websites and sitemaps #984 A web crawler connector, from a root URL or a sitemap - no credential, first of the five; inherits validate_webhook_url claims DNS-rebinding protection its callers undo by re-resolving #840/MCP OAuth discovery URLs are remote-chosen, and the validated address is not pinned #860's pinned client and makes Paginate GET /rag/documents, and stop full-scanning on ingest #27 matter sooner

• Sync connector: synchronize SharePoint and OneDrive #985 SharePoint and OneDrive, on a new SecretKind for an Entra app - the largest gap on the list, and the sharpest case of A sync source's wizard never says who will be able to read what it ingests #982's question (tenant-wide consent)

• Sync connector: Confluence spaces #986 Confluence spaces, on a page's version.number as the change signal

• Sync connector: import and synchronize Git documentation #987 A git repository's documentation - the commit sha makes incremental sync exact; inherits validate_webhook_url claims DNS-rebinding protection its callers undo by re-resolving #840/MCP OAuth discovery URLs are remote-chosen, and the validated address is not pinned #860 for the clone URL

• rag: a document listed by two sync sources is removed when either one drops it #1879 low A document two sync sources both list belongs to whichever ingested it last (rag_documents.sync_source_id holds one source), so either dropping it removes it - needs a claims table (found reviewing feat(rag): sync a knowledge base from a website #1868)

• Generalize S3Connector to an object store, before Azure Blob and GCS #988 Generalize S3Connector to an object store before writing Azure Blob and GCS - the condition Which sync connectors after Google Drive and S3 - decide the list and the order #938 attached to them

• A sync source's wizard never says who will be able to read what it ingests #982 frontend The sync-source wizard never says who will be able to read what a source ingests - the model is written down in Which sync connectors after Google Drive and S3 - decide the list and the order #938, and this is the sentence that states it where the collection is chosen

• A sync source is created, repointed and deleted with no audit entry #983 security A sync source is created, repointed and deleted with no audit entry, so "who bound this credential to this collection" has no answer after the fact (found deciding Which sync connectors after Google Drive and S3 - decide the list and the order #938)

• Tabs for the RAG pages: Reusable integrations as /rag's third tab, and a knowledge base's three sections as three #939 Tabs for the RAG pages - done, 0.0.213

• The RAG dialogs: a markdown editor for the image prompt, one width scale, and a mark on the parser choices #940 low The RAG dialogs: MarkdownEditor for the image prompt, one width scale (the same form gets 512px in create and 768px elsewhere), and a mark on the parser choices

• Move blocking file work off the request event loop #25 medium Move blocking file work off the request event loop - done (offloaded save/load and the worker's hash/stat; delete was missed, now rag: LocalFileStorage.delete blocks the event loop during bulk teardown #1294)

• Paginate GET /rag/documents, and stop full-scanning on ingest #27 medium Paginate GET /rag/documents, and stop full-scanning on ingest

• Add a real reranker to RAG retrieval #142 Add a real reranker to RAG retrieval — PR feat(rag): add a real reranker to RAG retrieval #911

• rag: binding an embedding secret skips the caller's secret-view check #912 medium security rag: binding an embedding secret skips the caller's secret-view check — found reviewing Add a real reranker to RAG retrieval #142

• rag: per-collection resolution picks a KB by non-unique collection_name #913 medium security rag: per-collection resolution picks a KB by non-unique collection_name — found reviewing Add a real reranker to RAG retrieval #142

• rag: chunk_count is never recorded, so every document claims 0 chunks #147 medium rag: chunk_count is never recorded, so every document claims 0 chunks — PR feat(rag): chunk with our own splitters and drop the langchain tree #834

• rag: KB stats count status "completed", but ingestion writes "done", so indexed_count is always 0 #148 medium rag: KB stats count status "completed", but ingestion writes "done", so indexed_count is always 0 — PR fix(rag): count the status the pipeline writes, not one nothing writes #957, which introduces DocumentStatus so the writer and the reader name one member

• The ingestion flow's _update_status has a branch nothing can reach, and a status parameter with one value #956 low The ingestion flow's _update_status has an unreachable done branch and a status parameter all four callers pass one value to — found fixing rag: KB stats count status "completed", but ingestion writes "done", so indexed_count is always 0 #148

• Replace langchain-text-splitters with our own, and drop the langchain tree #158 Replace langchain-text-splitters with our own, and drop the langchain tree — PR feat(rag): chunk with our own splitters and drop the langchain tree #834, with rag: chunk_count is never recorded, so every document claims 0 chunks #147 in the same branch

• Two RAG document-lookup helpers disagree on precedence; get_documents has no ORDER BY #548 high Two RAG document-lookup helpers disagree on precedence; get_documents has no ORDER BY — PR Give RAG document lookup one precedence and a stable order #670

• PyMuPDF OCR fallback nests an event loop, so a scanned PDF indexes empty #550 high PyMuPDF OCR fallback nests an event loop, so a scanned PDF indexes empty — PR fix(rag): await the OCR describer instead of nesting an event loop #666

• One RAG document-lookup helper; collapse the 3-4 full-collection scans per ingest #566 low One RAG document-lookup helper; collapse the 3-4 full-collection scans per ingest

• rag-source-add writes an unvalidated, unowned collection name from the CLI #707 medium rag-source-add writes an unvalidated, unowned collection name from the CLI

• Dispose the vector store's engine, or stop building one per ingested document #948 high The ingestion worker builds a pooled vector-store engine per document and disposes none, so a large batch reaches max_connections — PR fix(rag): dispose the vector store each ingestion flow builds #960

• Insert a document's chunks in one statement, not one per chunk #950 medium A document's chunks are inserted one statement each, so a 200-page PDF is one to three thousand round trips — PR perf(rag): write a document's chunks in batches, not one statement each #962

• A document's embeddings are all held in memory at once, so a long PDF is hundreds of megabytes in the worker #963 low A document's embeddings are all held in memory at once, so a long PDF is hundreds of megabytes in the worker — found reviewing PR perf(rag): write a document's chunks in batches, not one statement each #962

• The in-process RAG fallback handlers have no caller, and each leaks the store #948 fixed #959 low The in-process RAG fallback handlers have no caller and each carries Dispose the vector store's engine, or stop building one per ingested document #948's undisposed store — found fixing Dispose the vector store's engine, or stop building one per ingested document #948

• rag: teardown unlinks stored files before the request commits #1293 medium rag: teardown unlinks stored files before the request commits, so a failed commit leaves rows pointing at missing uploads — found reviewing fix(rag): unlink a dropped collection's stored uploads #1284 (PR for DELETE /rag/collections/{name} orphans the stored upload files #1265)

• rag: LocalFileStorage.delete blocks the event loop during bulk teardown #1294 medium rag: LocalFileStorage.delete blocks the event loop, and bulk teardown deletes every file in one turn — found reviewing fix(rag): unlink a dropped collection's stored uploads #1284; the delete case Move blocking file work off the request event loop #25 missed

• rag: delete paths drop vector tables and remove vectors before the request commits #1347 medium rag: delete paths drop vector tables and remove vectors before the request commits — same rollback class as rag: teardown unlinks stored files before the request commits #1293, on the store's own engine; found finishing rag: teardown unlinks stored files before the request commits #1293

• rag: deferred teardown file unlinks are in-process, not durable across a restart #1349 low rag: deferred teardown file unlinks are in-process (spawn_after_commit), so a worker restart mid-drain orphans files — recoverable leak, the durable (Prefect) half of rag: teardown unlinks stored files before the request commits #1293; sibling of Org-teardown cleanup is lost if the process dies after commit (spawn_after_commit is not durable) #1274

• rag: an app-scoped collection can be created but can never index or search #1631 medium rag: an app-scoped collection can be created but can never index or search - it belongs to no organization, so it has no vault to hold the embedding key feat(rag)!: drop the deployment embedding key; add data-protection docs #1604 made the only one; needs a deployment-level credential or a refusal at creation. Caused by feat(rag)!: drop the deployment embedding key; add data-protection docs #1604 (for Document and implement the data-protection deployment controls for FA-108 #1596), found reviewing it; the rows Documents ingested by a connector sync are invisible to every per-document surface #992 and rag: per-collection resolution picks a KB by non-unique collection_name #913 already treat specially

