LLC dashboard: company-context plumbing + 5 missing/redesign endpoints (from wiring audit #9851)

Follow-up from the API wiring audit (#9851). These LLC items need backend work or a frontend redesign beyond path wiring, so they were not patched blind. Until implemented, the relevant UI elements should be feature-flagged off (no dead buttons).

Root blocker: company-context plumbing

CompanyDashboard.vue, SubCompanyTree.vue, GoalTree.vue, OrgChart.vue read route.params.companyId, but their routes (/llc/dashboard, /llc/companies, /llc/goals, /llc/org-chart) define no :companyId param, and there is no company store. So companyId is always undefined and these views can't call the (company-scoped) backend. Decide the source of company context (route param vs Pinia store vs query) and thread it through.

Endpoints needing implementation / redesign

GET /api/llc/companies/tree (SubCompanyTree) — no global tree route; build client-side from /api/llc/companies/ once context exists.
GET /api/llc/goals/tree (GoalTree fetchGoals) — assemble client-side from flat /api/llc/goals?company_id= (parent_goal_id present) once context exists.
GET /api/llc/org-chart (OrgChart) — no agent reporting hierarchy is exposed; add a backend endpoint or render a degraded flat list. Pause/resume must use /api/llc/companies/{company_id}/controls/agents/{agent_id}/pause|resume.
POST /api/llc/companies/{id}/backlog/reorder (BacklogView) — LLCWorkItem.backlog_position exists; add a bulk-reorder write endpoint + ordering semantics.
POST /api/llc/work-items/suggest-ac (BacklogView) — needs an LLM-backed acceptance-criteria service; only the storage field exists.

Security hardening (noted by commit review)

Pre-existing work_items.py routes (/products, get_work_item, etc.) query by id without a tenant check (potential IDOR). The new /activity route was hardened with require_org_context; apply the same to the siblings.

Parent: #9851

fix(api-wiring): resolve frontend/backend contract drift (audit #9851) (

LLC ship pass — PR #9902 (`llc-ship` → `Dev_new_gui`)

After rebasing onto latest Dev_new_gui (PR #9862 had already fixed 9 of the original 16 unwired LLC calls), the remaining 7 unwired /api/llc calls are now resolved and the module is functional end-to-end:

Resolved here

✅ OrgChart → new read-only GET /companies/{id}/org-chart + controls pause/resume
✅ Company hierarchy (SubCompanyTree) → companies/ + per-root tree
✅ Goal tree → flat goals?company_id= + client build
✅ HeartbeatMonitor agents query
✅ Company-context root blocker → useLlcCompanyContext (route param → ?company= → first company); wired into OrgChart, GoalTree, CompanyDashboard
✅ LLC wiring audit exits 0 for /api/llc; blocking CI gate added (llc-contract.yml) + hermetic core-loop e2e (1 passed)

Flagged off (no backend — no dead buttons), still tracked under this issue:

⏳ POST /companies/{id}/backlog/reorder (BacklogView drag-reorder) — VITE_FEATURE_LLC_BACKLOG_REORDER
⏳ POST /work-items/suggest-ac (LLM-backed) — VITE_FEATURE_LLC_SUGGEST_AC
⏳ org-chart budget/assigned_item_count enrichment (currently 0 when no budget row)

Discoveries filed: #9899 (AgentOrgNode↔migration drift), #9900 (2 unmounted routers, non-LLC), #9901 (no budget-provisioning endpoint).

Keeping this issue open for the three ⏳ backend items above.

fix(llc): address review findings on org-chart + dashboard (#9861)

feat(llc): make LLC module functional end-to-end — wire 7 paths, org-…

Bug sweep 2026-06-10 → TOO-BIG. Needs backend + frontend work beyond path wiring: a company-context source (route param vs Pinia store) threaded through 4 LLC views, 5 missing/redesigned endpoints (org-chart, goals/tree, backlog/reorder, suggest-ac LLM service, companies/tree), plus IDOR hardening on sibling work_items.py routes. Multi-surface feature work — out of scope for the sweep.

