Skip to content
Closed
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
47 changes: 15 additions & 32 deletions .claude/hooks/issues-surface.sh
Original file line number Diff line number Diff line change
Expand Up @@ -26,58 +26,41 @@ source_val="$(printf '%s' "$payload" \
| head -n1 | sed -E 's/.*"([^"]*)"$/\1/')"

# --- parse the "Open items" table only ---------------------------------------
# Emit "PRI<TAB>ID<TAB>TYPE<TAB>SUMMARY" per open row. Scoped between the
# Emit "ORDER<TAB>PRI<TAB>ID<TAB>TYPE<TAB>SUMMARY" per open row. Scoped between the
# "## Open items" heading and the next "## " heading so the Resolved/archive
# table (different columns) is never counted.
rows="$(awk '
/^## Open items/ { inopen=1; next }
/^## / { if (inopen) inopen=0 }
inopen && /^\| #[0-9]/ {
inopen && /^\|[[:space:]]*[0-9]+[[:space:]]*\|[[:space:]]*#[0-9]/ {
n=split($0, c, "|")
id=c[2]; pri=c[3]; typ=c[4]; sum=c[5]
ord=c[2]; id=c[3]; priacuity=c[4]; typ=c[5]; sum=c[6]
split(priacuity, p, " "); pri=p[1]
gsub(/^[ \t]+|[ \t]+$/, "", ord)

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Priority field parses empty

Medium Severity

The hook reads priority from the Pri / acuity column by splitting on a single space and taking the first token, but pipe-delimited cells include a leading space, so that token is empty and trimming never yields P1/P2/P3. Session-start output then shows zero counts for every priority band and omits priority in the first ten task lines.

Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit 05acad6. Configure here.

gsub(/^[ \t]+|[ \t]+$/, "", id)
gsub(/^[ \t]+|[ \t]+$/, "", pri)
gsub(/^[ \t]+|[ \t]+$/, "", typ)
gsub(/^[ \t]+|[ \t]+$/, "", sum)
printf "%s\t%s\t%s\t%s\n", pri, id, typ, sum
printf "%s\t%s\t%s\t%s\t%s\n", ord, pri, id, typ, sum
}
' "$ledger" 2>/dev/null || true)"

total="$(printf '%s' "$rows" | grep -c . || true)"
if [ "${total:-0}" -eq 0 ]; then
echo "[issues] Outstanding-work memory (docs/outstanding-issues.md): no open items. Record one with /issues add …"
echo "[issues] Universal task ledger (docs/outstanding-issues.md): no open items. Record one with /issues add …"
exit 0
fi

group() { printf '%s\n' "$rows" | awk -F'\t' -v p="$1" '$1==p'; }
count() { printf '%s' "$1" | grep -c . || true; }
p1="$(group P1)"; p2="$(group P2)"; p3="$(group P3)"
c1="$(count "$p1")"; c2="$(count "$p2")"; c3="$(count "$p3")"
count_priority() { printf '%s\n' "$rows" | awk -F'\t' -v p="$1" '$2==p { n++ } END { print n+0 }'; }
c1="$(count_priority P1)"; c2="$(count_priority P2)"; c3="$(count_priority P3)"

echo "[issues] Outstanding-work memory — ${total} open (${c1}×P1, ${c2}×P2, ${c3}×P3). Source of truth: docs/outstanding-issues.md · read the full list back with /issues."
echo "[issues] Universal task ledger — ${total} open (${c1}×P1, ${c2}×P2, ${c3}×P3). Source of truth: docs/outstanding-issues.md · read the full ordered list with /issues."

print_group() { # $1=rows $2=max-to-list
local data="$1" limit="$2" shown=0 more=0 pri id typ sum
[ -z "$data" ] && return 0
while IFS=$'\t' read -r pri id typ sum; do
[ -z "$pri" ] && continue
if [ "$shown" -lt "$limit" ]; then
echo " ${pri} ${id} ${typ} — ${sum}"
shown=$((shown + 1))
else
more=$((more + 1))
fi
done <<EOF
$data
EOF
[ "$more" -gt 0 ] && echo " … +${more} more at this priority (see /issues)"
return 0
}

