|
1 | 1 | { |
2 | 2 | "ok": true, |
3 | | - "created_at": "2026-06-06T04:14:55+00:00", |
| 3 | + "created_at": "2026-06-16T17:24:52+00:00", |
4 | 4 | "repo_root": "/Users/teee/dev/teaagent", |
5 | 5 | "git": { |
6 | 6 | "branch": "main", |
7 | | - "commit": "b0b3054f49231598c378d031dc0feef03e87bd32", |
| 7 | + "commit": "bb9fb1b73df7c6ed909925d6358aa6b22d53139e", |
8 | 8 | "dirty": true |
9 | 9 | }, |
10 | 10 | "commands": [], |
11 | 11 | "docs_freshness": { |
12 | 12 | "scanned": 17, |
13 | | - "needs_attention": 0, |
14 | | - "by_owner": {}, |
| 13 | + "needs_attention": 3, |
| 14 | + "by_owner": { |
| 15 | + "docs": 1, |
| 16 | + "cli": 1, |
| 17 | + "architecture": 1 |
| 18 | + }, |
15 | 19 | "stale_threshold_days": 90 |
16 | 20 | }, |
17 | 21 | "roadmap_excerpt": { |
18 | 22 | "horizons": [ |
19 | 23 | { |
20 | 24 | "id": "H0", |
21 | 25 | "name": "Claim and risk hygiene", |
22 | | - "status": "In Progress", |
23 | | - "confidence": "Medium", |
24 | | - "next_gate": "DOCOPT-012 generalized guarded-claim registry" |
| 26 | + "status": "Complete", |
| 27 | + "confidence": "High", |
| 28 | + "next_gate": "H1" |
25 | 29 | }, |
26 | 30 | { |
27 | 31 | "id": "H1", |
28 | 32 | "name": "Daily operator loop", |
29 | | - "status": "In Progress", |
| 33 | + "status": "Complete", |
30 | 34 | "confidence": "High", |
31 | | - "next_gate": "M1 complete" |
| 35 | + "next_gate": "H2" |
32 | 36 | }, |
33 | 37 | { |
34 | 38 | "id": "H2", |
35 | 39 | "name": "Multi-surface continuity", |
36 | | - "status": "Pending", |
| 40 | + "status": "Partially fixed — M2 foundation wired", |
37 | 41 | "confidence": "Medium", |
38 | | - "next_gate": "M2 complete" |
| 42 | + "next_gate": "WDA-002" |
39 | 43 | }, |
40 | 44 | { |
41 | 45 | "id": "H3", |
42 | 46 | "name": "Ecosystem trust", |
43 | | - "status": "Pending", |
| 47 | + "status": "Partially fixed — M3 tests pass", |
44 | 48 | "confidence": "Medium", |
45 | | - "next_gate": "M3 complete" |
| 49 | + "next_gate": "WDC-002" |
46 | 50 | }, |
47 | 51 | { |
48 | 52 | "id": "H4", |
49 | | - "name": "Durable team operations", |
50 | | - "status": "Pending", |
| 53 | + "name": "Durable owner/agent operations", |
| 54 | + "status": "Partially fixed — shadow wired", |
51 | 55 | "confidence": "Low", |
52 | | - "next_gate": "M4 complete" |
| 56 | + "next_gate": "WDA-004" |
53 | 57 | }, |
54 | 58 | { |
55 | 59 | "id": "H5", |
56 | 60 | "name": "Quality and eval loop", |
57 | | - "status": "Pending", |
| 61 | + "status": "Partially fixed — release gate wired", |
58 | 62 | "confidence": "Low", |
59 | | - "next_gate": "M5 complete" |
| 63 | + "next_gate": "WDA-005" |
60 | 64 | } |
61 | 65 | ], |
62 | 66 | "milestones": [ |
63 | 67 | { |
64 | 68 | "id": "M0", |
65 | 69 | "target": "1-2 weeks", |
66 | | - "status": "Medium", |
67 | | - "next_gate": "`validate_docs_consistency.py`, `refresh_competitive_docs.py --check`, `teaagent tool lint --root .` pass" |
| 70 | + "status": "High", |
| 71 | + "next_gate": "All 3 checks pass: `validate_docs_consistency.py`, `refresh_competitive_docs.py --check`, `teaagent tool lint --root .`" |
68 | 72 | }, |
69 | 73 | { |
70 | 74 | "id": "M1", |
|
75 | 79 | { |
76 | 80 | "id": "M2", |
77 | 81 | "target": "4-10 weeks", |
78 | | - "status": "Medium", |
| 82 | + "status": "High", |
79 | 83 | "next_gate": "Long-session context guard acceptance, scope budget acceptance, plan revision acceptance" |
80 | 84 | }, |
81 | 85 | { |
82 | 86 | "id": "M3", |
83 | 87 | "target": "8-14 weeks", |
84 | | - "status": "Medium", |
| 88 | + "status": "High", |
85 | 89 | "next_gate": "Extension activation explain acceptance, MCP trust onboarding acceptance, subagent review/merge acceptance" |
86 | 90 | } |
87 | 91 | ] |
88 | 92 | }, |
89 | | - "open_risks": [ |
90 | | - { |
91 | | - "id": "SEC-05", |
92 | | - "category": "Budget", |
93 | | - "description": "Cost accounting reads `context['_cost_cents']` written by the LLM adapter — injectable by malicious adapter or prompt-injected response", |
94 | | - "status": "**OPEN**", |
95 | | - "priority": "P2" |
96 | | - }, |
97 | | - { |
98 | | - "id": "SEC-09", |
99 | | - "category": "Multi-sig", |
