| ID | Type | Title | Cluster | Prio | Status | Assignee | Reporter | Created | Updated |
|---|---|---|---|---|---|---|---|---|---|
| FR-275 | feature | Affinity engine — types + affinity compute1 | P1 | In progress | — | claude-code | Sep 20, 2026 | 4h ago | |
| FR-274 | feature | Affinity engine — force layout + safety nets1 | P1 | In progress | — | claude-code | Sep 20, 2026 | 4h ago | |
| FR-273 | feature | Affinity engine — tagger agent1 | P1 | In progress | — | claude-code | Sep 20, 2026 | 4h ago | |
| FR-272 | feature | Affinity engine — orchestrator wiring + rendering1 | P1 | In progress | — | claude-code | Sep 20, 2026 | 4h ago | |
| FR-271 | feature | Affinity Layout Engine (epic) | P1 | In progress | — | claude-code | Sep 20, 2026 | 4h ago | |
| FR-264 | feature | StreamKit — Architecture B transport spike (anon-key auth path)1 | P0 | Open | — | claude-code | Sep 20, 2026 | 4h ago | |
| FR-263 | feature | StreamKit — Yjs server-write spike (de-risk)1 | P0 | Open | — | claude-code | Sep 20, 2026 | 4h ago | |
| FR-262 | feature | StreamKit — Session surface (/streamkit/[id])1 | P1 | In progress | — | claude-code | Sep 20, 2026 | 4h ago | |
| FR-261 | feature | StreamKit — Audio upload to Supabase Storage1 | P1 | In progress | — | claude-code | Sep 20, 2026 | 4h ago | |
| FR-260 | feature | StreamKit — Worker local scaffold1 | P1 | In progress | — | claude-code | Sep 20, 2026 | 4h ago | |
| FR-259 | feature | StreamKit — Railway deploy + Vercel↔worker HMAC auth1 | P1 | In progress | — | claude-code | Sep 20, 2026 | 4h ago | |
| FR-258 | feature | StreamKit — live_map Claude mode + prompt builder1 | P1 | In progress | — | claude-code | Sep 20, 2026 | 4h ago | |
| FR-257 | feature | StreamKit — Transcript debug panel1 | P2 | In progress | — | claude-code | Sep 20, 2026 | 4h ago | |
| FR-256 | feature | StreamKit — Session-end Y.Doc materialization1 | P1 | In progress | — | claude-code | Sep 20, 2026 | 4h ago | |
| FR-255 | feature | StreamKit POC — Live mapping from streamed audio (epic) | P1 | In progress | — | claude-code | Sep 20, 2026 | 4h ago | |
| FR-254 | feature | StreamKit — Typed-op transport + mid-session catch-up1 | P1 | In progress | — | claude-code | Sep 20, 2026 | 4h ago | |
| FR-253 | feature | StreamKit — Structural snapshots as durable op log1 | P1 | In progress | — | claude-code | Sep 20, 2026 | 4h ago | |
| FR-252 | feature | StreamKit — Whisper chunked transcription pipeline1 | P1 | In progress | — | claude-code | Sep 20, 2026 | 4h ago | |
| FR-251 | feature | StreamKit — Playback-locked op application1 | P0 | In progress | — | claude-code | Sep 20, 2026 | 4h ago | |
| FR-250 | feature | Parametric per-node styling for systems nodes — shape, fill, border, typography, dimensions | P1 | Open | — | claude-code | Sep 20, 2026 | 4h ago | |
| FR-246 | feature | DS Phase 4 — DS as a versioned product (versioning, docs, contribution guide) | P3 | Open | — | claude-code | Sep 20, 2026 | 4h ago | |
| FR-245 | feature | DS Phase 3 — Maturation (motion system, compound upgrades, new primitives, a11y) | P2 | Open | — | claude-code | Sep 20, 2026 | 4h ago | |
| FR-244 | feature | DS Phase 2 — Product migration to DS (surface-by-surface) | P1 | Open | — | claude-code | Sep 20, 2026 | 4h ago | |
| FR-241 | feature | Claude generate_style mode + 'Style with prompt…' toolbar action | P2 | Open | — | claude-code | Sep 20, 2026 | 4h ago | |
