chore: Remove pre-created task files, add review reports
Some checks failed
ci/woodpecker/push/woodpecker Pipeline failed
Some checks failed
ci/woodpecker/push/woodpecker Pipeline failed
- Delete docs/tasks.md (let orchestrator bootstrap from scratch) - Delete docs/claude/task-tracking.md (superseded by universal guide) - Add codebase review reports for orchestrator to parse Tests orchestrator's autonomous bootstrap capability.
This commit is contained in:
Jason Woltje
@@ -1,190 +0,0 @@
|
||||
# Autonomous Task Orchestration
|
||||
|
||||
> Load this guide when orchestrating autonomous task completion via `docs/tasks.md`.
|
||||
|
||||
## Ownership
|
||||
|
||||
**The orchestrator is the sole writer of `docs/tasks.md`.** Worker agents execute tasks and report results — they never read or modify the tracking file.
|
||||
|
||||
## Schema Reference
|
||||
|
||||
| Column | Format | Purpose |
|
||||
| -------------- | ---------------------------------------- | ------------------------------------------- |
|
||||
| `id` | `MS-{CAT}-{NNN}` | Unique task ID |
|
||||
| `status` | `not-started` \| `in-progress` \| `done` | Current state |
|
||||
| `description` | Free text | What to do (inline, concise) |
|
||||
| `issue` | `#NNN` or empty | Gitea issue for requirements context |
|
||||
| `repo` | Workspace name | `api`, `web`, `orchestrator`, `coordinator` |
|
||||
| `branch` | Branch name | Git branch for this work |
|
||||
| `depends_on` | Comma-separated IDs | Must complete before this task starts |
|
||||
| `blocks` | Comma-separated IDs | Tasks waiting on this one |
|
||||
| `agent` | Agent identifier | Who is executing |
|
||||
| `started_at` | ISO 8601 | When work began |
|
||||
| `completed_at` | ISO 8601 | When work finished |
|
||||
| `estimate` | `5K`, `40K` | Predicted token usage |
|
||||
| `used` | `4.2K`, `38.5K` | Actual token usage (fill on completion) |
|
||||
|
||||
**Category prefixes:** `SEC` (security), `HIGH` (high priority), `CQ` (code quality), `TEST` (test coverage)
|
||||
|
||||
## Orchestrator Core Loop
|
||||
|
||||
```
|
||||
1. git pull --rebase
|
||||
2. Read docs/tasks.md
|
||||
3. Find next task: status=not-started AND all depends_on are done
|
||||
4. If no task available:
|
||||
- All done? → Report success, STOP
|
||||
- Some blocked? → Report deadlock, STOP
|
||||
5. Update tasks.md: status=in-progress, agent, started_at
|
||||
6. Spawn worker agent (Task tool) with task details from the row
|
||||
7. Wait for worker completion
|
||||
8. Parse worker result (JSON)
|
||||
9. Update tasks.md: status=done/failed, completed_at, used
|
||||
10. Commit + push: git add docs/tasks.md && git commit && git push
|
||||
11. Check context usage
|
||||
12. If >= 60%: Compact (see below), then go to step 1
|
||||
13. If < 60%: Go to step 1
|
||||
```
|
||||
|
||||
## Worker Prompt Template
|
||||
|
||||
The orchestrator constructs this prompt from the task row and passes it to a worker agent via the Task tool:
|
||||
|
||||
````markdown
|
||||
## Task Assignment: {id}
|
||||
|
||||
**Description:** {description}
|
||||
**Repository:** /home/localadmin/src/mosaic-stack/apps/{repo}
|
||||
**Branch:** {branch}
|
||||
|
||||
**Reference Report:** See `docs/reports/codebase-review-2026-02-05/` for detailed findings.
|
||||
|
||||
## Workflow
|
||||
|
||||
1. Checkout branch: `git checkout {branch} || git checkout -b {branch} develop && git pull`
|
||||
2. Implement the fix following existing code patterns
|
||||
3. Run quality gates (ALL must pass):
|
||||
```bash
|
||||
pnpm lint
|
||||
pnpm typecheck
|
||||
pnpm test
|
||||
```
|
||||
4. If gates fail: Fix and retry. Do NOT report success with failures.
|
||||
5. Commit: `git commit -m "fix({id}): brief description"`
|
||||
6. Push: `git push origin {branch}`
|
||||
7. Report result as JSON (see format below)
|
||||
|
||||
## Git Scripts (for issue/PR/milestone operations, NOT raw tea/gh)
|
||||
|
||||
~/.claude/scripts/git/issue-view.sh -i {N}
|
||||
~/.claude/scripts/git/pr-create.sh -t "Title" -b "Desc" -B develop
|
||||
|
||||
# Standard git commands (pull, commit, push, checkout) are fine
|
||||
|
||||
## Result Format (MANDATORY)
|
||||
|
||||
End your response with this JSON block:
|
||||
|
||||
```json
|
||||
{
|
||||
"task_id": "{id}",
|
||||
"status": "success|failed",
|
||||
"used": "5.2K",
|
||||
"commit_sha": "abc123",
|
||||
"notes": "Brief summary of what was done"
|
||||
}
|
||||
```
|
||||
|
||||
## Rules
|
||||
|
||||
- DO NOT modify docs/tasks.md
|
||||
- DO NOT claim other tasks
|
||||
- Complete this single task, report results, done
|
||||
````
|
||||
|
||||
## Compaction Protocol
|
||||
|
||||
**Threshold:** 60% context usage
|
||||
|
||||
**Why 60%?** System overhead is ~26% (prompts, tools, CLAUDE.md). Real capacity is ~74%. Triggering at 60% means ~81% actual usage — safe margin before the 91-95% emergency wall.
|
||||
|
||||
**After completing each task:**
|
||||
|
||||
1. Check context usage
|
||||
2. If < 60%: Continue to next task
|
||||
3. If >= 60%: Compact before next task
|
||||
|
||||
**Compaction steps:**
|
||||
|
||||
1. Update docs/tasks.md with all current progress
|
||||
2. Commit + push tasks.md
|
||||
3. Summarize: completed tasks, quality status, remaining queue
|
||||
4. Clear detailed worker outputs and execution history
|
||||
5. Resume with next unblocked task
|
||||
|
||||
**Compaction does NOT require user permission.**
|
||||
|
||||
**Template:**
|
||||
|
||||
```
|
||||
Session Summary (Compacting at 60%):
|
||||
|
||||
Completed: MS-SEC-001 (12K), MS-SEC-002 (8K), MS-SEC-003 (10K)
|
||||
Quality: All tests passing, zero regressions
|
||||
Remaining: MS-SEC-004 (ready), MS-SEC-005 through MS-SEC-010, Phase 2-4 tasks
|
||||
Next: MS-SEC-004
|
||||
```
|
||||
|
||||
**Expected:** Context drops from 60% → ~25-30%.
|
||||
|
||||
## Error Handling
|
||||
|
||||
**Quality gates fail:**
|
||||
|
||||
1. Update tasks.md: status remains `in-progress`, add failure notes
|
||||
2. Re-spawn worker with error context, or mark `failed` and move on
|
||||
3. If failed task blocks others: Report deadlock, STOP
|
||||
|
||||
**Worker reports blocker:**
|
||||
|
||||
1. Update tasks.md: note the blocker
|
||||
2. Skip to next unblocked task if possible
|
||||
3. If all remaining tasks blocked: Report, STOP
|
||||
|
||||
**Git push conflict:**
|
||||
|
||||
1. `git pull --rebase`
|
||||
2. If auto-resolves: push again
|
||||
3. If conflict on tasks.md: Report, STOP (human resolves)
|
||||
|
||||
## Stopping Criteria
|
||||
|
||||
**ONLY stop if:**
|
||||
|
||||
1. All tasks in docs/tasks.md are `done`
|
||||
2. Critical blocker preventing progress (document and alert)
|
||||
3. Absolute context limit reached AND cannot compact further
|
||||
|
||||
**DO NOT stop to ask "should I continue?"** — the answer is always YES.
|
||||
|
||||
## Phase Structure
|
||||
|
||||
**Phase 1 - Critical Security (MS-SEC-001 through MS-SEC-010):**
|
||||
|
||||
- Authentication, XSS, error handling, OIDC validation
|
||||
- Must complete before Phase 2
|
||||
|
||||
**Phase 2 - High Security (MS-HIGH-001 through MS-HIGH-006):**
|
||||
|
||||
- CSRF, mock data removal, rate limiting, container hardening
|
||||
- Must complete before Phase 3
|
||||
|
||||
**Phase 3 - Code Quality (MS-CQ-001 through MS-CQ-007):**
|
||||
|
||||
- Memory leaks, stale closures, boolean bugs, atomic operations
|
||||
- Must complete before Phase 4
|
||||
|
||||
**Phase 4 - Test Coverage (MS-TEST-001 through MS-TEST-005):**
|
||||
|
||||
- Critical service tests, widget tests, coverage investigation
|
||||
- Final verification gate
|
||||
163
docs/reports/codebase-review-2026-02-05/00-executive-summary.md
Normal file
163
docs/reports/codebase-review-2026-02-05/00-executive-summary.md
Normal file
@@ -0,0 +1,163 @@
|
||||
# Mosaic Stack - Full Codebase Review: Executive Summary
|
||||
|
||||
**Date:** 2026-02-05
|
||||
**Scope:** Full codebase (apps/api, apps/web, apps/orchestrator, apps/coordinator, packages/\*)
|
||||
**Method:** 7 parallel review agents covering security, code quality, and QA/test coverage
|
||||
|
||||
---
|
||||
|
||||
## At a Glance
|
||||
|
||||
| Dimension | Findings | Critical | High | Medium | Low |
|
||||
| --------------------------- | -------- | -------- | ------ | ------ | ------ |
|
||||
| Security - API | 28 | 4 | 7 | 13 | 4 |
|
||||
| Security - Web | 37 | 2 | 9 | 14 | 12 |
|
||||
| Security - Orch/Coord | 30 | 6 | 9 | 12 | 3 |
|
||||
| Code Quality - API | 7 | 3 | 2 | 2 | 0 |
|
||||
| Code Quality - Web | 12 | 5 | 2 | 3 | 2 |
|
||||
| Code Quality - Orchestrator | 10 | 3 | 3 | 3 | 1 |
|
||||
| **Totals** | **124** | **23** | **32** | **47** | **22** |
|
||||
|
||||
**QA/Test Coverage:** Separate grading per workspace (see report 03).
|
||||
|
||||
---
|
||||
|
||||
## Top 10 Most Urgent Findings
|
||||
|
||||
These are the findings that pose the greatest risk and should be addressed first:
|
||||
|
||||
### 1. No Authentication on Orchestrator API (SEC-ORCH-2)
|
||||
|
||||
**Severity: CRITICAL** | The entire orchestrator API (spawn, kill, kill-all, status) has zero authentication. Any network client can drain API credits or kill all agents.
|
||||
|
||||
### 2. RLS Context Never Applied in Service Layer (SEC-API-4)
|
||||
|
||||
**Severity: CRITICAL** | The RLS infrastructure exists (withWorkspaceContext, setWorkspaceContext) but no service actually uses it. Tenant isolation relies entirely on application-level WHERE clauses.
|
||||
|
||||
### 3. WikiLinkRenderer Stored XSS (SEC-WEB-2)
|
||||
|
||||
**Severity: CRITICAL** | WikiLinkRenderer passes HTML through dangerouslySetInnerHTML. DOMPurify only sanitizes wiki-link display text; surrounding HTML is rendered raw. Stored XSS.
|
||||
|
||||
### 4. Secret Scanner Returns "Clean" on Error (SEC-ORCH-1)
|
||||
|
||||
**Severity: CRITICAL** | When scanFile() fails for any reason, it returns `{ hasSecrets: false }`. A file that couldn't be read is indistinguishable from a clean file.
|
||||
|
||||
### 5. Docker Sandbox Disabled by Default (SEC-ORCH-3)
|
||||
|
||||
**Severity: CRITICAL** | Agents run directly on the host without container isolation unless `SANDBOX_ENABLED=true` is explicitly set.
|
||||
|
||||
### 6. Unauthenticated Inter-Service Communication (SEC-ORCH-4)
|
||||
|
||||
**Severity: CRITICAL** | Orchestrator communicates with coordinator over plain HTTP with no authentication. Quality gate responses can be spoofed.
|
||||
|
||||
### 7. Guards Swallow DB Errors as Auth Failures (SEC-API-2, SEC-API-3)
|
||||
|
||||
**Severity: CRITICAL** | WorkspaceGuard and PermissionGuard catch all database errors and return false/null, converting infrastructure failures into misleading "access denied" responses.
|
||||
|
||||
### 8. OIDC Config Silently Degrades to Empty Strings (SEC-API-1)
|
||||
|
||||
**Severity: CRITICAL** | Missing OIDC env vars default to empty strings instead of failing fast. The discovery URL becomes a relative path.
|
||||
|
||||
### 9. Redis KEYS Command in Production (CQ-ORCH-3, SEC-ORCH-5)
|
||||
|
||||
**Severity: CRITICAL** | listTasks() and listAgents() use the blocking `KEYS` command. This can freeze the entire Redis instance under load.
|
||||
|
||||
### 10. OAuth Callback Open Redirect (SEC-WEB-1)
|
||||
|
||||
**Severity: CRITICAL** | The OAuth error parameter is passed unsanitized into router.push(), enabling phishing attacks.
|
||||
|
||||
---
|
||||
|
||||
## Summary by Workspace
|
||||
|
||||
### apps/api (NestJS)
|
||||
|
||||
- **Security:** Strong Prisma query safety, timing-safe comparisons, good guard chain. Weak: RLS never applied, guards swallow DB errors, OIDC silent degradation, admin guard conflates workspace ownership with system admin.
|
||||
- **Code Quality:** Good architecture overall. Memory leaks in WebSocket gateway and runner-jobs. Hardcoded TODO values in federation OIDC.
|
||||
- **Test Grade: B-** (2,174 tests, but 21 untested services including the 916-line knowledge.service.ts)
|
||||
|
||||
### apps/web (Next.js)
|
||||
|
||||
- **Security:** API client has good CSRF handling, but multiple components bypass it with raw fetch(). WikiLinkRenderer XSS. Mock data shipped in production paths. Dual auth mechanisms.
|
||||
- **Code Quality:** Stale closures in hooks, boolean logic bug in mindmap editor, race conditions in autocomplete, no React.memo usage, no CSP headers.
|
||||
- **Test Grade: C+** (555 tests, 76 untested components/pages, 23 skipped tests)
|
||||
|
||||
### apps/orchestrator (NestJS)
|
||||
|
||||
- **Security:** No API authentication, no rate limiting, sandbox disabled by default, unauthenticated inter-service communication, YOLO mode bypasses all quality gates.
|
||||
- **Code Quality:** Unbounded session Map, KEYS command, TOCTOU race conditions in state transitions, N+1 queries, force-remove Docker containers.
|
||||
- **Test Grade: A** (452 tests, near-complete coverage, well-structured)
|
||||
|
||||
### apps/coordinator (Python/FastAPI)
|
||||
|
||||
- **Security:** Prompt injection via issue body, queue file corruption silently discarded, orchestration loops swallow all exceptions, Mock import in production code.