• rag: a self-hosted embedding provider, so a knowledge base can stay on the deployment's own hardware #1632 rag: a self-hosted embedding provider in the catalog, so a knowledge base can stay on the deployment's own hardware - the one hop docs/data-protection.md cannot make local today; named there as untracked until this (Document and implement the data-protection deployment controls for FA-108 #1596, feat(rag)!: drop the deployment embedding key; add data-protection docs #1604). Beside Add a real reranker to RAG retrieval #142

• rag/org-teardown: collection drop's reference re-check is not serialized with collection claims (TOCTOU) #1355 medium rag: the teardown collection-drop's list_by_collection_name re-check is not serialized with collection claims (TOCTOU) — the drop can still delete a name reclaimed between the re-read and the DROP TABLE; found reviewing rag: delete paths drop vector tables and remove vectors before the request commits #1347, pre-existing in Org-teardown cleanup is lost if the process dies after commit (spawn_after_commit is not durable) #1274's org-purge too; needs an advisory lock across both drops and the POST /rag/collections/{name} claim path; rooted in rag: per-collection resolution picks a KB by non-unique collection_name #913

• rag: two in-request collection-drop paths bypass the durable locked teardown #1359 medium rag: two in-request collection-drop paths bypass the durable locked teardown — DELETE /rag/collections/{name} (no rag: per-collection resolution picks a KB by non-unique collection_name #913 re-check, no lock) and _purge_personal_collections (re-check, no lock), both dropping the table before the request commits; found reviewing rag/org-teardown: collection drop's reference re-check is not serialized with collection claims (TOCTOU) #1355, which locked the durable path but not these; siblings of rag: delete paths drop vector tables and remove vectors before the request commits #1347/rag: deferred teardown file unlinks are in-process, not durable across a restart #1349/rag/org-teardown: collection drop's reference re-check is not serialized with collection claims (TOCTOU) #1355/rag: per-collection resolution picks a KB by non-unique collection_name #913

• rag: deferred vector-table drop leaks across tenants via name reuse (and a default-KB clear regression) #1362 high security rag: the whole deferred-drop arc (rag: delete paths drop vector tables and remove vectors before the request commits #1347/rag: deferred teardown file unlinks are in-process, not durable across a restart #1349/rag/org-teardown: collection drop's reference re-check is not serialized with collection claims (TOCTOU) #1355/rag: two in-request collection-drop paths bypass the durable locked teardown #1359) frees a collection name before the DROP runs, so an attacker re-creating the same explicit name in the commit-to-drop window has CREATE TABLE IF NOT EXISTS adopt the victim's populated table and reads its chunks; the rag/org-teardown: collection drop's reference re-check is not serialized with collection claims (TOCTOU) #1355 lock only serializes, it doesn't stop the claim winning the race. Also folds the default-KB clear regression. Needs a tombstone/generation (a mechanism decision, like Org-teardown cleanup is lost if the process dies after commit (spawn_after_commit is not durable) #1274). Found by codex on fix(rag): route the last two in-request collection drops through the durable teardown #1361; the arc's merge should hold until this is decided

• rag: teardown reservations need a stuck-tombstone sweep, and the default-clear has an ingest window #1364 low rag: teardown reservations (rag: deferred vector-table drop leaks across tenants via name reuse (and a default-KB clear regression) #1362) have no stuck-tombstone sweep — a name whose drop permanently fails is blocked for good — and the default-KB clear has a same-tenant ingest-vs-drop window; both fail-safe, found reviewing rag: deferred vector-table drop leaks across tenants via name reuse (and a default-KB clear regression) #1362

• rag: serialise teardown against concurrent writes (upload, sync) end to end #1382 low rag: teardown is not fully serialised against concurrent writes - the worker sync/retry ingestion paths don't consult the reservation (reachable for a default+sync clear, latent while nothing sets is_default), the reservation is created after the row delete so the upload guard is best-effort, and that guard drops its lock to avoid inverting delete's lock order; found reviewing fix(rag): reap stuck teardown reservations, guard uploads, and clear a dropped default #1378 (the rag: teardown reservations need a stuck-tombstone sweep, and the default-clear has an ingest window #1364 PR)

• rag: claim and org purge take the teardown and organizations locks in opposite order (ABBA deadlock) #1387 low rag: claim and org purge take the teardown lock and the organizations row lock in opposite order — a KB create naming an existing collection, racing a purge of that collection's org, deadlocks (ABBA); pre-existing since rag: deferred vector-table drop leaks across tenants via name reuse (and a default-KB clear regression) #1362's claim lock, split from rag: serialise teardown against concurrent writes (upload, sync) end to end #1382, found reviewing fix(rag): reap stuck teardown reservations, guard uploads, and clear a dropped default #1378

• rag: teardown lock-ordering residuals (gap-collection D↔K, user-delete U↔T) need a serialization point #1389 low rag: teardown lock-ordering residuals surviving rag: claim and org purge take the teardown and organizations locks in opposite order (ABBA deadlock) #1387's fix — a gap collection born between purge's snapshot and its org lock can D↔K-deadlock with a concurrent KB delete/drop and is dropped-but-not-reserved (rag: deferred vector-table drop leaks across tenants via name reuse (and a default-KB clear regression) #1362 window reopened for that subset); and user-delete's users FOR UPDATE inverts against a personal-KB create's teardown lock (U↔T); both narrow and self-resolving, both need a serialization point/outbox; split from rag: serialise teardown against concurrent writes (upload, sync) end to end #1382, found in rag: claim and org purge take the teardown and organizations locks in opposite order (ABBA deadlock) #1387's adversarial review

Unattended runs

• Drain background work before tearing the process down #11 high Drain background work before tearing the process down
• Agent Schedules & Triggers: set up and manage unattended runs from the UI #44 Agent Schedules & Triggers: set up and manage unattended runs from the UI — PR feat(agents): heartbeat & agent triggers #537
• Scheduled trigger fire() drops last_run_id and fails the flow on a model error #588 medium Scheduled trigger fire() drops last_run_id and fails the flow on a model error — PR fix(triggers): record a model-errored fire instead of failing the flow #589
• Stitch the parallel W3 features into one product: triggers dashboard widget, triggers onboarding, unified naming #594 Stitch schedules/triggers + dashboard customization + onboarding together on main
• run_now executes the agent synchronously in the HTTP request (504 + double-fire on slow runs) #658 medium run_now executes the agent synchronously in the HTTP request (504 + double-fire on slow runs) — PR Dispatch a manual trigger fire instead of running it in the request #679
• test_flow_starts_after_commit's spawn probe flakes on a 250ms grace under make test #680 low test_flow_starts_after_commit's spawn probe flakes on a 250ms grace under make test — PR Wait on the dispatched task instead of a 250ms grace #705
• A sandbox's activity log lives in the service's memory: 200 entries, gone on restart #1061 medium The sandbox activity log lives only in the service's 200-entry ring buffer, so a restart loses it — PR feat(agents): heartbeat & agent triggers #537
• Gmail as a connected account, and delete the email relay webhook it stands in for #1068 Gmail as a connected account, and delete the email relay webhook it stands in for — PR feat(agents): heartbeat & agent triggers #537
• The trigger create dialog: a fixed 90vh height, markless template cards, unreadable presets #1069 low The trigger create dialog: a fixed 90vh height, markless template cards, unreadable presets — PR feat(agents): heartbeat & agent triggers #537
• A trigger's Environment picker hides the default's name, so an environment reads as missing #1070 low A trigger's Environment picker hides the default's name, so an environment reads as missing — PR feat(agents): heartbeat & agent triggers #537
• The API trigger is a ghost button in the toolbar, not a tile beside the portals #1071 low The API trigger is a ghost button in the toolbar, not a tile beside the portals — PR feat(agents): heartbeat & agent triggers #537
• GitHub triggers should be a GitHub App, not an OAuth App with admin:repo_hook #1072 GitHub triggers should be a GitHub App, not an OAuth App with admin:repo_hook — found reviewing feat(agents): heartbeat & agent triggers #537, blocked on nothing but changes the delivery contract every portal shares
• An approval alert cannot reach its request past the first queue page #1336 medium frontend An approval alert cannot reach its request past the first queue page - list_approvals returns the 50 oldest and the tab has no pagination, so the newly parked run the email is about is the one row the reader cannot get to (found reviewing fix(approvals): send the parked-run alert to the queue, not the Builder #1202)