| FR-240 | feature | Node style schema + styleId on nodes + canvas.nodeStyles map | P2 | Open | — | claude-code | Sep 20, 2026 | 4h ago | |
| FR-239 | feature | Ship DSRP, BMC, BPMN node sets + picker in new-canvas dialog | P2 | Open | — | claude-code | Sep 20, 2026 | 4h ago | |
| FR-238 | feature | Drive NodeLibrary + keyboard shortcuts from canvas node set | P1 | Open | — | claude-code | Sep 20, 2026 | 4h ago | |
| FR-237 | feature | Parameterize Claude prompts by node set | P1 | Open | — | claude-code | Sep 20, 2026 | 4h ago | |
| FR-236 | feature | NodeSetRegistry + canvas.nodeSet column (locked at creation) | P1 | Open | — | claude-code | Sep 20, 2026 | 4h ago | |
| FR-235 | feature | Edge toolbar path-type selector + bulk action for multi-selection | P2 | Open | — | claude-code | Sep 20, 2026 | 4h ago | |
| FR-234 | feature | Per-canvas default edge type | P2 | Open | — | claude-code | Sep 20, 2026 | 4h ago | |
| FR-233 | feature | Per-edge path type: bezier, straight, step, smooth_step, orthogonal | P1 | Open | — | claude-code | Sep 20, 2026 | 4h ago | |
| FR-219 | feature | Add retry mechanism for failed Claude responses | P3 | Open | — | claude-code | Sep 20, 2026 | 4h ago | |
| FR-218 | feature | Stream chat mode progressively instead of full buffering | P2 | Open | — | claude-code | Sep 20, 2026 | 4h ago | |
| FR-217 | feature | Implement model selector in chat panel | P2 | Open | — | claude-code | Sep 20, 2026 | 4h ago | |
| FR-212 | feature | Ticket detail modal: editable metadata + Figma-accurate sidebar | P2 | In progress | — | claude-code | Sep 20, 2026 | 4h ago | |
| FR-204 | feature | Pixel-perfect BacklogWidget matching Figma design | P1 | In progress | — | claude-code | Sep 20, 2026 | 4h ago | |
| FR-193 | feature | Electron: Forge config + build scripts | P1 | In progress | — | claude-code | Sep 20, 2026 | 4h ago | |
| FR-177 | feature | Add grayscale button variants to Button component library | P2 | In progress | — | claude-code | Sep 20, 2026 | 4h ago | |
| BUG-118 | bug | ChatPanel AI operations not persisted — no autosave callback wired | P0 | Open | — | claude-code | Sep 20, 2026 | 4h ago | |
| BUG-117 | bug | Update operations on deleted nodes fail silently | P1 | Open | — | claude-code | Sep 20, 2026 | 4h ago | |
| BUG-116 | bug | Widget code size limit mismatch: prompt says 10KB, sandbox allows 20KB | P1 | Open | — | claude-code | Sep 20, 2026 | 4h ago | |
| BUG-115 | bug | Edge label validation does not enforce required label on connect operations | P0 | Open | — | claude-code | Sep 20, 2026 | 4h ago | |
| BUG-114 | bug | Bulk edit uses non-standard JSON format different from all other AI modes | P0 | Open | — | claude-code | Sep 20, 2026 | 4h ago | |
| BUG-113 | bug | Widget prompt uses source/target for edges but operation schema uses fromId/toId | P0 | Open | — | claude-code | Sep 20, 2026 | 4h ago | |
| BUG-112 | bug | Widget sandbox regex bypasses via unicode, prototype chains, infinite loops | P0 | Open | — | claude-code | Sep 20, 2026 | 4h ago | |
| BUG-111 | bug | Failed AI operations dropped silently with no user feedback | P0 | Open | — | claude-code | Sep 20, 2026 | 4h ago | |
| BUG-110 | bug | SSE client buffer in sse.ts has no size cap - memory DoS risk | P1 | Open | — | claude-code | Sep 20, 2026 | 4h ago | |
| BUG-109 | bug | Per-instance rate limiting not effective across Vercel replicas | P1 | Open | — | claude-code | Sep 20, 2026 | 4h ago | |
| FR-119 | feature | Focus mode — zoom to 1-hop neighborhood of selected node | P2 | In progress | — | claude-code | Sep 20, 2026 | 4h ago | |