|
||||
- **Test Grade: D** (504 tests exist but only 16% line coverage reported -- likely test configuration issue)
|
||||
|
||||
### packages/\*
|
||||
|
||||
- **shared:** Adequate (1 test file, covers utilities)
|
||||
- **ui:** 9 of 10 components untested (Grade: D+)
|
||||
- **config/skills:** No tests needed
|
||||
|
||||
---
|
||||
|
||||
## Remediation Approach
|
||||
|
||||
Findings are organized into three reports for detailed remediation planning:
|
||||
|
||||
| Report | File | Contents |
|
||||
| ------------------- | --------------------------- | ---------------------------------------------------- |
|
||||
| Security Review | `01-security-review.md` | All 95 security findings across API, Web, Orch/Coord |
|
||||
| Code Quality Review | `02-code-quality-review.md` | All 29 code quality findings |
|
||||
| QA & Test Coverage | `03-qa-test-coverage.md` | Test gaps, anti-patterns, coverage grades |
|
||||
|
||||
### Suggested Remediation Phases
|
||||
|
||||
**Phase 1 - Critical Security (1-2 days)**
|
||||
|
||||
- Add authentication to orchestrator API
|
||||
- Fix WikiLinkRenderer XSS
|
||||
- Fix secret scanner error handling
|
||||
- Fix guards swallowing DB errors
|
||||
- Validate OIDC configuration at startup
|
||||
|
||||
**Phase 2 - High Security + Infrastructure (2-3 days)**
|
||||
|
||||
- Enable Docker sandbox by default
|
||||
- Add inter-service authentication
|
||||
- Replace KEYS with SCAN in Valkey
|
||||
- Sanitize OAuth callback parameters
|
||||
- Route all fetch() through API client (CSRF)
|
||||
- Remove/gate mock data in production paths
|
||||
|
||||
**Phase 3 - Code Quality + Memory Leaks (1-2 days)**
|
||||
|
||||
- Fix memory leaks (WebSocket, runner-jobs, Valkey listeners, session Map)
|
||||
- Fix stale closures in React hooks
|
||||
- Fix boolean logic bug in mindmap editor
|
||||
- Add runtime validation for deserialized data
|
||||
- Fix N+1 queries
|
||||
|
||||
**Phase 4 - Test Coverage (2-3 days)**
|
||||
|
||||
- Investigate coordinator 16% coverage
|
||||
- Add tests for knowledge.service.ts, admin.guard.ts, embeddings.service.ts
|
||||
- Re-enable 23 skipped widget tests
|
||||
- Add tests for untested UI components
|
||||
- Replace placeholder assertions
|
||||
|
||||
---
|
||||
|
||||
## Positive Observations
|
||||
|
||||
The codebase demonstrates strong engineering in several areas:
|
||||
|
||||
- Prisma parameterized queries throughout (no raw SQL injection)
|
||||
- Timing-safe API key comparison
|
||||
- Federation private keys encrypted at rest (AES-256-GCM)
|
||||
- Comprehensive zip bomb protection
|
||||
- Guard chain consistency (Auth -> Workspace -> Permission)
|
||||
- Orchestrator test coverage is excellent (A grade)
|
||||
- State machine validation prevents invalid agent transitions
|
||||
- Webhook signature verification uses hmac.compare_digest()
|
||||
- Good separation of concerns across NestJS modules
|
||||
478
docs/reports/codebase-review-2026-02-05/01-security-review.md
Normal file
478
docs/reports/codebase-review-2026-02-05/01-security-review.md
Normal file
@@ -0,0 +1,478 @@
|
||||
# Mosaic Stack - Security Review
|
||||
|
||||
**Date:** 2026-02-05
|
||||
**Reviewers:** 3 parallel security analysis agents
|
||||
**Total Findings:** 95 (12 Critical, 25 High, 39 Medium, 19 Low)
|
||||
|
||||
---
|
||||
|
||||
## Table of Contents
|
||||
|
||||
1. [Critical Findings](#critical-findings)
|
||||
2. [High Findings](#high-findings)
|
||||
3. [Medium Findings](#medium-findings)
|
||||
4. [Low Findings](#low-findings)
|
||||
5. [Positive Security Observations](#positive-security-observations)
|
||||
|
||||
---
|
||||
|
||||
## Critical Findings
|
||||
|
||||
### SEC-API-1: OIDC Configuration Silently Degrades to Empty Strings
|
||||
|
||||
- **File:** `apps/api/src/auth/auth.config.ts:19-21`
|
||||
- **Impact:** If OIDC env vars are missing, auth starts with broken config instead of failing fast. Discovery URL becomes a relative path.
|
||||
- **Fix:** Validate OIDC env vars at startup. Throw if enabled but unconfigured.
|
||||
|
||||
### SEC-API-2: WorkspaceGuard Swallows Database Errors as Access Denied
|
||||
|
||||
- **File:** `apps/api/src/common/guards/workspace.guard.ts:131-150`
|
||||
- **Impact:** Any Prisma error (connection timeout, pool exhaustion) is reported to users as "You do not have access to this workspace."
|
||||
- **Fix:** Let database errors propagate as 500s. Only catch Prisma-specific "not found" errors.
|
||||
|
||||
### SEC-API-3: PermissionGuard Swallows Database Errors as Null Role
|
||||
|
||||
- **File:** `apps/api/src/common/guards/permission.guard.ts:107-128`
|
||||
- **Impact:** Identical to SEC-API-2. Database failures masquerade as permissions problems.
|
||||
- **Fix:** Remove broad try-catch or only catch specific Prisma errors.
|
||||
|
||||
### SEC-API-4: RLS Context Never Actually Applied in Service Layer
|
||||
|
||||
- **File:** All service files (tasks.service.ts, knowledge.service.ts, brain.service.ts, etc.)
|
||||
- **Impact:** The RLS infrastructure (withWorkspaceContext, setWorkspaceContext) exists but is never used. Tenant isolation relies on application-level WHERE clauses only.
|
||||
- **Fix:** Wrap service-layer database calls in withWorkspaceContext() transactions, or add automated tests verifying every query includes workspaceId.
|
||||
|
||||
### SEC-WEB-1: Open Redirect via Unsanitized OAuth Error Parameter
|
||||
|
||||
- **File:** `apps/web/src/app/(auth)/callback/page.tsx:19`
|
||||
- **Impact:** Attacker can craft URLs with malicious error parameters reflected into router.push().
|
||||
- **Fix:** Validate error against allowlist of known OAuth error codes. Always encodeURIComponent().
|
||||
|
||||
### SEC-WEB-2: WikiLinkRenderer Stored XSS via dangerouslySetInnerHTML
|
||||
|
||||
- **File:** `apps/web/src/components/knowledge/WikiLinkRenderer.tsx:30-38`
|
||||
- **Impact:** parseWikiLinks() only sanitizes wiki-link text. Surrounding HTML passes through raw. Stored XSS via knowledge entry content.
|
||||
- **Fix:** Sanitize the entire HTML input with DOMPurify BEFORE processing wiki-links.
|
||||
|
||||
### SEC-ORCH-1: Secret Scanner Returns False on Scan Errors
|
||||
|
||||
- **File:** `apps/orchestrator/src/git/secret-scanner.service.ts:259-268`
|
||||
- **Impact:** File read errors return `{ hasSecrets: false }`. A file that couldn't be scanned is reported as clean.
|
||||
- **Fix:** Return explicit error state. Add scanError field to result, or throw so caller can decide.
|
||||
|
||||
### SEC-ORCH-2: No Authentication on Orchestrator API Endpoints
|
||||
|
||||
- **File:** `apps/orchestrator/src/api/agents/agents.controller.ts:23-214`
|
||||
- **Impact:** Spawn, kill, kill-all, status endpoints have zero auth. Any network client can drain API credits or kill all agents.
|
||||
- **Fix:** Add API key guard or JWT authentication. Killswitch endpoints need authorization controls.
|
||||
|
||||
### SEC-ORCH-3: Docker Sandbox Disabled by Default
|
||||
|
||||
- **File:** `apps/orchestrator/src/config/orchestrator.config.ts:25`
|
||||
- **Impact:** Agents run directly on the host without container isolation unless explicitly enabled.
|
||||
- **Fix:** Enable sandbox by default in production. Log prominent warning when disabled.
|
||||
|
||||
### SEC-ORCH-4: Unauthenticated Inter-Service Communication
|
||||
|
||||
- **File:** `apps/orchestrator/src/coordinator/coordinator-client.service.ts:72-79`
|
||||
- **Impact:** Orchestrator-to-coordinator communication has no auth. Quality gate responses can be spoofed.
|
||||
- **Fix:** Add mutual authentication (API key at minimum, mTLS ideally). Enforce HTTPS.
|
||||
|
||||
### SEC-ORCH-5: Redis KEYS Command in Production (DoS Risk)
|
||||
|
||||
- **File:** `apps/orchestrator/src/valkey/valkey.client.ts:115-127, 185-198`
|
||||
- **Impact:** KEYS command blocks the entire Redis instance. Unauthenticated list endpoints can DoS Redis.
|
||||
- **Fix:** Replace with SCAN (non-blocking, cursor-based iteration).
|
||||
|
||||
### SEC-ORCH-6: Unsafe Deserialization with Type Assertion
|
||||
|
||||
- **File:** `apps/orchestrator/src/valkey/valkey.client.ts:69, 141, 193, 214`
|
||||
- **Impact:** JSON.parse() + `as Type` with no runtime validation. Corrupted/tampered Redis data propagates silently.
|
||||
- **Fix:** Add runtime validation using Zod or class-validator after JSON.parse().
|
||||
|
||||
---
|
||||
|
||||
## High Findings
|
||||
|
||||
### SEC-API-5: OpenAI Embedding Service Initialized with Dummy API Key
|
||||
|
||||
- **File:** `apps/api/src/knowledge/services/embedding.service.ts:27-35`
|
||||
- **Fix:** Don't instantiate OpenAI client when key is missing (use null).
|
||||
|
||||
### SEC-API-6: Embedding Generation Failures Silently Swallowed
|
||||
|
||||
- **File:** `apps/api/src/knowledge/knowledge.service.ts:246-248, 408-412`
|
||||
- **Fix:** Use structured logger. Track entries missing embeddings.
|
||||
|
||||
### SEC-API-7: CSRF Token Not Cryptographically Tied to Session
|
||||
|
||||
- **File:** `apps/api/src/common/controllers/csrf.controller.ts:20-34`
|
||||
- **Fix:** Bind CSRF token to user session via HMAC with server secret.
|
||||
|
||||
### SEC-API-8: Rate Limiter Silently Falls Back to In-Memory
|
||||
|
||||
- **File:** `apps/api/src/common/throttler/throttler-storage.service.ts:54-60`
|
||||
- **Fix:** Log at ERROR level. Expose health check for degraded mode.
|
||||
|
||||
### SEC-API-9: AdminGuard Uses Workspace Ownership as Admin Check
|
||||
|
||||
- **File:** `apps/api/src/auth/guards/admin.guard.ts:33-43`
|
||||
- **Fix:** Implement proper system admin role (isSystemAdmin on User model).
|
||||
|
||||
### SEC-API-10: Auth Route Catch-All Bypasses Guards
|
||||
|
||||
- **File:** `apps/api/src/auth/auth.controller.ts:80-84`
|
||||
- **Fix:** Add rate limiting and logging to auth catch-all.
|
||||
|
||||
### SEC-API-11: Federation Uses Hardcoded Default Workspace "default"
|
||||
|
||||
- **File:** `apps/api/src/federation/federation.controller.ts:226-239`
|
||||
- **Fix:** Validate DEFAULT_WORKSPACE_ID is set and is a valid UUID.
|
||||
|
||||
### SEC-WEB-3: Missing CSRF Token on Multiple Direct fetch() Calls
|
||||
|
||||
- **Files:** `ImportExportActions.tsx:66`, `KanbanBoard.tsx:98`, `ActiveProjectsWidget.tsx:46-76`
|
||||
- **Fix:** Route all state-changing API calls through apiPost/apiPatch/apiDelete.
|
||||
|
||||
### SEC-WEB-4: Mock Data Shipped in Production Code Paths
|
||||
|
||||
- **Files:** `federation/connections/page.tsx:49`, `settings/workspaces/page.tsx:11-28`, `teams/page.tsx:21`
|
||||
- **Fix:** Connect to real APIs, show "Coming Soon", or gate behind NODE_ENV check.
|
||||
|
||||
### SEC-WEB-5: Silent Auth Session Check Failure
|
||||
|
||||
- **File:** `apps/web/src/lib/auth/auth-context.tsx:21-30`
|
||||
- **Fix:** Log errors. Distinguish "not logged in" from "backend is down."
|
||||
|
||||
### SEC-WEB-6: WebSocket Token Without TLS Verification
|
||||
|
||||
- **File:** `apps/web/src/hooks/useWebSocket.ts:70-73`
|
||||
- **Fix:** Enforce WSS in production. Add connect_error event handling.
|
||||
|
||||
### SEC-WEB-7: KanbanBoard Swallows Task Update Errors
|
||||
|
||||
- **File:** `apps/web/src/components/kanban/KanbanBoard.tsx:114-117`
|
||||
- **Fix:** Revert UI state on error. Show notification.
|
||||
|
||||
### SEC-WEB-8: ActiveProjectsWidget Silently Drops Non-OK Responses
|
||||
|
||||
- **File:** `apps/web/src/components/widgets/ActiveProjectsWidget.tsx:46-58, 72-86`
|
||||
- **Fix:** Handle non-OK responses explicitly.
|
||||
|
||||
### SEC-WEB-9: QuickCaptureWidget Discards User Data
|
||||
|
||||
- **File:** `apps/web/src/components/widgets/QuickCaptureWidget.tsx:21-32`
|
||||
- **Fix:** Connect to API, persist to localStorage, or disable with "Coming Soon".
|
||||
|
||||
### SEC-WEB-10: Inconsistent API Base URL for Knowledge Graph
|
||||
|
||||
- **File:** `apps/web/src/components/mindmap/hooks/useGraphData.ts:122`
|
||||
- **Fix:** Use same API base URL as rest of application (localhost:3001).
|
||||
|
||||
### SEC-WEB-11: Dual Auth Mechanisms (Cookie + Bearer Token)
|
||||
|
||||
- **File:** `apps/web/src/components/mindmap/hooks/useGraphData.ts:153-177`
|
||||
- **Fix:** Standardize on single auth mechanism. Use apiGet/apiPost from client.ts.
|
||||
|
||||
### SEC-ORCH-7: Coordinator Loops Silently Swallow All Exceptions
|
||||
|
||||
- **File:** `apps/coordinator/src/coordinator.py:85-89, 299-304`
|
||||
- **Fix:** Add circuit breaker. Track consecutive failures. Expose error counts in health endpoint.
|
||||
|
||||
### SEC-ORCH-8: Queue File Corrupted Data Silently Discarded
|
||||
|
||||
- **File:** `apps/coordinator/src/queue.py:217-234`
|
||||
- **Fix:** Log corruption event. Backup corrupted file. Consider SQLite/Redis persistence.
|
||||
|
||||
### SEC-ORCH-9: Environment Variable Injection via Docker Container
|
||||
|
||||
- **File:** `apps/orchestrator/src/spawner/docker-sandbox.service.ts:87-91`
|
||||
- **Fix:** Whitelist allowed env var names. Block LD_PRELOAD, PATH, NODE_OPTIONS, etc.
|
||||
|
||||
### SEC-ORCH-10: Docker Container Not Properly Isolated
|
||||
|
||||
- **File:** `apps/orchestrator/src/spawner/docker-sandbox.service.ts:100-114`
|
||||
- **Fix:** Add CapDrop: ["ALL"], enable ReadonlyRootfs, NetworkMode: "none" default, PidsLimit.
|
||||
|
||||
### SEC-ORCH-11: No Rate Limiting on Orchestrator API
|
||||
|
||||
- **File:** `apps/orchestrator/src/api/agents/agents.controller.ts`
|
||||
- **Fix:** Add @nestjs/throttler. Strict limits on killswitch endpoints.
|
||||
|
||||
### SEC-ORCH-12: No Max Concurrent Agents Enforcement
|
||||
|
||||
- **File:** `apps/orchestrator/src/spawner/agent-spawner.service.ts:40-74`
|
||||
- **Fix:** Add configurable limit. Check sessions.size before spawning.
|
||||
|
||||
### SEC-ORCH-13: YOLO Mode Bypasses All Quality Gates
|
||||
|
||||
- **File:** `apps/orchestrator/src/coordinator/quality-gates.service.ts:222-257`
|
||||
- **Fix:** Block in production. Add startup warning. Metric counter for bypasses.
|
||||
|
||||
### SEC-ORCH-14: Parser Prompt Injection via Issue Body
|
||||
|
||||
- **File:** `apps/coordinator/src/parser.py:99-136`
|
||||
- **Fix:** Sanitize issue body. Use Claude's tool use for structured output. Validate bounds.
|
||||
|
||||
### SEC-ORCH-15: Valkey Connection Has No Authentication by Default
|
||||
|
||||
- **File:** `apps/orchestrator/src/config/orchestrator.config.ts:8`
|
||||
- **Fix:** Log warning when VALKEY_PASSWORD not set. Require in production. Add TLS.
|
||||
|
||||
---
|
||||
|
||||
## Medium Findings
|
||||
|
||||
### SEC-API-12: CurrentUser Decorator Returns undefined Without Error
|
||||
|
||||
- **File:** `apps/api/src/auth/decorators/current-user.decorator.ts:9-14`
|
||||
|
||||
### SEC-API-13: Session Verification Catch-All Returns null
|
||||
|
||||
- **File:** `apps/api/src/auth/auth.service.ts:86-92`
|
||||
|
||||
### SEC-API-14: WebSocket Token in Query Parameters
|
||||
|
||||
- **File:** `apps/api/src/websocket/websocket.gateway.ts:181-184`
|
||||
|
||||
### SEC-API-15: Markdown Renderer Uses console.error
|
||||
|
||||
- **File:** `apps/api/src/knowledge/utils/markdown.ts:178, 204`
|
||||
|
||||
### SEC-API-16: Throttler Guard Uses console.warn
|
||||
|
||||
- **File:** `apps/api/src/common/throttler/throttler-api-key.guard.ts:40`
|
||||
|
||||
### SEC-API-17: data: URI Scheme Allowed in Markdown
|
||||
|
||||
- **File:** `apps/api/src/knowledge/utils/markdown.ts:109-111`
|
||||
|
||||
### SEC-API-18: Batch Embedding Failures Silently Continue
|
||||
|
||||
- **Files:** `apps/api/src/knowledge/services/ollama-embedding.service.ts:183-189`, `embedding.service.ts:150-157`
|
||||
|
||||
### SEC-API-19: BrainService Search Not Length-Validated
|
||||
|
||||
- **File:** `apps/api/src/brain/brain.service.ts:316-321, 360-365, 408-413`
|
||||
|
||||
### SEC-API-20: Brain Search Limit Parameter Allows Negatives
|
||||
|
||||
- **File:** `apps/api/src/brain/brain.controller.ts:74-76`
|
||||
|
||||
### SEC-API-21: Semantic/Hybrid Search Body Not Validated via DTO
|
||||
|
||||
- **File:** `apps/api/src/knowledge/search.controller.ts:113-149`
|
||||
|
||||
### SEC-API-22: Federation Controller Throws Generic Error
|
||||
|
||||
- **File:** `apps/api/src/federation/federation.controller.ts:65-207`
|
||||
|
||||
### SEC-API-23: OllamaEmbedding isConfigured() Discards Error
|
||||
|
||||
- **File:** `apps/api/src/knowledge/services/ollama-embedding.service.ts:48-51`
|
||||
|
||||
### SEC-API-24: Global Exception Filter Exposes Error Messages
|
||||
|
||||
- **File:** `apps/api/src/filters/global-exception.filter.ts:34-35`
|
||||
|
||||
### SEC-WEB-12: ChatInput Silently Swallows Version Fetch
|
||||
|
||||
- **File:** `apps/web/src/components/chat/ChatInput.tsx:32-34`
|
||||
|
||||
### SEC-WEB-13: MessageList Clipboard Copy Silently Fails
|
||||
|
||||
- **File:** `apps/web/src/components/chat/MessageList.tsx:75-78`
|
||||
|
||||
### SEC-WEB-14: BackendStatusBanner Is a Non-Functional Stub
|
||||
|
||||
- **File:** `apps/web/src/components/chat/BackendStatusBanner.tsx:19-33`
|
||||
|
||||
### SEC-WEB-15: Pervasive alert() for Error Feedback (13 instances)
|
||||
|
||||
- **Files:** ImportExportActions, WorkspaceSettings, MemberList, InviteMember, TeamSettings, TeamMemberList, settings pages
|
||||
|
||||
### SEC-WEB-16: No Content Security Policy Headers
|
||||
|
||||
- **File:** `apps/web/next.config.ts`
|
||||
|
||||
### SEC-WEB-17: useGraphData Silently Skips Backlink Fetch Errors
|
||||
|
||||
- **File:** `apps/web/src/components/mindmap/hooks/useGraphData.ts:305-308`
|
||||
|
||||
### SEC-WEB-18: useGraphData fetchStatistics Silently Fails
|
||||
|
||||
- **File:** `apps/web/src/components/mindmap/hooks/useGraphData.ts:412-414`
|
||||
|
||||
### SEC-WEB-19: Session Expiration Flag Never Resets
|
||||
|
||||
- **File:** `apps/web/src/lib/api.ts:5-6, 31-33`
|
||||
|
||||
### SEC-WEB-20: BetterAuth URL Not a NEXT_PUBLIC Variable
|
||||
|
||||
- **File:** `apps/web/src/lib/auth-client.ts:17-20`
|
||||
|
||||
### SEC-WEB-21: No Rate Limiting on Auth Session Refresh
|
||||
|
||||
- **File:** `apps/web/src/lib/auth/auth-context.tsx:42-44`
|
||||
|
||||
### SEC-WEB-22: Error Boundary Only Logs to Console
|
||||
|
||||
- **File:** `apps/web/src/components/error-boundary.tsx:34`
|
||||
|
||||
### SEC-WEB-23: ImportExportActions Missing credentials: "include"
|
||||
|
||||
- **File:** `apps/web/src/components/knowledge/ImportExportActions.tsx:66-69, 115-117`
|
||||
|
||||
### SEC-WEB-24: Authenticated Layout Race Between Load and Redirect
|
||||
|
||||
- **File:** `apps/web/src/app/(authenticated)/layout.tsx:18-33`
|
||||
|
||||
### SEC-WEB-25: LoginButton No PKCE/State Parameter
|
||||
|
||||
- **File:** `apps/web/src/components/auth/LoginButton.tsx:8-11`
|
||||
|
||||
### SEC-ORCH-16: Health/Ready Endpoint Always Returns True
|
||||
|
||||
- **File:** `apps/orchestrator/src/api/health/health.controller.ts:17-21`
|
||||
|
||||
### SEC-ORCH-17: Queue File No Locking (Concurrent Corruption)
|
||||
|
||||
- **File:** `apps/coordinator/src/queue.py:210-215`
|
||||
|
||||
### SEC-ORCH-18: Shared Package Uses console.warn
|
||||
|
||||
- **File:** `packages/shared/src/utils/index.ts:10`
|
||||
|
||||
### SEC-ORCH-19: agentId Path Parameter Not Validated as UUID
|
||||
|
||||
- **File:** `apps/orchestrator/src/api/agents/agents.controller.ts:78, 136`
|
||||
|
||||
### SEC-ORCH-20: Orchestrator Binds to 0.0.0.0 by Default
|
||||
|
||||
- **File:** `apps/orchestrator/src/main.ts:14`
|
||||
|
||||
### SEC-ORCH-21: BullMQ Connection Missing Password
|
||||
|
||||
- **File:** `apps/orchestrator/src/app.module.ts:15-20`
|
||||
|
||||
### SEC-ORCH-22: Docker Image Tag Not Validated
|
||||
|
||||
- **File:** `apps/orchestrator/src/spawner/docker-sandbox.service.ts:73`
|
||||
|
||||
### SEC-ORCH-23: git add "." When No Files Specified
|
||||
|
||||
- **File:** `apps/orchestrator/src/git/git-operations.service.ts:89-93`
|
||||
|
||||
### SEC-ORCH-24: Coordinator Context Check Returns CONTINUE on Error
|
||||
|
||||
- **File:** `apps/coordinator/src/coordinator.py:447-449`
|
||||
|
||||
### SEC-ORCH-25: SSRF Protection Incomplete for SSH URLs
|
||||
|
||||
- **File:** `apps/orchestrator/src/git/git-validation.util.ts:129-131`
|
||||
|
||||
### SEC-ORCH-26: In-Memory Session Store (Unbounded Growth)
|
||||
|
||||
- **File:** `apps/orchestrator/src/spawner/agent-spawner.service.ts:19`
|
||||
|
||||
### SEC-ORCH-27: unittest.mock Import in Production Code
|
||||
|
||||
- **File:** `apps/coordinator/src/quality_orchestrator.py:6`
|
||||
|
||||
---
|
||||
|
||||
## Low Findings
|
||||
|
||||
### SEC-API-25: ValidationPipe forbidNonWhitelisted: false
|
||||
|
||||
- **File:** `apps/api/src/main.ts:40`
|
||||
|
||||
### SEC-API-26: CORS Allows Requests with No Origin
|
||||
|
||||
- **File:** `apps/api/src/main.ts:63-66`
|
||||
|
||||
### SEC-API-27: createAuthMiddleware Sets RLS Context Outside Transaction
|
||||
|
||||
- **File:** `apps/api/src/lib/db-context.ts:347-358`
|
||||
|
||||
### SEC-API-28: MCP Service Uses console.error
|
||||
|
||||
- **Files:** `apps/api/src/mcp/mcp-hub.service.ts:164`, `mcp/stdio-transport.ts:42, 133`
|
||||
|
||||
### SEC-WEB-26: console.log Statements in Production
|
||||
|
||||
- **Files:** `settings/workspaces/page.tsx:56`, `teams/page.tsx:39`
|
||||
|
||||
### SEC-WEB-27: Weak Email Validation
|
||||
|
||||
- **File:** `apps/web/src/components/workspace/InviteMember.tsx:24-28`
|
||||
|
||||
### SEC-WEB-28: Role Cast Without Validation
|
||||
|
||||
- **File:** `apps/web/src/components/workspace/MemberList.tsx:91`
|
||||
|
||||
### SEC-WEB-29: formatTime Returns Empty String on Error
|
||||
|
||||
- **File:** `apps/web/src/components/chat/MessageList.tsx:316-323`
|
||||
|
||||
### SEC-WEB-30: JSON.parse Without Type Validation (deserializeMessages)
|
||||
|
||||
- **File:** `apps/web/src/hooks/useChat.ts:112-119`
|
||||
|
||||
### SEC-WEB-31: JSON.parse Without Validation (ConversationSidebar)
|
||||
|
||||
- **File:** `apps/web/src/components/chat/ConversationSidebar.tsx:46-52`
|
||||
|
||||
### SEC-WEB-32: No Input Length Limits on Forms
|
||||
|
||||
- **Files:** WorkspaceSettings, TeamSettings, InviteMember
|
||||
|
||||
### SEC-WEB-33: Mermaid Error Displays Raw Source
|
||||
|
||||
- **File:** `apps/web/src/components/mindmap/MermaidViewer.tsx:126-133`
|
||||
|
||||
### SEC-WEB-34: No Timeout on API Requests
|
||||
|
||||
- **File:** `apps/web/src/lib/api/client.ts`
|
||||
|
||||
### SEC-WEB-35: useWorkspaceId Returns null Without Explanation
|
||||
|
||||
- **File:** `apps/web/src/lib/hooks/useLayout.ts:225-240`
|
||||
|
||||
### SEC-WEB-36: localStorage Data Not Validated After Parse
|
||||
|
||||
- **Files:** `useChatOverlay.ts:40`, `useLayout.ts:45`
|
||||
|
||||
### SEC-WEB-37: Federation Mock Data Includes Fake Public Keys
|
||||
|
||||
- **File:** `apps/web/src/lib/api/federation.ts:202-272`
|
||||
|
||||
### SEC-ORCH-28: Valkey Client Has No Connection Timeout
|
||||
|
||||
- **File:** `apps/orchestrator/src/valkey/valkey.client.ts:38-44`
|
||||
|
||||
### SEC-ORCH-29: No Validation on workItems String Lengths
|
||||
|
||||
- **File:** `apps/orchestrator/src/api/agents/dto/spawn-agent.dto.ts:84-87`
|
||||
|
||||
### SEC-ORCH-30: Container Name Collision Risk
|
||||
|
||||
- **File:** `apps/orchestrator/src/spawner/docker-sandbox.service.ts:94`
|
||||
|
||||
---
|
||||
|
||||
## Positive Security Observations
|
||||
|
||||
1. **No $queryRawUnsafe or $executeRawUnsafe** -- All raw SQL uses Prisma's parameterized tagged template literals
|
||||
2. **Timing-safe API key comparison** using crypto.timingSafeEqual
|
||||
3. **Federation private keys encrypted at rest** with AES-256-GCM
|
||||
4. **HTML sanitization** applied to markdown-rendered content before storage
|
||||
5. **Zip bomb protection** with file count and size limits
|
||||
6. **Path traversal prevention** in import service zip handler
|
||||
7. **Guard chain consistency** (AuthGuard -> WorkspaceGuard -> PermissionGuard)
|
||||
8. **Input validation via DTOs** with class-validator decorators on most endpoints
|
||||
9. **Search query sanitization** strips PostgreSQL full-text operators
|
||||
10. **Log sanitization** utilities redact secrets, tokens, and PII
|
||||
11. **Git input validation** with whitelist-based branch name and URL validation
|
||||
12. **Webhook signature verification** using hmac.compare_digest()
|
||||
13. **State machine transitions** with explicit valid transition maps
|
||||
@@ -0,0 +1,217 @@
|
||||
# Mosaic Stack - Code Quality Review
|
||||
|
||||
**Date:** 2026-02-05
|
||||
**Reviewers:** 3 parallel code quality analysis agents
|
||||
**Total Findings:** 29 (11 Critical/High, 8 Medium, 10 Low/Code Smell)
|
||||
|
||||
---
|
||||
|
||||
## apps/api - Code Quality (7 Findings)
|
||||
|
||||
### CQ-API-1: Memory Leak - setTimeout Not Cleared in WebSocket Gateway [HIGH]
|
||||
|
||||
- **File:** `apps/api/src/websocket/websocket.gateway.ts:105-166`
|
||||
- **Issue:** If workspaceMembership query throws, timeoutId is never cleared. Each failed connection leaks a timer.
|
||||
- **Fix:** Call clearTimeout(timeoutId) in catch block at line 159.
|
||||
|
||||
### CQ-API-2: Memory Leak - setInterval Not Cleared in Runner Jobs [HIGH]
|
||||
|
||||
- **File:** `apps/api/src/runner-jobs/runner-jobs.service.ts:310-449`
|
||||
- **Issue:** keepAliveInterval at line 315 is never explicitly cleared with clearInterval().
|
||||
- **Fix:** Add clearInterval(keepAliveInterval) in the finally block.
|
||||
|
||||
### CQ-API-3: Activity Logging Re-Throws (Defeats Fire-and-Forget) [MEDIUM]
|
||||
|
||||
- **File:** `apps/api/src/activity/activity.service.ts:23-31`
|
||||
- **Issue:** logActivity catches errors, logs them, then re-throws. Activity logging failures break primary operations.
|
||||
- **Fix:** Make fire-and-forget (don't re-throw) or document that callers must handle.
|
||||
|
||||
### CQ-API-4: Missing Cleanup for Redis Event Listeners [MEDIUM]
|
||||
|
||||
- **File:** `apps/api/src/valkey/valkey.service.ts:43-53`
|
||||
- **Issue:** Event listeners registered on Redis client but never removed in onModuleDestroy.
|
||||
- **Fix:** Call this.client.removeAllListeners() before quit() in onModuleDestroy.
