Repository navigation
tracking: implementation sequence for all 282 open issues — 29 umbrella tracks + 13 standalone domains #13483
Description
What this is
A sequence map of every one of the 282 open issues, derived from the issue data on 2026-08-04 — not a hand-curated wishlist. Every open issue appears exactly once, in a track, in an order.
How to read it
- PART 1 — umbrella tracks. 29 umbrellas/epics own 90 issues between them. Finish a track before starting another; a half-finished umbrella is worse than an untouched one.
- PART 2 — standalone tracks. The remaining issues have no umbrella. They are grouped by domain so one person works in one area, and ordered within the group.
<-blocked by #Nmarks a stated dependency. There are only 9 of these in the entire backlog.- Priority tag is the issue's own label:
P0>P1>P2>P3>--(unlabelled).
Where the order comes from — and its limits
Read this before trusting a position in the list.
- Stated blockers (9 edges). Topologically sorted. These are real and load-bearing.
- Priority label. Within a track, P0 before P1 before P2. 183 of 282 issues (64%) carry no priority label at all, so they sort last within their track — that is an artifact of missing metadata, not a judgement that the work is unimportant. Worse, the 99 that are labelled use 9 competing vocabularies for 4 levels (
priority: high/P1-high/high-priority/ …), so the sort has to normalise them. Tracked in chore(triage): backlog metadata is unusable for sequencing — 64% unprioritised, 9 competing priority vocabularies, 9 stated dependencies across 282 issues #13485. - Issue number as the final tiebreak (older first).
The honest caveat: 273 of 282 issues have no stated dependency. The ordering between them is derived from priority and domain, not from analysis of what actually blocks what. This map is a starting sequence, not a proven critical path. Treat PART 1 track order and the 9 blocker edges as reliable; treat fine-grained ordering inside a track as a default to override.
Where an issue carries its own ## Implementation order section, that section wins — it was written from reading the code. The #13467 track is currently the only one with per-issue ordering; its waves (#13470+#13469 together in WAVE 1, #13468 in WAVE 0) override the priority-sort shown below.
Domain grouping is heuristic — conventional-commit scope in the title, then title prefix, then keyword, then labels. Cross-cutting labels (testing, backend, frontend) are deliberately not treated as domains, because they appear on issues from every area.
Suggested track order
Umbrella tracks are listed in priority order (highest-priority child first, then blocker fan-out, then size). Two exceptions worth calling out:
- epic(kb): retrieval quality is unmeasurable — real benchmarks, span metrics, chunker comparison, evidence-based tuning #13251 (retrieval measurement) gates feat(mesh-brain): community_clusterer has no cohesion re-split or hub exclusion — bridging hubs get promoted to anchors #13472 and is a prerequisite for any retrieval tuning anywhere in the backlog. It outranks its label.
- umbrella(code-intelligence): extracted code structure is discarded — three parallel extractors, no persistent graph, 300-file cap behind repo-wide statistics #13467 WAVE 1 (bug(knowledge): CodeIndexer discards the call graph — target_name never resolved, edges flattened into a CSV metadata string #13469 + tech-debt(code-intelligence): four AST extractors share no resolver and no node identity — converge before adding consumers #13470) must land as one unit — see that umbrella.
Maintenance
This map is a snapshot. It goes stale as issues open and close. Regenerate rather than hand-edit; the derivation is: strip fenced blocks and checklist lines from bodies -> extract blocked by|depends on|requires|prerequisite -> topological sort within track -> priority -> number.
