Roadmap: performance, resource & reliability sweep

[JSONbored]

Tracking epic for a sweep of performance, resource-usage, correctness, and test-coverage improvements surfaced by a codebase audit (2026-06). Each child below is independently shippable and scoped for a single focused PR.

The audit prioritized changes that improve work on the critical paths everyone hits — the build (which runs inside the test suite, every CI run, and every publish), the live D1-backed API routes (recomputed on every edge-cache miss), and the entity/block/extrinsic handlers (recently bug-prone).

Themes

• Build / CI resource — the artifact build does serial, per-subnet work on a path that runs many times per CI run.
• API runtime performance — offset pagination on large tables, an OR-across-columns query plan, serial batch/RPC dispatch, and uncached heavy live routes.
• Correctness / robustness — lenient entity ref/id parsing returning wrong-but-valid results, and re-implemented (inconsistent) query-param parsing.
• Test coverage — the scripts/ pipeline (~30k lines) is almost entirely unmeasured; branch-coverage gaps remain in a few hot runtime files.

Children

Build / CI resource

• perf(build): parallelize per-subnet artifact writes in build-artifacts.mjs #2057 — perf(build): parallelize per-subnet artifact writes in build-artifacts.mjs

API runtime performance

• perf(api): complete keyset-cursor pagination across entity feeds #2058 — perf(api): complete keyset-cursor pagination across entity feeds
• perf(api): audit + optimize the account_events hotkey-OR-coldkey query plan #2059 — perf(api): audit + optimize the account_events hotkey-OR-coldkey query plan
• perf(mcp): parallelize JSON-RPC batch dispatch #2060 — perf(mcp): parallelize JSON-RPC batch dispatch
• perf(api): cache/precompute heavy live D1 routes (compare/trends/percentiles) #2061 — perf(api): cache/precompute heavy live D1 routes (compare/trends/percentiles)
• perf(probe): evaluate parallelizing sequential subtensor probe RPC calls #2062 — perf(probe): evaluate parallelizing sequential subtensor probe RPC calls

Correctness / robustness

• fix(api): harden entity ref/id parsing — malformed refs resolve to wrong-but-valid results #2063 — fix(api): harden entity ref/id parsing (malformed refs → wrong-but-valid results)
• refactor(api): centralize + test pagination/query-param parsing #2064 — refactor(api): centralize + test pagination/query-param parsing

Test coverage

• test(scripts): unit-test the build/validator pipeline (only 4 of 85 scripts measured) #2065 — test(scripts): unit-test the build/validator pipeline (only 4 of 85 scripts measured)
• test: close branch-coverage gaps in hot runtime files #2066 — test: close branch-coverage gaps in hot runtime files

Notes

• Each child carries gittensor:bug for a uniform contributor lane.
• Medium-confidence perf items (the query-plan and caching ones) are framed as audit + optimize — the first deliverable is a measurement (EXPLAIN QUERY PLAN / before-after timing), not a blind change.
• Determinism guarantees on the build artifacts (reproducible generated_at, byte-identical output) must be preserved by any build-perf change.

---

Wave 2 — audit sweep (2026-06)

30 additional verified issues from a multi-agent codebase audit. ⭐ = gittensor:priority; 🔧 = not a good-first-issue (needs deeper context).

Correctness bugs

• handleBlockEvents trusts numeric block refs without a blocks-tier existence check (mirror of #1953) #2069 — handleBlockEvents trusts numeric block refs without a blocks-tier existence check (mirror of fix(api): resolve numeric block extrinsics refs #1953) ⭐
• handleAccountBalance loses u128 rao precision via Number(BigInt(...)) before scaling #2070 — handleAccountBalance loses u128 rao precision via Number(BigInt(...)) before scaling ⭐
• ai-search embedding-sync records docs as embedded even when Workers AI returns fewer/empty vectors, creating a permanent Vectorize hole #2071 — ai-search embedding-sync records docs as embedded even when Workers AI returns fewer/empty vectors, creating a permanent Vectorize hole ⭐🔧

Health/probe correctness

• Sustained-down RPC breaker ignores subtensor-wss, leaving degraded WSS endpoints pool_eligible forever #2072 — Sustained-down RPC breaker ignores subtensor-wss, leaving degraded WSS endpoints pool_eligible forever
• nodeWebSocketConnector hangs on premature WSS close and leaks the socket on error #2074 — nodeWebSocketConnector hangs on premature WSS close and leaks the socket on error

REST/MCP parity

• REST subnet list enum/string filters are case-sensitive while MCP list_subnets lowercases — same value, different outcome #2073 — REST subnet list enum/string filters are case-sensitive while MCP list_subnets lowercases — same value, different outcome
• REST subnets collection can't sort/filter by integration_readiness (MCP list_subnets can) #2085 — REST subnets collection can't sort/filter by integration_readiness (MCP list_subnets can)
• MCP and REST disagree on tie ordering for non-unique sort fields (sortSubnets has a netuid tie-break sortRows lacks) #2089 — MCP and REST disagree on tie ordering for non-unique sort fields (sortSubnets has a netuid tie-break sortRows lacks)