# P1 = do-next, list all. P2 = should-do, list up to 8. P3 = collapse to a count.
[ "$c1" -gt 0 ] && print_group "$p1" 999
[ "$c2" -gt 0 ] && print_group "$p2" 8
[ "$c3" -gt 0 ] && echo " ${c3} × P3 (nice-to-have / revisit-when) — see /issues"
# Preserve the ledger's dependency-aware order. Acuity totals above are metadata only.
printf '%s\n' "$rows" | awk -F'\t' '
NF && NR <= 10 { printf " %s. %s %s %s — %s\n", $1, $2, $3, $4, $5 }
END { if (NR > 10) printf " … +%d more in ledger order (see /issues)\n", NR - 10 }
'

# --- capture reminder ---------------------------------------------------------
case "$source_val" in
Expand Down
27 changes: 15 additions & 12 deletions .claude/skills/issues/SKILL.md
Original file line number Diff line number Diff line change
Expand Up @@ -3,11 +3,11 @@ name: issues
description: Track and recall all outstanding tasks, recommendations, and issues for this repo as durable cross-session memory. Use when the user types "/issues" (state the open items back), or asks to add/close/update/capture an outstanding task, recommendation, or issue. The memory lives in docs/outstanding-issues.md; a plain "/issues" is read-only.
---

# issues — the outstanding-work memory
# issues — the universal task ledger

`docs/outstanding-issues.md` is the durable, cross-session memory of everything still outstanding:
open **tasks**, **recommendations** not yet acted on, and **issues** not yet resolved. Chat context
resets; that file does not. This skill reads it back and keeps it current.
`docs/outstanding-issues.md` is the single durable, cross-session task ledger. Its ordered **Open
items** table is the only active queue. Legacy evidence and resolved sections are history, not work.
Chat context resets; that file does not. This skill reads it back and keeps it current.

**The ledger is the source of truth, not chat memory.** Never answer `/issues` from conversation
recall — always read the file first, so the answer is correct even in a fresh session.
Expand All @@ -20,8 +20,8 @@ recall — always read the file first, so the answer is correct even in a fresh
## Default: `/issues` (read-only)

1. Read `docs/outstanding-issues.md`.
2. State the **open items** back, grouped by priority (P1 → P3), each as
`#ID · type · summary — next action (source)`.
2. State the **open items** back in the table's recommended **Order**, each as
`Order · #ID · priority/acuity · type · taskwhen; next action`.
3. End with a one-line count, e.g. `5 open: 0×P1, 3×P2, 2×P3 · 0 resolved this session`.
4. Do **not** mutate the file or commit on a plain read.

Expand All @@ -32,16 +32,16 @@ If a filter is given, narrow step 2: `/issues P1` (by priority), `/issues issues

Parse the intent from natural language too — the exact syntax is a convenience, not a requirement.

- **`/issues add <text>`** — append a row to **Open items**. Infer `Pri`/`Type` from the text
(ask only if genuinely ambiguous; default `P2`/`task`). Allocate the ID from the
`<!-- issues:next-id=NNN -->` marker, then bump that marker. Fill `Source` with
`session <today>` unless the user names one; `Added` is today's date.
- **`/issues add <text>`** — append a row to **Open items** at the next order. Infer
`Pri`/`Acuity`/`Type` (ask only if genuinely ambiguous; default `P2`/`A2`/`task`). Allocate the ID
from the `<!-- issues:next-id=NNN -->` marker, then bump it. Fill every execution field; use
`session <today>` as the source unless the user names one.
- **`/issues done <id> [outcome]`** — move that row from **Open items** to **Resolved / archive**
with today's date and a one-line outcome. Archive, never delete.
- **`/issues update <id> <text>`** — edit an open row's summary or next action in place.
- **`/issues capture`** — scan the current session for recommendations, follow-ups, deferrals, and
unfixed problems that surfaced but were not recorded. Propose them as a numbered list and add the
confirmed ones (dedupe against existing rows first — do not re-add something already tracked).
confirmed ones. Dedupe against the whole file, including legacy evidence and resolved history.

## Capture discipline (proactive memory)

Expand All @@ -52,9 +52,12 @@ paragraph; put the smallest next action in **Detail / next action**.