TRACKS: 42 ISSUES: 282 cross-issue blocker edges: 9
==============================================================================
PART 1 — UMBRELLA TRACKS (finish the umbrella, then move on)
==============================================================================
### U#13096 [--] Capability audit: LLC adapter layer + voice pipeline — confirmed gaps (9 children)
1. #13097 [P0] LLC adapters: agent cancel/timeout orphans the whole subprocess tree
2. #13098 [--] LLC adapters: no read-only sign-in probe before dispatch — signed-out agen
3. #13099 [--] LLC adapters: no stall or first-output watchdog — a hung run holds a slot
4. #13100 [--] LLC adapters: no version floor or compat assertion on any external agent C
5. #13101 [--] LLC adapters: commentary vs final answer is tag-based, so it cannot work f
6. #13102 [--] Voice: TTS text is not shaped for speech — markdown, file paths, URLs and
7. #13103 [--] Voice: first audio waits for a full terminated sentence — no sub-sentence
8. #13105 [--] Voice: end-of-turn is purely temporal — a mid-sentence pause commits the t
9. #13116 [--] LLC scheduler: only rate-limit failures have a recovery path — every other
### U#13467 [P1] umbrella(code-intelligence): extracted code structure is discarded — t (11 children)
1. #13469 [P1] bug(knowledge): CodeIndexer discards the call graph — target_name never re
2. #13468 [P1] bug(codebase-analytics): call-graph endpoint analyses 300 of 3,541 backend
3. #13470 [P1] tech-debt(code-intelligence): four AST extractors share no resolver and no
4. #13471 [P2] feat(knowledge): reverse-BFS impact analysis over the resolved code graph <-blocked by #13469
5. #13472 [P2] feat(mesh-brain): community_clusterer has no cohesion re-split or hub excl <-blocked by #13251
6. #13473 [P2] feat(mesh-brain): community ids are not stable across scheduled re-cluster
7. #13474 [P2] fix(memory-graph): PropertyGraph.shortest_path has no production caller —
8. #13475 [P2] feat(mcp): no code-structure tools on the MCP surface — 10 tools, none can
9. #13476 [P2] fix(codebase-analytics): orphaned-function detection is computed on every
10. #13482 [P2] decision(code-intelligence): four product-direction questions from the #13
11. #13477 [P3] chore(deps): verify datasketch/scipy import latency on Windows targets bef
### U#13227 [--] MCP tool governance: converge authorization, wire declared-but-unset l (8 children)
1. #13228 [P1] MCP tool calls bypass canonical RBAC — three parallel authorization models
2. #13414 [P1] security(mcp): approved tool schemas are cached but never re-verified — a <-blocked by #13421
3. #13229 [--] MCPBridgeManifest.resource_limits is declared and plumbed but set by no br
4. #13230 [--] MCP prompt layer incomplete — 8 of 11 bridges lack /mcp/prompts, picker co
5. #13231 [--] Uninstall runs no extension-authored cleanup — orphaned artifacts on plugi
6. #13232 [--] No role-scoped tool + prompt bundles (blocked on MCP authorization converg
7. #13240 [--] Hub-installed skill MCP tools are unreachable — list_tools/call_tool have
8. #13420 [--] security(agents): per-agent resource allow-lists are not deny-by-default a
### U#13030 [P1] umbrella(optimization): large-model inference on lean hardware is scaf (6 children)
1. #13031 [P1] bug(optimization): layer streaming loads the entire checkpoint per layer,
2. #13032 [P1] bug(optimization): LayerInferenceEngine cannot produce correct output — no
3. #13033 [P1] bug(optimization): KV trim_to_length retains the oldest window instead of
4. #13034 [P1] security(models): no revision pinning or weight integrity verification — 1
5. #13035 [P2] tech-debt(optimization): LayerInferenceAdapter never registered + duplicat
6. #13036 [P2] tech-debt(optimization): no end-to-end memory/correctness baseline for the
### U#12492 [P1] epic: enable AutoBot to reliably navigate the internet (KB web ingesti (5 children)
1. #12493 [--] kb/web: handle CAPTCHA/interactive anti-bot (detect + session-cookie/solve
2. #12494 [--] kb/web: authenticated & gated-site support (cookies/headers/browser-login)
3. #12495 [--] kb/web: extract non-HTML content (PDF/Office/feeds) instead of returning e
4. #12496 [--] kb/web: crawl coverage + transparency (sitemap.xml, depth/page-cap visibil
5. #12497 [--] kb/web: fetch reliability (proxy/egress, SSL surfacing, per-domain politen
### U#12756 [P1] epic: one canonical AutoBot browser — unify stacks + full agent-browse (3 children)
1. #12759 [P2] feat(browser): persistent browser profiles (storage_state) surviving resta