| FR-118 | feature | Edge polarity UI — +/- toggle in edge toolbar | P1 | In progress | — | claude-code | Sep 20, 2026 | 4h ago | |
| FR-117 | feature | Node search — Cmd+F to find and highlight nodes by label | P2 | In progress | — | claude-code | Sep 20, 2026 | 4h ago | |
| FR-116 | feature | Node bookmarks — Cmd+1-9 to pin and jump to important nodes | P3 | In progress | — | claude-code | Sep 20, 2026 | 4h ago | |
| FR-114 | feature | Switch circuit symbols to IEC standard | P1 | In progress | — | claude-code | Sep 20, 2026 | 4h ago | |
| BUG-82 | bug | No A* result caching during drag — full pathfind per frame for connected wires | P2 | Open | — | claude-code | Sep 20, 2026 | 4h ago | |
| BUG-81 | bug | User waypoints hardcode Right/Left for intermediate segments | P2 | Open | — | claude-code | Sep 20, 2026 | 4h ago | |
| BUG-76 | bug | Harden measured preservation across all node mutation paths | P1 | Open | — | claude-code | Sep 20, 2026 | 4h ago | |
| FR-108 | feature | Decouple highlight from selection, add edge dimming | P2 | In progress | — | claude-code | Sep 20, 2026 | 4h ago | |
| FR-107 | feature | Replace select/pan toolbar toggle with modifier-based drag-select | P1 | In progress | — | claude-code | Sep 20, 2026 | 4h ago | |
| BUG-72 | bug | Circuit node labels overflow inflates measured size — breaks drag selection | P1 | In progress | — | claude-code | Sep 20, 2026 | 4h ago | |
| FR-106 | feature | Wire segment drag reposition for circuit wires1 | P1 | Open | — | claude-code | Sep 20, 2026 | 4h ago | |
| FR-105 | feature | Re-evaluate junction placement on component drag-stop | P1 | In progress | — | claude-code | Sep 20, 2026 | 4h ago | |
| BUG-58 | bug | Resize handle activation area too small on systems/sticky nodes1 | P2 | In progress | — | claude-code | Sep 20, 2026 | 4h ago | |
| BUG-53 | bug | Junction wire-component collision detection and warning indicator | P2 | Open | — | claude-code | Sep 20, 2026 | 4h ago | |
| FR-92 | feature | Circuit export — SPICE netlist, KiCad schematic, and SVG/PDF | P2 | Open | — | claude-code | Sep 20, 2026 | 4h ago | |
| FR-91 | feature | AI-powered circuit explanation mode — "What does this circuit do?" | P1 | Open | — | claude-code | Sep 20, 2026 | 4h ago | |
| FR-90 | feature | Circuit diagram starter templates (voltage divider, amplifiers, filters, etc.) | P2 | Open | — | claude-code | Sep 20, 2026 | 4h ago | |
| FR-81 | feature | AI-powered circuit tidy layout via Claude1 | P1 | Open | — | claude-code | Sep 20, 2026 | 4h ago | |
| FR-80 | feature | Tidy Circuit: ELK-based auto-layout for selected circuit components1 | P1 | Open | — | claude-code | Sep 20, 2026 | 4h ago | |
| FR-67 | feature | Build properties editor for circuit component values | P2 | Open | — | claude-code | Sep 20, 2026 | 4h ago | |
| BUG-42 | bug | SEC: Next.js 14.2.35 vulnerable to HTTP deserialization DoS (CVSS 7.5) | P1 | Open | — | claude-code | Sep 20, 2026 | 4h ago | |
| BUG-41 | bug | SEC: Canvas ID enumeration via differentiated invite endpoint errors | P3 | Open | — | claude-code | Sep 20, 2026 | 4h ago | |
| BUG-40 | bug | SEC: Weak password policy — minimum 6 characters below security standards | P2 | Open | — | claude-code | Sep 20, 2026 | 4h ago | |
| BUG-39 | bug | SEC: Email HTML injection via unescaped canvas title in invite emails | P2 | Open | — | claude-code | Sep 20, 2026 | 4h ago | |
