jaylfc · jaylfc · Aug 17, 2026
diff --git a/enumerated_findings_2320.txt b/enumerated_findings_2320.txt
@@ -0,0 +1,101 @@
+From the bot-review retrospective audit — 2026-08-16 and the enumerated findings from the durable source, here are the **19 remaining #2320 bot findings** (excluding finding #6 which is already fixed via PR #2458):
+
+---
+
+1. **Finding #1** (Critical) - .claude/skills/taos-agent/SKILL.md:89
+   - Summary: Pin the controller installer to a release commit and add verification before running it as root
+   - Code location: `.claude/skills/taos-agent/SKILL.md:89`
+
+2. **Finding #2** (Major) - desktop/src/lib/knowledge.ts:66
+   - Summary: Restore CSRF wrapping in the JSON request helpers
+   - Code location: `desktop/src/lib/knowledge.ts:66`
+
+3. **Finding #3** (Major) - scripts/check_doc_gate.py:121
+   - Summary: Validate rule and invariant member types
+   - Code location: `scripts/check_doc_gate.py:121`
+
+4. **Finding #4** (Major) - scripts/collate_changelog.py:116
+   - Summary: Make insertion and fragment cleanup safe to retry
+   - Code location: `scripts/collate_changelog.py:116`
+
+5. **Finding #5** (Major) - tinyagentos/agent_token_auth.py:119
+   - Summary: Apply token rotation to `check_agent_identity`
+   - Code location: `tinyagentos/agent_token_auth.py:119`
+
+7. **Finding #7** (Major) - tinyagentos/routes/agent_registry.py:785
+   - Summary: Use a rotation value with finer resolution than integer-second `iat`
+   - Code location: `tinyagentos/routes/agent_registry.py:785`
+
+8. **Finding #8** (Major) - tinyagentos/routes/device_pair_requests.py:179
+   - Summary: A pairing request that cannot raise a Decision still returns 200 and consumes a cap slot
+   - Code location: `tinyagentos/routes/device_pair_requests.py:179`
+
+9. **Finding #9** (Critical) - tests/conftest.py:511
+   - Summary: Missing `device_pair_requests.close()` in test fixture teardown
+   - Code location: `tests/conftest.py:511`
+
+10. **Finding #10** (Warning) - tinyagentos/routes/device_pair_requests.py:46
+    - Summary: Platform whitelist mismatch with devices route
+    - Code location: `tinyagentos/routes/device_pair_requests.py:46`
+
+11. **Finding #11** (Warning) - tinyagentos/routes/notifications.py:54
+    - Summary: `level` accepts any string without validation
+    - Code location: `tinyagentos/routes/notifications.py:54`
+
+12. **Finding #12** (Warning) - tinyagentos/routes/device_pair_requests.py:175
+    - Summary: Bare `except Exception: pass` swallows all errors
+    - Code location: `tinyagentos/routes/device_pair_requests.py:175`
+
+13. **Finding #13** (Warning) - tinyagentos/device_pair_requests_store.py:243
+    - Summary: `list_pending` uses `SELECT *` while `get()` uses `_SAFE_COLS`
+    - Code location: `tinyagentos/device_pair_requests_store.py:243`
+
+14. **Finding #14** (Warning) - desktop/src/apps/LibraryApp.tsx:1230
+    - Summary: `parseInt` without radix collapses non-numeric input to 0
+    - Code location: `desktop/src/apps/LibraryApp.tsx:1230`
+
+15. **Finding #15** (Warning) - desktop/src/apps/LibraryApp.tsx:149
+    - Summary: `??` does not catch wrong-type values from `localStorage`
+    - Code location: `desktop/src/apps/LibraryApp.tsx:149`
+
+16. **Finding #16** (Warning) - desktop/src/apps/LibraryApp.tsx:1257
+    - Summary: React `key` embeds array index, causing reconciliation issues
+    - Code location: `desktop/src/apps/LibraryApp.tsx:1257`
+
+17. **Finding #17** (Suggestion) - desktop/src/apps/chat/ChannelSidebar.tsx:274
+    - Summary: `thinkingChannelIds.includes(ch.id)` is O(n) per channel
+    - Code location: `desktop/src/apps/chat/ChannelSidebar.tsx:274`
+
+18. **Finding #18** (Suggestion) - desktop/src/apps/chat/ChannelSidebar.tsx:501
+    - Summary: Same O(n) `includes()` lookup repeated in the desktop channel list
+    - Code location: `desktop/src/apps/chat/ChannelSidebar.tsx:501`
+
+19. **Finding #19** (Warning) - desktop/src/apps/chat/__tests__/render-helpers.test.tsx:107
+    - Summary: Incomplete `tool_call` block omits required fields
+    - Code location: `desktop/src/apps/chat/__tests__/render-helpers.test.tsx:107`
+
+20. **Finding #20** (Warning) - desktop/src/components/ToolCallBlock.tsx:62
+    - Summary: `StatusIndicator` switch has no default case
+    - Code location: `desktop/src/components/ToolCallBlock.tsx:62`
+
+21. **Finding #21** (Critical) - tinyagentos/routes/agent_registry.py:785
+    - Summary: CRITICAL - Use a rotation value with finer resolution than integer-second `iat`
+    - Code location: `tinyagentos/routes/agent_registry.py:785`
+
+22. **Finding #22** (Suggestion) - tinyagentos/routes/agent_registry.py:785
+    - Summary: SUGGESTION - Use a rotation value with finer resolution than integer-second `iat`
+    - Code location: `tinyagentos/routes/agent_registry.py:785`
+
+23. **Finding #23** (Warning) - .claude/skills/taos-agent/SKILL.md:113
+    - Summary: WARNING - Skill references `Tasks` instead of `Routines`
+    - Code location: `.claude/skills/taos-agent/SKILL.md:113`
+
+---
+
+**Note:** Finding #6 (project_notes scope binding) is already fixed via PR #2458 and should be excluded from this verification and fix process.