2. #12760 [P3] feat(browser): site audit + visual-diff surface (screenshot-diff, Core Web
3. #12761 [P3] arch(browser): multi-instance orchestration / pooling behind the canonical
### U#12551 [P1] Epic: Self-improving, backend-flexible memory (reinforcement/decay + s (2 children)
1. #12556 [--] C1: pgvector adapter implementing BaseClient/BaseCollection + parity tests
2. #12557 [--] C2: Wire pgvector into backend selection/config + extension migration (opt
### U#12262 [P1] Umbrella: reconcile all open security alerts (Dependabot + code scanni (1 children)
1. #12276 [P1] security(deps): patch protobufjs / @babel/core — 2 open Dependabot alert(s
### U#10603 [P1] [Umbrella] AutoBot Efficiency & Precision — wire built-but-disconnecte (1 children)
1. #10601 [P1] perf(runtime): async DB routers, pooled HTTP, OpenVINO CACHE_DIR, per-work
### U#11820 [P1] Umbrella: every service must be SLM-managed & updatable — postgres has (0 children)
### U#11506 [P1] Umbrella: agent-operated desktop sessions with safe human takeover (x1 (0 children)
### U#10805 [P1] Epic: build real enterprise-features subsystems (PRD-gated) — supersed (0 children)
### U#10088 [P1] Umbrella/PRD: unify AutoBot secrets — one RBAC-governed store, vaults (0 children)
### U#10016 [P1] Umbrella: SLM lifecycle completeness — Install/Backup/Update/Restore p (0 children)
### U#12630 [P2] Umbrella/PRD: System Lifecycle Observability — surface dark memory + p (6 children)
1. #12631 [P2] P1a — Node: GET /api/memory/lifecycle (reinforcement + dry-run prune previ
2. #12632 [P2] P1b — SLM: memory-lifecycle aggregator + MemoryLifecycleTab monitoring tab <-blocked by #12631
3. #12633 [P2] P2a — Node: expose LLM provider circuit-breaker states (GET /api/system/br
4. #12634 [P2] P2b — SLM: unified GET /api/system/lifecycle aggregate + SystemLifecycleTa <-blocked by #12631
5. #12635 [P2] P3 — Node: peak/maturity usage-velocity prune signal (flag OFF default)
6. #12637 [P3] tech-debt: relocate ProviderFallbackView/SystemHealthView from autobot-fro
### U#11536 [--] Umbrella: OpenManus research adoption — browser perception loop, budge (2 children)
1. #11542 [P2] feat(mcp): generic external MCP server client bridge — user-configured std
2. #11544 [P3] feat(browser): ergonomic actions — scroll_to_text, get_dropdown_options, m
### U#11277 [P2] Umbrella: scoped + shareable custom skills and custom agents (company- (0 children)
### U#11137 [P2] Institutional memory from externally-initiated coding-agent sessions ( (0 children)
### U#10860 [P2] Shared UI component kit (@autobot/ui): consistent elements across both (0 children)
### U#13413 [--] Umbrella: agent governance, measurement and approval-surface gaps from (7 children)
1. #13422 [--] ui(design-system): risk-tier styling re-implemented in three views — move
2. #13417 [--] feat(tools): agents get no tool-routing guidance — generate a routing bloc
3. #13418 [--] governance: no operator-facing disclosure of configured-but-inert controls
4. #13419 [--] docs: no aggregated known-gaps register — generate one from labelled issue
5. #13423 [--] ui(workflow): WorkflowRunner and WorkflowLiveDashboard duplicate run state
6. #13424 [--] ui(artifacts): run output media is never surfaced — extract artifacts from
7. #13425 [--] ui(workflow): the workflow builder has no guided tour — onboarding is one <-blocked by #13422
### U#13251 [--] epic(kb): retrieval quality is unmeasurable — real benchmarks, span me (7 children)
1. #13243 [--] fix(kb): RAG benchmark harness scores a synthetic corpus with a fake embed
2. #13244 [--] feat(kb): add span-level retrieval metrics (recall/precision/precision-cei
3. #13245 [--] feat(kb): chunking-strategy comparison runner — five production chunkers,
4. #13246 [--] feat(kb): sweep and validate chunk size + overlap defaults — 800-1000 toke
5. #13247 [--] feat(kb): add global-segmentation semantic chunker — percentile-threshold
6. #13248 [--] feat(kb): generate a domain-specific retrieval eval set from AutoBot's own
7. #13249 [--] feat(kb): bounded retrieval-config sweep runner with a significance gate a
### U#13250 [--] security(chat): tool approval is gated twice by different mechanisms — (2 children)
1. #13416 [--] test(security): the two tool-approval planes are never compared — add a di
2. #13421 [--] ui(approvals): five approval surfaces with no shared record or component — <-blocked by #13422