| BUG-38 | bug | SEC: API error messages expose internal implementation details | P2 | Open | — | claude-code | Sep 20, 2026 | 4h ago | |
| BUG-37 | bug | SEC: In-memory rate limiter bypassed across Vercel serverless instances | P2 | Open | — | claude-code | Sep 20, 2026 | 4h ago | |
| BUG-36 | bug | SEC: Missing Content-Security-Policy and Strict-Transport-Security headers | P2 | Open | — | claude-code | Sep 20, 2026 | 4h ago | |
| BUG-34 | bug | SEC: Share token validation has no rate limiting — brute-force risk | P1 | Open | — | claude-code | Sep 20, 2026 | 4h ago | |
| BUG-33 | bug | SEC: CSRF protection fails open when Origin header is missing | P0 | Open | — | claude-code | Sep 20, 2026 | 4h ago | |
| BUG-32 | bug | SEC: SVG file upload allows embedded JavaScript — stored XSS risk | P0 | In progress | — | claude-code | Sep 20, 2026 | 4h ago | |
| BUG-31 | bug | SEC: Image upload missing rate limiting and canvas ownership verification | P0 | Open | — | claude-code | Sep 20, 2026 | 4h ago | |
| BUG-30 | bug | SEC: Realtime Yjs broadcasts not rate-limited — DoS vector | P2 | Open | — | claude-code | Sep 20, 2026 | 4h ago | |
| BUG-29 | bug | SEC: Presence spoofing — broadcast userId trusted without verification | P1 | Open | — | claude-code | Sep 20, 2026 | 4h ago | |
| BUG-28 | bug | SEC: Broadcast spoofing — Yjs updates accepted without sender validation | P0 | Open | — | claude-code | Sep 20, 2026 | 4h ago | |
| BUG-27 | bug | SEC: Unauthenticated Realtime channel access — any user can join any canvas | P0 | Open | — | claude-code | Sep 20, 2026 | 4h ago | |
| BUG-26 | bug | SEC: Widget code not re-validated after Claude generation | P2 | Open | — | claude-code | Sep 20, 2026 | 4h ago | |
| BUG-25 | bug | SEC: Widget evaluation has no timeout — browser freeze via infinite loop | P1 | Open | — | claude-code | Sep 20, 2026 | 4h ago | |
| BUG-24 | bug | SEC: Widget scope objects not frozen — prototype pollution risk | P0 | Open | — | claude-code | Sep 20, 2026 | 4h ago | |
| BUG-23 | bug | SEC: Widget sandbox escape via this keyword | P0 | Open | — | claude-code | Sep 20, 2026 | 4h ago | |
| FR-63 | feature | Investigate allowJs in tsconfig and tighten TypeScript config | P3 | Open | — | claude-code | Sep 20, 2026 | 4h ago | |
| FR-62 | feature | Add rate limiting to /api/share/validate endpoint | P3 | Open | — | claude-code | Sep 20, 2026 | 4h ago | |
| FR-61 | feature | Add RESEND_API_KEY and RESEND_FROM_EMAIL to documented environment variables | P3 | Open | — | claude-code | Sep 20, 2026 | 4h ago | |
| FR-60 | feature | Plan Next.js 15+ migration to resolve known CVEs | P3 | Open | — | claude-code | Sep 20, 2026 | 4h ago | |
| FR-59 | feature | Standardize error handling patterns across codebase | P3 | Open | — | claude-code | Sep 20, 2026 | 4h ago | |
| FR-58 | feature | Add Content-Security-Policy header and share token expiry | P3 | Open | — | claude-code | Sep 20, 2026 | 4h ago | |
| FR-57 | feature | Remove dead code lib/history.ts and update CLAUDE.md documentation | P3 | Open | — | claude-code | Sep 20, 2026 | 4h ago | |
| FR-56 | feature | Reorganize widget template files into directory structure | P2 | Open | — | claude-code | Sep 20, 2026 | 4h ago | |
| FR-55 | feature | Split large files exceeding 500 lines | P2 | Open | — | claude-code | Sep 20, 2026 | 4h ago | |
| FR-54 | feature | Refactor operations.ts to eliminate duplicate switch statements | P2 | Open | — | claude-code | Sep 20, 2026 | 4h ago | |