What a run costs

• Commit the run row so a failed run is still accounted #3 high Commit the run row so a failed run is still accounted
• Exclude a resumed run's own spend from its budget baseline #15 medium Exclude a resumed run's own spend from its budget baseline
• Default a new organization's budget to $100 #785 Default a new organization's budget to $100 (the budget existing by default, not measuring against it)
• spend_by_provider and spend_by_key cannot attribute a delegation's vendor or key #194 spend_by_provider and spend_by_key cannot attribute a delegation's vendor or key
• A failed terminal commit replaces the cancellation that ended the run #235 low A failed terminal commit replaces the cancellation that ended the run
• Per-person spend card under-counts vs By agent, with nothing explaining the gap #539 Per-person spend card under-counts vs By agent, with nothing explaining the gap
• The "could not be priced" caveat misses a tree that straddles the start of the window #620 low The "could not be priced" caveat misses a tree that straddles the start of the window — PR fix(budgets): count an unpriced tree that straddles the window start #650
• A message shows a cost with no sign that it is partial, and a conversation shows no total #772 medium A message shows a cost with no sign that it is partial, and a conversation shows no total — split out of Add Context manager #49, same point as Improve the Activity page (/runs) — plan + mockup first #45
• Per-message cost is web-chat only, so a channel or API thread totals nothing #776 low Per-message cost is web-chat only, so a channel or API thread totals nothing — found building A message shows a cost with no sign that it is partial, and a conversation shows no total #772
• Persist a model profile's context length, so compaction stops trusting a registry that is wrong #773 Persist a model profile's context length, so compaction stops trusting a registry that is wrong — split out of Add Context manager #49

Secrets at rest

• Make the vault master key explicit and rotatable #8 high Make the vault master key explicit and rotatable
• Stop putting tokens in the OAuth redirect URL #14 high Stop putting tokens in the OAuth redirect URL
• Require a freshness claim on an embed token #23 medium Require a freshness claim on an embed token
• Vault 'seal N fields under one version' is hand-rolled at 4 models; agent_embed has no key-version column #552 medium Vault 'seal N fields under one version' is hand-rolled at 4 models; agent_embed has no key-version column
• The observability secret is validated at run time; the factory docstring claims publish refuses it #561 medium The observability secret is validated at run time; the factory docstring claims publish refuses it

The database underneath

• Reconcile the delete cascades with the CHECK constraints #9 high Reconcile the delete cascades with the CHECK constraints
• Stop holding a pooled DB connection across slow work #12 high Stop holding a pooled DB connection across slow work
  • Reap runs a dead process left durably running #1078 medium Reap runs a dead process left durably running — the crash-orphan remainder of Stop holding a pooled DB connection across slow work #12's early commit
  • Knowledge singleton's pooled engine can cross worker event loops #1079 medium Knowledge singleton's pooled engine can cross worker event loops — pre-existing, found reviewing Stop holding a pooled DB connection across slow work #12
  • Dev-stack watchdog kills a healthy reloaded server and leaves nothing serving #1080 medium Dev-stack watchdog kills a healthy reloaded server — found standing up Stop holding a pooled DB connection across slow work #12's smoke stack
• Add row locks to four check-then-act races #17 medium Add row locks to four check-then-act races
• Return the five repository-calling routes to the service layer #28 medium Return the five repository-calling routes to the service layer
• A session can be in the sessions page and not in its total #1337 low A session can be in the sessions page and not in its total: The admin drawer reports "Never signed in" for anyone who has signed out #1256's open predicate evaluates its own now() per statement, so a session expiring between the page query and the count query is counted by one and not the other

Middleware written and never registered

• Actually apply the rate limiter #7 high Actually apply the rate limiter
• Register SecurityHeadersMiddleware #18 medium Register SecurityHeadersMiddleware