### U#13110 [--] Vision epic: capture exists, LLM vision path exists — nothing connects (5 children)
1. #13119 [--] VIS-1: promote camera + screen capture out of the SLM admin tool into shar
2. #13120 [--] VIS-2: retained capture source — hold the stream, supply current frame on
3. #13121 [--] VIS-3: user-supplied frames into a chat turn via the existing vision-in-th
4. #13122 [--] VIS-4: wire a vision source into the voice conversation loop
5. #13123 [--] VIS-5: consent + active-capture indicator shared across every vision sourc
### U#10193 [--] epic(auth): unify AutoBot + SLM into ONE user store with role-based ac (3 children)
1. #10200 [--] chore(db): migrate slm_users into autobot_users, then deprecate slm_users
2. #10201 [--] feat(auth): degraded-auth / network-partition handling for the SLM (#10193
3. #10203 [--] test(auth): cross-machine unified-identity + RBAC + two-host verification
### U#12420 [--] canonical(slm-frontend): no backend contract at all — 0 client classes (2 children)
1. #13138 [--] tech-debt(slm-frontend): 114 hand-declared types still shadow a generated
2. #13139 [--] tech-debt(slm-backend): 5 endpoints lack a response_model, so the generate
### U#12730 [--] Umbrella: GUI consistency via shared, enforced primitives (actions, em (1 children)
1. #12731 [--] frontend fragmentation: 3+ notification systems, 2 per-view button-class s
### U#13415 [--] eval(sql): the natural-language→SQL path has no accuracy measurement a (0 children)
### U#13264 [--] umbrella(config): #7437 migration silently dropped ~48 production defa (0 children)
### U#11515 [--] Umbrella: fully tokenised, consistent UI across both frontends (color (0 children)
==============================================================================
PART 2 — STANDALONE TRACKS (no umbrella; grouped by domain)
==============================================================================
### chat-workflow (11 open)
1. #13478 [P1] approval(chat): route the terminal-command gate through ApprovalGateServic
2. #13216 [P1] bug(chat): command approvals expire after 30min and cannot be honoured lat
3. #13479 [P1] approval(chat): execute the command on approve, not from a waiting poll lo <-blocked by #13478
4. #12371 [--] canonical(chat): 'list chats' served by 3 overlapping endpoints — list_cha
5. #12685 [--] tenancy(chat): LLC agent (CEO) conversations mix into ordinary /api/chat/s
6. #13008 [--] bug(user-mgmt): change_password 429 response masks the rate-limit message
7. #13280 [--] chore(chat): stop persisting 'metadata: null' — the writer behind the #132
8. #13293 [--] chore(chat): backfill assistant turns into sessions damaged before #13214
9. #13452 [--] type-safety: two divergent relation vocabularies (related_to vs relates_to
10. #13480 [--] approval(chat): recover approvals decided while the backend was restarting <-blocked by #13478
11. #13481 [--] approval(chat): make expiry an explicit policy (default none) and stop rep
### frontend-ui (34 open)
1. #12866 [P1] bug(frontend+backend): GUI shows 'Backend API Unreachable' on a healthy si
2. #13307 [P1] feat(backups): create-only feature — no delete/retention/export/import/off
3. #11658 [P2] Composable state-contract audit: per-instance refs consumed cross-componen
4. #11682 [P2] refactor(frontend): singleton consolidation phase 2 — API clients, observe
5. #12449 [P2] wire-in: notification_suppression.should_suppress/classify_notification ha
6. #12586 [P2] code_intelligence: MagicMock stub never real-loaded for 10 modules (precom
7. #13044 [P2] ci(duplication-guard): scans only 2 of 5 source trees — autobot_shared, sl
8. #13078 [P2] decision(frontend): Advanced Control is live in both SPAs — pick the canon
9. #13234 [P2] test(conftest): _make_pkg_stub fabricates dunders, so every getattr-based
10. #11086 [--] Verify Modal Sandbox SDK API in staging (follow-up to #11003 / PR #11085)
11. #12326 [--] frontend: 77 dead UI calls hit non-existent backend routes (browser automa
12. #12363 [--] canonical(frontend): no single backend contract — 8 independent HTTP clien
13. #12695 [--] GUI CRUD incomplete: Delete missing for portfolios/programs/work-items/goa
14. #12703 [--] GUI consistency (LLC views): duplicated action buttons (BoardsView create
15. #12707 [--] GUI empty states (LLC views): views look unfinished with no data — Company
16. #12729 [--] GUI icons: button pictograms clipped/misshapen — 245 ad-hoc inline SVGs mi
17. #12732 [--] i18n inconsistency: partial coverage — 85/442 .vue files use no t(), ~109
18. #12969 [--] bug(errors): deployed error_messages.yaml is never loaded — 'not found' wh