100 | | - "description": "Multi-sig approval hash uses 1-hour time bucket (`int(time.time()/3600)`); captured signature replayable for up to 59:59 within same window; hash logic duplicated in two files", |
101 | | - "status": "**OPEN**", |
102 | | - "priority": "P2" |
103 | | - }, |
104 | | - { |
105 | | - "id": "SEC-11", |
106 | | - "category": "Undo", |
107 | | - "description": "`UndoJournal._PATH_WRITE_TOOLS` covers file tools only; `workspace_run_shell_mutate` not tracked — UI shows \"undo available\" but shell side-effects are unrecoverable", |
108 | | - "status": "**OPEN**", |
109 | | - "priority": "P2" |
110 | | - }, |
111 | | - { |
112 | | - "id": "SEC-12", |
113 | | - "category": "Audit", |
114 | | - "description": "`os.fsync()` failure caught and silenced; audit degrades to in-memory only with no operator notification; disk-full attack eliminates all log persistence", |
115 | | - "status": "**OPEN**", |
116 | | - "priority": "P2" |
117 | | - }, |
118 | | - { |
119 | | - "id": "SEC-13", |
120 | | - "category": "Testing", |
121 | | - "description": "Critical security paths (cost tracking, audit HMAC, approval denial) mocked out in tests — bugs live undetected (confirmed: CG-03 lived months this way)", |
122 | | - "status": "**OPEN** — remediation plan in §9; target tests include `tests/test_chat_agent.py`, audit HMAC persistence/wrong-key tests, and MCP trust-expiry enforcement tests", |
123 | | - "priority": "P1" |
124 | | - }, |
125 | | - { |
126 | | - "id": "SEC-14", |
127 | | - "category": "Permission", |
128 | | - "description": "`preapproved_call_ids` deprecated but still functional — old integrations or adversarial callers can pre-approve arbitrary call IDs without HMAC digest verification", |
129 | | - "status": "**OPEN**", |
130 | | - "priority": "P3" |
131 | | - }, |
132 | | - { |
133 | | - "id": "SEC-15", |
134 | | - "category": "Multi-sig", |
135 | | - "description": "`TEAAGENT_ALLOW_DEV_SIGNATURES=1` accepts SHA-256 of `(message+pubkey)` as valid signature; no runtime guard prevents this in production WAN deployment", |
136 | | - "status": "**OPEN**", |
137 | | - "priority": "P2" |
138 | | - }, |
139 | | - { |
140 | | - "id": "SEC-16", |
141 | | - "category": "Code Quality", |
142 | | - "description": "Dead code at `budget_monitor.py:104-119` after early return — maintenance hazard that could accidentally activate on refactor", |
143 | | - "status": "**OPEN**", |
144 | | - "priority": "QW" |
145 | | - }, |
146 | | - { |
147 | | - "id": "DS-04", |
148 | | - "category": "Audit", |
149 | | - "description": "Stale `audit_trail` dict in suspension JSON predates CG-10 fix; forensic tooling may prefer the stale copy over the real RunStore events", |
150 | | - "status": "**OPEN**", |
151 | | - "priority": "P3" |
152 | | - }, |
153 | | - { |
154 | | - "id": "SC-01", |
155 | | - "category": "Dependencies", |
156 | | - "description": "Two alpha packages in production lock (`opentelemetry-exporter-gcp-logging==1.12.0a0`, `opentelemetry-resourcedetector-gcp==1.12.0a0`) can break between lock refreshes", |
157 | | - "status": "**OPEN**", |
158 | | - "priority": "P2" |
159 | | - }, |
160 | | - { |
161 | | - "id": "SC-02", |
162 | | - "category": "Dependencies", |
163 | | - "description": "`anthropic` SDK and `pyyaml` imported at runtime but undeclared in `pyproject.toml` — silent `ImportError` on installs without `google-cloud-aiplatform` or `pre-commit`", |
164 | | - "status": "**OPEN** — TASK-DD2-015 dependency declaration/import-check follow-up; fix target: `pyproject.toml`", |
165 | | - "priority": "P1" |
166 | | - }, |
167 | | - { |
168 | | - "id": "SC-03", |
169 | | - "category": "Dependencies", |
170 | | - "description": "`aiohttp` and `mcp` SDK in lock as orphans — not declared, not imported in core; add 22 transitive packages to attack surface unnecessarily", |
171 | | - "status": "**OPEN**", |
172 | | - "priority": "P2" |
173 | | - } |
174 | | - ], |
| 93 | + "open_risks": [], |
175 | 94 | "regenerate_commands": [ |
176 | 95 | "python3 scripts/build_release_docs_evidence_bundle.py", |
177 | 96 | "python3 scripts/validate_docs_consistency.py", |
|
0 commit comments