Session wrap-up (2026-06-10): the LLC ship (PR #9902, merged) also surfaced follow-up discoveries now tracked separately — #9909 (consolidate duplicated tree-build / statusColor / run-status mapping across the LLC views) is in this issue's frontend area. Open backend items for this umbrella remain: backlog-reorder endpoint, work-items/suggest-ac (LLM-backed), org-chart budget/assigned-count enrichment. Discoveries #9899 (AgentOrgNode↔migration drift) and #9901 (no budget-provisioning endpoint) also relate.

feat(llc/api): backlog reorder + suggest-AC, org-chart enrichment, fu…

PR #10034 (merged to Dev_new_gui) references this issue with a close keyword.

feat(llc/api): backlog reorder + suggest-AC, org-chart enrichment, full work-items tenant scoping (#9861)

If this issue is fully resolved, close it manually. If work remains, no action is needed.

Closed — merged to Dev_new_gui via PR #10034 (squash commit 824552668). This completes the issue's rescoped remainder; earlier portions shipped via PR #9902 (context plumbing, tree assembly, org-chart endpoint), #9627/PR #9997 (company selector/store), #9901/PR #9981 (budget provisioning).

Checklist accounting:

✅ companies/tree + goals/tree — client-side assembly (shipped PR feat(llc): make LLC module functional end-to-end — wire 7 paths, org-chart endpoint, e2e + CI gate (#9861) #9902)
✅ org-chart — endpoint shipped PR feat(llc): make LLC module functional end-to-end — wire 7 paths, org-chart endpoint, e2e + CI gate (#9861) #9902; NOW enriched with assigned_item_count (single GROUP BY through the AgentOrgNode.id PK convention) and budget-mode-aware budget_spent/budget_total (feat(llc/budget): token-based budget mode — track agent budgets in token counts alongside dollar amounts #8997 token agents expose token numbers)
✅ backlog/reorder — POST /companies/{id}/backlog/reorder, tenant-scoped, List[uuid.UUID] 422 validation, deduped payload, positions 0..n-1; list_backlog now orders by backlog_position so the reorder is observable
✅ work-items/suggest-ac — LLM-backed via the established AcSuggester/get_llm_service().chat pattern (60s bound); company_id derived from org context (the body field was a cross-tenant RAG hole — removed); advisory-only
✅ Security hardening — require_org_context + cross-tenant-404 extended to ALL 17 unscoped work-item routes (incl. attachments/{id}/download cross-tenant file read); agent loop unaffected (/api/llc/agent/* middleware path; e2e green)

76 tests green; independent review round (3 HIGH security/functional findings fixed — both new endpoints initially lacked auth; write-only backlog_position); all 4 LLC CI gates green.

Follow-ups: UI re-enabling of the reorder/suggest-AC buttons in BacklogView (flags still off — payload contract is { work_item_ids: [...] }); discoveries #10032 (dual agent-id keyspace), #9980 linked at the enum-filter site.

feat(llc/frontend): wire BacklogView drag-reorder + suggest-AC to #9861…

Navigation Menu

Repository navigation

LLC dashboard: company-context plumbing + 5 missing/redesign endpoints (from wiring audit #9851) #9861

Root blocker: company-context plumbing

Endpoints needing implementation / redesign

Security hardening (noted by commit review)

LLC ship pass — PR #9902 (`llc-ship` → `Dev_new_gui`)

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

LLC dashboard: company-context plumbing + 5 missing/redesign endpoints (from wiring audit #9851) #9861

Description

Root blocker: company-context plumbing

Endpoints needing implementation / redesign

Security hardening (noted by commit review)

Activity

mrveiss commented on Jun 10, 2026

LLC ship pass — PR #9902 (llc-ship → Dev_new_gui)

mrveiss commented on Jun 10, 2026

mrveiss commented on Jun 10, 2026

github-actions commented on Jun 12, 2026

mrveiss commented on Jun 12, 2026

Metadata

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Issue actions

LLC ship pass — PR #9902 (`llc-ship` → `Dev_new_gui`)