19. #13004 [--] test(npu_pipeline): test_dispatcher.py's async mock_post breaks dispatcher
20. #13005 [--] test(voice_processing): test_get_speech_provider_convenience depends on im
21. #13072 [--] tech-debt(frontend): SLM node-role vocabulary hand-mirrored, missing 'dock
22. #13113 [--] 23 tests order-dependently fail with 'no current event loop' — legacy asyn
23. #13128 [--] RedisConnectionManager.__init__ re-entrancy: resolving its own Redis host
24. #13129 [--] autobot_shared.user_management package __init__ eagerly coupled submodule
25. #13181 [--] api/*.py consumers still bind MagicMock code_intelligence stubs at import
26. #13355 [--] scripts: 9 shell scripts are mode 644 while the docs invoke them directly
27. #13360 [--] respond_tool_test: 2 pre-existing failures, and one of them makes a live D
28. #13382 [--] docs(env): .env.example does not document ALERTMANAGER_WEBHOOK_SECRET, the
29. #13389 [--] release: promote Dev_new_gui to main — 81 commits behind, blocked by one d
30. #13397 [--] security(paths): fold recordings.py's symlink rejection into the shared va
31. #13403 [--] training: confidence head and pattern-attention branch never receive gradi
32. #13404 [--] llm_shared/optimization: two implementations of meta-device layer eviction
33. #13440 [--] docs(testing): TESTING_FRAMEWORK_SUMMARY describes frontend CI jobs that d
34. #13449 [--] flaky: distributed_management_test.py claims task IDs in a shared live Red
### code-intel (16 open)
1. #12985 [P1] refactor(analytics): converge two diverged router-prefix parsers — audit_a
2. #13149 [P1] tech-debt(infrastructure): no canonical project-root resolution — 60 unexp
3. #13043 [P2] codebase-analytics: 99% of frontend calls get method=UNKNOWN — same-line-o
4. #12577 [--] refactor(automation): consolidate WorkflowRunner + orchestration WorkflowE
5. #12589 [--] test(codebase-analytics): unwired_tracker_test.py::test_detect_unwired_tra
6. #12711 [--] a11y/design-system (both GUIs): disabled controls look identical to enable
7. #12735 [--] enhancement(codebase-analytics): add 'Consistency & Integrity' detectors f
8. #12741 [--] Codebase Analytics under-reports: panels silently truncate to hardcoded to
9. #12771 [--] tech-debt: triage same-name class/enum clusters for consolidation (SourceT
10. #12953 [--] tech-debt(analytics): endpoint scan still misses 274 real routes (93.1% of
11. #13028 [--] Dead code: ai_hardware_accelerator._gpu_semantic_search and KnowledgeRetri
12. #13211 [--] docs(contributing): contributor path still steers PRs to `main` — default
13. #13237 [--] test(code-intelligence): LLMCodeGenerator async tests can never reach the
14. #13311 [--] 16 test files assert on source text via inspect.getsource — false failures
15. #13368 [--] tools: canonical lint runners break under a shadowing PYTHONPATH; codemod
16. #13437 [--] code-intelligence: an EmbeddingCache write failure discards the real embed
### deploy-infra (15 open)
1. #12596 [P1] deploy: Update-All STILL skips Play 2 — #12567 detach activates but the tr
2. #12912 [P1] deploy: PLAY 2 fails at 'Browser | Wait for service to be ready' — autobot
3. #12959 [P1] CRITICAL(deploy): Update-All uses inline tasks and applies only backend/en
4. #13047 [P1] bug(deploy): LimitCORE=infinity is applied regardless of backend_core_capt
5. #13460 [P1] deploy(updater): ai-stack, npu-worker, frontend and browser have no role a
6. #13070 [P2] chore(vnc): pin websockify to upstream 0.13.0 — apt ships 0.10.0 (2021) on
7. #13076 [P2] chore(vnc): 4 infrastructure scripts still hardcode /usr/share/novnc after
8. #10780 [P3] monitoring: per-tenant cost attribution (CostModelConfig is system-wide)
9. #12767 [P3] discovery(infra): 2 orphaned frontend .service.j2 templates (no task rende
10. #12485 [--] feat(fleet): optional SSH-credentials dialog on node recovery/enroll (supp
11. #12681 [--] setup-wizard: LLM-provider/adapter selection doesn't install required soft
12. #13145 [--] bug(slm): Edit Node silently discards all SSH/PKI/enrollment fields — Node
13. #13224 [--] test(infra): unrestored module-attribute mutations leak across tests (redi
14. #13357 [--] config: PROJECT_ROOT walks up for .env and silently resolves to the main c
15. #13362 [--] bug(slm): test_scim.py never collects — 'services' package collision leave
### mcp-agents (10 open)
1. #12508 [P1] agent: wrong specific facts in answers despite correct web_search results
2. #13090 [P1] agents: forbid privilege escalation — SLM backend run as root in a worktre