+
+Next Steps:
+1. Each finding needs to be verified against current origin/dev
+2. Confirmed findings will require test reproduction before fixing
+3. Stale findings will be noted as evidence that they're already fixed
+4. PR size constraint: max 7 findings per PR if more than 7 are confirmed
diff --git a/findings_enumerated.txt b/findings_enumerated.txt
@@ -0,0 +1,183 @@
+FINDING #1 | bot=cr sev=🟠 Major minor=False id=3744184930
+LOC: .claude/skills/taos-agent/SKILL.md:89
+SUMMARY: Pin the controller installer to a release commit and add verification before running it as root.
+PROMPT: Prompt for AI Agents 
+
+```
+Verify each finding against current code. Fix only still-valid issues, skip the
+rest with a brief reason, keep changes minimal, and validate.
+
+In @.claude/skills/taos-agent/SKILL.md around lines 88 - 89, Update the
+controller installation instructions around the quoted curl command to use an
+immutable release artifact or pinned release commit instead of master, verify
+its checksum or signature before execution, and avoid piping the downloaded
+script directly to sudo bash. For beta releases, provide a non-pipeline
+download-and-verify flow, and document the specific point and purpose of root
+privileges.
+```
+
+FINDING #2 | bot=cr sev=🟠 Major minor=False id=3744184935
+LOC: desktop/src/lib/knowledge.ts:66
+SUMMARY: Restore CSRF wrapping in the JSON request helpers.
+PROMPT: Prompt for AI Agents 
+
+```
+Verify each finding against current code. Fix only still-valid issues, skip the
+rest with a brief reason, keep changes minimal, and validate.
+
+In `@desktop/src/lib/knowledge.ts` around lines 64 - 66, Restore CSRF wrapping for
+the final same-origin JSON request in postJson at
+desktop/src/lib/knowledge.ts:64-66 by applying withCsrf to the merged init
+before fetch, adding its import if needed. Apply the same final-init wrapping in
+the POST caller at desktop/src/lib/github.ts:82-84, ensuring both mutating
+requests include X-CSRF-Token without changing handling for non-mutating or
+external URLs.
+```
+
+FINDING #3 | bot=cr sev=🟠 Major minor=False id=3744184941
+LOC: scripts/check_doc_gate.py:121
+SUMMARY: Validate rule and invariant member types.
+PROMPT: Prompt for AI Agents 
+
+```
+Verify each finding against current code. Fix only still-valid issues, skip the
+rest with a brief reason, keep changes minimal, and validate.
+
+In `@scripts/check_doc_gate.py` around lines 96 - 121, Extend _validate_config to
+validate each rule member: require name, when_changed, require_doc, hint, and
+on_modify to be strings when present, rejecting invalid values with ValueError
+so callers return EXIT_CONFIG_ERROR. Also iterate over
+invariants.referenced_paths_scan and require every entry to be a string,
+preserving existing structural checks and defaults.
+```
+
+FINDING #4 | bot=cr sev=🟠 Major minor=False id=3744184944
+LOC: scripts/collate_changelog.py:116
+SUMMARY: Make insertion and fragment cleanup safe to retry.
+PROMPT: prompt for AI agents 
+
+```
+Verify each finding against current code. Fix only still-valid issues, skip the
+rest with a brief reason, keep changes minimal, and validate.
+
+In `@scripts/collate_changelog.py` around lines 105 - 116, Make the insertion
+logic in the changelog collation flow robust when [Unreleased] has no trailing
+newline, and verify exactly one insertion occurred before deleting consumed
+fragments. Before inserting, detect whether the target version section already
+exists and skip insertion when it does, so retries cannot duplicate releases;
+only perform fragment cleanup after confirming the changelog was successfully
+updated or already contains that version section.
+```
+
+FINDING #5 | bot=cr sev=🟠 Major minor=False id=3744184948
+LOC: tinyagentos/agent_token_auth.py:119
+SUMMARY: Apply token rotation to `check_agent_identity`.
+PROMPT: prompt for AI agents 
+
+```
+Verify each finding against current code. Fix only still-valid issues, skip the
+rest with a brief reason, keep changes minimal, and validate.
+
+In `@tinyagentos/agent_token_auth.py` around lines 115 - 119, Extract the
+active-token and token_min_iat cutoff validation from _verify_agent_scope into a
+shared helper, preserving the existing 401 behavior for superseded tokens.
+Invoke this helper from both _verify_agent_scope and check_agent_identity so
+rotated tokens are rejected in identity-gated flows, and add a regression test
+covering a superseded token passed to check_agent_identity.
+```
+
+FINDING #7 | bot=cr sev=🟠 Major minor=False id=3744184953
+LOC: tinyagentos/routes/agent_registry.py:785
+SUMMARY: Use a rotation value with finer resolution than integer-second `iat`.
+PROMPT: Prompt for AI Agents 
+
+```
+Verify each finding against current code. Fix only still-valid issues, skip the
+rest with a brief reason, keep changes minimal, and validate.
+
+In `@tinyagentos/routes/agent_registry.py` around lines 783 - 785, Update
+tinyagentos/routes/agent_registry.py:783-785 in the token-rotation flow around
+bump_token_min_iat to use a signed monotonic token version or higher-resolution
+issued-at cutoff, rather than integer-second time.time(), so tokens minted
+before rotation in the same second are rejected. Update
+tests/test_token_rotation.py:166-174 to control the clock and verify that a
+pre-rotation same-second token is rejected while a post-rotation token is
+accepted.
+```
+
+FINDING #8 | bot=cr sev=🟠 Major minor=False id=3744184955
+LOC: tinyagentos/routes/device_pair_requests.py:179
+SUMMARY: A pairing request that cannot raise a Decision still returns 200 and consumes a cap slot.
+PROMPT: prompt for AI agents 
+
+```
+Verify each finding against current code. Fix only still-valid issues, skip the
+rest with a brief reason, keep changes minimal, and validate.
+
+In `@tinyagentos/routes/device_pair_requests.py` around lines 137 - 179, Require
+an available decision_store and non-empty admin_id before creating the pairing
+request or calling decision_store.create in the device-pairing route. If either
+prerequisite is missing, fail the request with a clear client-facing error
+instead of returning pair_request_id and verify_code; preserve the existing
+best-effort notification and success response only when approval can proceed.
+```
+
+FINDING #9 | bot=kilo sev=CRITICAL minor=False id=3744229727
+LOC: tests/conftest.py:511
+SUMMARY: CRITICAL:
+
+FINDING #10 | bot=kilo sev=WARNING minor=False id=3744229729
+LOC: tinyagentos/routes/device_pair_requests.py:46
+SUMMARY: WARNING:
+
+FINDING #11 | bot=kilo sev=WARNING minor=False id=3744229731
+LOC: tinyagentos/routes/notifications.py:54
+SUMMARY: WARNING:
+
+FINDING #12 | bot=kilo sev=WARNING minor=False id=3744229733
+LOC: tinyagentos/routes/device_pair_requests.py:175
+SUMMARY: WARNING:
+
+FINDING #13 | bot=kilo sev=WARNING minor=False id=3744229734
+LOC: tinyagentos/device_pair_requests_store.py:243
+SUMMARY: WARNING:
+
+FINDING #14 | bot=kilo sev=WARNING minor=False id=3744229735
+LOC: desktop/src/apps/LibraryApp.tsx:1230
+SUMMARY: WARNING:
+
+FINDING #15 | bot=kilo sev=WARNING minor=False id=3744229739
+LOC: desktop/src/apps/LibraryApp.tsx:149
+SUMMARY: WARNING:
+
+FINDING #16 | bot=kilo sev=WARNING minor=False id=3744229740
+LOC: desktop/src/apps/LibraryApp.tsx:1257
+SUMMARY: WARNING:
+
+FINDING #17 | bot=kilo sev=SUGGESTION minor=True id=3744229741
+LOC: desktop/src/apps/chat/ChannelSidebar.tsx:274
+SUMMARY: SUGGESTION:
+
+FINDING #18 | bot=kilo sev=SUGGESTION minor=True id=3744229742
+LOC: desktop/src/apps/chat/ChannelSidebar.tsx:501
+SUMMARY: SUGGESTION:
+
+FINDING #19 | bot=kilo sev=WARNING minor=False id=3744229745
+LOC: desktop/src/apps/chat/__tests__/render-helpers.test.tsx:107
+SUMMARY: WARNING:
+
+FINDING #20 | bot=kilo sev=WARNING minor=False id=3744229747
+LOC: desktop/src/components/ToolCallBlock.tsx:62
+SUMMARY: WARNING:
+
+FINDING #21 | bot=kilo sev=CRITICAL minor=False id=3744229752
+LOC: tinyagentos/routes/agent_registry.py:785
+SUMMARY: CRITICAL:
+
+FINDING #22 | bot=kilo sev=SUGGESTION minor=True id=3744229754
+LOC: tinyagentos/routes/agent_registry.py:785
+SUMMARY: SUGGESTION:
+
+FINDING #23 | bot=kilo sev=WARNING minor=False id=3744229757
+LOC: .claude/skills/taos-agent/SKILL.md:113
+SUMMARY: WARNING: