feat(kanban): add phase 6 gitops enforcement #2562

Issues found but failed to post (294 code objects reviewed).

• Merge Base: 499f146
• Head: 8620410

✅	File Path	Comments Posted
✅	`review.md`
✅	`.gitignore`
✅	`.cursorrules`
✅	`.ai/README.md`
✅	`docs/project.md`
✅	`scripts/test.ts`	0
✅	`.cursor/BUGBOT.md`
✅	`.github/ai-loop.yml`
✅	`CLAUDE.md`
➖	`.codex/commands/plan.md`
➖	`.codex/commands/ship.md`
✅	`scripts/ai-loop/hash.ts`	0
✅	`.ai/rules/13-security.md`
✅	`.claude/commands/ship.md`
➖	`.codex/commands/phase.md`
✅	`scripts/ai-loop/state.ts`	0
✅	`scripts/vitest.config.ts`
✅	`.claude/commands/phase.md`
➖	`.codex/commands/review.md`
✅	`scripts/ai-loop/config.ts`	0
✅	`scripts/ai-loop/schema.ts`
✅	`scripts/setup-local-db.sh`
✅	`.claude/commands/review.md`
➖	`.codex/commands/open-pr.md`
✅	`scripts/setup-domain.sh`
✅	`.ai/i18n/agent-banners.json`
✅	`.claude/commands/plan.md`
✅	`docs/agent-orchestration.md`
➖	`package.json`
✅	`scripts/preflight/result.ts`	0
✅	`.ai/rules/00-constitution.md`
✅	`.ai/rules/18-pr-readiness.md`
➖	`.codex/commands/env-audit.md`
➖	`.codex/commands/preflight.md`
✅	`scripts/ai-loop/github.ts`	0
✅	`scripts/ai-loop/router.ts`	0
✅	`scripts/check-port-policy.sh`
✅	`scripts/preflight/run-cli.ts`	0
✅	`scripts/security-audit.sh`
✅	`.claude/commands/env-audit.md`
✅	`.claude/commands/preflight.md`
➖	`.codex/commands/ifrs-audit.md`
➖	`.codex/commands/pdpl-audit.md`
✅	`.oxfmtrc.json`
✅	`scripts/preflight/redactor.ts`	0
✅	`scripts/preflight/registry.ts`	0
✅	`.ai/rules/22-kanban-console.md`
✅	`.claude/commands/ifrs-audit.md`
✅	`.claude/commands/open-pr.md`
✅	`.claude/commands/pdpl-audit.md`
➖	`.codex/commands/orchestrate.md`
➖	`.codex/commands/plan-status.md`
✅	`apps/web/src/routes/kanban.tsx`	0
✅	`scripts/ai-loop/pr-metadata.ts`	0
✅	`scripts/preflight/fix/apply.ts`	0
✅	`scripts/preflight/runner.ts`	0
✅	`.ai/rules/15-pdpl-compliance.md`
✅	`.ai/rules/19-ifrs-compliance.md`
✅	`.ai/rules/20-environments.md`
✅	`.claude/commands/orchestrate.md`
✅	`.claude/commands/plan-status.md`
➖	`.codex/commands/execute-task.md`
➖	`.codex/commands/init-project.md`
➖	`.codex/commands/user-stories.md`
✅	`.github/workflows/ai-review.yml`
✅	`scripts/ai-loop/normalize.ts`	0
✅	`scripts/ai-loop/router-logic.ts`	0
✅	`.claude/commands/execute-task.md`
✅	`.claude/commands/init-project.md`
✅	`scripts/check-pr-readiness.sh`
✅	`scripts/preflight/output/json.ts`
➖	`scripts/tests/ai-loop.spec.ts`
✅	`.ai/rules/14-secret-management.md`
➖	`.codex/commands/security-audit.md`
✅	`scripts/ai-loop/executor-state.ts`	0
✅	`scripts/preflight/secret-cache.ts`
✅	`scripts/sync-codex-commands.ts`	0
✅	`.claude/commands/security-audit.md`
✅	`.github/workflows/pr-readiness.yml`
✅	`scripts/preflight/checks/env.ts`	0
✅	`.ai/rules/21-agent-orchestration.md`
✅	`.claude/commands/user-stories.md`
✅	`.github/workflows/ai-fix-router.yml`
✅	`scripts/preflight/checks/support.ts`	0
✅	`scripts/preflight/fix/post-write.ts`
✅	`scripts/preflight/version-policy.ts`	0
✅	`.ai/rules/17-aws-well-architected.md`
✅	`apps/web/src/kanbanConsoleMock.ts`	0
✅	`scripts/preflight/checks/stack.ts`	0
✅	`scripts/preflight/output/markdown.ts`
✅	`scripts/preflight/output/terminal.ts`	0
✅	`scripts/sync-codex-environment.ts`	0
➖	`scripts/tests/port-policy.spec.ts`
✅	`scripts/preflight/fix/guided-fetch.ts`	0
✅	`scripts/preflight/fix/provider-cli.ts`
➖	`.codex/commands/upgrade-multitenant.md`
✅	`scripts/preflight/fix/auto-generate.ts`	0
✅	`scripts/preflight/fix/env-bootstrap.ts`	0
✅	`scripts/preflight/latest-versions.json`
✅	`scripts/preflight/non-secret-keys.json`
✅	`scripts/preflight/project-md-schema.ts`	0
✅	`scripts/verify-template-adoption.sh`
✅	`.claude/commands/upgrade-multitenant.md`
➖	`.codex/commands/extract-pr-learnings.md`
➖	`.codex/environments/environment.toml`
✅	`scripts/preflight/fix/auto-derive.ts`	0
✅	`.claude/commands/extract-pr-learnings.md`
➖	`apps/web/src/kanbanConsoleMock.test.ts`
✅	`docs/tasks/t3-kanban-project-console.md`
✅	`packages/contracts/src/kanbanConsole.ts`
✅	`scripts/preflight/checks/integrations.ts`	0
✅	`scripts/preflight/markdown-services-table.ts`
✅	`scripts/tsconfig.json`
✅	`vitest.config.ts`
✅	`apps/server/src/kanban/GitStatusProvider.ts`	0
✅	`scripts/preflight/checks/env/sync-env-guard.ts`	0
✅	`.github/workflows/ai-fix-executor-claude.yml`
➖	`packages/contracts/src/kanbanConsole.test.ts`
✅	`apps/web/src/components/KanbanConsoleMock.tsx`	0
➖	`.agents/skills/source-command-ifrs-audit/SKILL.md`
➖	`.agents/skills/source-command-pdpl-audit/SKILL.md`
✅	`apps/server/src/kanban/AgentWorkflowLauncher.ts`	0
✅	`apps/server/src/kanban/GitHubProjectsProvider.ts`	0
➖	`apps/server/src/kanban/GitStatusProvider.test.ts`
✅	`apps/web/src/components/KanbanConsoleMock.browser.tsx`	0
✅	`packages/contracts/src/index.ts`
➖	`apps/server/src/kanban/AgentWorkflowLauncher.test.ts`
➖	`apps/server/src/kanban/GitHubProjectsProvider.test.ts`
✅	`.github/workflows/ci.yml`
✅	`apps/web/src/routes/_chat.index.tsx`	0
➖	`bun.lock`
✅	`AGENTS.md`
➖	`apps/web/src/routeTree.gen.ts`
✅	`.github/pull_request_template.md`