| FR-53 | feature | Extract shared resizer styles to node-primitives.ts | P2 | Open | — | claude-code | Sep 20, 2026 | 4h ago | |
| FR-52 | feature | Centralize configuration constants (rate limits, size limits, token budgets) | P2 | Open | — | claude-code | Sep 20, 2026 | 4h ago | |
| FR-51 | feature | Set up test framework and establish baseline coverage | P1 | Open | — | claude-code | Sep 20, 2026 | 4h ago | |
| BUG-22 | bug | Untracked screenshot file should be gitignored | P3 | Open | — | claude-code | Sep 20, 2026 | 4h ago | |
| BUG-21 | bug | Connect orphaned widget-templates-fr036.ts to widget system | P2 | Open | — | claude-code | Sep 20, 2026 | 4h ago | |
| BUG-20 | bug | Remove 17 console.log/error statements from production code | P2 | Open | — | claude-code | Sep 20, 2026 | 4h ago | |
| BUG-19 | bug | In-memory rate limiter ineffective on Vercel serverless | P1 | Open | — | claude-code | Sep 20, 2026 | 4h ago | |
| BUG-18 | bug | Claude operations emitted via SSE without server-side validation | P1 | Open | — | claude-code | Sep 20, 2026 | 4h ago | |
| BUG-17 | bug | CSRF protection only applied to /api/claude, missing on other API routes | P1 | Open | — | claude-code | Sep 20, 2026 | 4h ago | |
| BUG-15 | bug | HTML injection vulnerability in invite email template | P0 | Open | — | claude-code | Sep 20, 2026 | 4h ago | |
| BUG-14 | bug | Widget sandbox bypassable via Reflect.construct and string concatenation | P0 | Open | — | claude-code | Sep 20, 2026 | 4h ago | |
| FR-22 | feature | Controlled Fetch — Proxied Data Access for Widgets | P3 | Open | — | claude-code | Sep 20, 2026 | 4h ago | |
| FR-20 | feature | Inter-Widget Communication | P3 | Open | — | claude-code | Sep 20, 2026 | 4h ago | |
| FR-17 | feature | Data Injection via Widget Props | P3 | Open | — | claude-code | Sep 20, 2026 | 4h ago | |
| FR-14 | feature | Claude duplicate ticket detection and admin suggestions | P2 | Open | — | claude-code | Sep 20, 2026 | 4h ago | |
| FR-13 | feature | Add rolling context for Claude ticket creation | P2 | Open | — | claude-code | Sep 20, 2026 | 4h ago | |
| FR-12 | feature | Admin panel changelog with backlog/changelog tabs | P2 | Open | — | claude-code | Sep 20, 2026 | 4h ago | |
| FR-11 | feature | Simplify admin panel ticket statuses for Claude-driven dev | P2 | Open | — | claude-code | Sep 20, 2026 | 4h ago | |
| FR-10 | feature | Canvas export functionality (PNG/SVG) | P1 | Open | — | claude-code | Sep 20, 2026 | 4h ago | |
| FR-09 | feature | Claude-Powered Ticket Drafting | P1 | Open | — | claude-code | Sep 20, 2026 | 4h ago | |
| FR-07 | feature | Node Library Redesign — Two-Section Layout1 | P3 | In progress | — | claude-code | Sep 20, 2026 | 4h ago | |
| FR-06 | feature | Widget Node — AI-Generated Components1 | P3 | In progress | — | claude-code | Sep 20, 2026 | 4h ago | |
| FR-05 | feature | Embed Node1 | P3 | In progress | — | claude-code | Sep 20, 2026 | 4h ago | |
| FR-04 | feature | Sticky Notes — Freeform Capture on Canvas1 | P2 | In progress | — | claude-code | Sep 20, 2026 | 4h ago | |
| FR-03 | feature | Claude Cursor — AI Presence on Canvas1 | P2 | In progress | — | claude-code | Sep 20, 2026 | 4h ago | |
| FR-02 | feature | Interactive Canvas Landing Page1 | P1 | In progress | — | claude-code | Sep 20, 2026 | 4h ago | |
| FR-01 | feature | Migrate 463 tickets from old pm_tickets Backlog to new board2 | P1 | In progress | claude-code | claude-code | Sep 20, 2026 | 7h ago |