Skip to content

Umbrella: llc-module — finish endpoints, frontend spine, adapters, internal dedup #9923

Description

@mrveiss

Mission

Take the LLC (Low-Level Coordinator) module from "wired and proven end-to-end" to feature-complete and maintainable. The core loop already ships and passes e2e (#9902, 1df676a32); this umbrella covers the remaining backend endpoints flagged off during the ship (backlog-reorder, suggest-AC, per-agent budget), the LLC frontend spine (company selector, portfolio/program/project browser, Gantt), new adapter capabilities (subscription-mode, Copilot, replay, PR-linking), and the LLC-internal dedup refactors surfaced by the duplication audit.

Dependency edges

Members (sized)

Triage delta — 2026-06-12 (new members from wave reviews)

Triage delta — 2026-06-19 (unfiled-issue sweep)

Triage delta — 2026-06-21

Activity

  1. mrveiss commented on Jun 11, 2026

    @mrveiss
    OwnerAuthor

    Blocker cleared (2026-06-11): #9793 closed via PR #9948 (857cfaedc) — backend image now ships claude + gh CLIs with a heartbeat CLI-availability gate and compose credential passthrough. The umbrella #9919 dependency edge ("U5 blocked until #9793 lands") is resolved; LLC subprocess agents are runnable under compose (API-key variants; subscription-OAuth variant remains a product decision on the #9793 thread).

  2. mrveiss commented on Jun 11, 2026

    @mrveiss
    OwnerAuthor

    Batch session 2026-06-11 — 11 members landed

    Member PR Squash commit
    #9841 env_float/env_int → autobot_shared #9964 a71cf35a1
    #9909 LLC frontend dedup → composables/llc/ #9969 4f31b36b0
    #9532 workIntent on checkout #9976 adfe7d810
    #9839 probe_pid/terminate_pid primitives #9979 092a36b51
    #9901 budget provisioning #9981 59020282b
    #9844 adapter test conftest #9990 f449d9f05
    #9773 registry-adapter rate-limit backoff #9993 a2be8d76e
    #9843 shared DI (get_session/service_dep) #9994 e04b019b3
    #9627 company selector + sidebar spine #9997 8a7954eec
    #8997 token budget mode #9998 e6e3cff71
    #9842 PollLoopScheduler base #10003 333d60bcc

    Every member went through an independent code-review round pre-merge; review-caught fixes included the #9773 success-transcript false-positive (would have re-run completed work) and the #9901 provision race + import-crashing env parse.

    Discoveries filed: #9978 (LLC view strict-type errors), #9987 (liveness-monitor test patches a lazy import), #9992 (claude CLI stderr never drained), #9995 (sys.modules suite pollution masks router-test regressions).

    Remaining members (all L/M features): #9861 (rescope — backlog-reorder + suggest-AC + org-chart enrichment; unblocked: #9899 closed via PR #9989), #9628, #9020, #9625, #9008, #9033, #9034. Both original blockers (#9793, #9899) are now closed — all remaining members are startable.

  3. mrveiss commented on Jun 16, 2026

    @mrveiss
    OwnerAuthor

    Adapter features audit (#9008/#9033): both have registered, partially-implemented adapters but several ACs unmet. Shipped the one real bug (adapter_type hire-validation, PR #10227) and decomposed the rest into scoped members:

    #9008/#9033 remain open pending these. Remaining original L member: #9628 (Portfolio→Program→Project browser).

  4. mrveiss commented on Jun 17, 2026

    @mrveiss
    OwnerAuthor

    ⚠️ Security regression found + fixed (#10148 → PR #10258 73660669): #9020's GET /projects/{id}/timeline and #9628's GET /companies/{id}/projects were added to sprints.py without tenant isolation — every sprints.py endpoint (28) depended only on get_async_session, so any authenticated caller could read/mutate another company's data by enumerating UUIDs (HIGH IDOR). Root cause: those PRs mirrored sprints.py's pre-existing un-guarded pattern instead of the IDOR-guarded pattern in the sibling work_items.py. Now fixed (all 28 endpoints guarded + test_sprints_idor.py). Lesson: new LLC endpoints must carry require_org_context from the start.

  5. 22 remaining items

  6. added sub-issues on Sep 1, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions