Issues

• security: client IP trusts X-Forwarded-For from any 6PN caller, not just the Caddy proxy

  2witstudios/PageSpace#2754 · Filter by author 2witstudios opened on Oct 1, 2026

• [tools] Two tool descriptions exceed the documented 1024-char provider cap — is it enforced anywhere?

  bug
  2witstudios/PageSpace#2480 · Filter by author 2witstudios opened on Aug 23, 2026

• tenant-export: four pre-existing defects that abort or corrupt a correct migration

  2witstudios/PageSpace#2459 · Filter by author 2witstudios opened on Aug 22, 2026

• Storage reconcile: a failure between charge and watermark advance re-bills the interval

  2witstudios/PageSpace#2445 · Filter by author 2witstudios opened on Aug 19, 2026

• Background reconciles cannot tell a landed charge from a swallowed one, and close the window anyway

  2witstudios/PageSpace#2444 · Filter by author 2witstudios opened on Aug 19, 2026

• Drive envs: a failed provision-time storage measurement is never retried

  2witstudios/PageSpace#2443 · Filter by author 2witstudios opened on Aug 19, 2026
  3

• Keep session panes mounted when returning to the conversation list (terminals lose their reap protection on navigation)

  enhancement
  2witstudios/PageSpace#2385 · Filter by author 2witstudios opened on Aug 10, 2026

• ask_user stays answerable during a remote collaborator's stream (GlobalAssistantView, SidebarChatTab)

  2witstudios/PageSpace#2305 · Filter by author 2witstudios opened on Aug 1, 2026

• Post-#2202 cleanup: drop layout blob, bootstrap table, and the rolling-deploy shim

  2witstudios/PageSpace#2228 · Filter by author 2witstudios opened on Jul 24, 2026

• Audit: full inventory of impure functions across the monorepo (goal: completely pure functions)

  audittech-debt
  2witstudios/PageSpace#2162 · Filter by author 2witstudios opened on Jul 19, 2026
  2

• [Epic] Sources of truth: stop synchronizing duplicated state — collapse it

  type:epic
  2witstudios/PageSpace#2161 · Filter by author 2witstudios opened on Jul 19, 2026

• pages: trash cascade implemented twice, plus raw non-cascading writers — the class of bug repair-orphaned-trashed-pages.ts fixes can recur

  enhancement
  2witstudios/PageSpace#2157 · Filter by author 2witstudios opened on Jul 19, 2026

• tasks: legacy assignee columns vs task_assignees junction — dual-write reimplemented in two writers, onboarding writes only the legacy side

  bug
  2witstudios/PageSpace#2152 · Filter by author 2witstudios opened on Jul 19, 2026

• admin: apps/admin is a hand-copied, already-diverged fork of apps/web modules (Stripe price IDs ×2, auth ×2, onboarding seeds ×2)

  enhancement
  2witstudios/PageSpace#2151 · Filter by author 2witstudios opened on Jul 19, 2026

• billing: the concurrency view counts credit holds, the gate counts per-process slots — the number users see is never the number that blocks them

  bug
  2witstudios/PageSpace#2147 · Filter by author 2witstudios opened on Jul 19, 2026

• state: SWR and Zustand both hold the same server state — useEditingStore + 17 isPaused guards are arbitration for duplication that should be collapsed

  type:epic
  2witstudios/PageSpace#2146 · Filter by author 2witstudios opened on Jul 19, 2026

• ai/state: finish the transport demotion — 7+ dual-write sites between the useChat array and the conversation cache

  enhancement
  2witstudios/PageSpace#2145 · Filter by author 2witstudios opened on Jul 19, 2026

• ai: useAnswerAskUser re-seeds the transport from a render-time snapshot — three distinct stale-write bugs

  bug
  2witstudios/PageSpace#2144 · Filter by author 2witstudios opened on Jul 19, 2026

• refactor(auth): eliminate barrel index.ts — direct imports per module

  2witstudios/PageSpace#1393 · Filter by author 2witstudios opened on May 21, 2026

• [GDPR] S4:F5: Encryption in transit gaps — HSTS gated on isProduction, internal traffic plaintext, n

  gdpr:criticalgdpr:stream-4gdpr
  2witstudios/PageSpace#969 · Filter by author 2witstudios opened on Apr 13, 2026

• [GDPR] S4:F2: File storage at rest is unencrypted; cloud relies entirely on infra disk encryption

  gdpr:criticalgdpr:stream-4gdpr
  2witstudios/PageSpace#966 · Filter by author 2witstudios opened on Apr 13, 2026

• [GDPR] F3.24: Tenant mode inherits full cloud AI provider set with no filtering

  gdpr:highgdpr:provider-deferredgdpr:stream-3gdpr
  2witstudios/PageSpace#964 · Filter by author 2witstudios opened on Apr 13, 2026
  1

• Externalize security audit logs and application logging

  enhancementtype:epic
  2witstudios/PageSpace#890 · Filter by author 2witstudios opened on Apr 11, 2026
  4

• Discovery: Multi-tenant Infrastructure Isolation Architecture

  2witstudios/PageSpace#772 · Filter by author 2witstudios opened on Mar 11, 2026

• [Epic] Monitoring

  type:epic
  2witstudios/PageSpace#592 · Filter by author 2witstudios opened on Feb 12, 2026 · Milestone 5: Enterprise Compliance