# Issue Register — Waggle V1 Pre-Production Qualification

> **Historical snapshot — superseded.** This register records findings as of
> 2026-03-20 and is not the current open-issue or launch authority. See
> [`09-LAUNCH_RECOMMENDATION.md`](./09-LAUNCH_RECOMMENDATION.md) for the current
> Windows-first Solo scope, external gates, and recommendation.

Generated: 2026-03-20 | Branch: `phase8-wave-8f-ui-ux` | Tests: 3,895 passing

---

## CRITICAL Issues (Must Fix Before Ship)

| ID | Phase | Category | Title | Location | Fix Estimate |
|----|-------|----------|-------|----------|-------------|
| PRQ-001 | 3B | Security | CORS allows any origin (`origin: true`) | `packages/server/src/local/index.ts:1122` | 30 min |
| PRQ-002 | 3B | Security | SSE endpoints bypass CORS via `reply.hijack()` | `packages/server/src/local/routes/chat.ts` | 1 hr |
| PRQ-003 | 3C | Code Quality | Zero error boundaries — render crash = white screen | `app/src/App.tsx` (entire app) | 2 hr |
| PRQ-004 | 4A | Security | OAuth refresh tokens stored plaintext in vault metadata | `packages/core/src/vault.ts:156-161` | 1 hr |
| PRQ-005 | 4A | Security | Server CSP has `unsafe-eval` + `unsafe-inline` | `packages/server/src/local/security-middleware.ts:24` | 30 min |
| PRQ-006 | 4B | Security | API key in git history (redaction commit was empty) | Branch `phase6-capability-truth`, commit `c29d75f` | 30 min (verify revoked + delete branch) |
| PRQ-007 | 2 | UX | Streaming loading indicator invisible (BEM CSS classes with no definitions) | `packages/ui/src/components/chat/ChatArea.tsx` | 30 min |
| PRQ-008 | 2 | UX | SplashScreen uses pre-Direction-D navy-blue gradient | `packages/ui/src/components/onboarding/SplashScreen.tsx` | 30 min |

**Total CRITICAL: 8** (5 Security, 1 Code Quality, 2 UX)

---

## HIGH Issues (Should Fix Before Ship)

| ID | Phase | Category | Title | Location | Fix Estimate |
|----|-------|----------|-------|----------|-------------|
| PRQ-009 | 3A | Code Quality | Rate-limit retry `turn--` can loop infinitely | `packages/agent/src/agent-loop.ts:129,140` | 1 hr |
| PRQ-010 | 3A | Code Quality | SQL string interpolation in sqlite-vec search | `packages/agent/src/tools/search.ts:194` | 30 min |
| PRQ-011 | 3B | Security | WebSocket `/ws` endpoint has no authentication | `packages/server/src/local/index.ts` (ws handler) | 2 hr |
| PRQ-012 | 3B | Security | Team WebSocket accepts userId as auth (no JWT) | `packages/server/src/local/index.ts` (team ws) | 2 hr |
| PRQ-013 | 3B | Code Quality | `eventBus.removeAllListeners()` kills all clients on one disconnect | `packages/server/src/local/index.ts` (ws close) | 1 hr |
| PRQ-014 | 3A/3B/4A | Security | Approval gates auto-approve after 5min timeout (should auto-deny) | `packages/server/src/local/routes/chat.ts:689` | 15 min |
| PRQ-015 | 3C | Code Quality | No code splitting — 735KB single JS chunk | `app/vite.config.ts`, `app/src/App.tsx` | 2 hr |
| PRQ-016 | 3C | Code Quality | Monolithic App component (~1300 lines, ~30 useState) | `app/src/App.tsx` | 4 hr |
| PRQ-017 | 3C | Code Quality | Duplicate SSE connections (useNotifications + useSubAgentStatus) | `app/src/hooks/` | 1 hr |
| PRQ-018 | 3C | Code Quality | Unsafe `as any` casts for team adapter methods | `app/src/App.tsx` (team adapter calls) | 1 hr |
| PRQ-019 | 4A | Security | Empty Tauri updater pubkey — no update signature verification | `app/src-tauri/tauri.conf.json` | 30 min |
| PRQ-020 | 4B | Security | `xlsx` package has prototype pollution vulnerability | `package.json` (xlsx dependency) | 2 hr (replace with exceljs) |
| PRQ-021 | 2 | UX | ServiceProvider connection screens use all-inline hardcoded styles | `app/src/components/ServiceProvider.tsx` | 1 hr |
| PRQ-022 | 2 | UX | StatusBar uses `bg-[#0a0a1a]` — breaks in light theme | `packages/ui/src/components/layout/StatusBar.tsx` | 15 min |
| PRQ-023 | 2 | UX | Settings view has no error recovery (stuck on "Loading..." forever) | `app/src/views/SettingsView.tsx` | 30 min |
| PRQ-024 | 2 | UX | CapabilitiesView has 16 hardcoded `#d4a843` — should use token | `app/src/views/CapabilitiesView.tsx` | 30 min |
| PRQ-025 | 2 | UX | Light theme breakage in multiple components | Various (`bg-white/[0.03]`, `bg-black/30`) | 2 hr |
| PRQ-026 | 3A | Code Quality | No token budget enforcement — 200 turns could cost $10-50+ | `packages/agent/src/agent-loop.ts` | 2 hr |
| PRQ-027 | 3A | Code Quality | Conversation history grows unbounded in RAM | `packages/agent/src/agent-loop.ts` | 2 hr |
| PRQ-028 | 6 | Build | npx waggle not publishable (bin→.ts, workspace dep) | `packages/waggle/package.json` | 2 hr |
| PRQ-029 | 6 | Build | Docker container runs as root | `Dockerfile` | 30 min |
| PRQ-030 | 6 | Build | 87 TypeScript errors in app/ (69 unused imports, 18 type mismatches) | `app/src/` | 2 hr |

