Umbrella: canonical-source duplication — concepts with no single definition, where the copies have already drifted #13916

Summary

Five findings that share one cause: a concept has no single authoritative definition, so subsystems each
keep their own copy, and the copies drift. Every one was discovered the same way — someone needed a list
that already existed elsewhere and had nothing telling them so.

This is not a tidiness umbrella. Each item has already produced a production defect or made one
undiagnosable.

The pattern, stated once

A canonical source exists (or should), a second copy is written in good faith, nothing compares them, and
the divergence surfaces months later as a bug in an unrelated subsystem. #13512 is the worked example: the
audio-extension allowlist existed in three modules, one of them a security boundary, and the copies had
already drifted apart before anyone looked.

Task tree

Wave 1 — copies that already disagree (a live divergence, not a latent one)

• security(media): audio-extension allowlist has already drifted — knowledge ingestion accepts .mkv the upload boundary rejects, audio connector omits .mp4/.webm #13615 — audio-extension allowlist has already drifted. api/knowledge.py accepts .mkv that the
  canonical ALLOWED_AUDIO_EXTENSIONS rejects; audio_connector.py omits .mp4/.webm. One of these
  paths is an upload boundary, so reconciling changes what the system admits — a decision, not a
  refactor. Do first: it is the only item where the copies are known to differ in behaviour today.

Wave 2 — canonical source exists and is not used

• tech-debt(orchestration): canonical service registry lists 2 of 9 running services — autobot-backend, celery, chromadb, tts-worker and 3 more are absent; discovery hides it #13915 — service registry lists 2 of 9 running services and omits autobot-backend itself.
  Discovery hides it, so nothing fails loudly. Directly caused the CRITICAL(deploy): update rewrites 2000+ .py files under the live interpreter — 22-minute window where late first-imports raise ImportError for symbols that exist #13539 celery bug (the updater had no
  authoritative "what must restart after a sync" and used a hand-written list that omitted celery, which
  then served 7-day-old code across ten deploys). depends on nothing; unblocks the durable form of
  CRITICAL(deploy): update rewrites 2000+ .py files under the live interpreter — 22-minute window where late first-imports raise ImportError for symbols that exist #13539's fix.
• canonical(enums): AlertSeverity and ErrorSeverity duplicate the shared Severity enum, and 119 severity literals bypass enums entirely #13597 — canonical Severity exists at autobot_shared/status_enums.py:73 and its own docstring
  claims analytics, code-intelligence and logging. ce849accfde migrated 2 enums; a systematic AST
  scan found 15 more — including ConfidenceLevel in four files and four enums that
  api/schemas_analytics.py re-declares from code_intelligence/. Inventory posted on the issue.

Wave 3 — no canonical source has been chosen yet

• canonical(frontend): no single backend contract — 8 independent HTTP clients (2 generic) + 22 raw fetch sites, and generated api.ts is bypassed (4 importers vs 74 hand-typed responses) and stale (2424 vs 2152 paths) #12363 — no single backend contract: 8 independent HTTP clients on the frontend. Larger than the
  others and needs an architecture decision before any consolidation, so it should not block Waves 1-2.
• canonical(state): no datum declares its system of record — Redis, Postgres and ChromaDB hold the same data with no authority rule #15663 — no datum declares its system of record: the same data lives in Redis, Postgres and
  ChromaDB with no authority rule. Extends this umbrella from duplicated definitions to duplicated
  runtime data, where the same cause has already destroyed user state (knowledge: browser empty + 'unvectorized on every reload' — facts (Redis) wiped 43→0 while 22 ChromaDB vectors remain; facts not durably persisted; vectorized status read from Redis flag not the vector store #12733: 43 facts → 0 while 22
  vectors survived). Needs an architecture decision (which store is authoritative for knowledge facts),
  so like canonical(frontend): no single backend contract — 8 independent HTTP clients (2 generic) + 22 raw fetch sites, and generated api.ts is bypassed (4 importers vs 74 hand-typed responses) and stale (2424 vs 2152 paths) #12363 it should not block Waves 1-2.

Reference — the worked example

• tech-debt(transcriber): allowed-audio-extension set duplicated across three modules, one of them a security boundary #13512 — three copies of the audio allowlist collapsed onto SecurityConstants.ALLOWED_AUDIO_EXTENSIONS,
  plus a guard test (repo_tests/audio_extension_allowlist_test.py) that fails when a fourth literal
  copy appears. It also documented the two sets it deliberately left alone and tracked them separately as
  security(media): audio-extension allowlist has already drifted — knowledge ingestion accepts .mkv the upload boundary rejects, audio connector omits .mp4/.webm #13615, rather than silently widening scope. This is the shape every item here should take.

Acceptance criteria

The umbrella closes when every child closes and these hold — none is owned by an individual child:

1. Every consolidation lands with a guard test, in the shape of audio_extension_allowlist_test.py:
   a test that fails when a new duplicate of the canonical definition appears. Without it the count regrows —
   refactor(types): consolidate 15+ Severity/RiskLevel/Level enums onto constants/status_enums.py:Severity #6689 consolidated 15+ severity enums and 15 more exist today, which is the proof.
2. Deliberate exceptions are recorded, not omitted. Where a copy is kept on purpose (a domain-specific
   scale, a genuinely distinct concept sharing a noun), the guard test names it and says why. Capability
   is defined in four places with different members and should stay that way; that belongs written down.
3. No consolidation silently changes behaviour. Where copies differ (security(media): audio-extension allowlist has already drifted — knowledge ingestion accepts .mkv the upload boundary rejects, audio connector omits .mp4/.webm #13615), reconciling them alters
   what the system accepts or rejects — that is an owner decision recorded on the issue before the change,
   not a side effect of a refactor.
4. The canonical source is discoverable from the copy site. A developer who needs the list must be able
   to find it without knowing it exists — the reason every one of these was written twice.

Deliberately excluded

• Capability (4 definitions, different members — distinct concepts sharing a noun) and three-point
  LOW/MEDIUM/HIGH scales that coincide without being related. Listed so future scans do not re-raise them.
• The drift-checker false-positive classes (CRITICAL(deploy): drift checker reports 3 false-positive stale components — resolving them would remove 34 plugin files and the audit logs #13851, bug(deploy): drift endpoint reports 28 phantom drifts while a self-update is running — no deploy-in-progress signal, and resolve is delete-style #13913). They are arguably a canonical-source problem —
  the checker compares directories instead of asking the role what it deploys — but they are tracked under
  Umbrella: silent failures and telemetry gaps — 4 incidents where systemctl said active and the service was not working #13852 with the observability findings and should not be double-assigned.

Why grouped

Individually each reads as tech debt and gets deprioritised. Together they are one structural gap with a
measurable cost already paid: a security boundary that drifted (#13512/#13615), a week of stale workers
(#13539 via #13915), and a severity consolidation that regrew to 15 duplicates after being "finished"
(#6689 → #13597).