The product's surfaces and shells

• Add onboarding #53 Add onboarding — PR feat(onboarding): first-run tour, guided flows #624
• Default avatars for orgs, profiles and agents #60 Default avatars for orgs, profiles and agents
• Secrets 'Added by' avatar seeds on email, not user id (hue inconsistent) #799 Secrets 'Added by' avatar hue inconsistent with member lists (found implementing Default avatars for orgs, profiles and agents #60)
• Mobile View #120 Mobile View
• Add default system prompt #124 Add default system prompt
• Pre-enable a default set of tools when creating an agent #786 Pre-enable a default set of tools when creating an agent (same shape as Add default system prompt #124, tool list TBD)
• Fix Agent Builder frontend #127 Fix Agent Builder frontend
• Improve "Alerts" in Limits section (agent builder) #128 Improve "Alerts" in Limits section (agent builder)
• Model picker says the org has no models when the profiles read failed #863 low Model picker says the org has no models when the profiles read failed — same defect one element from Agent draft can't be published by a builder who can't add a model #591, found reviewing PR fix(builder): warn up front when an agent draft can never get a model #846 — closed; the sibling case is in Six answers to "what models and providers exist", and none of them is the authority #923
• Chat composer: a long paste should attach, and attachments should look like files #133 Chat composer: a long paste should attach, and attachments should look like files
• A per-conversation approval mode in /chat: follow the agent, approve everything, or ask about everything #925 A per-conversation approval mode in /chat - follow the agent, approve everything, or ask about everything. Loosens what a spec gated, so it is gated on approvals:decide, ceilinged by the organization, and every waived call still writes its row
• Chat's temperature and thinking-effort overrides are sent on every turn and read by nothing #924 medium Chat's temperature and thinking_effort overrides are sent on every turn and read by nothing - the reader left with the general-assistant path in b56ba1fe and the popover did not (found scoping A per-conversation approval mode in /chat: follow the agent, approve everything, or ask about everything #925)
• The chat's Model tab opens empty, so it never says which model the conversation runs on #926 low The chat's Model tab opens empty, so it never says which model the conversation runs on - the published profile is already loaded for context_window_tokens and only the window is kept
• Composer attachments wrap into rows: twenty files is ~850px of composer, and it should be a carousel #927 Composer attachments wrap into rows: twenty files is ~850px of composer. One scrolled row and a compact FileCard variant - the sequel to Chat composer: a long paste should attach, and attachments should look like files #133, under One file viewer, not four: the chat file dialog is the poorest of them #136's one-card constraint
• Rating a message spins both thumbs: the spinner is keyed on the current rating, not the button clicked #928 low Rating a message spins both thumbs - the spinner is keyed on currentRating, which is null on every unrated message, rather than on the button clicked. Same file as rating-buttons hand-rolls two fetch calls instead of a lib client and a hook #563
• Favourite a conversation: a starred band at the top of the chat sidebar #929 Favourite a conversation: a starred band at the top of the chat sidebar, on top of /chat: search, sort and an agent filter on the conversation list #159's controls
• The Share conversation dialog: a member picker instead of an email box, room to breathe, and icons on view/edit #931 The Share conversation dialog: MemberPicker instead of an email box, room to breathe, and icons on view/edit
• Dashboard pages have no bottom padding: it is declared on the flex-column scroll container, where it is not painted #933 low Dashboard pages have no bottom padding - main declares pb-20 lg:pb-16 on a flex-column scroll container, which does not paint it once the page overflows; four surfaces have re-added it inside the content at three different values
• The admin user drawer: four facts, no memberships, no last-seen, and three privileged actions that look alike #942 The admin user drawer: four facts, no memberships, no last-seen, and three privileged actions that look alike (the piece of Admin redesign #63 worth doing alone)
• Active sessions: paging blanks the card and jumps the scroll - the query has no keepPreviousData #944 low Active sessions paging blanks the card and jumps the scroll - the one paged query with no keepPreviousData, which query-freshness.ts already diagnoses in writing
• The run detail panel survives a tab switch on /runs, and below lg it hides the tab you switched to #934 low The run detail panel survives a tab switch on /runs, and below lg it hides the tab you switched to - the panel is page state, the tab is uncontrolled, so nothing clears the focus. Blocks The approval email links to the agent's Builder page, which has no approvals queue #935
• The approval email links to the agent's Builder page, which has no approvals queue #935 medium The approval email links to /agents/{id}, which has no approvals queue - there is no URL for the Approvals tab to link to (found scoping The run detail panel survives a tab switch on /runs, and below lg it hides the tab you switched to #934)
• The approval alert is mailed to people who may not decide, and the page just has no queue for them #1203 medium The approval alert is mailed to people who may not decide - builder and member hold no approvals:decide, so the initiator the default audience names follows Review the request to a page with no Approvals tab at all (found by the reviewer on PR fix(approvals): send the parked-run alert to the queue, not the Builder #1202)
• Alert emails name no organization, so they open whichever one the reader last used #1204 medium Alert emails name no organization, so they open whichever one the reader last used - all four notification URLs are organization-agnostic while activeOrgId decides what the page acts on; run.organization_id is in scope and discarded. Same class as The members page judges permissions from the active organization while acting on the one in the URL #1032 (found by the reviewer on PR fix(approvals): send the parked-run alert to the queue, not the Builder #1202)
• Notification bell badge and mark-all-read cap at 500 unread with no continuation #1761 severity:low The notification bell badge and mark-all-read both cap at 500 unread candidates with no continuation - an account past that count sees a wrong badge and a partial mark-all-read, silently (found by the reviewer on PR feat(notifications): the write path and the four inbox routes (#1598) #1692, notification center Add role-targeted in-app notifications, delivery channels and app-admin announcements #1598)
• A rate-limited mandatory security_event/configuration_changed is dropped with no coalesced fallback #1762 severity:medium security A rate-limited mandatory security_event/configuration_changed notification is dropped with no coalesced fallback - the audit entry still lands, only the alert is silently lost (found by the reviewer on PR feat(notifications): notify on a security event or a settings change #1711, notification center Add role-targeted in-app notifications, delivery channels and app-admin announcements #1598)
• ABBA lock hazard: audit-chain lock vs. admin-delete's app-admin row locks #1763 severity:medium ABBA lock hazard: the audit-chain lock (impersonation start) vs. admin-delete's app-admin row locks (FOR UPDATE) - same class as rag: claim and org purge take the teardown and organizations locks in opposite order (ABBA deadlock) #1387/rag: teardown lock-ordering residuals (gap-collection D↔K, user-delete U↔T) need a serialization point #1389, can silently drop a mandatory notification when the deadlock victim is the survivor's savepoint rather than the whole transaction (found by the reviewer on PR feat(notifications): notify on a security event or a settings change #1711, notification center Add role-targeted in-app notifications, delivery channels and app-admin announcements #1598)
• Environments: pin a version from the environment, not only from the version #134 Environments: pin a version from the environment, not only from the version
• One table primitive, with sortable headers and filters, everywhere #139 One table primitive, with sortable headers and filters, everywhere — closed
• Sandboxes: split connections from what is running, into tabs #140 Sandboxes: split connections from what is running, into tabs
• A sandbox's activity log lives in the service's memory: 200 entries, gone on restart #1061 A sandbox's activity log lives in the sandbox service's memory: 200 entries per session, gone on restart, and nothing on our side ever saw them. Record each operation as it happens, then the log is a query rather than a window and paginating it means something. Later (found finishing the Running tab in Sandboxes, runtimes and workspaces: an attachment that never reaches the workspace, a CSP that blocks every PDF, and seven things nothing explains #1039; the truncation notice is on that branch)
• Migrate the sandbox onto Pydantic AI workspaces (pydantic-ai-backend breaking release) #2003 dependencies Move the sandbox onto Pydantic AI workspaces (ctx.workspace) via pydantic-ai-backend's SandboxdWorkspace and ConsoleCapability(use_workspace=True) - library side is feat(workspaces)!: replace the backend protocol with Pydantic AI workspaces pydantic-ai-backend#112; changes what feeds A sandbox's activity log lives in the service's memory: 200 entries, gone on restart #1061's operation record
• web_search and create_chart render as raw JSON: the frontend matches tool names the backend stopped emitting #144 medium web_search and create_chart render as raw JSON: the frontend matches tool names the backend stopped emitting
• run_python: collapse the code once the output arrives, and show it while it runs #145 run_python: collapse the code once the output arrives, and show it while it runs
• /chat: search, sort and an agent filter on the conversation list #159 /chat: search, sort and an agent filter on the conversation list
• A new conversation shows no agent until the page is reloaded #909 low A new conversation shows no agent until the page is reloaded — the listing is fetched before the first answer exists
• Let a person arrange their own dashboard: pick widgets, order and width #213 Let a person arrange their own dashboard: pick widgets, order and width — closed (PR feat(dashboard): let a person arrange their own dashboard layout #587), which is what makes Does /admin "Overview" earn a page? Six figures and three links that all exist elsewhere #922 answerable
• Skills are always available: drop the 'Ready-made skills' install step, one Skills list #281 Skills are always available: drop the 'Ready-made skills' install step, one Skills list
• A consistent list-page shell (container, pagination, filter bar) across resource pages #282 A consistent list-page shell (container, pagination, filter bar) across resource pages — closed
• Every wrong-method request answers 500 instead of 405 #917 medium Every wrong-method request answers 500 instead of 405: OpenTelemetry's FastAPI instrumentation reads .path off _IncludedRouter, which FastAPI 0.141 has none of (found reviewing fix(builder): configure an agent in one place, and stop guessing at what a reader sees #914; pre-existing, reachable on every route)
• Remove the Refresh button from /admin #283 Remove the Refresh button from /admin — closed
• Standardise the admin pages (users and tabs) to the shared table and list-page shell #284 Standardise the admin pages (users and tabs) to the shared table and list-page shell — closed, and /admin/organizations has no search, sort, filter or pagination - the route behind it answers none #921 is what it left behind
• /admin/organizations has no search, sort, filter or pagination - the route behind it answers none #921 /admin/organizations has no search, sort, filter or pagination, and the route behind it answers none - the one page Standardise the admin pages (users and tabs) to the shared table and list-page shell #284's chain left with the shell and none of the controls
• Does /admin "Overview" earn a page? Six figures and three links that all exist elsewhere #922 Does /admin "Overview" earn a page? Six figures and three links that all exist elsewhere - the platform dashboard widget reads the same /admin/stats, and the three links repeat three of the five tabs above them
• mcp-server-list still uses native confirm(): no busy-guard, so a double-click can double-DELETE #554 medium mcp-server-list still uses native confirm(): no busy-guard, so a double-click can double-DELETE
• Onboarding steps on the MCP page vanish when the server catalog is empty #592 low Onboarding steps on the MCP page vanish when the server catalog is empty — PR feat(onboarding): first-run tour, guided flows #624
• Onboarding tour leaves Settings and the workspace file browser unexplained #593 Onboarding tour leaves Settings and the workspace file browser unexplained — PR feat(onboarding): first-run tour, guided flows #624
• A still-parked run says nothing about waiting once the page is reloaded #601 low A still-parked run says nothing about waiting once the page is reloaded — PR fix(chat): keep a parked run saying it waits after a reload #653
• Every baked MCP logo is keyed on a brand domain the lookup never asks for #614 low Every baked MCP logo is keyed on a brand domain the lookup never asks for — PR fix(mcp): key baked logos on the URL host the lookup asks with #648
• MCP OAuth callback outcome is read by nothing - no toast after the provider redirect #657 medium MCP OAuth callback outcome is read by nothing - no toast after the provider redirect — PR Announce the MCP OAuth outcome after the provider redirect #682
• Activity: a date-range picker owned by the page, windowing all three tabs and the export #760 Activity: a date-range picker owned by the page, windowing all three tabs and the export — PR Frontend standardisation: one table, one shell, admin on both, skills without install, map in four directions #759
• Activity: an icon per run surface — Slack, Telegram and Mattermost get their marks #761 Activity: an icon per run surface — Slack, Telegram and Mattermost get their marks — PR Frontend standardisation: one table, one shell, admin on both, skills without install, map in four directions #759
• Activity: expose the filters the backend already answers — rated up, person, agent, version #762 Activity: expose the filters the backend already answers — rated up, person, agent, version — PR Frontend standardisation: one table, one shell, admin on both, skills without install, map in four directions #759
• Run export drops the on-screen status/surface/rating filters it claims to carry #763 medium Run export drops the on-screen status/surface/rating filters it claims to carry — PR Frontend standardisation: one table, one shell, admin on both, skills without install, map in four directions #759
• Activity: paginate the run history — the page shows fifty rows and says nothing about the rest #764 Activity: paginate the run history — the page shows fifty rows and says nothing about the rest — PR Frontend standardisation: one table, one shell, admin on both, skills without install, map in four directions #759
• Activity: open the conversation behind a run — the id is there and nothing links it #765 Activity: open the conversation behind a run — the id is there and nothing links it — PR Frontend standardisation: one table, one shell, admin on both, skills without install, map in four directions #759
• Activity: one control grammar and an observability-grade look across Approvals, Runs and Spend #766 Activity: one control grammar and an observability-grade look across Approvals, Runs and Spend — PR Frontend standardisation: one table, one shell, admin on both, skills without install, map in four directions #759
• Activity's filters are local state, so no dashboard slice can hand over to the runs behind it #768 Activity's filters are local state, so no dashboard slice can link to the runs behind it — found reviewing PR feat(dashboard): let a person arrange their own dashboard layout #587
• Web chat never rehydrates a conversation's history, so a reopened thread runs with no context #771 high Web chat never rehydrates a conversation's history, so a reopened thread runs with no context — found scoping Add Context manager #49
• A turn cancelled by a closed tab is unrecoverable, and its spend is not #781 A turn cancelled by a closed tab is unrecoverable, and its spend is not — found adding Add Context manager #49's progress notice
• Show how full the context window is, beside what the turn cost #774 Show how full the context window is, beside what the turn cost — split out of Add Context manager #49

