scriptoriumadmin/veritas-kanban
1
0
Fork 0
mirror of https://github.com/BradGroux/veritas-kanban.git synced 2026-08-28 02:44:59 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1
veritas-kanban/docs/CODEBASE-AUDIT-2026-05-16.md
Brad Groux a42988a3e2 Ratcheting lint warning budget
2026-06-04 00:16:42 -07:00

5.7 KiB
Raw Permalink Blame History

Codebase Audit - 2026-05-16

This audit covered the server, web app, shared package, CLI, MCP server, docs, scripts, and CI.

Changes Applied

  • Fixed Tool Policies API calls to use the shared apiFetch helper, so sub-path deployments and custom VITE_API_URL values work consistently.
  • Fixed same-column kanban drag reorder state so reorder persistence can fire.
  • Fixed checkpoint clearing when tasks are marked done or explicitly cleared.
  • Fixed dependency blocking so blocked -> in-progress cannot bypass incomplete blockers.
  • Hardened outbound webhook delivery through shared URL validation, DNS checks, and manual redirect handling.
  • Added VK_API_KEY headers to raw CLI summary and memory fetch paths.
  • Improved CLI/MCP API error messages for standard { success: false, error } envelopes.
  • Included CLI and MCP packages in the root build and CI build-output checks.
  • Added a release validator for package version alignment, changelog/badge checks, local artifacts, git tags, and GitHub release state.
  • Added scheduled Playwright and k6 CI gates outside the fast PR workflow.
  • Fixed Docker dependency stages to copy CLI and MCP package manifests now that they are part of the workspace.
  • Split task detail, create-task, settings, search, and chat panels out of the initial web bundle through lazy loading.
  • Centralized web view metadata for URL routing, header navigation, command palette navigation, and lazy-route loading labels.
  • Centralized task-detail tab metadata and reset behavior so feature-gated or disabled tabs cannot strand the panel on hidden content.
  • Removed the warning cluster in server/src/index.ts and added a CI lint warning budget to prevent new debt.
  • Fixed stale CLI/MCP runtime versions by reading package metadata.
  • Fixed vk setup sample-task guidance so it no longer prints an impossible task ID.
  • Corrected stale health endpoint and port docs.
  • Quarantined the legacy review-task creation script behind an explicit opt-in flag.

Verified Findings

  • Production dependency audit is clean.
  • pnpm typecheck passes across the workspace.
  • pnpm test:unit passes across server and web packages.
  • Targeted regressions pass for URL validation, squad webhooks, task checkpoint/dependency behavior, auth, feedback, and web API helpers.
  • pnpm build passes across shared, server, web, CLI, and MCP after expanding the root build.
  • pnpm lint exits 0 and currently reports 601 warnings, down from 728, mostly any, non-null assertions, and test-only unused values.
  • pnpm lint:budget enforces the current warning ceiling and prints package/rule counts so future cleanup can ratchet it down.
  • pnpm validate:release -- --github passes for v4.3.1, including local tag, origin tag, and published GitHub release checks.
  • Scheduled QA workflow YAML parses successfully.
  • The Vite production build no longer emits oversized chunk warnings; the largest app chunk is the lazy TaskDetailPanel chunk at 473.98 kB.
  • Source TODO sweep found two intentional future seams: OpenClaw sessions_spawn workflow execution and CSP style nonce migration.

Refactor Targets

  • Centralize all outbound integrations into a named endpoint registry with validation, secrets, delivery history, and audit events.
  • Add workflow agent execution profiles for read-only review, workspace-write implementation, local-only no-network, and publish-capable networked runs.
  • Replace the remaining OpenClaw workflow execution placeholder with the same provider-adapter model used by the Codex agent path.
  • Move production style handling away from broad CSP unsafe-inline once the UI/runtime path supports nonce-tagged style injection consistently.
  • Move more services behind the existing storage provider abstraction instead of direct file I/O.
  • Centralize web view registration so App, Header, and command palette navigation cannot drift.
  • Extract task-detail tab registration so feature-gated tabs cannot strand users on hidden content.
  • Tighten lint in phases: app code first, test files second.

Expansion Candidates

  • Work Queue view focused on next actions, blockers, agent status, and review readiness.
  • Saved board views backed by the existing URL filter model.
  • Review readiness summary in task details using verification, deliverables, review, metrics, and observations.
  • Outbound integration registry for hooks, policies, squad chat, and failure alerts.
  • Release validation script covering versions, changelog, tag, GitHub release, Docker build, CLI, and MCP artifacts.
  • Scheduled Playwright and k6 CI jobs separate from the fast PR gate.

Tracker Follow-Up

  • #394 - Centralize outbound integration endpoint registry and delivery audit.
  • #395 - Complete OpenClaw workflow-step execution through provider adapters.
  • #396 - Remove broad CSP unsafe-inline style allowance in production.
  • #397 - Centralize web view, navigation, and task-detail tab registration.
  • #398 - Reduce lint warning debt and phase in stricter lint gates.
  • #399 - Add release validation script for versions, artifacts, tags, and GitHub releases.
  • #400 - Add scheduled Playwright and k6 CI gates outside the fast PR path.
  • #401 - Add saved board views backed by URL filters.
  • #402 - Split oversized frontend bundles and route-heavy Vite chunks.