-
synckit: give Idempotency runtime teeth, unify rotation decrypt (audit Phase 4)
-
synckit: instrument the conflict layer and billing calls (audit Phase 3)
-
synckit: uncap large-body transport, don't hold plaintext during upload (audit Phase 2)
-
synckit: harden crypto and conflict resolution against a hostile server (audit Phase 1)
-
tests: contract tests for db::users, db::items core, db::synckit_billing + cross-session password revoke
-
tests: give ota release fixtures a valid-length signature
-
server: quality cleanups (wordlist self-test, duration clamp, typed member paths, collections DOM)
-
server: run scan-spool disk stats on the blocking pool
-
server: parse build command into escaped argv instead of raw shell interpolation
-
server: mt architectural refactors (audit 2026-07-02 follow-up)
-
server: mt audit findings — health 503, SSRF img-proxy e2e, hardening
-
server: gate one-time checkout finalize on payment settlement
-
tests: sanitize project slug from underscore usernames in harness
-
server: money-core db-layer contract tests (db::transactions)
-
server: close Architecture B+ dups + rss control-byte gap (audit Run 17)
-
server: module docs on leaf db modules; glob the audit-file gitignore
-
server: frontend hygiene — dead JS, fragmented tab JS, inline CSS, img shift
-
server: gallery N+1 + ImageId, de-truncate aggregates, keyset paginator
-
server: fix test harness for spawn_pool shutdown-receiver signature
-
server: escalate/log the silent error-swallow sites
-
server: drain the background pool on graceful shutdown
-
server: flip OAuth empty-scope to userinfo; validate build signing_key_path
-
server: make SyncKit Stripe creates idempotent to close activate race
-
Test collections and items::bulk db cold spots
-
Test passkeys, ssh_keys, and issues db cold spots
-
Test db money/race cold spots; fix inert cancel_stale_rotation
-
audit Run 16 Phase 6: Observability
-
audit Run 16 Phase 5: Performance
-
audit Run 16 Phase 4: Resilience
-
audit Run 16 Phase 3: Concurrency