## Writing rules

- Keep the table format and column order exactly as in `docs/outstanding-issues.md`. One row per item.
- Keep the Open items table format and column order exactly as in `docs/outstanding-issues.md`. One
row per item; keep Order contiguous after any mutation.
- IDs are monotonic and never reused — always allocate from the `issues:next-id` marker and bump it.
- Escape `|` inside cell text (write `\|`) so the markdown table stays intact.
- Fill acuity, intelligence, timing, effort, dependencies/approvals, success/verification, stop rule,
and source/update fields. Do not put a claim into Open items unless it remains recommended.
- Respect the repo's RAG/clinical/privacy flagging rules if an item _itself_ touches a protected
surface — recording it here is fine, but acting on it later still needs the usual gate.

Expand Down
8 changes: 7 additions & 1 deletion AGENTS.md
Original file line number Diff line number Diff line change
Expand Up @@ -454,8 +454,14 @@ Run the matching planner command in `docs/productivity-workflows.md` without sid
**recommendation**, and **issue** for this repo. Chat context resets between sessions; that file does
not, so anything worth remembering after a session ends belongs there.

`docs/outstanding-issues.md` is the single universal task ledger. Its ordered **Open items** table is
the only active queue and records acuity, capability, timing, effort, approvals, success criteria,
verification, and stop rules. The legacy evidence and resolved sections preserve history but are not
active work. Keep detailed provider procedures in `docs/operator-backlog.md`, update affected records
together, and never restore completed, stale, duplicate, speculative, or rejected work to Open items.

- When the user types `/issues`, invoke the `issues` skill (`.claude/skills/issues/SKILL.md`): read
`docs/outstanding-issues.md` and state the open items back, grouped by priority. A plain `/issues`
`docs/outstanding-issues.md` and state the open items back in recommended order. A plain `/issues`
is read-only — it mutates and commits nothing.
- `/issues add|done|update|capture …` mutate the ledger; each mutation commits **only**
`docs/outstanding-issues.md` (no push unless the user asks or you are already handing off).
Expand Down
1 change: 1 addition & 0 deletions docs/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -71,6 +71,7 @@ npm run docs:check-links

## Plans and workstreams (living)

- [outstanding-issues.md](outstanding-issues.md) — universal ordered task ledger and durable repository memory
- [maturity-backlog-workorders.md](maturity-backlog-workorders.md) — actionable work orders tracking the repository-maturity audit backlog
- [framework-dependency-modernization-checklist.md](framework-dependency-modernization-checklist.md) — ordered Next.js 16, runtime, dependency, Turbopack, and verification migration program
- [search-rag-master-plan.md](search-rag-master-plan.md) / [search-rag-master-context.md](search-rag-master-context.md) — search/RAG roadmap and shared context
Expand Down
2 changes: 1 addition & 1 deletion docs/branch-review-ledger.md
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,7 @@ Use this ledger to prevent repeated branch and PR reviews when the reviewed HEAD