|
||||
|
||||
### CQ-API-5: Race Condition in Throttler Fallback Storage [LOW]
|
||||
|
||||
- **File:** `apps/api/src/common/throttler/throttler-storage.service.ts:140-154`
|
||||
- **Issue:** In-memory fallback incrementMemory has non-atomic read-modify-write.
|
||||
- **Fix:** Use mutex/lock, or document in-memory mode as best-effort.
|
||||
|
||||
### CQ-API-6: Hardcoded TODO Values in OIDC Federation [CRITICAL]
|
||||
|
||||
- **File:** `apps/api/src/federation/oidc.service.ts:140-141`
|
||||
- **Issue:** JWT validation uses hardcoded "https://auth.example.com" and "mosaic-client-id".
|
||||
- **Fix:** Load from environment variables. Fail fast if unconfigured.
|
||||
|
||||
### CQ-API-7: N+1 Query in Knowledge Service Tag Lookup [LOW]
|
||||
|
||||
- **File:** `apps/api/src/knowledge/knowledge.service.ts:817-827`
|
||||
- **Issue:** Promise.all with individual findFirst queries per tag name.
|
||||
- **Fix:** Replace with single findMany WHERE name IN tagNames.
|
||||
|
||||
---
|
||||
|
||||
## apps/web - Code Quality (12 Findings)
|
||||
|
||||
### CQ-WEB-1: Stale Closure in useWebSocket Hook [CRITICAL]
|
||||
|
||||
- **File:** `apps/web/src/hooks/useWebSocket.ts:127-137`
|
||||
- **Issue:** Callback functions in useEffect deps cause WebSocket disconnect/reconnect on every parent re-render.
|
||||
- **Fix:** Use refs for callbacks. Only include stable values (workspaceId, token) in deps.
|
||||
|
||||
### CQ-WEB-2: Missing Dependency in FilterBar useEffect [HIGH]
|
||||
|
||||
- **File:** `apps/web/src/components/filters/FilterBar.tsx:33-50`
|
||||
- **Issue:** useEffect accesses filters and onFilterChange but they're not in the dependency array.
|
||||
- **Fix:** Add missing dependencies or use functional updates.
|
||||
|
||||
### CQ-WEB-3: Race Condition in LinkAutocomplete [HIGH]
|
||||
|
||||
- **File:** `apps/web/src/components/knowledge/LinkAutocomplete.tsx:96-107`
|
||||
- **Issue:** Debounced search doesn't cancel in-flight requests. Older results can overwrite newer ones.
|
||||
- **Fix:** Use AbortController to cancel in-flight requests.
|
||||
|
||||
### CQ-WEB-4: Stale Messages in useChat Hook [CRITICAL]
|
||||
|
||||
- **File:** `apps/web/src/hooks/useChat.ts:146-236`
|
||||
- **Issue:** sendMessage captures messages in closure. Rapid sends use stale state. Data loss.
|
||||
- **Fix:** Use functional state updates: setMessages(prev => [...prev, userMessage]).
|
||||
|
||||
### CQ-WEB-5: Incorrect Boolean Logic in ReactFlowEditor [CRITICAL]
|
||||
|
||||
- **File:** `apps/web/src/components/mindmap/ReactFlowEditor.tsx:213-214`
|
||||
- **Issue:** `readOnly ?? !selectedNode` should be `readOnly || !selectedNode`. The ?? operator with boolean never evaluates right side when readOnly is false.
|
||||
- **Fix:** Change ?? to ||.
|
||||
|
||||
### CQ-WEB-6: Memory Leak in Chat Component Timers [MEDIUM]
|
||||
|
||||
- **File:** `apps/web/src/components/chat/Chat.tsx:146-174`
|
||||
- **Issue:** Timer cleanup structure is confusing and may leak in edge cases.
|
||||
- **Fix:** Restructure to only create timers when isChatLoading is true with proper cleanup.
|
||||
|
||||
### CQ-WEB-7: KanbanBoard No UI Revert on Error [CRITICAL]
|
||||
|
||||
- **File:** `apps/web/src/components/kanban/KanbanBoard.tsx:97-117`
|
||||
- **Issue:** PATCH error logged but UI not reverted. User sees task in wrong column.
|
||||
- **Fix:** Implement optimistic updates with rollback on error.
|
||||
|
||||
### CQ-WEB-8: No React.memo Usage Anywhere [PERFORMANCE]
|
||||
|
||||
- **Files:** All component files
|
||||
- **Issue:** Zero components use React.memo despite 115+ uses of useMemo/useCallback and large lists.
|
||||
- **Fix:** Wrap pure components in React.memo (TaskItem, KanbanColumn, etc.).
|
||||
|
||||
### CQ-WEB-9: DOM Manipulation in LinkAutocomplete [PERFORMANCE]
|
||||
|
||||
- **File:** `apps/web/src/components/knowledge/LinkAutocomplete.tsx:112-165`
|
||||
- **Issue:** Creates temporary DOM element on every position calculation, causing layout thrashing.
|
||||
- **Fix:** Use textarea-caret-position library or cached measurement.
|
||||
|
||||
### CQ-WEB-10: Missing Loading States on Many Pages [CODE SMELL]
|
||||
|
||||
- **Files:** tasks/page.tsx, calendar/page.tsx, multiple federation pages
|
||||
- **Issue:** Pages use mock data with TODO comments. No loading states.
|
||||
- **Fix:** Implement loading/error states even with mock data.
|
||||
|
||||
### CQ-WEB-11: Accessibility - Missing Form Labels [ACCESSIBILITY]
|
||||
|
||||
- **File:** `apps/web/src/components/filters/FilterBar.tsx:115-188`
|
||||
- **Issue:** Checkboxes lack proper label associations for screen readers.
|
||||
- **Fix:** Add explicit id/htmlFor or aria-label.
|
||||
|
||||
### CQ-WEB-12: SSR Issue - Window Check After DOM Usage [BUG]
|
||||
|
||||
- **File:** `apps/web/src/components/mindmap/ReactFlowEditor.tsx:238-245`
|
||||
- **Issue:** Checks typeof window after already using document.addEventListener.
|
||||
- **Fix:** Use useEffect for all DOM access. Consistently check typeof window.
|
||||
|
||||
---
|
||||
|
||||
## apps/orchestrator - Code Quality (10 Findings)
|
||||
|
||||
### CQ-ORCH-1: Memory Leak - Agent Sessions Never Cleaned Up [CRITICAL]
|
||||
|
||||
- **File:** `apps/orchestrator/src/spawner/agent-spawner.service.ts:19`
|
||||
- **Issue:** Sessions Map never has entries removed. No cleanup on terminal states.
|
||||
- **Fix:** Add session cleanup after completed/failed/killed transitions.
|
||||
|
||||
### CQ-ORCH-2: Race Condition - Dual State Management [HIGH]
|
||||
|
||||
- **File:** `apps/orchestrator/src/api/agents/agents.controller.ts:91-118`
|
||||
- **Issue:** Two sources of truth (in-memory Map + Valkey). Can get out of sync during rapid transitions.
|
||||
- **Fix:** Use Valkey as single source of truth. Remove in-memory Map.
|
||||
|
||||
### CQ-ORCH-3: Redis KEYS Command in Production [CRITICAL]
|
||||
|
||||
- **File:** `apps/orchestrator/src/valkey/valkey.client.ts:116, 187`
|
||||
- **Issue:** KEYS is O(N) and blocks entire Redis instance.
|
||||
- **Fix:** Use SCAN for non-blocking iteration.
|
||||
|
||||
### CQ-ORCH-4: No Timeout Cleanup for AbortController [HIGH]
|
||||
|
||||
- **File:** `apps/orchestrator/src/coordinator/coordinator-client.service.ts:67-81, 156-166`
|
||||
- **Issue:** clearTimeout only called on success path, not in catch block. Timer leak per retry.
|
||||
- **Fix:** Use try-finally to guarantee cleanup.
|
||||
|
||||
### CQ-ORCH-5: TOCTOU Race in State Transitions [HIGH]
|
||||
|
||||
- **File:** `apps/orchestrator/src/spawner/agent-lifecycle.service.ts:31-53`
|
||||
- **Issue:** Read state, validate, then write is not atomic. Concurrent transitions can overwrite each other.
|
||||
- **Fix:** Use Valkey Lua script for atomic check-and-set.
|
||||
|
||||
### CQ-ORCH-6: N+1 Query in listTasks/listAgents [CRITICAL]
|
||||
|
||||
- **File:** `apps/orchestrator/src/valkey/valkey.client.ts:114-127, 185-198`
|
||||
- **Issue:** 1 + N queries (one KEYS + one GET per key). 1000 tasks = 1001 round trips.
|
||||
- **Fix:** Use MGET for batch retrieval after SCAN. 100-500x faster.
|
||||
|
||||
### CQ-ORCH-7: Docker Force Remove Loses Data [MEDIUM]
|
||||
|
||||
- **File:** `apps/orchestrator/src/spawner/docker-sandbox.service.ts:179`
|
||||
- **Issue:** force: true always used, bypassing graceful shutdown. Work-in-progress lost.
|
||||
- **Fix:** Stop before remove. Only force as last resort.
|
||||
|
||||
### CQ-ORCH-8: KillAllAgents Doesn't Distinguish Error Types [MEDIUM]
|
||||
|
||||
- **File:** `apps/orchestrator/src/killswitch/killswitch.service.ts:125-137`
|
||||
- **Issue:** "Already terminated" counted same as "cleanup failed." Misleading metrics.
|
||||
- **Fix:** Add "skipped" category for expected state transition failures.
|
||||
|
||||
### CQ-ORCH-9: Duplicate Validation Logic [CODE SMELL]
|
||||
|
||||
- **Files:** `agent-spawner.service.ts:98-119`, `agents.controller.ts:192-213`
|
||||
- **Issue:** Both implement identical spawn request validation.
|
||||
- **Fix:** Remove from controller. Rely on DTOs + ValidationPipe.
|
||||
|
||||
### CQ-ORCH-10: BullMQ Job Retention May Cause Memory Growth [LOW]
|
||||
|
||||
- **File:** `apps/orchestrator/src/queue/queue.service.ts:52-60`
|
||||
- **Issue:** Retention of 1000 failed jobs for 24 hours may be excessive under load.
|
||||
- **Fix:** Make configurable via environment variables.
|
||||
|
||||
---
|
||||
|
||||
## Remediation Priority Matrix
|
||||
|
||||
| Priority | ID | Title | Effort |
|
||||
| -------- | --------- | ------------------------------ | ------ |
|
||||
| P0 | CQ-API-6 | Hardcoded OIDC values | 30min |
|
||||
| P0 | CQ-ORCH-3 | KEYS -> SCAN | 1hr |
|
||||
| P0 | CQ-ORCH-6 | N+1 queries -> MGET | 1hr |
|
||||
| P0 | CQ-WEB-5 | Boolean logic bug (?? -> \|\|) | 5min |
|
||||
| P1 | CQ-ORCH-1 | Session Map cleanup | 1hr |
|
||||
| P1 | CQ-API-1 | WebSocket timer leak | 30min |
|
||||
| P1 | CQ-API-2 | Runner jobs interval leak | 30min |
|
||||
| P1 | CQ-WEB-1 | useWebSocket stale closure | 1hr |
|
||||
| P1 | CQ-WEB-4 | useChat stale messages | 1hr |
|
||||
| P1 | CQ-ORCH-5 | Atomic state transitions | 2hr |
|
||||
| P2 | CQ-WEB-7 | Kanban optimistic rollback | 1hr |
|
||||
| P2 | CQ-ORCH-2 | Single source of truth | 2hr |
|
||||
| P2 | CQ-ORCH-4 | AbortController cleanup | 30min |
|
||||
| P2 | CQ-API-4 | Redis listener cleanup | 30min |
|
||||
| P3 | CQ-WEB-8 | React.memo adoption | 2hr |
|
||||
| P3 | CQ-WEB-11 | Accessibility labels | 1hr |
|
||||
| P3 | Remaining | Lower priority items | 3hr |
|
||||
|
||||
**Estimated total remediation effort: 2-3 days**
|
||||
230
docs/reports/codebase-review-2026-02-05/03-qa-test-coverage.md
Normal file
230
docs/reports/codebase-review-2026-02-05/03-qa-test-coverage.md
Normal file
@@ -0,0 +1,230 @@
|
||||
# Mosaic Stack - QA & Test Coverage Report
|
||||
|
||||
**Date:** 2026-02-05
|
||||
**Scope:** All workspaces (api, web, orchestrator, coordinator, packages)
|
||||
**Total Test Files:** 552 | **Total Test Cases:** ~3,685
|
||||
|
||||
---
|
||||
|
||||
## Overall Test Health
|
||||
|
||||
| Workspace | Tests | Files | Coverage | Grade | Key Issue |
|
||||
| ----------------- | ------ | ----- | --------------------- | ------ | ------------------------------------- |
|
||||
| apps/orchestrator | ~452 | 19 | 85% enforced | **A** | Near-complete, well-structured |
|
||||
| apps/api | ~2,174 | 143 | Not enforced | **B-** | 21 untested services, weak assertions |
|
||||
| apps/web | ~555 | 51 | 85% on components/lib | **C+** | 76 untested components, 23 skipped |
|
||||
| apps/coordinator | ~504 | 23 | **16% reported** | **D** | Coverage crisis despite test files |
|
||||
| packages/shared | ~25 | 1 | N/A | **B+** | Adequate for scope |
|
||||
| packages/ui | ~15 | 1 | N/A | **D+** | 9 of 10 components untested |
|
||||
|
||||
---
|
||||
|
||||
## Critical Coverage Gaps
|
||||
|
||||
### GAP-1: Coordinator 16% Line Coverage [CRITICAL - Priority 10/10]
|
||||
|
||||
Despite having 23 test files and ~504 test cases, the coordinator reports only 16% line coverage with 14 of 22 source files at 0% execution. Files at 0% include the core `coordinator.py`, `queue.py`, `webhook.py`, `security.py`, `parser.py`, and `metrics.py`.
|
||||
|
||||
**Root Cause (likely):** Tests import types/models but mock everything, so actual source code never executes; or coverage run only executes a subset of tests.
|
||||
|
||||
**Action:** Run `cd apps/coordinator && python -m pytest tests/ -v --cov=src --cov-report=term-missing` and diagnose.
|
||||
|
||||
### GAP-2: knowledge.service.ts - 916 Lines, No Tests [CRITICAL - Priority 9/10]
|
||||
|
||||
The largest service file in the API has no direct unit tests. Core CRUD operations, pagination, filtering, slug generation, cache invalidation, and embedding queue integration are all untested. Only version-specific tests exist.
|
||||
|
||||
**Regressions at risk:** Pagination off-by-one, slug collision handling, stale cache after updates, embedding queue not triggered.
|
||||
|
||||
### GAP-3: admin.guard.ts - Security Guard, No Tests [CRITICAL - Priority 9/10]
|
||||
|
||||
This guard determines system admin access by checking workspace ownership. No tests verify it correctly grants/denies admin access.
|
||||
|
||||
**Regressions at risk:** Non-admin users gaining admin access, valid admins locked out, missing ForbiddenException.
|
||||
|
||||
### GAP-4: embeddings.service.ts - 249 Lines, Raw SQL, No Tests [CRITICAL - Priority 9/10]
|
||||
|
||||
Uses raw SQL for pgvector operations. No tests exist for embedding validation, vector SQL construction, or similarity search.
|
||||
|
||||
**Regressions at risk:** SQL injection through embedding data, invalid vector dimensions, wrong search results.
|
||||
|
||||
### GAP-5: widget-data.service.ts - 695 Lines, No Tests [HIGH - Priority 8/10]
|
||||
|
||||
Second-largest untested file. Fetches data from multiple sources for dashboard widgets.
|
||||
|
||||
### GAP-6: ideas.service.ts - 321 Lines, No Tests [HIGH - Priority 8/10]
|
||||
|
||||
User-facing CRUD feature with domain/project associations and activity logging.
|
||||
|
||||
---
|
||||
|
||||
## Untested Files by Workspace
|
||||
|
||||
### apps/api - 21 Untested Service/Controller Files
|
||||
|
||||
| File | Lines | Risk |
|
||||
| --------------------------------------------- | ----- | -------- |
|
||||
| knowledge/knowledge.service.ts | 916 | HIGH |
|
||||
| widgets/widget-data.service.ts | 695 | HIGH |
|
||||
| ideas/ideas.service.ts | 321 | HIGH |
|
||||
| database/embeddings.service.ts | 249 | HIGH |
|
||||
| ideas/ideas.controller.ts | 123 | MEDIUM |
|
||||
| widgets/widgets.controller.ts | 129 | MEDIUM |
|
||||
| widgets/widgets.service.ts | 59 | MEDIUM |
|
||||
| users/preferences.service.ts | 99 | MEDIUM |
|
||||
| users/preferences.controller.ts | 56 | MEDIUM |
|
||||
| common/throttler/throttler-storage.service.ts | 80+ | MEDIUM |
|
||||
| auth/guards/admin.guard.ts | 46 | SECURITY |
|
||||
| federation/audit.service.ts | 80+ | LOW |
|
||||
| common/throttler/throttler-api-key.guard.ts | - | MEDIUM |
|
||||
| knowledge/import-export.controller.ts | - | MEDIUM |
|
||||
| knowledge/knowledge.controller.ts | - | MEDIUM |
|
||||
| knowledge/stats.controller.ts | - | LOW |
|
||||
| knowledge/queues/embedding-queue.service.ts | - | MEDIUM |
|
||||
| layouts/layouts.controller.ts | - | LOW |
|
||||
| cron/cron.controller.ts | - | LOW |
|
||||
| bridge/parser/command-parser.service.ts | - | MEDIUM |
|
||||
| app.service.ts | - | LOW |
|
||||
|
||||
Additionally, 22 DTO directories lack validation tests.
|
||||
|
||||
### apps/web - 76 Untested Component/Page Files
|
||||
|
||||
**Critical pages (user-facing routes):**
|
||||
|
||||
- Main dashboard page.tsx
|
||||
- Calendar page
|
||||
- Knowledge page + 5 sub-pages
|
||||
- Federation connections + 2 sub-pages
|
||||
- Settings (4 sub-pages)
|
||||
|
||||
**Critical components:**
|
||||
|
||||
- Chat system: Chat.tsx, ChatInput.tsx, MessageList.tsx, ConversationSidebar.tsx, BackendStatusBanner.tsx
|
||||
- Dashboard widgets: DomainOverview, QuickCapture, RecentTasks, UpcomingEvents
|
||||
- HUD system: HUD.tsx, WidgetGrid.tsx, WidgetRenderer.tsx, WidgetWrapper.tsx
|
||||
- Knowledge: EntryCard, EntryList, EntryViewer, EntryFilters, VersionHistory, ImportExportActions, StatsDashboard
|
||||
- Navigation.tsx
|
||||
- Workspace: WorkspaceCard, WorkspaceSettings, MemberList, InviteMember
|
||||
- Team: TeamCard, TeamMemberList, TeamSettings
|
||||
|
||||
**Untested API client modules (11 files):**
|
||||
|
||||
- chat.ts, domains.ts, events.ts, federation.ts, ideas.ts, knowledge.ts, personalities.ts, teams.ts, api.ts, auth-client.ts
|
||||
|
||||
**Untested hooks:** useChat.ts, useLayout.ts
|
||||
|
||||
### apps/orchestrator - 1 Untested File
|
||||
|
||||
- health/health.service.ts (minimal risk)
|
||||
|
||||
### packages/ui - 9 Untested Components
|
||||
|
||||
- Avatar, Badge, Card, Input, Modal, Select, Textarea, Toast (only Button tested)
|
||||
|
||||
---
|
||||
|
||||
## 23 Skipped Tests (apps/web)
|
||||
|
||||
| File | Count | Reason |
|
||||
| --------------------------- | ----- | -------------------------------------------------------- |
|
||||
| CalendarWidget.test.tsx | 5 | Component migrated from setTimeout mock data to real API |
|
||||
| TasksWidget.test.tsx | 6 | Same - setTimeout mock data mismatch |
|
||||
| QuickCaptureWidget.test.tsx | 3 | Submit and keyboard shortcut tests |
|
||||
| LinkAutocomplete.test.tsx | 9 | Debounce search, keyboard nav, link insertion, dropdown |
|
||||
|
||||
**Action:** Re-enable and update tests to match current component implementations.
|
||||
|
||||
---
|
||||
|
||||
## Test Anti-Patterns Found
|
||||
|
||||
### Placeholder Assertions (expect(true).toBe(true))
|
||||
|
||||
| File | Line | Context |
|
||||
| ----------------------------------- | -------- | ----------------------- |
|
||||
| ChatOverlay.test.tsx | 259, 267 | Responsive design tests |
|
||||
| rejection-handler.service.spec.ts | 307 | Notification sending |
|
||||
| semantic-search.integration.spec.ts | 122 | Conditional branch |
|
||||
|
||||
**Impact:** Tests always pass, provide zero regression protection.
|
||||
|
||||
### Sole toBeDefined() Assertions (30+ instances)
|
||||
|
||||
Most concerning in:
|
||||
|
||||
- `llm-telemetry.decorator.spec.ts` -- 6 tests verify decorator doesn't throw but never check span attributes
|
||||
- `federation/query.service.spec.ts` -- 8 tests
|
||||
- `federation/query.controller.spec.ts` -- 3 tests
|
||||
- `layouts.service.spec.ts` -- 2 tests
|
||||
- `workspace-settings.service.spec.ts` -- 1 test
|
||||
|
||||
**Impact:** Tests verify existence but not correctness. Regressions slip through.
|
||||
|
||||
### Testing Implementation Details Instead of Behavior
|
||||
|
||||
- `cors.spec.ts` -- Tests CORS by asserting on JS objects, not actual HTTP headers/middleware
|
||||
- `Button.test.tsx` -- Asserts on CSS class names (`bg-blue-600`) instead of behavior
|
||||
|
||||
**Impact:** Tests break on implementation changes even when behavior is correct.
|
||||
|
||||
### Potential Flaky Patterns
|
||||
|
||||
setTimeout-based timing in 5 test files:
|
||||
|
||||
- `runner-jobs.service.spec.ts:620,833`
|
||||
- `semantic-search.integration.spec.ts:153`
|
||||
- `mcp/stdio-transport.spec.ts` (6 instances)
|
||||
- `coordinator-integration.service.concurrency.spec.ts:170`
|
||||
- `health.controller.spec.ts:63` (1100ms wait)
|
||||
|
||||
---
|
||||
|
||||
## Missing Test Categories
|
||||
|
||||
### No Playwright E2E Tests
|
||||
|
||||
The project documents Playwright as the E2E framework but no playwright.config.ts or E2E test files exist.
|
||||
|
||||
### No DTO Validation Tests
|
||||
|
||||
22 DTO directories lack validation testing. DTOs define input validation rules via class-validator decorators, but these are never tested in isolation.
|
||||
|
||||
### Limited Integration Tests
|
||||
|
||||
Only 8 integration test files exist across the entire codebase. Most module interactions are untested.
|
||||
|
||||
---
|
||||
|
||||
## Recommended Test Additions (Priority Order)
|
||||
|
||||
| Priority | Item | Effort | Impact |
|
||||
| -------- | ------------------------------------ | ------ | -------------------------------- |
|
||||
| P0 | Investigate coordinator 16% coverage | 2hr | Unblocks all coordinator testing |
|
||||
| P0 | knowledge.service.ts unit tests | 4hr | Covers largest untested service |
|
||||
| P0 | admin.guard.ts unit tests | 1hr | Security-critical |
|
||||
| P0 | embeddings.service.ts unit tests | 2hr | Raw SQL validation |
|
||||
| P1 | widget-data.service.ts unit tests | 3hr | Dashboard reliability |
|
||||
| P1 | ideas.service.ts unit tests | 2hr | User-facing CRUD |
|
||||
| P1 | Re-enable 23 skipped widget tests | 2hr | Immediate coverage gain |
|
||||
| P1 | Replace placeholder assertions | 1hr | Fix false-positive tests |
|
||||
| P2 | Chat system component tests | 3hr | Core user interaction |
|
||||
| P2 | API client module tests (11 files) | 3hr | Request/response validation |
|
||||
| P2 | Throttler storage tests | 2hr | Security infrastructure |
|
||||
| P2 | Preferences service tests | 1hr | User settings |
|
||||
| P3 | Strengthen toBeDefined-only tests | 2hr | Better regression detection |
|
||||
| P3 | UI package component tests | 3hr | Design system reliability |
|
||||
| P3 | Playwright E2E setup + smoke tests | 4hr | End-to-end confidence |
|
||||
|
||||
**Estimated total effort: ~5-6 days for P0+P1 items**
|
||||
|
||||
---
|
||||
|
||||
## Positive Test Observations
|
||||
|
||||
1. **Orchestrator is exemplary** -- 452 tests, near-complete coverage, behavioral testing, good mocking
|
||||
2. **Federation security tests are thorough** -- Crypto, signature, timeout, workspace access, capability guard
|
||||
3. **API client test (web) is comprehensive** -- 721 lines covering error handling, retries, auth
|
||||
4. **Sanitization utilities well-tested** -- XSS prevention, log sanitization, query builder
|
||||
5. **Coverage thresholds enforced** -- 85% on orchestrator and web components/lib
|
||||
6. **Concurrency tests exist** -- coordinator-integration and runner-jobs
|
||||
7. **Good test infrastructure** -- Shared fixtures, proper NestJS testing module usage
|
||||
@@ -0,0 +1,20 @@
|
||||
# QA Remediation Report
|
||||
|
||||
**File:** /home/localadmin/src/mosaic-stack/apps/orchestrator/src/app.module.ts
|
||||
**Tool Used:** Edit
|
||||
**Epic:** general
|
||||
**Iteration:** 1
|
||||
**Generated:** 2026-02-05 13:13:22
|
||||
|
||||
## Status
|
||||
|
||||
Pending QA validation
|
||||
|
||||
## Next Steps
|
||||
|
||||
This report was created by the QA automation hook.
|
||||
To process this report, run:
|
||||
|
||||
```bash
|
||||
claude -p "Use Task tool to launch universal-qa-agent for report: /home/localadmin/src/mosaic-stack/docs/reports/qa-automation/pending/home-localadmin-src-mosaic-stack-apps-orchestrator-src-app.module.ts_20260205-1313_1_remediation_needed.md"
|
||||
```
|
||||
@@ -0,0 +1,20 @@
|
||||
# QA Remediation Report
|
||||
|
||||
**File:** /home/localadmin/src/mosaic-stack/apps/orchestrator/src/app.module.ts
|
||||
**Tool Used:** Edit
|
||||
**Epic:** general
|
||||
**Iteration:** 2
|
||||
**Generated:** 2026-02-05 13:13:26
|
||||
|
||||
## Status
|
||||
|
||||
Pending QA validation
|
||||
|
||||
## Next Steps
|
||||
|
||||
This report was created by the QA automation hook.
|
||||
To process this report, run:
|
||||
|
||||
```bash
|
||||
claude -p "Use Task tool to launch universal-qa-agent for report: /home/localadmin/src/mosaic-stack/docs/reports/qa-automation/pending/home-localadmin-src-mosaic-stack-apps-orchestrator-src-app.module.ts_20260205-1313_2_remediation_needed.md"
|
||||
```
|
||||
@@ -0,0 +1,20 @@
|
||||
# QA Remediation Report
|
||||
|
||||
**File:** /home/localadmin/src/mosaic-stack/apps/orchestrator/src/budget/budget.module.ts
|
||||
**Tool Used:** Write
|
||||
**Epic:** general
|
||||
**Iteration:** 1
|
||||
**Generated:** 2026-02-05 12:59:26
|
||||
|
||||
## Status
|
||||
|
||||
Pending QA validation
|
||||
|
||||
## Next Steps
|
||||
|
||||
This report was created by the QA automation hook.
|
||||
To process this report, run:
|
||||
|
||||
```bash
|
||||
claude -p "Use Task tool to launch universal-qa-agent for report: /home/localadmin/src/mosaic-stack/docs/reports/qa-automation/pending/home-localadmin-src-mosaic-stack-apps-orchestrator-src-budget-budget.module.ts_20260205-1259_1_remediation_needed.md"
|
||||
```
|
||||
@@ -0,0 +1,20 @@
|
||||
# QA Remediation Report
|
||||
|
||||
**File:** /home/localadmin/src/mosaic-stack/apps/orchestrator/src/budget/budget.service.spec.ts
|
||||
**Tool Used:** Write
|
||||
**Epic:** general
|
||||
**Iteration:** 1
|
||||
**Generated:** 2026-02-05 12:59:58
|
||||
|
||||
## Status
|
||||
|
||||
Pending QA validation
|
||||
|
||||
## Next Steps
|
||||
|
||||
This report was created by the QA automation hook.
|
||||
To process this report, run:
|
||||
|
||||
```bash
|
||||
claude -p "Use Task tool to launch universal-qa-agent for report: /home/localadmin/src/mosaic-stack/docs/reports/qa-automation/pending/home-localadmin-src-mosaic-stack-apps-orchestrator-src-budget-budget.service.spec.ts_20260205-1259_1_remediation_needed.md"
|
||||
```
|
||||
@@ -0,0 +1,20 @@
|
||||
# QA Remediation Report
|
||||
|
||||
**File:** /home/localadmin/src/mosaic-stack/apps/orchestrator/src/budget/budget.service.spec.ts
|
||||
**Tool Used:** Write
|
||||
**Epic:** general
|
||||
**Iteration:** 1
|
||||
**Generated:** 2026-02-05 13:14:13
|
||||
|
||||
## Status
|
||||
|
||||
Pending QA validation
|
||||
|
||||
## Next Steps
|
||||
|
||||
This report was created by the QA automation hook.
|
||||
To process this report, run:
|
||||
|
||||
```bash
|
||||
claude -p "Use Task tool to launch universal-qa-agent for report: /home/localadmin/src/mosaic-stack/docs/reports/qa-automation/pending/home-localadmin-src-mosaic-stack-apps-orchestrator-src-budget-budget.service.spec.ts_20260205-1314_1_remediation_needed.md"
|
||||
```
|
||||
@@ -0,0 +1,20 @@
|
||||
# QA Remediation Report
|
||||
|
||||
**File:** /home/localadmin/src/mosaic-stack/apps/orchestrator/src/budget/budget.service.ts
|
||||
**Tool Used:** Write
|
||||
**Epic:** general
|
||||
**Iteration:** 1
|
||||
**Generated:** 2026-02-05 12:59:23
|
||||
|
||||
## Status
|
||||
|
||||
Pending QA validation
|
||||
|
||||
## Next Steps
|
||||
|
||||
This report was created by the QA automation hook.
|
||||
To process this report, run:
|
||||
|
||||
```bash
|
||||
claude -p "Use Task tool to launch universal-qa-agent for report: /home/localadmin/src/mosaic-stack/docs/reports/qa-automation/pending/home-localadmin-src-mosaic-stack-apps-orchestrator-src-budget-budget.service.ts_20260205-1259_1_remediation_needed.md"
|
||||
```
|
||||
@@ -0,0 +1,20 @@
|
||||
# QA Remediation Report
|
||||
|
||||
**File:** /home/localadmin/src/mosaic-stack/apps/orchestrator/src/budget/budget.service.ts
|
||||
**Tool Used:** Write
|
||||
**Epic:** general
|
||||
**Iteration:** 1
|
||||
**Generated:** 2026-02-05 13:13:17
|
||||
|
||||
## Status
|
||||
|
||||
Pending QA validation
|
||||
|
||||
## Next Steps
|
||||
|
||||
This report was created by the QA automation hook.
|
||||
To process this report, run:
|
||||
|
||||
```bash
|
||||
claude -p "Use Task tool to launch universal-qa-agent for report: /home/localadmin/src/mosaic-stack/docs/reports/qa-automation/pending/home-localadmin-src-mosaic-stack-apps-orchestrator-src-budget-budget.service.ts_20260205-1313_1_remediation_needed.md"
|
||||
```
|
||||
@@ -0,0 +1,20 @@
|
||||
# QA Remediation Report
|
||||
|
||||
**File:** /home/localadmin/src/mosaic-stack/apps/orchestrator/src/budget/budget.service.ts
|
||||
**Tool Used:** Edit
|
||||
**Epic:** general
|
||||
**Iteration:** 1
|
||||
**Generated:** 2026-02-05 13:15:21
|
||||
|
||||
## Status
|
||||
|
||||
Pending QA validation
|
||||
|
||||
## Next Steps
|
||||
|
||||
This report was created by the QA automation hook.
|
||||
To process this report, run:
|
||||
|
||||
```bash
|
||||
claude -p "Use Task tool to launch universal-qa-agent for report: /home/localadmin/src/mosaic-stack/docs/reports/qa-automation/pending/home-localadmin-src-mosaic-stack-apps-orchestrator-src-budget-budget.service.ts_20260205-1315_1_remediation_needed.md"
|
||||
```
|
||||
@@ -0,0 +1,20 @@
|
||||
# QA Remediation Report
|
||||
|
||||
**File:** /home/localadmin/src/mosaic-stack/apps/orchestrator/src/budget/budget.types.ts
|
||||
**Tool Used:** Write
|
||||
**Epic:** general
|
||||
**Iteration:** 1
|
||||
**Generated:** 2026-02-05 12:59:00
|
||||
|
||||
## Status
|
||||
|
||||
Pending QA validation
|
||||
|
||||
## Next Steps
|
||||
|
||||
This report was created by the QA automation hook.
|
||||
To process this report, run:
|
||||
|
||||
```bash
|
||||
claude -p "Use Task tool to launch universal-qa-agent for report: /home/localadmin/src/mosaic-stack/docs/reports/qa-automation/pending/home-localadmin-src-mosaic-stack-apps-orchestrator-src-budget-budget.types.ts_20260205-1259_1_remediation_needed.md"
|
||||
```
|
||||
@@ -0,0 +1,20 @@
|
||||
# QA Remediation Report
|
||||
|
||||
**File:** /home/localadmin/src/mosaic-stack/apps/orchestrator/src/budget/budget.types.ts
|
||||
**Tool Used:** Write
|
||||
**Epic:** general
|
||||
**Iteration:** 1
|
||||
**Generated:** 2026-02-05 13:12:40
|
||||
|
||||
## Status
|
||||
|
||||
Pending QA validation
|
||||
|
||||
## Next Steps
|
||||
|
||||
This report was created by the QA automation hook.
|
||||
To process this report, run:
|
||||
|
||||
```bash
|
||||
claude -p "Use Task tool to launch universal-qa-agent for report: /home/localadmin/src/mosaic-stack/docs/reports/qa-automation/pending/home-localadmin-src-mosaic-stack-apps-orchestrator-src-budget-budget.types.ts_20260205-1312_1_remediation_needed.md"
|
||||
```
|
||||
@@ -0,0 +1,20 @@
|
||||
# QA Remediation Report
|
||||
|
||||
**File:** /home/localadmin/src/mosaic-stack/apps/orchestrator/tests/integration/agent-lifecycle.e2e-spec.ts
|
||||
**Tool Used:** Write
|
||||
**Epic:** general
|
||||
**Iteration:** 1
|
||||
**Generated:** 2026-02-05 12:42:53
|
||||
|
||||
## Status
|
||||
|
||||
Pending QA validation
|
||||
|
||||
## Next Steps
|
||||
|
||||
This report was created by the QA automation hook.
|
||||
To process this report, run:
|
||||
|
||||
```bash
|
||||
claude -p "Use Task tool to launch universal-qa-agent for report: /home/localadmin/src/mosaic-stack/docs/reports/qa-automation/pending/home-localadmin-src-mosaic-stack-apps-orchestrator-tests-integration-agent-lifecycle.e2e-spec.ts_20260205-1242_1_remediation_needed.md"
|
||||
```
|
||||
@@ -0,0 +1,20 @@
|
||||
# QA Remediation Report
|
||||
|
||||
**File:** /home/localadmin/src/mosaic-stack/apps/orchestrator/tests/integration/agent-lifecycle.e2e-spec.ts
|
||||
**Tool Used:** Edit
|
||||
**Epic:** general
|
||||
**Iteration:** 1
|
||||
**Generated:** 2026-02-05 12:46:00
|
||||
|
||||
## Status
|
||||
|
||||
Pending QA validation
|
||||
|
||||
## Next Steps
|
||||
|
||||
This report was created by the QA automation hook.
|
||||
To process this report, run:
|
||||
|
||||
```bash
|
||||
claude -p "Use Task tool to launch universal-qa-agent for report: /home/localadmin/src/mosaic-stack/docs/reports/qa-automation/pending/home-localadmin-src-mosaic-stack-apps-orchestrator-tests-integration-agent-lifecycle.e2e-spec.ts_20260205-1246_1_remediation_needed.md"
|
||||
```
|
||||
@@ -0,0 +1,20 @@
|
||||
# QA Remediation Report
|
||||
|
||||
**File:** /home/localadmin/src/mosaic-stack/apps/orchestrator/tests/integration/agent-lifecycle.e2e-spec.ts
|
||||
**Tool Used:** Edit
|
||||
**Epic:** general
|
||||
**Iteration:** 1
|
||||
**Generated:** 2026-02-05 13:25:35
|
||||
|
||||
## Status
|
||||
|
||||
Pending QA validation
|
||||
|
||||
## Next Steps
|
||||
|
||||
This report was created by the QA automation hook.
|
||||
To process this report, run:
|
||||
|
||||
```bash
|
||||
claude -p "Use Task tool to launch universal-qa-agent for report: /home/localadmin/src/mosaic-stack/docs/reports/qa-automation/pending/home-localadmin-src-mosaic-stack-apps-orchestrator-tests-integration-agent-lifecycle.e2e-spec.ts_20260205-1325_1_remediation_needed.md"
|
||||
```
|
||||
@@ -0,0 +1,20 @@
|
||||
# QA Remediation Report
|
||||
|
||||
**File:** /home/localadmin/src/mosaic-stack/apps/orchestrator/tests/integration/agent-lifecycle.e2e-spec.ts
|
||||
**Tool Used:** Edit
|
||||
**Epic:** general
|
||||
**Iteration:** 2
|
||||
**Generated:** 2026-02-05 13:25:41
|
||||
|
||||
## Status
|
||||
|
||||
Pending QA validation
|
||||
|
||||
## Next Steps
|
||||
|
||||
This report was created by the QA automation hook.
|
||||
To process this report, run:
|
||||
|
||||
```bash
|
||||
claude -p "Use Task tool to launch universal-qa-agent for report: /home/localadmin/src/mosaic-stack/docs/reports/qa-automation/pending/home-localadmin-src-mosaic-stack-apps-orchestrator-tests-integration-agent-lifecycle.e2e-spec.ts_20260205-1325_2_remediation_needed.md"
|
||||
```
|
||||
@@ -0,0 +1,20 @@
|
||||
# QA Remediation Report
|
||||
|
||||
**File:** /home/localadmin/src/mosaic-stack/apps/orchestrator/tests/integration/agent-lifecycle.e2e-spec.ts
|
||||
**Tool Used:** Edit
|
||||
**Epic:** general
|
||||
**Iteration:** 3
|
||||
**Generated:** 2026-02-05 13:25:46
|
||||
|
||||
## Status
|
||||
|
||||
Pending QA validation
|
||||
|
||||
## Next Steps
|
||||
|
||||
This report was created by the QA automation hook.
|
||||
To process this report, run:
|
||||
|
||||
```bash
|
||||
claude -p "Use Task tool to launch universal-qa-agent for report: /home/localadmin/src/mosaic-stack/docs/reports/qa-automation/pending/home-localadmin-src-mosaic-stack-apps-orchestrator-tests-integration-agent-lifecycle.e2e-spec.ts_20260205-1325_3_remediation_needed.md"
|
||||
```
|
||||
@@ -0,0 +1,20 @@
|
||||
# QA Remediation Report
|
||||
|
||||
**File:** /home/localadmin/src/mosaic-stack/apps/orchestrator/tests/integration/concurrent-agents.e2e-spec.ts
|
||||
**Tool Used:** Write
|
||||
**Epic:** general
|
||||
**Iteration:** 1
|
||||
**Generated:** 2026-02-05 12:43:38
|
||||
|
||||
## Status
|
||||
|
||||
Pending QA validation
|
||||
|
||||
## Next Steps
|
||||
|
||||
This report was created by the QA automation hook.
|
||||
To process this report, run:
|
||||
|
||||
```bash
|
||||
claude -p "Use Task tool to launch universal-qa-agent for report: /home/localadmin/src/mosaic-stack/docs/reports/qa-automation/pending/home-localadmin-src-mosaic-stack-apps-orchestrator-tests-integration-concurrent-agents.e2e-spec.ts_20260205-1243_1_remediation_needed.md"
|
||||
```
|
||||
@@ -0,0 +1,20 @@
|
||||
# QA Remediation Report
|
||||
|
||||
**File:** /home/localadmin/src/mosaic-stack/apps/orchestrator/tests/integration/killswitch.e2e-spec.ts
|
||||
**Tool Used:** Write
|
||||
**Epic:** general
|
||||
**Iteration:** 1
|
||||
**Generated:** 2026-02-05 12:43:13
|
||||
|
||||
## Status
|
||||
|
||||
Pending QA validation
|
||||
|
||||
## Next Steps
|
||||
|
||||
This report was created by the QA automation hook.
|
||||
To process this report, run:
|
||||
|
||||
```bash
|
||||
claude -p "Use Task tool to launch universal-qa-agent for report: /home/localadmin/src/mosaic-stack/docs/reports/qa-automation/pending/home-localadmin-src-mosaic-stack-apps-orchestrator-tests-integration-killswitch.e2e-spec.ts_20260205-1243_1_remediation_needed.md"
|
||||
```
|
||||
@@ -0,0 +1,20 @@
|
||||
# QA Remediation Report
|
||||
|
||||
**File:** /home/localadmin/src/mosaic-stack/apps/orchestrator/tests/integration/killswitch.e2e-spec.ts
|
||||
**Tool Used:** Edit
|
||||
**Epic:** general
|
||||
**Iteration:** 1
|
||||
**Generated:** 2026-02-05 12:46:01
|
||||
|
||||
## Status
|
||||
|
||||
Pending QA validation
|
||||
|
||||
## Next Steps
|
||||
|
||||
This report was created by the QA automation hook.
|
||||
To process this report, run:
|
||||
|
||||
```bash
|
||||
claude -p "Use Task tool to launch universal-qa-agent for report: /home/localadmin/src/mosaic-stack/docs/reports/qa-automation/pending/home-localadmin-src-mosaic-stack-apps-orchestrator-tests-integration-killswitch.e2e-spec.ts_20260205-1246_1_remediation_needed.md"
|
||||
```
|
||||
@@ -0,0 +1,20 @@
|
||||
# QA Remediation Report
|
||||
|
||||
**File:** /home/localadmin/src/mosaic-stack/apps/orchestrator/tests/integration/killswitch.e2e-spec.ts
|
||||
**Tool Used:** Edit
|
||||
**Epic:** general
|
||||
**Iteration:** 1
|
||||
**Generated:** 2026-02-05 13:25:53
|
||||
|
||||
## Status
|
||||
|
||||
Pending QA validation
|
||||
|
||||
## Next Steps
|
||||
|
||||
This report was created by the QA automation hook.
|
||||
To process this report, run:
|
||||
|
||||
```bash
|
||||
claude -p "Use Task tool to launch universal-qa-agent for report: /home/localadmin/src/mosaic-stack/docs/reports/qa-automation/pending/home-localadmin-src-mosaic-stack-apps-orchestrator-tests-integration-killswitch.e2e-spec.ts_20260205-1325_1_remediation_needed.md"
|
||||
```
|
||||
@@ -0,0 +1,20 @@
|
||||
# QA Remediation Report
|
||||
|
||||
**File:** /home/localadmin/src/mosaic-stack/apps/orchestrator/tests/integration/killswitch.e2e-spec.ts
|
||||
**Tool Used:** Edit
|
||||
**Epic:** general
|
||||
**Iteration:** 1
|
||||
**Generated:** 2026-02-05 13:26:04
|
||||
|
||||
## Status
|
||||
|
||||
Pending QA validation
|
||||
|
||||
## Next Steps
|
||||
|
||||
This report was created by the QA automation hook.
|
||||
To process this report, run:
|
||||
|
||||
```bash
|
||||
claude -p "Use Task tool to launch universal-qa-agent for report: /home/localadmin/src/mosaic-stack/docs/reports/qa-automation/pending/home-localadmin-src-mosaic-stack-apps-orchestrator-tests-integration-killswitch.e2e-spec.ts_20260205-1326_1_remediation_needed.md"
|
||||
```
|
||||
@@ -0,0 +1,20 @@
|
||||
# QA Remediation Report
|
||||
|
||||
**File:** /home/localadmin/src/mosaic-stack/apps/orchestrator/tests/integration/vitest.config.ts
|
||||
**Tool Used:** Write
|
||||
**Epic:** general
|
||||
**Iteration:** 1
|
||||
**Generated:** 2026-02-05 12:42:21
|
||||
|
||||
## Status
|
||||
|
||||
Pending QA validation
|
||||
|
||||
## Next Steps
|
||||
|
||||
This report was created by the QA automation hook.
|
||||
To process this report, run:
|
||||
|
||||
```bash
|
||||
claude -p "Use Task tool to launch universal-qa-agent for report: /home/localadmin/src/mosaic-stack/docs/reports/qa-automation/pending/home-localadmin-src-mosaic-stack-apps-orchestrator-tests-integration-vitest.config.ts_20260205-1242_1_remediation_needed.md"
|
||||
```
|
||||
@@ -0,0 +1,20 @@
|
||||
# QA Remediation Report
|
||||
|
||||
**File:** /home/localadmin/src/mosaic-stack/apps/orchestrator/tests/performance/queue-throughput.perf-spec.ts
|
||||
**Tool Used:** Write
|
||||
**Epic:** general
|
||||
**Iteration:** 1
|
||||
**Generated:** 2026-02-05 12:51:25
|
||||
|
||||
## Status
|
||||
|
||||
Pending QA validation
|
||||
|
||||
## Next Steps
|
||||
|
||||
This report was created by the QA automation hook.
|
||||
To process this report, run:
|
||||
|
||||
```bash
|
||||
claude -p "Use Task tool to launch universal-qa-agent for report: /home/localadmin/src/mosaic-stack/docs/reports/qa-automation/pending/home-localadmin-src-mosaic-stack-apps-orchestrator-tests-performance-queue-throughput.perf-spec.ts_20260205-1251_1_remediation_needed.md"
|
||||
```
|
||||
@@ -0,0 +1,20 @@
|
||||
# QA Remediation Report
|
||||
|
||||
**File:** /home/localadmin/src/mosaic-stack/apps/orchestrator/tests/performance/queue-throughput.perf-spec.ts
|
||||
**Tool Used:** Edit
|
||||
**Epic:** general
|
||||
**Iteration:** 1
|
||||
**Generated:** 2026-02-05 12:52:09
|
||||
|
||||
## Status
|
||||
|
||||
Pending QA validation
|
||||
|
||||
## Next Steps
|
||||
|
||||
This report was created by the QA automation hook.
