Static board · Read-only. Open an entry ID to inspect its Markdown source. Regenerate with /board-view after the board changes.

eb-self

0 open · 90 total

Pattern intelligence

Ranked systemic investigations

rule v1 · score is not confidence

useful resurfacing confirmed systemic fixes hypotheses with outcomes

No multi-entry clusters are present.

To do 0

—

Review 0

—

Validate 0

—

Done 82

B001P1

SessionStart O(n^2) blocked_by loop exceeds 10s timeout on large boards

hooks/scripts/board-session-start.sh

o-n-squaredhook-latency

B002P1

Injection reject-blocklist is trivially bypassable; payloads promote to live board

hooks/scripts/board-consolidate.sh

injection-filter-bypassuntrusted-input

B003P1

Adversarial/benign fixtures are dead code; ARCHITECTURE claims a reject-rate guarantee

tests/smoke/automated.sh

untested-claimtest-coverage-gap

B004P1

Permission allowlist does not cover the scripts the hooks actually invoke

references/required-permissions.json

permission-mismatchsilent-failure

B005P2

First captured finding is invisible — buried in _sessions/, only a count shown

hooks/stop-hook-procedure.md

invisible-feedbackux-affordance

B006P2

Advancing one entry through tdd->review->validate requires two session restarts

commands/worker-start.md

ux-friction

B007P2

Validator success is a dead end the board does not reflect

agents/validator.md

ux-affordance

B008P2

Corrupt/truncated session-mode.json silently un-pauses a paused session

hooks/scripts/board-stop-gate.sh

fail-opensilent-failure

B009P2

Consolidator silently no-ops (findings lost) when python3 is broken/absent

hooks/scripts/board-consolidate.sh

silent-failure

B010

Empty board renders a broken two-line open-count (0 then 0)

hooks/scripts/board-session-start.sh

cosmetic

+ 72 more resolved

B011

ARCHITECTURE.md is stale for 1.2.0 (version header, MCP server absent, wrong script/suite counts)

ARCHITECTURE.md

doc-drift

B012

CHANGELOG 1.2.0 link points to an unpushed rc tag (likely 404)

CHANGELOG.md

doc-drift

B013

README uses emoji, violating BRAND.md 'no emoji in product copy'

README.md

brand-consistency

B014P2

Two implementations of scratch->live promotion with no stated canonical engine

agents/consolidator.md

duplication

B015

Internal milestone jargon (M2.2.c) leaks into user-facing command output

commands/board-install-permissions.md

jargon-leak

B016

Version sprawl across surfaces; no authoritative version signal

references/required-permissions.json

version-drift

B017

board-triage says 'five rules' but defines six

skills/board-triage/SKILL.md

doc-inconsistency

B018

board-resolve contradicts itself on which steps are mandatory

skills/board-resolve/SKILL.md

doc-inconsistency

B019

pattern recurrence threshold is inconsistent (2+ vs >=3) across three surfaces

skills/board-intake/SKILL.md

doc-inconsistency

B020

board-migrate is two unrelated operations under one verb

commands/board-migrate.md

surface-overload

B021

code-reviewer name collides with /code-review and its tools contradict its read-only contract

agents/code-reviewer.md

namingcontract-mismatch

B022

nothing_to_test / nothing_to_review still advance the entry forward

agents/tdd-builder.md

counterintuitive-behavior

B023P2

board-index-check invariant is defeated by the resolve-in-place convention

hooks/scripts/board-index-check.sh

invariant-mismatchdogfooding-pain

B024P0

MCP path traversal via project name writes files outside the repo root

mcp-server/engineering_board_mcp.py

path-traversalmcp-security

B025P1

Reject filter bypassed by a polite/adverb lead-in before the imperative verb

hooks/scripts/board_reject_check.py

injection-filter-bypassuntrusted-input

B026P1

MCP-captured scratch findings are silently destroyed on consolidate

mcp-server/engineering_board_mcp.py

silent-data-lossformat-mismatch

B027P1

README Quickstart dead-ends at board-init; capture-promote-fix path is undiscoverable