| Date | Branch or ref | Reviewed HEAD | Scope | Outcome | Checks |
| ---------- | -------------------------------------------------------- | ---------------------------------------- | ---------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| 2026-07-24 | `codex/supabase-document-change-trigger` | `9c7d9edf509a51478f5bebbabcca64e3926dc877` + reviewed working diff | Document-change ingestion trigger migration, schema mirror, grants, privacy and fail-safe delivery | APPROVE. No P0-P2 finding. The trigger is update-only, acts solely on a strict JSON boolean false/absent-to-true transition, sends only the receiver's allowlisted owner-scoped fields, fails open for document writes when Vault/GUC/pg_net is unavailable, and revokes execution from public/anon/authenticated. No production URL fallback exists. Highest residual risk is deliberate pg_net at-most-once delivery; the clear-then-flip recovery and data-preserving rollback are documented, and the trigger remains inert until both the Vault secret and environment base-URL GUC are configured. | Disposable `supabase/postgres:17.6.1.127` schema replay and drift-manifest regeneration passed (16s; scratch container removed); focused schema/drift/receiver Vitest 89/89; migration-role, function-grant (30 SECURITY DEFINER functions) and owner-scope guards; production-readiness CI mode READY with expected secretless-worktree warnings; offline RAG 21 suites/307 tests; `verify:cheap` 365 files, 3,241 passed/1 skipped; static trace of receiver payload, authoritative owner-scoped reload and idempotent enqueue path. No live provider mutation or migration apply. |
| 2026-07-24 | `codex/supabase-document-change-trigger` | `9c7d9edf509a51478f5bebbabcca64e3926dc877` + reviewed working diff | Document-change ingestion trigger migration, schema mirror, grants, privacy and fail-safe delivery | APPROVE. No P0-P2 finding. The trigger is update-only, acts solely on a strict JSON boolean false/absent-to-true transition, sends only the receiver's allowlisted owner-scoped fields, fails open for document writes when Vault/GUC/pg_net is unavailable, and revokes execution from public/anon/authenticated. No production URL fallback exists. Highest residual risk is deliberate pg_net at-most-once delivery; the clear-then-flip recovery and data-preserving rollback are documented, and the trigger remains inert until both the Vault secret and environment base-URL GUC are configured. | Disposable Supabase Postgres 17.6.1.127 schema replay and drift-manifest regeneration passed (16s; scratch container removed); focused schema/drift/receiver Vitest 89/89; migration-role, function-grant (30 SECURITY DEFINER functions) and owner-scope guards; production-readiness CI mode READY with expected secretless-worktree warnings; offline RAG 21 suites/307 tests; `verify:cheap` 365 files, 3,241 passed/1 skipped; static trace of receiver payload, authoritative owner-scoped reload and idempotent enqueue path. No live provider mutation or migration apply. |
| 2026-07-23 | PR #1090 / `cursor/fix-phone-dock-edge-1b1d` | `761de7e9ad623b6bd8d634d849a9eb465d622e48` (merged as `09028ef217209fceb53f1122ac7738b509bce323`) | Phone safe-area and edge-to-edge search-dock UI review | MERGED. No P0-P2 finding. The branch was three commits behind, so current `origin/main` was merged before landing; the actual merge tree matched the reviewed synthetic tree. The dock remains flush to the viewport with safe-area padding inside the form, and the phone shell no longer retains the `dvh` clamp that created the Safari toolbar band. Zero actionable review threads. | `npm run ensure`; focused `ui-tools.spec.ts` phone-home and edge-to-edge scenarios: Chromium 2/2 and WebKit 2/2; refreshed hosted policy, security, unit, build, advisory UI, Production UI and required aggregate checks green; exact-head ancestry and local-main tree equality proved after merge. |
| 2026-07-22 | PR #1087 / `codex/reconcile-product-truth` | `edbc2260fef59ca2fa7c6973dffb85e32354bce1` (merged as `05dc52fd8408a65117e22a6236e43252203bea92`) | Product-truth copy, account persistence and unavailable-SSO presentation | MERGED. Cross-device claims now match favourites/preferences persistence; recent searches are identified as browser-session data; the contradictory “never shared” statement is removed. All unavailable setup providers and Apple elsewhere use the connected accessible “coming soon” placeholder pattern. The single review finding was fixed, replied to and resolved. | Red DOM proof; focused 19/19; `verify:cheap` 3,220 passed / 1 skipped; `verify:ui` 265/265; PR-local build/secret scan/offline RAG; final hosted required, Production UI, policy and security checks green. No provider calls or RAG spend. |
| 2026-07-22 | PR #1086 / `codex/reconcile-xlsx-budgets` | `5376880a40749b6526fd7e4603a7be9d04bc9624` (merged as `2963fba46eacd644618a588fa283f7597faa2644`) | XLSX resource-boundary review | MERGED. Enforces worksheet, non-empty-row, rendered-cell and UTF-8 output ceilings before result fragments are appended; sparse-column output is preserved. No actionable review threads. | Red 257-sheet reproducer; focused 4/4; `verify:cheap` 3,218 passed / 1 skipped; PR-local build/scan/offline RAG; hosted required/security/policy green. |
Expand Down
1 change: 1 addition & 0 deletions docs/codebase-index.md
Original file line number Diff line number Diff line change
Expand Up @@ -334,6 +334,7 @@ One shared composer (`master-search-header.tsx`) serves every mode. Placement:
| Full documentation index | `docs/README.md` |
| Routes and modes | `docs/site-map.md` |
| Search/RAG roadmap | `docs/search-rag-master-plan.md` |
| Universal task ledger | `docs/outstanding-issues.md` |
| Reindex operations | `docs/reindex-runbook.md` |
| Production readiness | `docs/production-readiness-checklist.md` |
| Capacity / scale-up | `docs/capacity-review.md`, `docs/auth-connection-cap-runbook.md` |
Expand Down
Loading
Loading