Models and providers

• Six answers to "what models and providers exist", and none of them is the authority #923 Six answers to "what models and providers exist", and none of them is the authority - PROVIDERS (27), model_listings.json (20), model_fallbacks.json (7, and not about fallbacks), the genai_prices snapshot, image_models.json and two hand-written tables in docs/models.md, over a run-time authority that is Pydantic AI's own inference. Seven providers answer an empty picker today.

Performance and security (audit 2026-08-19)

The sweep behind these is Audit agenticos 2026-08-19 performance and security. #947 is
the one that is not like the others: it is a live, unauthenticated denial of service.

• Rate-limit the auth surface, and take bcrypt off the event loop #947 critical security Rate-limit the auth surface, and take bcrypt off the event loop - 171 ms measured per checkpw, no limit on any route in auth.py, so ~6 req/s saturate a worker. Also an enumeration timing oracle and an unlimited mail amplifier. Supersedes the auth half of Actually apply the rate limiter #7
• Dispose the vector store's engine, or stop building one per ingested document #948 high The ingestion worker creates and abandons a pooled engine per document - aclose() has one caller in the repo; get_worker_db_context does the opposite deliberately one module away
• Collapse the dashboard's fifteen sequential aggregates into a handful #949 Collapse the dashboard's fifteen sequential aggregates into a handful - ten scans of one window; not gather, because Two gated tool calls in one model step race the request's AsyncSession #169
• #950 Insert a document's chunks in one statement, not one per chunk
• #951 Stream bodies through the BFF proxy instead of buffering them - 50 MB buffered twice on upload, TTFB = whole transfer on download
• #952 One HTTP client per channel adapter, not one per call - ~30 TLS handshakes per streamed turn at EDIT_INTERVAL = 1.0
• #953 Two listings query per row where the code beside them batches
• #954 Resolve a spec's references in one query - six loops, one of them on every run
• #955 Stop shipping the whole brand-glyph table to the sign-in page - 89 marks to draw three

CI, the suite and the tools

• #33 low Code health clean-up: nine small items from the 2026-08-01 audit
• #109 TypeScript 7 and ESLint 10 are blocked, each by a different plugin
• #1820 dependencies security effort:m mcp is capped below 2.0 because 2.0 moves the SDK to httpx2: PinnedAsyncClient is an httpx client and cannot send the httpx2.Request the OAuth helpers now build, the discovery refusals catch the wrong library's InvalidURL (#889 again), and the streamable transport renamed itself and dropped its headers argument. Migrating the pin is the change; a shim would put the SSRF check and the request in different libraries - found reviewing PR #1804, which Dependabot had widened the cap in
• #130 E2E: the vault rotation spec fails intermittently before the secret is created
• #154 e2e: sharing and skills specs fail when a mutation's refetch lands stale
• #1474 low e2e: journey.spec flakes reading the hosted link after publish - the same class, in the one spec #154 did not cover; the reload before the read narrows the window rather than closing it - found on PR #1383, which touches none of it
• #155 Backend dependencies: fastapi-cache2 is initialised and caches nothing, plus four more that are imported nowhere — PR #831
• #156 Frontend dependencies: date-fns is unused and three icon libraries answer one question — PR #835
• #836 gen:mcp-logos writes an unformatted file, so make lint fails until the commit hook rewrites it — found writing #156's generator, which solves it — PR #835, alongside #156
• #829 high The Resend email provider imports an SDK declared nowhere — found by the deptry gate #831 adds, and what keeps DEP001 switched off until it is answered — PR #842; the provider was never reachable and is deleted, so #843 records what bringing Resend back would cost
• #830 Recorded: why google-api-python-client and every model-provider extra stay in the image — the two questions #155 deliberately excluded from its own PR — closed as recorded, both answers still hold
• #843 Resend as an email provider, properly, or not at all — closed, not planned: SMTP is the one way this platform sends mail
• #833 ty relaxations are justified by libraries this project does not have — langgraph and deepagents never were, langchain stopped being one in #158 — PR #842
• #162 e2e: the cost journey spec flakes on main after passing on the PR
• #855 low make audit fails the required Security Scan job on a single pypi.org timeout — one request per locked distribution, no retry; the network half of the same problem #154 records for e2e
• #203 low yamlfmt, zizmor and the pre-commit basics read only changed files, and no gate reads the tree
• #311 high The ai-review reviewer has produced nothing since 2026-08-05, and reports success
• #317 CI burns ~8,900 billed Actions minutes a week, a fifth of it on runs nothing cancels
• #618 Three frontend tests hand-roll the same source-tree walker — PR #645
• #635 check_comments.py descends into every .claude worktree, so a commit waits ~7 minutes — PR #647
• #663 Bring app/services/embed_session.py into the 100% coverage + ty gate — PR #674
• #862 low test-frontend goes red on a 5s testTimeout coverage instrumentation cannot meet — a different spec each run, each passing alone; the vitest half of the timing-flake pair #154 and #162 record for e2e — found reviewing PR #624
• #915 medium Frontend coverage gate red on Node 26: the built-in sessionStorage shadows jsdom's in vitest, so resume.ts's catch loses coverage while every test passes - the sessionStorage half of the localStorage normalization vitest.setup.ts already does; pre-existing from PR #624, found running the gate for #537's trigger-wizard restyle
• #1075 low frontend layout.test.tsx reaches the network - the root layout's unmocked readBranding() makes the spec depend on what is listening on :8000, so it hangs against a container that accepts connections without answering; green on CI and against a healthy backend, which is why nobody had seen it
• #1338 low ci Flaky: test_lifespan_drain.py::test_the_lifespan_waits_for_in_flight_background_work fails under xdist with RuntimeError: Event loop is closed and passes on a plain re-run - the test that guards the drain #1137 and #1274 depend on — root cause is the module-global model_catalog._listing_client closed on a dead loop; mitigated in PR #1378 (the drain test stubs the close), the conftest reset that fully fixes it stays open; found working #1364 (duplicate #1381 folded in)
• #1545 enhancement ci Publish agenticos-backend and agenticos-frontend to GHCR on every v* tag (and edge from main); docker compose up pulls them, a clone keeps building through docker-compose.override.yml, the quickstart needs only Docker. Blocked by #1544. Neighbours #1512 (GHCR package visibility), #1415 (SBOM per release), #143 (the docker job leaves ci.yml)
• #1830 high effort:s Valkey 8 cannot read the RDB redis:7-alpine left in redis_data, so the first deploy after #1638 to reach a host carrying that volume crash-loops redis, leaves app in Created and serves 404 while the migrations have already run — confirmed on production 2026-09-21 deploying 0.0.477
• #1831 medium effort:s The compose healthchecks have no start_period, so a container that crashed carries its stale unhealthy into the next up and fails a deploy that would otherwise pass — the message is identical to #1830's, so a fix that worked reads as one that did not; found redeploying after #1830
• #1832 high ci effort:m A Deploy run waiting at the production approval gate holds concurrency: deploy-production, so every later run sits pending with no jobs and is cancelled by the next one — thirteen days of merges never reached the server and nothing said so. Neighbours #317 (runs nothing cancels) and #1545 (what the deploy pulls)