README.md

onboardingtime-to-first-value

B028P2

MCP serialize_frontmatter does not escape newlines; field values can inject keys

mcp-server/engineering_board_mcp.py

frontmatter-injectionuntrusted-input

B029P2

claim-acquire self-deletes its lock on a session_id containing whitespace

hooks/scripts/board-claim-acquire.sh

input-validationsilent-failure

B030P2

Permission-install delivery is a 6-step copy-paste loop, undiscoverable from onboarding

commands/board-install-permissions.md

onboardingdelivery-friction

B031

Stale suite/file counts across README and ARCHITECTURE after C1

README.md

doc-driftcount-mismatch

B032

CHANGELOG Unreleased fixture arithmetic reads as a contradiction (50 vs 36+24)

CHANGELOG.md

doc-drift

B033

worker-start unsupported-discipline error leaks a version number to the user

commands/worker-start.md

jargon-leakversion-drift

B034P0

MCP entry_id path traversal in board_claim/board_release (arbitrary create + rm -rf)

mcp-server/engineering_board_mcp.py

path-traversalmcp-security

B035P1

MCP bulk tools bypass router-row containment (arbitrary BOARD.md overwrite + cross-root read)

mcp-server/engineering_board_mcp.py

path-traversalmcp-security

B036

MCP append_section heading/body not newline-flattened

mcp-server/engineering_board_mcp.py

input-hygiene

B037P1

Reject filter bypassed by markdown list/blockquote markers before the verb

hooks/scripts/board_reject_check.py

injection-filter-bypass

B038P1

MCP affects_prefix injects a BOARD-ROUTER row (control-file corruption + bulk DoS + project spoof)

mcp-server/engineering_board_mcp.py

router-injectionmcp-security

B039P2

MCP board_init follows symlinks to write scaffold outside root

mcp-server/engineering_board_mcp.py

path-traversalmcp-security

B040

MCP board_capture_finding title/kind not flattened (scratch header injection + count spoof)

mcp-server/engineering_board_mcp.py

input-hygienemcp-security

B041

RFC 0002 stale command count + missing /board-view verdict

docs/rfcs/0002-surface-product-review.md

doc-drift

B042

Landing page did not surface /board-view and still conceded the visualization gap it closed

docs/index.html

marketing-coherence

B043P1

Reject filter bypassed by Unicode bullets, markdown headings, line separators

hooks/scripts/board_reject_check.py

injection-filter-bypass

B044

MCP board_capture_finding evidence field injects scratch headers (count spoof)

mcp-server/engineering_board_mcp.py

input-hygienemcp-security

B045

CHANGELOG Unreleased reject-filter fixture counts stale + self-contradictory

CHANGELOG.md

doc-driftcount-mismatch

B046P1

Permission rules emitted without Tool(...) wrapper; self-check reports a false green

commands/board-install-permissions.md

permissionsfalse-negative-selfcheck

B047

worker->pm refusal hint points to a dead-end (/board-resume no-ops from worker mode)

hooks/scripts/board-mode-guard.sh

error-messagewrong-recovery-hint

B048P1

Reject filter bypassed by adverb-fronted imperatives

hooks/scripts/board_reject_check.py

injection-filter-bypass

B049

CHANGELOG never records run-all reaching 14 suites; a "13 suites" line is stale

CHANGELOG.md

stale-countcoherence

B050

/board-view (flagship visual viewer) absent from the Quickstart first-value path

README.md

onboardingdiscoverability

B051P1

Reject filter line-separator folding incomplete (CR/VT/FF/FS/GS/RS)

hooks/scripts/board_reject_check.py

injection-filter-bypass

B052

consolidate promotion writer flattens only evidence_quote, not title/affects/tags

hooks/scripts/board-consolidate.sh

frontmatter-injection

B053P1

Reject filter misses non-ASCII sentence terminators as clause boundaries

hooks/scripts/board_reject_check.py

injection-filter-bypass

B054P2

MCP board_capture_finding evidence blockquote splits on \n only (CR/FF/NEL forge a header)

mcp-server/engineering_board_mcp.py

frontmatter-injection

B055

README "rendered live by /board-view" link points at a raw .html blob (GitHub shows source)

README.md

docslink-degradation

B056P2

Reject terminator fold incomplete (Arabic comma/semicolon, Armenian, Tibetan, Khmer, Mongolian, ...)