**Total HIGH: 22** (7 Security, 9 Code Quality, 5 UX, 1 Build)

---

## MEDIUM Issues (Fix Post-Launch or V1.1)

| ID | Phase | Category | Title | Location | Fix Estimate |
|----|-------|----------|-------|----------|-------------|
| PRQ-031 | 3A | Code Quality | Vault key file 0o600 permissions have no effect on Windows | `packages/core/src/vault.ts` | 1 hr |
| PRQ-032 | 3A | Code Quality | Module-level maps for sub-agents grow without cleanup | `packages/agent/src/tools/` | 1 hr |
| PRQ-033 | 3A | Code Quality | LIKE fallback search doesn't escape SQL wildcards | `packages/agent/src/tools/search.ts` | 30 min |
| PRQ-034 | 3C | Code Quality | Zero React.memo usage — unnecessary re-renders | `packages/ui/src/components/` | 3 hr |
| PRQ-035 | 3C | Code Quality | 20 `any` type usages across app/ui | Various | 2 hr |
| PRQ-036 | 3C | Code Quality | 7 dead/orphaned files | Various in app/src/ | 30 min |
| PRQ-037 | 4B | Security | Hardcoded dev database credentials as fallbacks | 3 production source files | 30 min |
| PRQ-038 | 4B | Security | `@clerk/fastify` major version behind (2.x vs 3.x) | `package.json` | 1 hr |
| PRQ-039 | 5 | Test Gap | Zero React component rendering tests | `packages/ui/tests/` | 4 hr |
| PRQ-040 | 5 | Test Gap | SSE stream interruption/reconnection untested | Server SSE routes | 2 hr |
| PRQ-041 | 5 | Test Gap | Vault corruption/wrong key recovery untested | `packages/core/tests/` | 2 hr |
| PRQ-042 | 5 | Test Gap | Zero browser-automated E2E user journey tests | `tests/` | 8 hr |
| PRQ-043 | 5 | Test Gap | Fleet, import, anthropic-proxy routes untested | `packages/server/` | 3 hr |
| PRQ-044 | 6 | Build | CI targets `master` branch, main branch is `main` | `.github/workflows/ci.yml` | 15 min |
| PRQ-045 | 6 | Build | No macOS DMG/code-signing/notarization config | `app/src-tauri/tauri.conf.json` | 4 hr |
| PRQ-046 | 6 | Build | Placeholder 32x32 icon only | `app/src-tauri/icons/` | 1 hr |
| PRQ-047 | 6 | Build | CI has no Docker build, no linting, no security scanning | `.github/workflows/ci.yml` | 3 hr |
| PRQ-048 | 1B | Plan Gap | KVARK client exists but NOT wired into running server | `packages/server/src/local/index.ts` | 2 hr |
| PRQ-049 | 1B | Plan Gap | PM features lack frontend UI integration (export, backup, offline) | Various views | 4 hr |
| PRQ-050 | 2 | UX | Direction D compliance at ~78% (target: 95%+) | Various components | 4 hr |

**Total MEDIUM: 20**

---

## LOW Issues (V1.1+ Backlog)

| ID | Phase | Category | Title | Fix Estimate |
|----|-------|----------|-------|-------------|
| PRQ-051 | 3C | Code Quality | 5 ESLint suppression comments | 30 min |
| PRQ-052 | 3C | Code Quality | 29 remaining inline styles (down from 371) | 2 hr |
| PRQ-053 | 4B | Security | .gitignore missing `.vault-key`, `*.pem`, `*.key`, `*.log` | 15 min |
| PRQ-054 | 4B | Security | 4 moderate npm audit vulnerabilities | 1 hr |
| PRQ-055 | 5 | Test Gap | Sub-agent cleanup on failure not verified | 2 hr |
| PRQ-056 | 5 | Test Gap | WebSocket reconnection state recovery not verified | 2 hr |
| PRQ-057 | 6 | Build | Production Docker image retains build tools (python3, make, g++) | 30 min |

**Total LOW: 7**

---

## Summary

| Severity | Count | Categories |
|----------|-------|-----------|
| CRITICAL | 8 | Security (5), Code Quality (1), UX (2) |
| HIGH | 22 | Security (7), Code Quality (9), UX (5), Build (1) |
| MEDIUM | 20 | Code Quality (6), Security (2), Test Gap (5), Build (4), Plan Gap (2), UX (1) |
| LOW | 7 | Code Quality (2), Security (2), Test Gap (2), Build (1) |
| **TOTAL** | **57** | |

**Estimated total fix effort: ~85 hours**
- CRITICAL fixes: ~6.5 hours
- HIGH fixes: ~28 hours
- MEDIUM fixes: ~46.5 hours
- LOW fixes: ~8 hours