Repository navigation
Tracking: 2026-09-07 app audit backlog #433
Description
Backlog from the 2026-09-07 audit of Control, the coordinator backend and the app shell. Each linked issue is self-contained: where the bug is, what to change, and the exit criteria including the test that must fail before the fix. Work top to bottom. Tick an item when its PR merges.
P0: correctness and safety
- Parallel Codex workers kill their shared sandbox and the coordinator misreports the failure #434 (fixed by fix(control): keep parallel workers from exhausting a shared sandbox #435)
- Coordinator can open a pull request without operator approval #408
- Approval policy should derive from tool access level, not a hand-maintained name list #409
- "Commit & push" defaults to main when the branch is unknown #410
- Reserved slugs miss
control,delivery,observeand five top-level routes #411 -
/api/reposfetched without the active-team header shows personal repos inside a team scope #412
P1: reliability and user-visible classes of bug
- Control session list treats a failed fetch as "No sessions yet" #413
-
/controlshows the new-mission screen before it knows whether sessions exist #414 - Selecting a session can silently do nothing, and auto-restore fails closed #415
- Control pickers show "New project…", "Model" and "No repository" while data is still loading #416
- First message of a new mission can be lost without a trace #417
- Killed Control turns stay "streaming" for 17 minutes before the reaper runs #418
- Validate the Control
permissionsstring and warn on "Approve Edits" with Codex #419 - No server-side lock prevents two coordinator turns on one conversation #420
- Backfill
repo_idfor legacy Control sessions #421 - Route-segment errors are never reported to Sentry and replace the whole shell #422
- Library and pane mutations ignore
res.okand show changes that were never saved #423 (fixed by Fix silent mutation failures and preserve unsaved edits #565) - Investigate the 30 to 40 second cold start after every production deploy #424
P2: hygiene, coverage, performance, accessibility
- Mobile Control has no session list and no way to start a session #425
- Command palette cannot find Control sessions or the Control page #426
- 33 API routes crash with a 500 on a malformed JSON body #427 (fixed by fix: return 400 for malformed API JSON bodies #566)
- Adopt zod for request bodies, starting with the untested team and connections routes #428 (completed by fix: validate team member role requests #567–fix: validate connection OAuth callback state #578)
- Dashboard ships the Supabase realtime client and Shiki in every page bundle #429 (completed by Defer dashboard syntax highlighting and omit legacy realtime from Neon builds #583 and Keep template prompts on the server and complete Neon bundle cleanup #586)
- Icon-only buttons have no accessible name and status dots are colour-only #430 (fixed by Name icon actions and announce live status #584)
- Remove the permanently-off Vercel integration flags and the dead migrate route #431 (fixed by Remove dormant personal Vercel integration #588)
- Project combobox cannot create a project from the name you typed #432
Rules that apply to every item: files stay under 500 lines, regression tests go red before green (see TESTING.md), PR bodies follow the template. Test placement follows the repo convention: pure logic gets a colocated vitest test under lib/, API routes get a tests/unit/ suite, user-visible behaviour gets a Playwright case in the matching tests/e2e/ spec.
Activity
charlesrhoward commentedon Oct 6, 2026
The final item, #431, is resolved by #588 and deployed. All audit items are now checked off; production smoke and the live MCP environment-variable readback passed.