|
||||
To process this report, run:
|
||||
|
||||
```bash
|
||||
claude -p "Use Task tool to launch universal-qa-agent for report: /home/localadmin/src/mosaic-stack/docs/reports/qa-automation/pending/home-localadmin-src-mosaic-stack-apps-orchestrator-tests-performance-queue-throughput.perf-spec.ts_20260205-1252_1_remediation_needed.md"
|
||||
```
|
||||
@@ -0,0 +1,20 @@
|
||||
# QA Remediation Report
|
||||
|
||||
**File:** /home/localadmin/src/mosaic-stack/apps/orchestrator/tests/performance/queue-throughput.perf-spec.ts
|
||||
**Tool Used:** Write
|
||||
**Epic:** general
|
||||
**Iteration:** 1
|
||||
**Generated:** 2026-02-05 13:22:17
|
||||
|
||||
## Status
|
||||
|
||||
Pending QA validation
|
||||
|
||||
## Next Steps
|
||||
|
||||
This report was created by the QA automation hook.
|
||||
To process this report, run:
|
||||
|
||||
```bash
|
||||
claude -p "Use Task tool to launch universal-qa-agent for report: /home/localadmin/src/mosaic-stack/docs/reports/qa-automation/pending/home-localadmin-src-mosaic-stack-apps-orchestrator-tests-performance-queue-throughput.perf-spec.ts_20260205-1322_1_remediation_needed.md"
|
||||
```
|
||||
@@ -0,0 +1,20 @@
|
||||
# QA Remediation Report
|
||||
|
||||
**File:** /home/localadmin/src/mosaic-stack/apps/orchestrator/tests/performance/queue-throughput.perf-spec.ts
|
||||
**Tool Used:** Write
|
||||
**Epic:** general
|
||||
**Iteration:** 1
|
||||
**Generated:** 2026-02-05 13:23:01
|
||||
|
||||
## Status
|
||||
|
||||
Pending QA validation
|
||||
|
||||
## Next Steps
|
||||
|
||||
This report was created by the QA automation hook.
|
||||
To process this report, run:
|
||||
|
||||
```bash
|
||||
claude -p "Use Task tool to launch universal-qa-agent for report: /home/localadmin/src/mosaic-stack/docs/reports/qa-automation/pending/home-localadmin-src-mosaic-stack-apps-orchestrator-tests-performance-queue-throughput.perf-spec.ts_20260205-1323_1_remediation_needed.md"
|
||||
```
|
||||
@@ -0,0 +1,20 @@
|
||||
# QA Remediation Report
|
||||
|
||||
**File:** /home/localadmin/src/mosaic-stack/apps/orchestrator/tests/performance/secret-scanner-throughput.perf-spec.ts
|
||||
**Tool Used:** Write
|
||||
**Epic:** general
|
||||
**Iteration:** 1
|
||||
**Generated:** 2026-02-05 12:51:45
|
||||
|
||||
## Status
|
||||
|
||||
Pending QA validation
|
||||
|
||||
## Next Steps
|
||||
|
||||
This report was created by the QA automation hook.
|
||||
To process this report, run:
|
||||
|
||||
```bash
|
||||
claude -p "Use Task tool to launch universal-qa-agent for report: /home/localadmin/src/mosaic-stack/docs/reports/qa-automation/pending/home-localadmin-src-mosaic-stack-apps-orchestrator-tests-performance-secret-scanner-throughput.perf-spec.ts_20260205-1251_1_remediation_needed.md"
|
||||
```
|
||||
@@ -0,0 +1,20 @@
|
||||
# QA Remediation Report
|
||||
|
||||
**File:** /home/localadmin/src/mosaic-stack/apps/orchestrator/tests/performance/secret-scanner-throughput.perf-spec.ts
|
||||
**Tool Used:** Edit
|
||||
**Epic:** general
|
||||
**Iteration:** 1
|
||||
**Generated:** 2026-02-05 12:52:05
|
||||
|
||||
## Status
|
||||
|
||||
Pending QA validation
|
||||
|
||||
## Next Steps
|
||||
|
||||
This report was created by the QA automation hook.
|
||||
To process this report, run:
|
||||
|
||||
```bash
|
||||
claude -p "Use Task tool to launch universal-qa-agent for report: /home/localadmin/src/mosaic-stack/docs/reports/qa-automation/pending/home-localadmin-src-mosaic-stack-apps-orchestrator-tests-performance-secret-scanner-throughput.perf-spec.ts_20260205-1252_1_remediation_needed.md"
|
||||
```
|
||||
@@ -0,0 +1,20 @@
|
||||
# QA Remediation Report
|
||||
|
||||
**File:** /home/localadmin/src/mosaic-stack/apps/orchestrator/tests/performance/secret-scanner-throughput.perf-spec.ts
|
||||
**Tool Used:** Edit
|
||||
**Epic:** general
|
||||
**Iteration:** 1
|
||||
**Generated:** 2026-02-05 13:22:25
|
||||
|
||||
## Status
|
||||
|
||||
Pending QA validation
|
||||
|
||||
## Next Steps
|
||||
|
||||
This report was created by the QA automation hook.
|
||||
To process this report, run:
|
||||
|
||||
```bash
|
||||
claude -p "Use Task tool to launch universal-qa-agent for report: /home/localadmin/src/mosaic-stack/docs/reports/qa-automation/pending/home-localadmin-src-mosaic-stack-apps-orchestrator-tests-performance-secret-scanner-throughput.perf-spec.ts_20260205-1322_1_remediation_needed.md"
|
||||
```
|
||||
@@ -0,0 +1,20 @@
|
||||
# QA Remediation Report
|
||||
|
||||
**File:** /home/localadmin/src/mosaic-stack/apps/orchestrator/tests/performance/spawner-throughput.perf-spec.ts
|
||||
**Tool Used:** Write
|
||||
**Epic:** general
|
||||
**Iteration:** 1
|
||||
**Generated:** 2026-02-05 12:51:11
|
||||
|
||||
## Status
|
||||
|
||||
Pending QA validation
|
||||
|
||||
## Next Steps
|
||||
|
||||
This report was created by the QA automation hook.
|
||||
To process this report, run:
|
||||
|
||||
```bash
|
||||
claude -p "Use Task tool to launch universal-qa-agent for report: /home/localadmin/src/mosaic-stack/docs/reports/qa-automation/pending/home-localadmin-src-mosaic-stack-apps-orchestrator-tests-performance-spawner-throughput.perf-spec.ts_20260205-1251_1_remediation_needed.md"
|
||||
```
|
||||
@@ -0,0 +1,20 @@
|
||||
# QA Remediation Report
|
||||
|
||||
**File:** /home/localadmin/src/mosaic-stack/apps/orchestrator/tests/performance/spawner-throughput.perf-spec.ts
|
||||
**Tool Used:** Write
|
||||
**Epic:** general
|
||||
**Iteration:** 1
|
||||
**Generated:** 2026-02-05 13:21:57
|
||||
|
||||
## Status
|
||||
|
||||
Pending QA validation
|
||||
|
||||
## Next Steps
|
||||
|
||||
This report was created by the QA automation hook.
|
||||
To process this report, run:
|
||||
|
||||
```bash
|
||||
claude -p "Use Task tool to launch universal-qa-agent for report: /home/localadmin/src/mosaic-stack/docs/reports/qa-automation/pending/home-localadmin-src-mosaic-stack-apps-orchestrator-tests-performance-spawner-throughput.perf-spec.ts_20260205-1321_1_remediation_needed.md"
|
||||
```
|
||||
@@ -0,0 +1,20 @@
|
||||
# QA Remediation Report
|
||||
|
||||
**File:** /home/localadmin/src/mosaic-stack/apps/orchestrator/tests/performance/vitest.config.ts
|
||||
**Tool Used:** Write
|
||||
**Epic:** general
|
||||
**Iteration:** 1
|
||||
**Generated:** 2026-02-05 12:50:45
|
||||
|
||||
## Status
|
||||
|
||||
Pending QA validation
|
||||
|
||||
## Next Steps
|
||||
|
||||
This report was created by the QA automation hook.
|
||||
To process this report, run:
|
||||
|
||||
```bash
|
||||
claude -p "Use Task tool to launch universal-qa-agent for report: /home/localadmin/src/mosaic-stack/docs/reports/qa-automation/pending/home-localadmin-src-mosaic-stack-apps-orchestrator-tests-performance-vitest.config.ts_20260205-1250_1_remediation_needed.md"
|
||||
```
|
||||
@@ -0,0 +1,20 @@
|
||||
# QA Remediation Report
|
||||
|
||||
**File:** /home/localadmin/src/mosaic-stack/apps/web/src/components/widgets/TaskProgressWidget.tsx
|
||||
**Tool Used:** Write
|
||||
**Epic:** general
|
||||
**Iteration:** 1
|
||||
**Generated:** 2026-02-05 12:55:00
|
||||
|
||||
## Status
|
||||
|
||||
Pending QA validation
|
||||
|
||||
## Next Steps
|
||||
|
||||
This report was created by the QA automation hook.
|
||||
To process this report, run:
|
||||
|
||||
```bash
|
||||
claude -p "Use Task tool to launch universal-qa-agent for report: /home/localadmin/src/mosaic-stack/docs/reports/qa-automation/pending/home-localadmin-src-mosaic-stack-apps-web-src-components-widgets-TaskProgressWidget.tsx_20260205-1255_1_remediation_needed.md"
|
||||
```
|
||||
@@ -0,0 +1,20 @@
|
||||
# QA Remediation Report
|
||||
|
||||
**File:** /home/localadmin/src/mosaic-stack/apps/web/src/components/widgets/TaskProgressWidget.tsx
|
||||
**Tool Used:** Edit
|
||||
**Epic:** general
|
||||
**Iteration:** 1
|
||||
**Generated:** 2026-02-05 13:16:28
|
||||
|
||||
## Status
|
||||
|
||||
Pending QA validation
|
||||
|
||||
## Next Steps
|
||||
|
||||
This report was created by the QA automation hook.
|
||||
To process this report, run:
|
||||
|
||||
```bash
|
||||
claude -p "Use Task tool to launch universal-qa-agent for report: /home/localadmin/src/mosaic-stack/docs/reports/qa-automation/pending/home-localadmin-src-mosaic-stack-apps-web-src-components-widgets-TaskProgressWidget.tsx_20260205-1316_1_remediation_needed.md"
|
||||
```
|
||||
@@ -0,0 +1,20 @@
|
||||
# QA Remediation Report
|
||||
|
||||
**File:** /home/localadmin/src/mosaic-stack/apps/web/src/components/widgets/TaskProgressWidget.tsx
|
||||
**Tool Used:** Edit
|
||||
**Epic:** general
|
||||
**Iteration:** 2
|
||||
**Generated:** 2026-02-05 13:16:32
|
||||
|
||||
## Status
|
||||
|
||||
Pending QA validation
|
||||
|
||||
## Next Steps
|
||||
|
||||
This report was created by the QA automation hook.
|
||||
To process this report, run:
|
||||
|
||||
```bash
|
||||
claude -p "Use Task tool to launch universal-qa-agent for report: /home/localadmin/src/mosaic-stack/docs/reports/qa-automation/pending/home-localadmin-src-mosaic-stack-apps-web-src-components-widgets-TaskProgressWidget.tsx_20260205-1316_2_remediation_needed.md"
|
||||
```
|
||||
@@ -0,0 +1,20 @@
|
||||
# QA Remediation Report
|
||||
|
||||
**File:** /home/localadmin/src/mosaic-stack/apps/web/src/components/widgets/TaskProgressWidget.tsx
|
||||
**Tool Used:** Edit
|
||||
**Epic:** general
|
||||
**Iteration:** 3
|
||||
**Generated:** 2026-02-05 13:16:37
|
||||
|
||||
## Status
|
||||
|
||||
Pending QA validation
|
||||
|
||||
## Next Steps
|
||||
|
||||
This report was created by the QA automation hook.
|
||||
To process this report, run:
|
||||
|
||||
```bash
|
||||
claude -p "Use Task tool to launch universal-qa-agent for report: /home/localadmin/src/mosaic-stack/docs/reports/qa-automation/pending/home-localadmin-src-mosaic-stack-apps-web-src-components-widgets-TaskProgressWidget.tsx_20260205-1316_3_remediation_needed.md"
|
||||
```
|
||||
@@ -0,0 +1,20 @@
|
||||
# QA Remediation Report
|
||||
|
||||
**File:** /home/localadmin/src/mosaic-stack/apps/web/src/components/widgets/TaskProgressWidget.tsx
|
||||
**Tool Used:** Edit
|
||||
**Epic:** general
|
||||
**Iteration:** 4
|
||||
**Generated:** 2026-02-05 13:16:42
|
||||
|
||||
## Status
|
||||
|
||||
Pending QA validation
|
||||
|
||||
## Next Steps
|
||||
|
||||
This report was created by the QA automation hook.
|
||||
To process this report, run:
|
||||
|
||||
```bash
|
||||
claude -p "Use Task tool to launch universal-qa-agent for report: /home/localadmin/src/mosaic-stack/docs/reports/qa-automation/pending/home-localadmin-src-mosaic-stack-apps-web-src-components-widgets-TaskProgressWidget.tsx_20260205-1316_4_remediation_needed.md"
|
||||
```
|
||||
@@ -0,0 +1,20 @@
|
||||
# QA Remediation Report
|
||||
|
||||
**File:** /home/localadmin/src/mosaic-stack/apps/web/src/components/widgets/TaskProgressWidget.tsx
|
||||
**Tool Used:** Edit
|
||||
**Epic:** general
|
||||
**Iteration:** 5
|
||||
**Generated:** 2026-02-05 13:16:47
|
||||
|
||||
## Status
|
||||
|
||||
Pending QA validation
|
||||
|
||||
## Next Steps
|
||||
|
||||
This report was created by the QA automation hook.
|
||||
To process this report, run:
|
||||
|
||||
```bash
|
||||
claude -p "Use Task tool to launch universal-qa-agent for report: /home/localadmin/src/mosaic-stack/docs/reports/qa-automation/pending/home-localadmin-src-mosaic-stack-apps-web-src-components-widgets-TaskProgressWidget.tsx_20260205-1316_5_remediation_needed.md"
|
||||
```
|
||||
@@ -0,0 +1,20 @@
|
||||
# QA Remediation Report
|
||||
|
||||
**File:** /home/localadmin/src/mosaic-stack/apps/web/src/components/widgets/WidgetRegistry.tsx
|
||||
**Tool Used:** Edit
|
||||
**Epic:** general
|
||||
**Iteration:** 1
|
||||
**Generated:** 2026-02-05 12:55:04
|
||||
|
||||
## Status
|
||||
|
||||
Pending QA validation
|
||||
|
||||
## Next Steps
|
||||
|
||||
This report was created by the QA automation hook.
|
||||
To process this report, run:
|
||||
|
||||
```bash
|
||||
claude -p "Use Task tool to launch universal-qa-agent for report: /home/localadmin/src/mosaic-stack/docs/reports/qa-automation/pending/home-localadmin-src-mosaic-stack-apps-web-src-components-widgets-WidgetRegistry.tsx_20260205-1255_1_remediation_needed.md"
|
||||
```
|
||||
@@ -0,0 +1,20 @@
|
||||
# QA Remediation Report
|
||||
|
||||
**File:** /home/localadmin/src/mosaic-stack/apps/web/src/components/widgets/WidgetRegistry.tsx
|
||||
**Tool Used:** Edit
|
||||
**Epic:** general
|
||||
**Iteration:** 2
|
||||
**Generated:** 2026-02-05 12:55:10
|
||||
|
||||
## Status
|
||||
|
||||
Pending QA validation
|
||||
|
||||
## Next Steps
|
||||
|
||||
This report was created by the QA automation hook.
