stack/docs/deferred-errors.md

Deferred Errors

Documented per Two-Phase Completion Protocol during Phase 3 Polish.

---

MS-MED-006: SEC-WEB-16 - Add Content Security Policy Headers

• File: apps/web/next.config.ts
• Error: No Content Security Policy (CSP) headers configured
• Category: Architectural
• Reason: CSP requires extensive configuration specific to the deployment environment. Inline scripts from Next.js, third-party integrations (Authentik, Ollama), WebSocket connections, and dynamic imports all need careful allowlisting. A misconfigured CSP breaks the application in production. This needs a dedicated effort with staging environment testing.
• Suggested approach:
  1. Audit all script sources, style sources, connect sources, and frame sources
  2. Start with CSP report-only mode to capture violations without blocking
  3. Add nonce-based script loading for Next.js inline scripts
  4. Configure per-environment CSP (dev permissive, prod strict)
  5. Add violation reporting endpoint
• Risk: Medium — Mitigated by other security controls (CSRF tokens, XSS sanitization, auth guards). CSP is defense-in-depth.

---

MS-MED-008: CQ-ORCH-2 - Use Valkey as Single Source of Truth for Sessions

• File: apps/orchestrator/src/spawner/agent-spawner.service.ts:19
• Error: In-memory Map used for sessions alongside Valkey, creating dual source of truth
• Category: Architectural
• Reason: Migrating from in-memory Map to Valkey-only requires: (1) redesigning the session access pattern to be async everywhere, (2) handling Valkey connection failures gracefully, (3) ensuring atomic read-modify-write for state transitions, (4) updating ~20 call sites that currently access the synchronous Map. The in-memory Map is bounded by CQ-ORCH-1 (session cleanup on terminal states), reducing the unbounded growth risk.
• Suggested approach:
  1. Add TTL-based expiry to Valkey session keys
  2. Implement read-through cache pattern: Map as cache, Valkey as source
  3. Add Valkey connection health check before spawn operations
  4. Migrate call sites incrementally with feature flag
• Risk: Low — Bounded by CQ-ORCH-1 cleanup. Single-instance deployment means no cross-instance consistency issue.