pastilhasandClaude Fable 5
6071ded175
TODO.md had reached 1050 lines and 72 open items across 28 sections, read mostly on a phone. It is now a directory: todo/<theme>/<item>.md, one card per file, with frontmatter carrying id, status, created date and order, and the prose body copied across verbatim. TODO.md becomes a generated index (bun run todo:index). Dates: where an item's prose stated one it is used; otherwise its old section's; otherwise 2026-08-20, floored at the day before the split rather than invented. date_source records which. Shaped for a two-way Kanban board, filed as todo/tooling — a card is a file, id is the identity, frontmatter is the machine's half and the body is the owner's. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
1.1 KiB
id, title, theme, status, created, date_source, order
| id | title | theme | status | created | date_source | order |
|---|---|---|---|---|---|---|
| multi-user/assertpermissiontotality-checks-the-wrong | `assertPermissionTotality` checks the wrong list, and `registry.test.ts` has been red since 2026-08-13 | multi-user | open | 2026-08-13 | stated | 12 |
assertPermissionTotality checks the wrong list, and registry.test.ts has been red since
2026-08-13. It is fed Object.keys(handlers) from server.tsx, but Bun serves the route table.
Those diverged when the cliamp/desktop/vault plugins were switched off: /api/cliamp/ws and
/api/cliamp/audio/ws are still live routes with their handlers and registry claims commented out.
Not exploitable — isWsProviderAllowed finds no permission and 403s a member; the owner upgrades onto
a dead socket. But the boot check that exists to stop exactly this cannot see it. Two fixes: point
totality at the route table, and either delete the dead routes or restore their claims. The 8 failing
tests in registry.test.ts are the same drift — REAL_WS still lists all nine providers as served,
which is why nobody noticed. Found 2026-08-14.