eb-self

7 open · 70 total
To do 7
B006P2
Advancing one entry through tdd->review->validate requires two session restarts
commands/worker-start.md
ux-friction
B016P3
Version sprawl across surfaces; no authoritative version signal
references/required-permissions.json
version-drift
B020P3
board-migrate is two unrelated operations under one verb
commands/board-migrate.md
surface-overload
B021P3
code-reviewer name collides with /code-review and its tools contradict its read-only contract
agents/code-reviewer.md
namingcontract-mismatch
B022P3
nothing_to_test / nothing_to_review still advance the entry forward
agents/tdd-builder.md
counterintuitive-behavior
B057P3
count_scratch_findings undercounts multi-finding scratch-append blocks
mcp-server/engineering_board_mcp.py
status-accuracy
F003P3
Surface matched Learnings at the moment of need (session summary + viewer panel)
hooks/scripts/board-session-start.sh
learnings-surfacing
Review 0
—
Validate 0
—
Done 57
B001P1
SessionStart O(n^2) blocked_by loop exceeds 10s timeout on large boards
hooks/scripts/board-session-start.sh
o-n-squaredhook-latency
B002P1
Injection reject-blocklist is trivially bypassable; payloads promote to live board
hooks/scripts/board-consolidate.sh
injection-filter-bypassuntrusted-input
B003P1
Adversarial/benign fixtures are dead code; ARCHITECTURE claims a reject-rate guarantee
tests/smoke/automated.sh
untested-claimtest-coverage-gap
B004P1
Permission allowlist does not cover the scripts the hooks actually invoke
references/required-permissions.json
permission-mismatchsilent-failure
B005P2
First captured finding is invisible — buried in _sessions/, only a count shown
hooks/stop-hook-procedure.md
invisible-feedbackux-affordance
B007P2
Validator success is a dead end the board does not reflect
agents/validator.md
ux-affordance
B008P2
Corrupt/truncated session-mode.json silently un-pauses a paused session
hooks/scripts/board-stop-gate.sh
fail-opensilent-failure
B009P2
Consolidator silently no-ops (findings lost) when python3 is broken/absent
hooks/scripts/board-consolidate.sh
silent-failure
B010P3
Empty board renders a broken two-line open-count (0 then 0)
hooks/scripts/board-session-start.sh
cosmetic
B011P3
ARCHITECTURE.md is stale for 1.2.0 (version header, MCP server absent, wrong script/suite counts)
ARCHITECTURE.md
doc-drift
+ 47 more resolved
B012P3
CHANGELOG 1.2.0 link points to an unpushed rc tag (likely 404)
CHANGELOG.md
doc-drift
B013P3
README uses emoji, violating BRAND.md 'no emoji in product copy'
README.md
brand-consistency
B014P2
Two implementations of scratch->live promotion with no stated canonical engine
agents/consolidator.md
duplication
B015P3
Internal milestone jargon (M2.2.c) leaks into user-facing command output
commands/board-install-permissions.md
jargon-leak
B017P3
board-triage says 'five rules' but defines six
skills/board-triage/SKILL.md
doc-inconsistency
B018P3
board-resolve contradicts itself on which steps are mandatory
skills/board-resolve/SKILL.md
doc-inconsistency
B019P3
pattern recurrence threshold is inconsistent (2+ vs >=3) across three surfaces
skills/board-intake/SKILL.md
doc-inconsistency
B023P2
board-index-check invariant is defeated by the resolve-in-place convention
hooks/scripts/board-index-check.sh
invariant-mismatchdogfooding-pain
B024P0
MCP path traversal via project name writes files outside the repo root
mcp-server/engineering_board_mcp.py
path-traversalmcp-security
B025P1
Reject filter bypassed by a polite/adverb lead-in before the imperative verb
hooks/scripts/board_reject_check.py
injection-filter-bypassuntrusted-input
B026P1
MCP-captured scratch findings are silently destroyed on consolidate
mcp-server/engineering_board_mcp.py
silent-data-lossformat-mismatch
B027P1
README Quickstart dead-ends at board-init; capture-promote-fix path is undiscoverable
README.md
onboardingtime-to-first-value
B028P2
MCP serialize_frontmatter does not escape newlines; field values can inject keys
mcp-server/engineering_board_mcp.py
frontmatter-injectionuntrusted-input
B029P2
claim-acquire self-deletes its lock on a session_id containing whitespace
hooks/scripts/board-claim-acquire.sh
input-validationsilent-failure
B030P2
Permission-install delivery is a 6-step copy-paste loop, undiscoverable from onboarding
commands/board-install-permissions.md
onboardingdelivery-friction
B031P3
Stale suite/file counts across README and ARCHITECTURE after C1
README.md
doc-driftcount-mismatch
B032P3
CHANGELOG Unreleased fixture arithmetic reads as a contradiction (50 vs 36+24)
CHANGELOG.md
doc-drift
B033P3
worker-start unsupported-discipline error leaks a version number to the user
commands/worker-start.md
jargon-leakversion-drift
B034P0
MCP entry_id path traversal in board_claim/board_release (arbitrary create + rm -rf)
mcp-server/engineering_board_mcp.py
path-traversalmcp-security
B035P1