Reliability / timeouts

• handleAccountBalance finney RPC fetch has no AbortSignal timeout (unbounded on every cache miss) #2075 — handleAccountBalance finney RPC fetch has no AbortSignal timeout (unbounded on every cache miss)

Reliability / observability

• handleHealthTrends swallows D1 errors with a bare catch, bypassing the [d1All] dark-serve log contract #2076 — handleHealthTrends swallows D1 errors with a bare catch, bypassing the [d1All] dark-serve log contract

CORS correctness

• x-metagraph-stale-contract header is emitted but missing from Access-Control-Expose-Headers (unreadable cross-origin) #2077 — x-metagraph-stale-contract header is emitted but missing from Access-Control-Expose-Headers (unreadable cross-origin)
• icon-proxy 304 and 405 responses omit access-control-allow-origin, breaking cross-origin revalidation #2078 — icon-proxy 304 and 405 responses omit access-control-allow-origin, breaking cross-origin revalidation

D1 / query perf

• Add (hotkey, day) index on account_events_daily to remove temp-sort on the default /accounts/{ss58}/history #2079 — Add (hotkey, day) index on account_events_daily to remove temp-sort on the default /accounts/{ss58}/history
• Add composite extrinsics(signer, block_number, extrinsic_index) index to drop the per-account filesort and cover the summary aggregates #2080 — Add composite extrinsics(signer, block_number, extrinsic_index) index to drop the per-account filesort and cover the summary aggregates
• Add a (netuid, event_kind, block_number) index for the /subnets/{netuid}/events ?kind filter (currently an unindexed post-filter) #2081 — Add a (netuid, event_kind, block_number) index for the /subnets/{netuid}/events ?kind filter (currently an unindexed post-filter) 🔧
• Add a composite index for extrinsics feed call_module/call_function/success filters (currently unindexed PK-walk) #2082 — Add a composite index for extrinsics feed call_module/call_function/success filters (currently unindexed PK-walk) 🔧
• Add covering index for neuron_daily per-subnet history aggregation (avoid per-row heap fetch in handleSubnetHistory) #2083 — Add covering index for neuron_daily per-subnet history aggregation (avoid per-row heap fetch in handleSubnetHistory)

Caching correctness

• GraphQL POST returns cacheable success directives (max-age=60, SWR=300) even when result.errors is populated #2084 — GraphQL POST returns cacheable success directives (max-age=60, SWR=300) even when result.errors is populated

Input validation

• handleExtrinsics numeric feed filters silently coerce non-numeric values to 0 instead of rejecting with 400 #2086 — handleExtrinsics numeric feed filters silently coerce non-numeric values to 0 instead of rejecting with 400
• Cap semantic_search query length in shared semanticSearch (parity with ask's ASK_MAX_QUESTION_LENGTH) #2088 — Cap semantic_search query length in shared semanticSearch (parity with ask's ASK_MAX_QUESTION_LENGTH)

Security hardening

• RPC proxy upstream fetch omits redirect:'manual' — a 3xx from a trusted upstream is auto-followed, re-POSTing the caller body off-allowlist #2087 — RPC proxy upstream fetch omits redirect:'manual' — a 3xx from a trusted upstream is auto-followed, re-POSTing the caller body off-allowlist

Worker runtime perf

• /health readiness probe runs an unconditional non-memoized D1 query per request, contradicting its no-I/O docstring #2090 — /health readiness probe runs an unconditional non-memoized D1 query per request, contradicting its no-I/O docstring
• Homepage + api-catalog discovery responses lack ETag/304 (and api-catalog re-serializes per request) #2091 — Homepage + api-catalog discovery responses lack ETag/304 (and api-catalog re-serializes per request)
• Parallelize the four R2-staged loaders in the */3 fast-load cron (currently drained serially) #2092 — Parallelize the four R2-staged loaders in the */3 fast-load cron (currently drained serially)

Build/CI resource

• Memoize compileComponentValidator in validate-schemas.mjs (1,751 redundant ajv.compile() calls -> 61) #2093 — Memoize compileComponentValidator in validate-schemas.mjs (1,751 redundant ajv.compile() calls -> 61)
• Stop recompiling the full OpenAPI components block per route in validate-openapi-examples + validate-api #2094 — Stop recompiling the full OpenAPI components block per route in validate-openapi-examples + validate-api
• build-artifacts: replace per-row Array.find joins (source-health + candidate subnet_name) with Maps #2095 — build-artifacts: replace per-row Array.find joins (source-health + candidate subnet_name) with Maps
• build-artifacts: eliminate redundant re-filter/re-group of verification, endpoint, and candidate arrays #2096 — build-artifacts: eliminate redundant re-filter/re-group of verification, endpoint, and candidate arrays
• validate.mjs re-filters all surfaces per subnet instead of grouping once (asymmetric with adjacent endpointsByNetuid) #2097 — validate.mjs re-filters all surfaces per subnet instead of grouping once (asymmetric with adjacent endpointsByNetuid)

Test coverage

• Python SDK test suite (37 cases) is never run in CI or before PyPI publish #2098 — Python SDK test suite (37 cases) is never run in CI or before PyPI publish