Documentation

• #29 medium Correct three documentation claims that describe behaviour that does not exist
• #840 medium validate_webhook_url claims DNS-rebinding protection its callers undo by re-resolving — same shape as #29 and #561; the claim is narrowed rather than delivered — PR #842
  • #860 high MCP OAuth discovery URLs are remote-chosen, and the validated address is not pinned (found reviewing PR #842 — #840's "an operator typed it" reasoning covers the connection URL and the cdp_url, but not mcp_oauth._send, whose every hop the remote server names; this is the delivery half #840 declined) — PR #875
    • #889 low An MCP discovery URL with a bad port answers 500 rather than the refusal — httpx.InvalidURL is not an httpx.HTTPError, so the flow's three catches miss it and #872's fix cannot reach it (pre-existing, found merging main into PR #875)
  • #861 medium A blocked MCP server URL answers a generic 500 instead of naming the refusal — SSRFBlockedError is a ValueError, which no handler maps (pre-existing, found reading the same path) — PR #872
    • #873 medium Importing a spec YAML answers a generic 500 for every kind of mistake in it — a raw pydantic ValidationError is not a RequestValidationError, so no field error reaches the person who edited the file (found sweeping the same defect in PR #872)
    • #874 low An ingestion override with too large a chunk_overlap answers a 500 rather than the form its own docstring says it refuses to (same sweep) — PR #881
      • #882 low A per-field refusal answers with details.errors, which the form cannot mark — the frontend reads details.fields, so all four call sites of that idiom show a sentence and highlight nothing (found fixing #874; #873 added the fourth) — PR #892
        • #891 low The same defect in a third shape: seventeen refusals name one field with a singular details.field and the envelope's message, which no form reads either (deliberately left out of #882 — converging one of eighteen would make it disagree with its siblings) — PR #900
          • #897 low A connector's per-field refusal is flattened to a sentence by validate_config's (bool, str) protocol, so the sync-source wizard marks nothing — the one place #891 could not reach (found fixing #891)
          • #898 low A refused model id is posted back in details={"model": model} — the caller's own submission, serialized and logged — and still marks no input (found fixing #891)
• #122 Improve README.md
• #212 low docs/testing.md documents three fixtures and a layout the suite does not have
• #664 Stale docs: governance.md claims deployment-wide rate limiting; SECURITY.md describes RoleChecker/UserRole — PR #665
• #783 README: badges, star tracker and product graphics, styled like pydantic-ai / FastAPI (follow-up to the empty-bodied, closed #122)
• #784 Docs: a readability and visual pass, modelled on pydantic-ai / FastAPI (presentation, not content-correctness like #29/#664)
• #1912 low docs/channels.md says Allowed origins; the console field is Allowed sites (found building the use-case library, #1909)

The roadmap

• #46 Add Guardrails
  • #1900 high security Output guardrails redact the final answer after every streaming surface has sent the raw text — the harness guard sees only final output (found building the use-case library, follow-up to #1895)
  • #1901 PII redaction has no phone-number detector — the harness ships email, IBAN, card and SSN only (same source)
  • #2000 security Output guardrails do not screen streamed tool arguments or a delegate's streamed answer — the paths left after #1900's stream screen (follow-up to #1900)
• #47 Add Planning
• #48 Add Context
• #49 Add Context manager — PR #775, which also closes #771, #772, #773 and #774
• #50 Add Tool Search
• #51 Improve WebSearch and WebFetch capabilities — PR #839 adds the web_fetch capability (SSRF-guarded, own web:fetch scope); search-provider spend metering decided against and recorded on the issue, which found #840
  • #857 Native web search escapes the approval gate, the way native fetch did (found reviewing #839, which fixed the web_fetch half)
• #52 Agents evaluation & authoring assistant — plan first
• #1897 An internal LLM wiki agents maintain, web version only — design first; nearest existing mechanism is #1470's memory files
• #54 Add realtime models + transcription
• #55 Add media
• #56 Add Dynamic workflows
  • n8n-parity review of the editor and the tables (2026-09-29), all in the Workflows + Virtual Tables milestone:
  • Workflows
    • #1932 high separate Manual and API triggers, and run a manual workflow from the editor
    • #1933 high show a run live on the canvas - each step's status, tries and output
    • #1934 high a step's input and output data in its settings (JSON, table and schema views)
    • #1935 high test a single step with the data its upstream steps produced
    • #1936 mid pin a step's output as test data
    • #1937 mid map fields by dragging values from the Input pane
    • #1938 mid template fields that mix text with values from earlier steps
    • #1939 mid rename a step, add a note to it, and switch it off without deleting it
    • #1940 low sticky notes on the canvas
    • #1941 mid canvas ergonomics - insert on a connection, tidy up, minimap and shortcuts
    • #1942 high search, sort and manage workflows from the list, and rename one in the editor
    • #1943 high run history you can debug - filters, open a past run on the canvas, retry from the failed step
    • #1944 mid workflow settings - timezone, execution timeout, error workflow and what runs to keep
    • #1945 mid an error workflow that runs when another workflow fails
    • #1946 mid call another workflow as a step
    • #1947 high Switch, Wait, Filter and more Merge modes
    • #1948 mid data transformation steps - Edit fields, Sort, Limit, Remove duplicates, Aggregate, Split out, Date & time
    • #1949 mid webhook test URL, listen for a test event, and respond to the caller
    • #1950 mid create a credential from a step without leaving the editor
    • #1951 mid HTTP request - import cURL, authentication from the vault, pagination
    • #1952 mid a real code editor for the Python and JavaScript steps, with a test run
    • #1953 mid import and export a workflow, and a template gallery
    • #1954 low compare two versions of a workflow
    • #1955 mid test a chat-triggered workflow in a chat panel inside the editor
    • #1956 high activate and pause a published workflow from the editor header
    • #1957 high step settings that stay short - optional settings on demand and quieter validation
  • Virtual Tables
    • #1958 high add records from the console
    • #1959 high edit cells in place in the grid
    • #1960 high delete records, one or many
    • #1961 high import a CSV and export a table
    • #1962 mid filter and search records in the grid, saved with a view
    • #1963 mid manage columns from the grid header
    • #1964 low large tables - virtualised scrolling and counts
• #57 Add Overflowing tool output (harness module renamed to tool_output_limits; reference refreshed)
  • #803 Prune tool_output_limits spills at run end on non-run-scoped workspaces (found reviewing #57)
• #787 Add System Reminders: re-inject steering guidance mid-run against instruction fade (harness system_reminders)
• #788 Add a Memory capability: persist and recall facts across runs — plan first
  • #1470 Reshape it into two capabilities a builder picks (memory_files, memory_mem0) and drop the operator console; the native fact store, the origin trust tier and the Memory tab went with it. #1384, #1385 and #1386 were closed as superseded by the same reshape
  • #1077 A plan does not survive to the conversation's next turn, and the agent denies it exists (found adding the chat plan strip; the same question as #788 about state that outlives a run)
  • #1902 memory_files is refused in scheduled and triggered runs by design, and the docs do not say so — two tutorials hit it at run time (found building the use-case library)
  • #2027 security Let a trigger run as its creator (opt-in), so a scheduled run can reach their memory, personal connections and conversation search - the product half #1902 left out of scope; also carries the Builder hint and the sandbox user-scope inconsistency (found working #1902)
• #789 Add a Conversations Search capability: search past transcripts mid-run — plan first (a tool, unlike #159's UI list search). Shipped on #788's branch (#1383) rather than its own: it needs the same run-level fact — who will hear this run — and a second derivation of that is the thing to avoid
• #58 Add Image Generation
• #59 Add Browseruse
• #62 Agents redesign
• #63 Admin redesign
• #64 MCP redesign
• #65 Knowledge Base redesign
• #66 Vault redesign
• #67 Chat redesign
• #68 Organizations redesign
• #69 Skills redesign
  • #1911 medium Gallery skills cannot be loaded reliably - their title-case names are deferred-capability ids the model guesses as slugs, and a second wrong guess ends the turn (found building the use-case library, #1909)
• #70 Artefakty — needs a definition before it can be scoped
• #71 Deep Research mode — blocked on #47, #51
• #72 Seed Agents
• #73 Seed Skills
• #150 A first-class public API: organization API keys, so everything the UI does is doable without it
  • #1903 docs/api.md says X-Organization-Id is required; get_active_organization falls back to the personal organization — docs fix or require it for API keys (found writing the agent-API tutorial)
  • #2121 bug A provider refusal on POST /agents/{id}/run answers 500 without the run id; mirror resume's RunExecutionError (found verifying #1796)
  • #2122 enhancement Multi-turn conversations for keys: no conversation to open, history never sent to the model, so the default sandbox scope refuses every key-made run (found verifying #1796)
• #151 A global assistant in the UI, running the platform through its own API — blocked on #150
• #276 Render the delegation tree recursively on the agent map

Artifacts: from published pages to live pages (2026-09-30)

Origin #70. Gap analysis and Q&A 2026-09-30; W8 items need nothing unmerged, W10 items wait on #56.

