Issues

• test(kernel): evidence-hold.db.test.ts flakes by one second when posted_at falls just past a whole second

  kernelpriority:P3review-followup
  DOS/Crove#1664 · Filter by author JOY opened on Oct 27, 2026 · Icebox

• kernel(security): move the job egress check into the invariant suite (#1653 follow-up)

  kernelpriority:P3review-followup
  DOS/Crove#1663 · Filter by author JOY opened on Oct 27, 2026 · Icebox

• kernel(security): decide the derived risk of the R1 commands that feed egress queues (#1653)

  kernelpriority:P2
  DOS/Crove#1662 · Filter by author JOY opened on Oct 27, 2026 · GA gate

• app: module screens outside /o/$slug in the manifests and the module guard; ADR-0031 §3 wording

  priority:P3review-followupweb
  DOS/Crove#1660 · Filter by author JOY opened on Oct 27, 2026 · Icebox

• test(web): axe's undecided contrast on the landing page is listed, not asserted

  priority:P3review-followupweb
  DOS/Crove#1657 · Filter by author JOY opened on Oct 27, 2026 · Icebox

• kernel(G3): entities in the module manifests, checked against the catalog

  kernelpriority:P2
  DOS/Crove#1656 · Filter by author JOY opened on Oct 27, 2026 · GA gate

• test(web): landing page performance budget in CI (DESIGN 6.3)

  priority:P2web
  DOS/Crove#1655 · Filter by author JOY opened on Oct 27, 2026 · GA gate

• web(G5): every command has a vi and en label; the audit log shows labels, not command names

  priority:P2web
  DOS/Crove#1654 · Filter by author JOY opened on Oct 27, 2026 · GA gate

• kernel(security): every job queue declares its egress, checked in CI, and the derived risk follows it

  kernelpriority:P2
  DOS/Crove#1653 · Filter by author JOY opened on Oct 27, 2026 · GA gate
  4

• kernel(G3): routes and nav in the module manifests; the shell builds module navigation from them

  kernelpriority:P2
  DOS/Crove#1652 · Filter by author JOY opened on Oct 27, 2026 · GA gate
  3

• tooling(G5): dependency-cruiser with a module DAG from manifest dependsOn, no deep imports

  priority:P2tooling
  DOS/Crove#1651 · Filter by author JOY opened on Oct 27, 2026 · GA gate

• tooling: knip entry for tools/ lists the scripts run by path instead of tools/**

  priority:P3review-followuptooling
  DOS/Crove#1650 · Filter by author JOY opened on Oct 27, 2026 · Icebox

• docs(plan): plan and ADR for notes and personal to-do lists (#1648)

  kernelpriority:P3
  DOS/Crove#1649 · Filter by author JOY opened on Oct 27, 2026 · Icebox
  3

• Epic: Notes and personal to-do lists

  kernelpriority:P3
  DOS/Crove#1648 · Filter by author JOY opened on Oct 27, 2026 · Icebox

• ci: Invariant suite (from base) re-checks the base files after the run, since PR code still runs after the swap (#1645 review)

  priority:P3review-followupsecuritytooling
  DOS/Crove#1647 · Filter by author JOY opened on Oct 27, 2026 · Icebox

• ci: a committed node_modules shim under a test directory could shadow a dependency of the invariant suite (#1643 review)

  priority:P3review-followupsecuritytooling
  DOS/Crove#1644 · Filter by author JOY opened on Oct 27, 2026 · Icebox

• kernel: manifest permission check reads more SQL forms and the app's hard-coded keys (#1630 follow-up)

  kernelpriority:P3review-followup
  DOS/Crove#1641 · Filter by author JOY opened on Oct 27, 2026 · Icebox

• ci(pii-scan): office files outside fixtures, ls-files buffer, synthetic Gmail local parts (review follow-up of #1638)

  priority:P3review-followuptooling
  DOS/Crove#1640 · Filter by author JOY opened on Oct 27, 2026 · Icebox

• kernel: make sideEffect required in CommandDef (#1577 follow-up)

  kernelpriority:P3review-followup
  DOS/Crove#1637 · Filter by author JOY opened on Oct 27, 2026 · Icebox

• finance: crove_finance.bank_line.bank_account is classified payment but holds a chart account code (#1626 follow-up)

  financepriority:P3review-followup
  DOS/Crove#1635 · Filter by author JOY opened on Oct 27, 2026 · Icebox

• kernel: activity summaries embed party and org names, tax codes and addresses (#1626 follow-up)

  kernelpriority:P3review-followup
  DOS/Crove#1634 · Filter by author JOY opened on Oct 27, 2026 · Icebox

• kernel: input_sha256 of a low-entropy input can be brute-forced (#1626 follow-up)

  kernelpriority:P3review-followup
  DOS/Crove#1633 · Filter by author JOY opened on Oct 27, 2026 · Icebox

• kernel: audit-facts scan misses loop-built facts, spreads and renamed values (#1626 follow-up)

  kernelpriority:P3review-followup
  DOS/Crove#1632 · Filter by author JOY opened on Oct 27, 2026 · Icebox
  1

• test(web): the landing page passes an axe scan at 360 px in both themes, and /en holds no Vietnamese copy

  priority:P2web
  DOS/Crove#1629 · Filter by author JOY opened on Oct 27, 2026 · GA gate
  3

• inbox.list and inbox.get read a revision's legalEntityId from different kinds

  priority:P3review-followupweb
  DOS/Crove#1625 · Filter by author JOY opened on Oct 27, 2026 · Icebox