hooks/scripts/board_reject_check.py

injection-filter-bypass

B057

count_scratch_findings undercounts multi-finding scratch-append blocks

mcp-server/engineering_board_mcp.py

status-accuracy

B058P1

Reject filter invisible-char strip is a hand-list; the Cf/default-ignorable class splits verbs

hooks/scripts/board_reject_check.py

injection-filter-bypass

B059P1

Reject filter skip-run misses ordered/lettered/checkbox list markers

hooks/scripts/board_reject_check.py

injection-filter-bypass

B060

Slash-directive regex misses a slash abutting a marker/quote/paren

hooks/scripts/board_reject_check.py

injection-filter-bypass

B061P2

Reject filter strips Unicode tag chars for its scan but promotes them raw (ASCII smuggling)

hooks/scripts/board_reject_check.py

injection-filter-bypass

B062P2

Promotion reuses resolved canonical entry identifiers

mcp-server/engineering_board_core.py

invariant-mismatchdogfooding-pain

B063P2

board_context silently returns no guidance for task-only requests

mcp-server/engineering_board_core.py

B064P2

MCP bundle builder reports a pin that it does not update

mcp-server/build-mcpb.sh

invariant-mismatchdogfooding-pain

B065P2

Promotion provenance collides when a daily MCP scratch file is recreated

mcp-server/engineering_board_core.py

B066P2

board_context rejects the safe repository-relative cwd '.'

mcp-server/engineering_board_core.py

B067P2

GitHub Actions forces actions/checkout v4 from deprecated Node.js 20 onto Node.js 24

.github/workflows/

B068P2

board-consolidate apply instructions omit the session selector required by session-scoped plans

skills/board-consolidate/SKILL.md

B069P2

Resolved entries append below older archive rows despite newest-first contract

mcp-server/engineering_board_mcp.py

B070P2

Fresh Codex marketplace installs mutable main under a released version label

.agents/plugins/marketplace.json

B071P2

Codex auto-loads Claude hook adapters that require CLAUDE_PROJECT_DIR

.codex-plugin/plugin.json

B072P2

Codex skips the prompt Stop hook and reports failure after every turn

.codex-plugin/plugin.json

B073P2

SessionStart counts BOARD convention examples as open entries

hooks/scripts/board-session-start.sh

B074P2

Self-hosted claim locks dirty the repository because runtime board paths are not ignored

.gitignore

B075P2

Authoritative current-behavior table describes superseded graph context and outcome limitations

docs/PRODUCT_EVOLUTION_SPEC.md

B076P2

Dated root audit snapshots can be mistaken for current product truth

COMPREHENSION.md

B077P2

Codex exec cancels read-only board tools while MCP schemas omit approval annotations

mcp-server/engineering_board_mcp.py

B078P2

Claude strict plugin validation rejects the ignored marketplace policy field

.claude-plugin/marketplace.json

F001P2

Zero-dep HTML board viewer (/board-view -> committed board.html)

commands/board-view.md

board-visibility

F002P2

Onboarding wizard (/board-setup) that collapses install->value to one step

commands/board-setup.md

onboarding

F003

Surface matched Learnings at the moment of need (session summary + viewer panel)

hooks/stop-hook-procedure.md

learnings-surfacing

F004P2

Package Engineering Board as an installable Codex plugin

.codex-plugin/plugin.json

Learnings · durable memory

L004high×11untested

A denylist heuristic is never done — assume every pattern has an adjacent bypass

applies to: hooks/scripts/board_reject_check.py, tests/security/

filter-completeness

L003high×7untested

The newest surface carries the most risk — red-team it hardest

applies to: mcp-server/

new-surface-risk

L005high×7untested

Fix an input-handling class across every site at once, not one site per cycle

applies to: hooks/scripts/board_reject_check.py, hooks/scripts/board-consolidate.sh, mcp-server/engineering_board_mcp.py

whole-class-sweep

L001high×3untested

Ship every deterministic guard with a test that drives its real fixtures and call-sites

applies to: hooks/scripts/, tests/, references/

untested-claim

L002medium×2untested

Board health invariants must respect the open-vs-resolved entry lifecycle

applies to: hooks/scripts/board-index-check.sh, hooks/scripts/board-session-start.sh

invariant-mismatch

Questions · Observations

Q001 question Does driving one board from Claude Code + Claude Desktop simultaneously work, and what breaks?
Q002 question Does current D.1 version 4 context change cross-incident diagnosis?
Q003 question Does context presentation prevent cross-incident first causes?

Stats

bugs 0 open · 78 resolved
features 0 open · 4 resolved
questions 0 open · 3 resolved
learnings 5
top patternsfilter-completeness ×1invariant-mismatch ×1new-surface-risk ×1

Coordination

Claims

no active claims

Recent reclaims

no recent reclaims

Active workers

no active workers