Filtered Issues Details

apps/server/src/kanban/GitHubProjectsProvider.ts

line 191: In fieldValue, the priority of the nullish coalescing on line 191 is reversed. When the GitHub CLI returns field values with structure { "field": { "name": "Status" }, "name": "In Progress" }, the expression trim(field.name) ?? trim(objectValue(field.field)?.name) evaluates field.name first, which yields the value ("In Progress") rather than the field name ("Status"). Since "in progress" is not in the wanted set for field names like "Status", the field is skipped and the lookup falls through to the fallback. The expression should be trim(objectValue(field.field)?.name) ?? trim(field.name) to prioritize the nested field.field.name (the actual field name) over field.name (which may hold the value). [ Failed validation ]

apps/server/src/kanban/GitStatusProvider.ts

line 535: The targetTagOutput git command is only executed when input.targetTag is explicitly provided, but targetTag on line 554 can also be derived from releaseTagFromBranch(branch). When input.targetTag is undefined and targetTag is derived from the branch name, targetTagOutput will always be an empty string (from Effect.succeed("")), causing the gate-tag-readiness gate to incorrectly report "passing" even if the derived tag already exists in the repository. [ Posting failed ]

scripts/ai-loop/config.ts

line 53: The config file path defaults to .github/ai-loop.yml (a YAML file), but the code uses JSON.parse() to parse it. YAML is a superset of JSON, meaning valid JSON is valid YAML, but not vice versa. If the config file uses any YAML-specific syntax (like unquoted strings, multi-line strings with |, anchors, etc.), JSON.parse() will throw a SyntaxError. Either the file extension should be .json, or a YAML parser library should be used. [ Failed validation ]

scripts/ai-loop/router-logic.ts

line 56: The function checks state.last_result_fingerprint but the calling code stores the fingerprint in state.last_signal_fingerprint. In router.ts, after computing findingSetFingerprint, it is assigned to last_signal_fingerprint (e.g., last_signal_fingerprint: findingSetFingerprint). However, shouldBlockRepeatedFindingSet compares against last_result_fingerprint, which is a different field that is never populated with the finding fingerprint. This means the repeated-finding-set detection will never trigger, defeating the intended blocking behavior. [ Failed validation ]

scripts/preflight/checks/integrations.ts

line 181: The doppler/yaml check provides a misleading hint even when the check passes. When files.length > 0 && !hasPlaceholder evaluates to true (status = "pass"), the hint is still set to "Replace placeholder Doppler project names." because the ternary at lines 182-185 only distinguishes between files.length === 0 and files.length > 0, not whether the check passed. Other checks in this file correctly use undefined for the hint when passing (e.g., line 221, line 250), but this one always provides a string hint. [ Failed validation ]

scripts/preflight/fix/apply.ts

line 35: The checks for stack-b/convex-deployment (lines 34-38) and stack-a/neon-url (lines 44-46) only verify status === "error" but do not check the fixable property, unlike the other fix conditions which use hasFixableIssue. This inconsistency means fixes will be attempted for these checks even if they report fixable: false, potentially running provider CLI commands when the check explicitly indicated the issue cannot be auto-fixed. [ Posting failed ]

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(kanban): add phase 6 gitops enforcement #2562

Uh oh!

Uh oh!

feat(kanban): add phase 6 gitops enforcement #2562

Uh oh!

Issues found but failed to post (294 code objects reviewed).

Details

Filtered Issues Details

Re-running checks...