3. #11371 [P3] LLC activity: add real-time push (WS/SSE) endpoint for the company Activit
4. #12542 [--] decision(agent): should the self-awareness context block inject on EVERY c
5. #12550 [--] decision/provision: install claude CLI + extend backend/celery service PAT
6. #12702 [--] LLC lifecycle: standardize Archive → Restore → Delete-from-archive across
7. #13269 [--] security(mcp): realtime_mcp_bridge._call_inprocess bypasses scope checking
8. #13332 [--] tech-debt(llc): scheduler/__init__ eagerly imports the world — but Celery
9. #13369 [--] bug(llc): scheduler base calls Task.cancelling() (3.11+) — AttributeError
10. #13457 [--] test(orchestration): test_recovery_plan_serialization fails whenever test_
### browser-vision (6 open)
1. #12886 [P1] bug(tts): synthesis 404s — deployed worker lacks /tts/synthesize/stream be
2. #12378 [P2] product decision (#12326): aspirational UI panels have no backend (browser
3. #13148 [P2] tech-debt(vnc/ansible): 3 hand-synchronised duplications that caused #1306
4. #13204 [--] security(browser): send_to_browser_vm and playwright_service bypass the SS
5. #13236 [--] browser: migrate callers onto the canonical interface (ADR-009 steps 3-6)
6. #13299 [--] bug(voice): a per-utterance WS error frame is only logged — the sentence i
### ci-test (33 open)
1. #10691 [P2] ci: backend unit tests not enforced — stale assertion merged via #10623 un
2. #11380 [P2] CI resilience: single self-hosted runner 'Little-Slave' is a SPOF that blo
3. #12984 [P2] refactor(ci): converge two diverged PR-comment upserts; ssot-coverage appe
4. #13045 [P2] ci: runner outage leaves PRs indefinitely pending with a required context
5. #13200 [P2] tech-debt(ci): 3 of 4 commit-blocking pre-commit checkers have no tests +
6. #12986 [P3] refactor(ci): backend-Python path filter duplicated 7x across 6 workflows
7. #13131 [P3] ci: relocating already-dismissed-false-positive code re-triggers a fresh S
8. #13158 [P3] chore(tests): 28 remaining open() calls without encoding= in test files —
9. #12823 [--] ci: auto-update-pr-branches leaves refreshed PRs with ZERO checks — GITHUB
10. #12993 [--] test: integration_unknown_action_contract_test discovery is CWD-relative,
11. #12995 [--] ci: PR issue-linkage gate accepts only closing keywords, so multi-batch PR
12. #12998 [--] test rot: 4 GitLab/Gitea connector tests patch a module-level _store_ts re
13. #13162 [--] ci: Python unit-test suite is not a required check — red tests merged to D
14. #13286 [--] Marker-excluded tests (slow/integration/performance/distributed) run in no
15. #13298 [--] bug(ci): verify-generated-types bakes the build machine's paths into api.t
16. #13312 [--] autobot-slm-backend: 56 failing tests + 11 errors revealed by #13300 — nev
17. #13350 [--] test-infra: ban dotted-string mock.patch in colocated tests — 330 latent s
18. #13352 [--] ci: scheduled workflows are dormant — they exist only on Dev_new_gui, and
19. #13353 [--] ci: check-ts-delta enforces a stale 188-error baseline behind a step that
20. #13358 [--] test-infra: both backends ship a top-level 'middleware' package — combined
21. #13361 [--] test-infra: autobot-backend/conftest.py leaks 62 sys.modules keys — live i
22. #13384 [--] ci: watchdog's global concurrency group makes its sweeps cancel each other
23. #13386 [--] test: llc/tests conftest teardown leaves the real knowledge package withou
24. #13387 [--] test: test_integration_summarization_agent_reaches_completed skips on the
25. #13396 [--] security(ci): six run: steps interpolate ${{ }} directly; three are in an
26. #13400 [--] ci: the Security Scan check cannot fail on a security finding — every audi
27. #13432 [--] ci: cancel-in-progress voids the base-branch suite — no post-merge verific
28. #13435 [--] test-infra: services/knowledge test stubs leak utils.async_chromadb_client
29. #13439 [--] ci(watchdog): force-cancel queued runs superseded on the same (workflow, r
30. #13445 [--] test: no wall-clock budget assertion carries the performance marker — all
31. #13446 [--] test-infra: backend unit tests reach a live Redis when autobot_shared.redi
32. #13450 [--] test-infra: five leaking owners the sys.modules baseline never saw — the t
33. #13451 [--] test-infra: 16 hand-rolled sys.modules stub helpers — one duplicated primi
### kb-rag-memory (15 open)
1. #12603 [P2] feat(memory): negative-memory 'avoid' lane — re-inject recent failures to