• #1965 bug A staging run republishes the production page - environment in the identity
• #1966 Restore a kept version as the current one
• #1967 Filter the list by the publishing agent
• #1968 bug A script-drawn page's thumbnail is empty
• #1969 security Links inside a page open through the viewer after a confirmation
• #1970 The agent reads its page back and edits part of it
• #1971 security A pinned library set served to pages, and a bundled skill
• #1972 security Public link settings: expiry, pinned version, password, view counts
• #1973 security Embed a public artifact on allowlisted sites
• #1974 Live data: bind a page to a saved view - blocked by #56, #1783
• #1975 security Live data on a public link behind an organization switch - blocked by #1974
• #1976 security Actions through workflows - blocked by #56, #1792, #1974
• #1977 Follow a page and be notified of a new version - blocked by #56

Microsoft 365: Teams, Outlook and the Graph (2026-09-30)

Epic #1989. Builds on Entra sign-in (#1419) and the SharePoint/OneDrive sync (#985); copies the Google account and Gmail trigger (#1068).

• #1983 security Connect a Microsoft account for delegated Graph access - blocks #1984, #1986, #1988
• #1984 Outlook mail trigger - blocked by #1983
• #1986 Outlook calendar trigger - blocked by #1983
• #1985 security Teams channel bot, approvals as Adaptive Cards
• #1987 Work IQ MCP servers in the catalog (needs a templated catalog URL)
• #1988 security Deliver results to Teams and Outlook - blocked by #1983, #1985

Audit clean-up bags

• #545 low Backend duplication & quality cleanup (audit 2026-08-10)
• #557 medium useKBDetail holds server data in useState off React Query; two registered query keys are dead
• #558 medium Admin query-key factories type params as unknown; admin.ratings is keyed three ways
• #559 medium The ratings-by-day shape is declared four times under two confusable names
• #560 medium Two upload routes serialize the same schema differently (response_model_exclude_none)
• #562 medium Type the dict[str, Any] service contracts in sandbox and connectors - done, 0.0.214
• #567 low Extract the runner's duplicated prompt-flatten and terminal-state assembly
• #568 low Unify the two backend-schema form renderers (SchemaForm vs ConfigureStep)
  • #1093 low Converge the backend connector config schema onto JSON Schema (drop ConnectorConfigField) - the L, higher-risk half #568 deferred; #568 unified the renderer, this unifies the wire shape
• #569 low Frontend duplication & quality cleanup (audit 2026-08-10)

Bookkeeping

• #168 Issue map: how the open issues relate, and what blocks what
• #683 The issue map (#168) has an empty body, so the filing rule that depends on it cannot be followed
• #687 24 issues closed with no closing PR since Aug 5; at least two are still broken on main

The spine — what blocks what

Ordered by how much it unblocks. Everything not named here is independent.

1. #440 blocks the whole refusal cluster, and it was closed in error.
Reopened today after verifying on main: PiiRedactionFilter is attached to the root
logger at app/core/logging.py:73, where it never sees a record from a module
logger, and setup_logging has exactly one caller — app/main.py:217 — so the Prefect
worker never installs it at all. Every fix in that cluster works the same way: stop
putting the vendor's text in the response, keep it in the logger.exception beside the
raise. That remedy is only sound if the log is scrubbed, and it is not. #676, #681,
#686, #695, #699 and #659 all inherit the assumption; app/services/rag/failures.py:19
states the failure in the present tense and cites the number.

2. #311 is why the sweeps keep finding things. The automated reviewer has produced
nothing since 2026-08-05 while reporting success; eleven pull requests merged on a
sentence that read like a verdict. Until it is fixed the only review before a merge is
a human one. Not a formal blocker on anything — but it is the reason clusters like
"the frontend's own API surface" are found in audits rather than in review.

3. #564 is the structural fix for five symptoms. #13, #30, #546, #553 and #702 are
all the same ~40 hand-rolled backendFetch handlers under src/app/api/**: one
unencoded and unauthenticated (#13), eighteen unencoded (#30), the family swallowing
the backend's refusal reason (#546), omitting no-store (#553), and three echoing the
backend's content type (#702). Collapsing them into platformProxy removes the class.
Decide this before PR #668 merges — it already touches about forty of those files
for #546 alone.

4. #150 → #151 and #47 + #51 → #71, both stated in the blocked issue's own
title. #151 (a global assistant driving the platform through its own API) cannot start
before organization API keys exist; #71 (deep research) needs planning and the web
capabilities first.

5. #139 → #282 → #284. One table primitive, then the list-page shell built on it,
then the admin pages standardised onto both. Doing them in the other order means
writing the admin pages twice. Same shape in #136 → #138, #500: one file viewer
before the files page and the header field it needs.

6. #44 + #213 + #53 → #594. Three feature branches — PR #537 (triggers), PR #587
(dashboard layout), PR #624 (onboarding) — that each land alone and then have to agree
with each other on main. #594 is that reconciliation and cannot start until all three
merge.

7. #3, #7 and #12 are acceptance criteria of #39, and PR #634 says Closes #39.
#39's "Done when" list is four items: every surface records a run identically (#3),
EmbedSession takes a session factory rather than a session (#12), rate limits apply
to the public surfaces (#7), and docs/channels.md describes what exists. Three of
those are separate open issues. Either the footer should be Refs #39 with the
checkboxes ticked as they land, or #39 should be re-scoped to what #634 actually
finishes. Closes only when the change genuinely finishes it.

Pairs that want one pull request, not two: #7 + #18 (both are one
app.add_middleware line in create_app), #147 + #148 (adjacent lines of one
aggregation in repositories/rag_document.py:188-189), #548 → #566 (fix the
disagreement, then collapse the two helpers into one).

8. The connector chain, decided in #938. #984 (a web crawler) is first because it needs no credential and waits on nothing; #985 needs a new SecretKind for an Entra app that nothing else wants yet; #988 blocks Azure Blob and GCS and is the condition #938 attached to them - generalize S3Connector before writing either, not alongside. #990 came before all four and is done (0.0.216), which is what makes a change signal worth naming at all. #982 and #983 are not blockers but every connector on the chain inherits them, so they are worth having before the third one rather than after.

• #1544 (runtime frontend config) → #1545 (published images): no frontend image until the hostnames leave the build

The duplicate register — already adjudicated

Recorded so nobody re-litigates them, and so the next filer can see what "the same
bug" has looked like here.

Pairs that look like duplicates and are not — checked, keep both:

• #13 / #30 — #30 is the sweep over eighteen unencoded segments; #13 is the one
  instance that is also unauthenticated, which is why it is severity:high where the
  sweep is medium. #13 must be in #30's fix, and #30 must not close without it.
• #7 / #18 — two different middlewares, both written and never registered. One
  call site, two fixes, two sets of acceptance criteria.
• #147 / #148 — both make one stats row lie; the fixes are independent and each
  body says so. #147 landed in #834 rather than alone, because #158 could not
  measure its own before/after while the only stored chunk count was a constant 0.
• #656 / #678 — two shapes the i18n guard misses (hyphen, acronym), two pull
  requests (#677, #688).
• #48 / #49 — context injection against context compaction. Different
  capabilities, adjacent names.

What has no scope yet

• #70 Artefakty — says so in its own title. Needs a definition before it can be
  estimated.
• #122, #124, #127, #128 have empty bodies. All four sit on W1 · Aug 3–7, a
  milestone eight days past, and are unactionable as written: "Fix Agent Builder
  frontend" names no defect and has no acceptance criterion. #168 was the fifth
  empty body and is fixed by this rebuild; these four are not. Either write them or
  close them — leaving them is what makes the open count untrustworthy.
• #52 carries plan first in its title deliberately.
• #1897 (LLM wiki) is filed to schedule a design: what "web only" covers, who may write and how it relates to context and memory files are all open.

Known-stale references

An issue body's cross-references were true when written. About 78 of the open bodies
cite at least one number that has since closed — mostly the roadmap family citing #16
(un-metered embeddings), which is done. The one that changes a decision is #39's
second checkbox, which describes #16 as live; it is not.