|
||||
To process this report, run:
|
||||
|
||||
```bash
|
||||
claude -p "Use Task tool to launch universal-qa-agent for report: /home/localadmin/src/mosaic-stack/docs/reports/qa-automation/pending/home-localadmin-src-mosaic-stack-apps-web-src-components-widgets-WidgetRegistry.tsx_20260205-1255_2_remediation_needed.md"
|
||||
```
|
||||
@@ -0,0 +1,20 @@
|
||||
# QA Remediation Report
|
||||
|
||||
**File:** /home/localadmin/src/mosaic-stack/apps/web/src/components/widgets/**tests**/TaskProgressWidget.test.tsx
|
||||
**Tool Used:** Write
|
||||
**Epic:** general
|
||||
**Iteration:** 1
|
||||
**Generated:** 2026-02-05 12:55:35
|
||||
|
||||
## Status
|
||||
|
||||
Pending QA validation
|
||||
|
||||
## Next Steps
|
||||
|
||||
This report was created by the QA automation hook.
|
||||
To process this report, run:
|
||||
|
||||
```bash
|
||||
claude -p "Use Task tool to launch universal-qa-agent for report: /home/localadmin/src/mosaic-stack/docs/reports/qa-automation/pending/home-localadmin-src-mosaic-stack-apps-web-src-components-widgets-__tests__-TaskProgressWidget.test.tsx_20260205-1255_1_remediation_needed.md"
|
||||
```
|
||||
@@ -0,0 +1,20 @@
|
||||
# QA Remediation Report
|
||||
|
||||
**File:** /home/localadmin/src/mosaic-stack/apps/web/src/components/widgets/**tests**/TaskProgressWidget.test.tsx
|
||||
**Tool Used:** Edit
|
||||
**Epic:** general
|
||||
**Iteration:** 1
|
||||
**Generated:** 2026-02-05 12:57:05
|
||||
|
||||
## Status
|
||||
|
||||
Pending QA validation
|
||||
|
||||
## Next Steps
|
||||
|
||||
This report was created by the QA automation hook.
|
||||
To process this report, run:
|
||||
|
||||
```bash
|
||||
claude -p "Use Task tool to launch universal-qa-agent for report: /home/localadmin/src/mosaic-stack/docs/reports/qa-automation/pending/home-localadmin-src-mosaic-stack-apps-web-src-components-widgets-__tests__-TaskProgressWidget.test.tsx_20260205-1257_1_remediation_needed.md"
|
||||
```
|
||||
@@ -0,0 +1,20 @@
|
||||
# QA Remediation Report
|
||||
|
||||
**File:** /home/localadmin/src/mosaic-stack/apps/web/src/components/widgets/**tests**/TaskProgressWidget.test.tsx
|
||||
**Tool Used:** Edit
|
||||
**Epic:** general
|
||||
**Iteration:** 1
|
||||
**Generated:** 2026-02-05 13:16:58
|
||||
|
||||
## Status
|
||||
|
||||
Pending QA validation
|
||||
|
||||
## Next Steps
|
||||
|
||||
This report was created by the QA automation hook.
|
||||
To process this report, run:
|
||||
|
||||
```bash
|
||||
claude -p "Use Task tool to launch universal-qa-agent for report: /home/localadmin/src/mosaic-stack/docs/reports/qa-automation/pending/home-localadmin-src-mosaic-stack-apps-web-src-components-widgets-__tests__-TaskProgressWidget.test.tsx_20260205-1316_1_remediation_needed.md"
|
||||
```
|
||||
@@ -0,0 +1,20 @@
|
||||
# QA Remediation Report
|
||||
|
||||
**File:** /home/localadmin/src/mosaic-stack/apps/web/src/components/widgets/**tests**/TaskProgressWidget.test.tsx
|
||||
**Tool Used:** Edit
|
||||
**Epic:** general
|
||||
**Iteration:** 1
|
||||
**Generated:** 2026-02-05 13:17:03
|
||||
|
||||
## Status
|
||||
|
||||
Pending QA validation
|
||||
|
||||
## Next Steps
|
||||
|
||||
This report was created by the QA automation hook.
|
||||
To process this report, run:
|
||||
|
||||
```bash
|
||||
claude -p "Use Task tool to launch universal-qa-agent for report: /home/localadmin/src/mosaic-stack/docs/reports/qa-automation/pending/home-localadmin-src-mosaic-stack-apps-web-src-components-widgets-__tests__-TaskProgressWidget.test.tsx_20260205-1317_1_remediation_needed.md"
|
||||
```
|
||||
@@ -0,0 +1,20 @@
|
||||
# QA Remediation Report
|
||||
|
||||
**File:** /home/localadmin/src/mosaic-stack/apps/web/src/components/widgets/**tests**/TaskProgressWidget.test.tsx
|
||||
**Tool Used:** Edit
|
||||
**Epic:** general
|
||||
**Iteration:** 2
|
||||
**Generated:** 2026-02-05 13:17:14
|
||||
|
||||
## Status
|
||||
|
||||
Pending QA validation
|
||||
|
||||
## Next Steps
|
||||
|
||||
This report was created by the QA automation hook.
|
||||
To process this report, run:
|
||||
|
||||
```bash
|
||||
claude -p "Use Task tool to launch universal-qa-agent for report: /home/localadmin/src/mosaic-stack/docs/reports/qa-automation/pending/home-localadmin-src-mosaic-stack-apps-web-src-components-widgets-__tests__-TaskProgressWidget.test.tsx_20260205-1317_2_remediation_needed.md"
|
||||
```
|
||||
@@ -0,0 +1,20 @@
|
||||
# QA Remediation Report
|
||||
|
||||
**File:** /home/localadmin/src/mosaic-stack/apps/web/src/components/widgets/**tests**/TaskProgressWidget.test.tsx
|
||||
**Tool Used:** Edit
|
||||
**Epic:** general
|
||||
**Iteration:** 1
|
||||
**Generated:** 2026-02-05 13:18:22
|
||||
|
||||
## Status
|
||||
|
||||
Pending QA validation
|
||||
|
||||
## Next Steps
|
||||
|
||||
This report was created by the QA automation hook.
|
||||
To process this report, run:
|
||||
|
||||
```bash
|
||||
claude -p "Use Task tool to launch universal-qa-agent for report: /home/localadmin/src/mosaic-stack/docs/reports/qa-automation/pending/home-localadmin-src-mosaic-stack-apps-web-src-components-widgets-__tests__-TaskProgressWidget.test.tsx_20260205-1318_1_remediation_needed.md"
|
||||
```
|
||||
@@ -0,0 +1,20 @@
|
||||
# QA Remediation Report
|
||||
|
||||
**File:** /home/localadmin/src/mosaic-stack/apps/web/src/components/widgets/**tests**/TaskProgressWidget.test.tsx
|
||||
**Tool Used:** Edit
|
||||
**Epic:** general
|
||||
**Iteration:** 1
|
||||
**Generated:** 2026-02-05 13:19:29
|
||||
|
||||
## Status
|
||||
|
||||
Pending QA validation
|
||||
|
||||
## Next Steps
|
||||
|
||||
This report was created by the QA automation hook.
|
||||
To process this report, run:
|
||||
|
||||
```bash
|
||||
claude -p "Use Task tool to launch universal-qa-agent for report: /home/localadmin/src/mosaic-stack/docs/reports/qa-automation/pending/home-localadmin-src-mosaic-stack-apps-web-src-components-widgets-__tests__-TaskProgressWidget.test.tsx_20260205-1319_1_remediation_needed.md"
|
||||
```
|
||||
@@ -0,0 +1,20 @@
|
||||
# QA Remediation Report
|
||||
|
||||
**File:** /home/localadmin/src/mosaic-stack/packages/shared/src/types/widget.types.ts
|
||||
**Tool Used:** Edit
|
||||
**Epic:** general
|
||||
**Iteration:** 1
|
||||
**Generated:** 2026-02-05 13:16:53
|
||||
|
||||
## Status
|
||||
|
||||
Pending QA validation
|
||||
|
||||
## Next Steps
|
||||
|
||||
This report was created by the QA automation hook.
|
||||
To process this report, run:
|
||||
|
||||
```bash
|
||||
claude -p "Use Task tool to launch universal-qa-agent for report: /home/localadmin/src/mosaic-stack/docs/reports/qa-automation/pending/home-localadmin-src-mosaic-stack-packages-shared-src-types-widget.types.ts_20260205-1316_1_remediation_needed.md"
|
||||
```
|
||||
@@ -1,32 +0,0 @@
|
||||
# Tasks
|
||||
|
||||
| id | status | description | issue | repo | branch | depends_on | blocks | agent | started_at | completed_at | estimate | used |
|
||||
| ----------- | ----------- | ----------------------------------------------------------------------------------------------------------------------- | ----- | ------------ | ------------------------ | --------------------------------------------------------------------------------------- | -------------------------------- | ----- | ---------- | ------------ | -------- | ---- |
|
||||
| MS-SEC-001 | not-started | SEC-ORCH-2: Add authentication to orchestrator API (spawn/kill/status endpoints) | | orchestrator | fix/security-remediation | | MS-SEC-002,MS-SEC-003,MS-SEC-004 | | | | 15K | |
|
||||
| MS-SEC-002 | not-started | SEC-WEB-2: Fix WikiLinkRenderer XSS - sanitize entire HTML with DOMPurify before wiki-link processing | | web | fix/security-remediation | MS-SEC-001 | MS-SEC-010 | | | | 10K | |
|
||||
| MS-SEC-003 | not-started | SEC-ORCH-1: Fix secret scanner error handling - return explicit error state instead of false | | orchestrator | fix/security-remediation | MS-SEC-001 | MS-SEC-010 | | | | 8K | |
|
||||
| MS-SEC-004 | not-started | SEC-API-2/3: Fix guards swallowing DB errors - let Prisma errors propagate as 500s | | api | fix/security-remediation | MS-SEC-001 | MS-SEC-010 | | | | 10K | |
|
||||
| MS-SEC-005 | not-started | SEC-API-1: Validate OIDC configuration at startup - fail fast if enabled but unconfigured | | api | fix/security-remediation | MS-SEC-004 | MS-SEC-010 | | | | 8K | |
|
||||
| MS-SEC-006 | not-started | SEC-ORCH-3: Enable Docker sandbox by default, log warning when disabled | | orchestrator | fix/security-remediation | MS-SEC-003 | MS-SEC-010 | | | | 8K | |
|
||||
| MS-SEC-007 | not-started | SEC-ORCH-4: Add inter-service authentication (orchestrator-coordinator API key) | | orchestrator | fix/security-remediation | MS-SEC-006 | MS-SEC-010 | | | | 15K | |
|
||||
| MS-SEC-008 | not-started | SEC-ORCH-5/CQ-ORCH-3: Replace KEYS with SCAN in Valkey client | | orchestrator | fix/security-remediation | MS-SEC-007 | MS-SEC-010 | | | | 12K | |
|
||||
| MS-SEC-009 | not-started | SEC-WEB-1: Sanitize OAuth callback parameters - validate error against allowlist | | web | fix/security-remediation | MS-SEC-002 | MS-SEC-010 | | | | 8K | |
|
||||
| MS-SEC-010 | not-started | Phase 1 verification: Run security tests, validate all critical fixes | | api | fix/security-remediation | MS-SEC-002,MS-SEC-003,MS-SEC-004,MS-SEC-005,MS-SEC-006,MS-SEC-007,MS-SEC-008,MS-SEC-009 | MS-HIGH-001 | | | | 10K | |
|
||||
| MS-HIGH-001 | not-started | SEC-WEB-3: Route all fetch() calls through API client for CSRF (ImportExportActions, KanbanBoard, ActiveProjectsWidget) | | web | fix/high-security | MS-SEC-010 | MS-HIGH-006 | | | | 15K | |
|
||||
| MS-HIGH-002 | not-started | SEC-WEB-4: Remove or gate mock data in production paths (federation, workspaces, teams pages) | | web | fix/high-security | MS-SEC-010 | MS-HIGH-006 | | | | 12K | |
|
||||
| MS-HIGH-003 | not-started | SEC-ORCH-11: Add rate limiting to orchestrator API with @nestjs/throttler | | orchestrator | fix/high-security | MS-SEC-010 | MS-HIGH-006 | | | | 10K | |
|
||||
| MS-HIGH-004 | not-started | SEC-ORCH-10: Add Docker container hardening (CapDrop ALL, ReadonlyRootfs, PidsLimit) | | orchestrator | fix/high-security | MS-SEC-010 | MS-HIGH-006 | | | | 12K | |
|
||||
| MS-HIGH-005 | not-started | SEC-ORCH-12: Add max concurrent agents enforcement with configurable limit | | orchestrator | fix/high-security | MS-SEC-010 | MS-HIGH-006 | | | | 10K | |
|
||||
| MS-HIGH-006 | not-started | Phase 2 verification: Run security tests, validate all high-priority fixes | | api | fix/high-security | MS-HIGH-001,MS-HIGH-002,MS-HIGH-003,MS-HIGH-004,MS-HIGH-005 | MS-CQ-001 | | | | 10K | |
|
||||
| MS-CQ-001 | not-started | CQ-API-1/2: Fix memory leaks - WebSocket timer, runner jobs interval | | api | fix/code-quality | MS-HIGH-006 | MS-CQ-007 | | | | 10K | |
|
||||
| MS-CQ-002 | not-started | CQ-ORCH-1: Fix session Map memory leak - cleanup on terminal states | | orchestrator | fix/code-quality | MS-HIGH-006 | MS-CQ-007 | | | | 12K | |
|
||||
| MS-CQ-003 | not-started | CQ-WEB-1/4: Fix stale closures in useWebSocket and useChat hooks | | web | fix/code-quality | MS-HIGH-006 | MS-CQ-007 | | | | 15K | |
|
||||
| MS-CQ-004 | not-started | CQ-WEB-5: Fix boolean logic bug in ReactFlowEditor (?? to \|\|) | | web | fix/code-quality | MS-HIGH-006 | MS-CQ-007 | | | | 5K | |
|
||||
| MS-CQ-005 | not-started | CQ-ORCH-5: Add atomic state transitions with Valkey Lua script | | orchestrator | fix/code-quality | MS-HIGH-006 | MS-CQ-007 | | | | 15K | |
|
||||
| MS-CQ-006 | not-started | CQ-ORCH-6: Fix N+1 queries with MGET batch retrieval | | orchestrator | fix/code-quality | MS-HIGH-006 | MS-CQ-007 | | | | 12K | |
|
||||
| MS-CQ-007 | not-started | Phase 3 verification: Run all tests, validate code quality fixes | | api | fix/code-quality | MS-CQ-001,MS-CQ-002,MS-CQ-003,MS-CQ-004,MS-CQ-005,MS-CQ-006 | MS-TEST-001 | | | | 10K | |
|
||||
| MS-TEST-001 | not-started | Add tests for knowledge.service.ts (916 lines, untested) | | api | fix/test-coverage | MS-CQ-007 | MS-TEST-005 | | | | 25K | |
|
||||
| MS-TEST-002 | not-started | Add tests for admin.guard.ts and embeddings.service.ts | | api | fix/test-coverage | MS-CQ-007 | MS-TEST-005 | | | | 15K | |
|
||||
| MS-TEST-003 | not-started | Re-enable 23 skipped widget tests in web | | web | fix/test-coverage | MS-CQ-007 | MS-TEST-005 | | | | 20K | |
|
||||
| MS-TEST-004 | not-started | Investigate coordinator 16% coverage - fix test configuration | | coordinator | fix/test-coverage | MS-CQ-007 | MS-TEST-005 | | | | 15K | |
|
||||
| MS-TEST-005 | not-started | Final verification: Full test suite, coverage report, quality gates pass | | api | fix/test-coverage | MS-TEST-001,MS-TEST-002,MS-TEST-003,MS-TEST-004 | | | | | 15K | |
|
||||
Reference in New Issue
Block a user