2. #12832 [P2] decision(mesh-brain): enable MeshBrainScheduler? mesh_pruner deletes data
3. #12419 [P3] feat(knowledge): KnowledgeResearchPanel acceptSource/rejectSource has no b
4. #12426 [P3] perf(knowledge): facts/by_category uses SMEMBERS+sorted() per request (no
5. #11064 [--] perf(rag): BM25 IDF uses query-local candidate set, not corpus stats (#110
6. #12537 [--] decision(rag): _SYNTHESIS_SCHEMA_CACHE never invalidates at runtime — leav
7. #12581 [--] B1 fast-follows: symbolic-index TTL/reconcile + caller wiring (#12555)
8. #12733 [--] knowledge: browser empty + 'unvectorized on every reload' — facts (Redis)
9. #12932 [--] tech-debt(memory-graph): #3612's shim left 4 shadowed symbols — two import
10. #12977 [--] bug(governance): fact-forcing and repetition gates may be enforced only in
11. #13242 [--] test(knowledge/backends): ChromaDB contract coverage is stubbed out — deci
12. #13277 [--] data(kb): vector index poisoned with empty documents — facts marked comple
13. #13344 [--] bug(memory): intermittent 'duration_seconds cannot be negative' aborts the
14. #13430 [--] bug(kb): CausalRelationshipExtractor output is unwired — PipelineContext h
15. #13455 [--] test(knowledge): test_scan_finds_contradictions is intermittent — 1 in 5 i
### backend-api (12 open)
1. #12750 [P2] tech-debt(backend): orphaned parallel pydantic-settings config module (mod
2. #13085 [P2] bug(backend): LLC background schedulers (BudgetWatchdog/LivenessMonitor/Co
3. #13015 [P3] Planner does not tag sub-question topics as #12621/#12625 design assumed
4. #11114 [--] Scheduled automatic backups (#10016 member 2 — schedule half) [decision-ga
5. #12517 [--] implement real BatchJob execution per job_type (data_processing/file_conve
6. #12678 [--] fix(backend): broken log interpolation + dead CLI flags in code_analysis/a
7. #12892 [--] tech-debt(backend): 51 of 95 health/status handlers await unbounded — #127
8. #13285 [--] assess_command_risk() takes ~29s to classify 1.1MB of command text — super
9. #13287 [--] file_locking_test concurrent-write test costs 13.62s with no identified ca
10. #13339 [--] a2a: TaskManager caches a possibly-None Redis client at import and never r
11. #13364 [--] fix(api): voice bundle endpoints open sessions with a non-context-manager,
12. #13429 [--] chore: .paperclip/config.json is a tracked, generated machine-local config
### security-auth (11 open)
1. #12587 [P2] code_intelligence.security: 4 vulnerability classes from the legacy analyz
2. #12361 [P3] ci(security): 'Semgrep OSS' check red — community rules need SEMGREP_APP_T
3. #12684 [--] canonical(secrets): fragmented secret stores — /secrets shows SLM's own st
4. #12786 [--] tech-debt(auth): "superadmin" is used at 17 require_role call sites but is
5. #13051 [--] bug(secrets): SecretCreateRequest.owner_id/org_id/team_ids/shared_with acc
6. #13052 [--] gap(secrets): legacy-store envelope importers exist but have no invocation
7. #13117 [--] EncryptionService accepts a weak master key with only a log warning
8. #13257 [--] test(auth): conftest get_current_user stub is sync while the real dependen
9. #13281 [--] tech-debt(approvals): broad except Exception hid a TypeError on every appr
10. #13365 [--] bug(auth): /api/npu/status is service-only but called from the frontend —
11. #13408 [--] pair_device consumes the QR challenge token non-atomically - replay window
### perf-llm (5 open)
1. #10621 [P2] perf(llm): enable chat tiered routing + llm_type→model defaults after rag_
2. #13048 [P2] discovery(npu): pipeline-parallel model loader has no production get_layer
3. #13049 [P2] tech-debt(optimization): consolidate architecture-family, dtype and compre
4. #12341 [--] perf: code-analysis endpoints re-scan the whole tree per request (4,291 fi
5. #12979 [--] perf(http): 134 raw aiohttp.ClientSession constructions remain (127 per-re
### docs (2 open)
1. #11429 [--] docs: scope/visibility consolidation design doc (#11290 design deliverable
2. #12045 [--] docs: currency refresh — align README/Pages/wiki/metadata with shipped cap
### misc (2 open)
1. #11294 [--] enhance(self-improvement): per-tenant background re-learn sweep (replaces
2. #11703 [--] Stale branches detected
Activity
mrveiss commentedon Sep 28, 2026
v0.9 PR batch plan (2026-09-28) — a batch is a review pass, not a size bucket
Built from tonight's per-issue premise checks across v0.9.1–v0.9.6 (read-only pass by a4; all verdicts are comments on the issues). Each batch rides one CI run and one review pass; same file ⇒ same batch; hub files exempt.