Do not chase the rest. Check a referenced number's state before acting on it:

gh issue view <n> --json state,stateReason,title

Triage state, 2026-08-13

Every open issue now has a type, a milestone, an effort:* label and a row on the
VstormOS board. Before today, 84 had no type and 26 — #456 and the whole
2026-08-10 audit batch, #545–#569 — were on no project at all, which made them
invisible to every view the board is read through.

Re-deriving this

gh issue list --state open --limit 300 --json number,title,body,labels,milestone
gh pr list --state open --limit 100 --json number,title,body      # then grep the footers

Pass --limit. It defaults to 30 and caps at 100; under a hundred open issues it
silently drops the lowest numbers, which is how #2–#7 once read as closed and a blocker
chain read as already done.

Refs #683, #687.

Filed 2026-08-28, merging the W4 backlog

Thirty pull requests were merged and released as 0.0.316-0.0.343 in one pass. The
five issues above with 13xx numbers came out of that: four from reviewer findings
on branches that were merged anyway, and one flake. Each is in its cluster.

One pull request was not merged: #1128 (#1079, the knowledge retrieval
store crossing worker event loops). Its fix builds a store with its own pool,
which #948 and #12 removed from main, so a mechanical merge either re-adds the
second pool or stops fixing the bug. #1079 stays open with the new shape written
down on it.

Filed 2026-08-29, from the MCP redesign

Three came out of one branch (docs/site-improvements), all in the #64 MCP
redesign cluster and all in the same thread of work:

• #1339 medium A Mattermost conversation was one channel, not one thread — the agent read every thread in a channel as one conversation

• #1340 medium Starting OAuth from the catalog answered 404

• #1341 medium The Builder picker keyed its rows on the catalog entry, so an organization with several connections to one server could bind only one of them — one card per server with an account select, and per-binding personal substitution

  • #1342 feature A member holding two accounts on one service cannot say which an agent speaks as — #1341 declines to guess, and nothing records the choice
  • #1343 low A resumed direct-message run stops speaking as the member who started it — agent_runs records the surface but not whether the conversation held one person

• #1391 feature An MCP binding is either the organization's account or each person's own — a kind, not a flag. Supersedes #1341's per-binding substitution and #1343's private_to_user; builds on #1342's nomination of a default account. Filed 2026-09-04 — PR #1392

  • #1442 medium Publish and run time each decide MCP prefix collisions, and only publish says so
  • #1443 low ownAccountStatus re-implements the server's account rule on the client, and they disagree on unauthorized
  • #1444 low The personal-service briefing builds a frontend URL in the runner, which a locale-prefixed deployment breaks
  • #1445 low An API run authenticated with a user's own JWT is told nobody is signed in

  All four found reviewing PR #1392 before merge; none blocks 0.0.356.

Security programme (milestone W6 and W7 · Sep 7–18, planned 2026-09-05)

The theme for W6 and W7: a client's security review answered in writing, a mechanism and a test behind every row of a controls matrix (HIPAA §164.312, SOC 2 CC6–CC8), an issue behind every gap. #1424 is the epic and the four-area status; docs/security.md (#1412) is the deliverable the rest feeds.

• #1424 security meta Security programme - the epic
• #1412 documentation security docs/security.md: threat model, data flows, what is encrypted where, the controls matrix
• #1413 security Traces sent to Logfire carry full prompts and outputs - a content mode on AgentSpec.observability (same card as #561)
• #1414 low security frontend CodeQL alert #20 in oauth-return.ts - validate or dismiss with a reason (#135 added the path)
• #1415 ci security CodeQL on pull requests, a frontend dependency audit, an SBOM per release (parity via #143)
• #1416 security frontend A real Content-Security-Policy; the widget and hosted page are the framing exception (#702 family)
• #1417 ci security A security pytest marker naming every refusal test, reported per release
• #1418 security Encrypted connections to Postgres and Redis, and a doctor line
• #1419 security Generic OIDC sign-in beside Google; honours the sign-up policy (#914). SAML/SCIM and TOTP are in the roadmap note, unfiled
• #1420 security Per-organization data retention with an audit floor
• #1421 security Erasure and export of one person's data - what UserService.delete leaves (#941 neighbour)
• #1422 security Audit trail export and a hash chain (#20, #983 neighbours)
• #1423 security S3-compatible file storage with server-side encryption beside the local disk
• #1448 security A HIPAA deployment profile and a doctor --profile hipaa check that proves a running deployment matches it - the configuration half of #1412

Existing security issues scheduled under the same theme rather than moved here: #943 and #1044 (impersonation),
#913, #1047, #1066, #1245, #555, #1072 and #150. Bartek's 2026-09-05 sweep added #1427 (a deactivated member's
channel turn), #1437 (a WebSocket outliving its session), #1438 (identity binding while impersonating) and #1439
(a password change that revokes nothing) — the same theme, filed independently.

W6 and W7 are one milestone as of 2026-09-05, and everything schedulable was drained out of Later into it.
Seven issues stayed behind: #52 and #56 (themes planned in the roadmap note), #70 (unscoped), #71 and #151
(blocked), #54 (needs an architectural decision for the realtime half), #985 (needs the tenant-consent answer).

Filed 2026-10-12, from pydantic-ai-harness

Five capabilities adopted from pydantic-ai-harness (we lock 0.54.0), chosen by the maintainer after comparing the harness's capability list with what AgenticOS already ships. All five are in Later, unassigned:

• #2105 effort:s Repair malformed tool-call arguments before validation - fewer paid retries, mostly for open-weight and local models
• #2106 effort:m A run reviewer: a second model that steers a run while it goes - complements #52 (evaluation after a run) and #2086 (the deterministic loop guard)
• #2107 effort:l Code mode: call many tools from one sandboxed script - must keep the approval gate, budgets and permissions on calls made from code
• #2108 effort:m Background tools: keep working while a slow tool runs - needs answers for budget reservation, cancellation and durable resume
• #2109 effort:s Detect prompt-cache busts per agent and model - feeds #2088 (metrics export)

#2086 (tool-call loops) was checked against the harness the same day: nothing upstream detects loops, so it stays, built on our SystemReminders port. Not adopted, with the reason: the MCP-backed integrations (covered by the MCP catalog), the developer tools (coder, localstack, macroscope, aws_lambda), capability_creation (an agent writing its own capabilities at run time contradicts "code defines, configuration composes"), advisor, prompt_injection_defender and dynamic_workflow.

Filed 2026-10-12, the Self improving milestone

#52 is now the parent of a milestone of its own, Self improving, with its design settled in a Q&A from the plan in #1111: evals first, the authoring assistant on top. #1801 was folded into #52 and closed. #2102 (structured outputs) was closed as covered by workflow model steps (#1925). Children, all for Bartosz Ochnik, in dependency order:

• #2110 Datasets → #2111 scoring → #2112 per-environment connections → #2113 eval runs (needs the three before it)
• #2114 generated cases (needs #2110) · #2115 suites and triggers (needs #2113) → #2116 promotion gate
• #2117 the authoring assistant from #1111, checked by evals (needs #2113)
• #2118 more proposal targets (context, model, capabilities...) and #2119 knowledge gaps (both after #2117)

#52's body is the single description of the whole milestone: the loop, the target matrix, principles and what is out of scope.

Related elsewhere: #2106 (run reviewer) shares the judge with #2111; #2086 (loop guard) and the workflow step evals of #1925 share the check vocabulary.

Filed 2026-10-12, from client feedback (Henning, Antoni)

Built in PR #2062 (milestone W11 · Oct 12–16):

• #2124 folders with access for Apps, Skills, Context and Knowledge bases - extends #2072's audiences to folders.
• #2125 any number of accounts of one MCP server on one agent - extends #2073.
• #2126 rename Agent files to Documents.
• Browser: #2127 one capability on browser-use (removes the step-by-step browser; unblocks #801) → #2128 ask the person / take over, #2129 a saved signed-in session per person, #2130 stealth browser in the sandbox plus proxy or external browser. #2128-#2130 build on #2127; #2129 also on #2128 (signing in happens in the takeover view). Related: #2094.
• #2131 discoverability of Availability, personal MCP accounts and Documents - related to #2063, #2075.
• Public API follow-ups from #1796: #2121 (done in #2062), #2122.