MCP bulk tools bypass router-row containment (arbitrary BOARD.md overwrite + cross-root read)
mcp-server/engineering_board_mcp.py
path-traversalmcp-security
B036P3
MCP append_section heading/body not newline-flattened
mcp-server/engineering_board_mcp.py
input-hygiene
B037P1
Reject filter bypassed by markdown list/blockquote markers before the verb
hooks/scripts/board_reject_check.py
injection-filter-bypass
B038P1
MCP affects_prefix injects a BOARD-ROUTER row (control-file corruption + bulk DoS + project spoof)
mcp-server/engineering_board_mcp.py
router-injectionmcp-security
B039P2
MCP board_init follows symlinks to write scaffold outside root
mcp-server/engineering_board_mcp.py
path-traversalmcp-security
B040P3
MCP board_capture_finding title/kind not flattened (scratch header injection + count spoof)
mcp-server/engineering_board_mcp.py
input-hygienemcp-security
B041P3
RFC 0002 stale command count + missing /board-view verdict
docs/rfcs/0002-surface-product-review.md
doc-drift
B042P3
Landing page did not surface /board-view and still conceded the visualization gap it closed
docs/index.html
marketing-coherence
B043P1
Reject filter bypassed by Unicode bullets, markdown headings, line separators
hooks/scripts/board_reject_check.py
injection-filter-bypass
B044P3
MCP board_capture_finding evidence field injects scratch headers (count spoof)
mcp-server/engineering_board_mcp.py
input-hygienemcp-security
B045P3
CHANGELOG Unreleased reject-filter fixture counts stale + self-contradictory
CHANGELOG.md
doc-driftcount-mismatch
B046P1
Permission rules emitted without Tool(...) wrapper; self-check reports a false green
commands/board-install-permissions.md
permissionsfalse-negative-selfcheck
B047P3
worker->pm refusal hint points to a dead-end (/board-resume no-ops from worker mode)
hooks/scripts/board-mode-guard.sh
error-messagewrong-recovery-hint
B048P1
Reject filter bypassed by adverb-fronted imperatives
hooks/scripts/board_reject_check.py
injection-filter-bypass
B049P3
CHANGELOG never records run-all reaching 14 suites; a "13 suites" line is stale
CHANGELOG.md
stale-countcoherence
B050P3
/board-view (flagship visual viewer) absent from the Quickstart first-value path
README.md
onboardingdiscoverability
B051P1
Reject filter line-separator folding incomplete (CR/VT/FF/FS/GS/RS)
hooks/scripts/board_reject_check.py
injection-filter-bypass
B052P3
consolidate promotion writer flattens only evidence_quote, not title/affects/tags
hooks/scripts/board-consolidate.sh
frontmatter-injection
B053P1
Reject filter misses non-ASCII sentence terminators as clause boundaries
hooks/scripts/board_reject_check.py
injection-filter-bypass
B054P2
MCP board_capture_finding evidence blockquote splits on \n only (CR/FF/NEL forge a header)
mcp-server/engineering_board_mcp.py
frontmatter-injection
B055P3
README "rendered live by /board-view" link points at a raw .html blob (GitHub shows source)
README.md
docslink-degradation
B056P2
Reject terminator fold incomplete (Arabic comma/semicolon, Armenian, Tibetan, Khmer, Mongolian, ...)
hooks/scripts/board_reject_check.py
injection-filter-bypass
B058P1
Reject filter invisible-char strip is a hand-list; the Cf/default-ignorable class splits verbs
hooks/scripts/board_reject_check.py
injection-filter-bypass
B059P1
Reject filter skip-run misses ordered/lettered/checkbox list markers
hooks/scripts/board_reject_check.py
injection-filter-bypass
B060P3
Slash-directive regex misses a slash abutting a marker/quote/paren
hooks/scripts/board_reject_check.py
injection-filter-bypass
B061P2
Reject filter strips Unicode tag chars for its scan but promotes them raw (ASCII smuggling)
hooks/scripts/board_reject_check.py
injection-filter-bypass
F001P2
Zero-dep HTML board viewer (/board-view -> committed board.html)
commands/board-view.md
board-visibility
F002P2
Onboarding wizard (/board-setup) that collapses install->value to one step
commands/board-setup.md
onboarding

Learnings · durable memory

L004high×11
A denylist heuristic is never done — assume every pattern has an adjacent bypass
applies to: hooks/scripts/board_reject_check.py, tests/security/
filter-completeness
L003high×7
The newest surface carries the most risk — red-team it hardest
applies to: mcp-server/
new-surface-risk
L005high×7
Fix an input-handling class across every site at once, not one site per cycle
applies to: hooks/scripts/board_reject_check.py, hooks/scripts/board-consolidate.sh, mcp-server/engineering_board_mcp.py
whole-class-sweep
L001high×3
Ship every deterministic guard with a test that drives its real fixtures and call-sites
applies to: hooks/scripts/, tests/, references/
untested-claim
L002medium×2
Board health invariants must respect the open-vs-resolved entry lifecycle
applies to: hooks/scripts/board-index-check.sh, hooks/scripts/board-session-start.sh
invariant-mismatch

Questions · Observations