api/nodes.pymodels/database.pydatabase.pytouch (one cluster with B1/B3, one agent in order)roles/backend/tasks/main.ymlbase_agent.py:474-483autobot_memory_graph/semantic_search.py(717/717 pin)Alone by design: #16979 (strongest single item), #17092, #16951. Not PRs: #17034 (audit), #17017 AC1 (scope question). Closure passes: #16464, #15226, #17099, #14781. Waiting: #15497 on #15494. Already owned: #17739/#17738 → #17725; #15907; #16985; #16982+#12684; #17054; #17546/#17547.
Attribution kept honest in the source file: B12's
#17208side of the collision is relayed (its body carries no file anchor); #16056 is a v0.9.1 issue whose anchors are both v0.9.2 cluster files. Pusher order after the current queue: B9 → B4 → B8 → B5 → B1/B2/B3.mrveiss commentedon Sep 29, 2026
Batch plan corrections (2026-09-29), from the specification passes — three change the schedule, not the code:
stalled_run_sweep.pygainsrelease_for_run+STALL_RELEASE_REASON, so AC2's lease half, AC5, AC6's release half and AC7 all land with it. AC5's two-sweepers question is answered in the diff — same transaction as the status write, sameSKIP LOCKEDselection. What remains is AC2's other two nouns: claims and assignments. Proving mutation: release the lease only; the new assertion reddens, the existing one stays green. Boundary feat(llc): make the workspace lease real — acquire, release, reclaim, and dispose on evidence (#16818) #17725 records and the work must not cross: the release frees the slot, not the directory — disposal isllc.services.workspace_disposal's.autobot_shared/is AC4's precondition, not tidiness: a wiring assertion over a shared module asserts the seam from outside, while a guard over a path living only inloop.pymust assert against the loop. AC3 is a ruling, available today.autobot_memory_graph/semantic_search.pyis 717 pinned at 717.:577-717is ~141 lines of index bootstrap (Redis DDL, no search logic) → its own module, file to ~576, ~141 lines of headroom, zero behaviour change — a mechanical import-move PR.:108-189'sHybridScorer(what Cover-multiplicity scoring: rank by weighted view agreement, not one fused scalar #17208 modifies) leaves the file at ~635, still over, so it unblocks nothing alone and belongs to Cover-multiplicity scoring: rank by weighted view agreement, not one fused scalar #17208's own work. Two traps: the ratchet gets a new entry regenerated by its detector, never hand-written; and no re-export unless a caller needs it.Specs: B4, B5, B6, B7, B8, B9, B10, B12 — eight of twelve.
mrveiss commentedon Oct 3, 2026
Removing the
blocked_byedge to #13251: this issue's own body contradicts it.The edge appears to have been drawn by matching the string
13251in the body without reading what the sentence says. In this issue, every mention of #13251 is the replicated status-table line:That line says #13472 is blocked. It does not say this issue is. The same line appears verbatim in #13470, #13473, #13475, #13476, #13477 and #13467 — one piece of boilerplate copied across a sibling set, six native edges drawn from it.
Of the eight issues carrying an edge to #13251, exactly one is genuinely dependent: #13472, whose body states the dependency in its own voice and gives the reasoning — "#13251 builds the measurement, this consumes it." And even that one is decision-permissive: "Land after #13251, or at minimum with a recorded before/after anchor-set diff on this issue."
The decisive case is #13473, which reads "Safe to start immediately. Independent of the code-graph track and of #13251" while carrying a live edge to it — the edge contradicting the text it was derived from.
Consequence of the removal: this issue is startable now. Across the seven spurious edges that is #13470, #13473, #13475, #13476 and #13483 in v0.10.0, plus #13467 (v0.9.6) and #13477 (Backlog) — five in-milestone issues becoming available with no code written.
Not a reschedule and not a repoint. An earlier note on #13251 reported seven dependents scheduled before their blocker and asked whether to move the epic or the dependents. That framing was wrong: seven of them were never blocked, so nothing was scheduled against a blocker three milestones out. The error was trusting the edges over the bodies.
The mechanism, so it is not repeated: a prose reference to a sibling's gate became an edge on the containing issue. "
13251appears in this body" was read as "this body depends on 13251", with no check on what the sentence asserted.Verified against the issue body before removal. #13472's edge is left in place.