Rewrite the README for the revival beta - #1331
Conversation
Self-review — current head
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates the project's documentation, including the README and the Cloud Deployment Guide, to align with the new revival roadmap (ADR-0044), shifting the project's posture from archiving to a v0.x free open beta. It also updates the demo-autopilot.mjs script to use extractListItems when retrieving boards. Feedback on the code changes highlights a potential runtime TypeError if the API returns a nullish response when fetching boards, suggesting the use of a nullish coalescing operator to default to an empty array.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: ed0482664f
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Fresh-eyes review — changes requestedReviewed commit: Scope: every #1302 acceptance criterion, factual claims, links/commands, GIF provenance/legibility, and the deliberate #1299 licensing dependency. This was a read-only review; I made no branch changes. HIGH
MEDIUM
LOW
Acceptance-criterion / evidence notes
|
|
Review fix evidence for final head
Verification after the batch:
Merge remains blocked on #1296 and #1299; public hosted use additionally depends on #1297. |
|
@codex review Fresh round requested on final head |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 4fe6cc4117
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
Final-head CI accounting: required CI is 20/20 green, but CI Extended run 29220917062 is a real |
Chris0Jeky
left a comment
Chris0Jeky
left a comment
There was a problem hiding this comment.
Fresh independent final-head review — changes required
Reviewed exact commit: 4fe6cc41173f50b006e94a1cf58883ff23700de4
CRITICAL
None.
HIGH
None.
MEDIUM
-
The documented separate-process MCP quickstarts do not reuse the database created by this README's own source quickstart. (existing final-head bot thread)
Location:
README.md:91-99,mcp.example.json:1-10, and the standalone HTTP row atREADME.md:93.Risk:
scripts/dev-up.ps1 -Seedstarts the API with a process-scopedConnectionStrings__DefaultConnection=Data Source=%LOCALAPPDATA%\Taskdeck\taskdeck-dev.dband restores the parent environment;scripts/dev-up.sh --seedsimilarly exports the pinned XDG path only inside the launcher process. The copiedmcp.example.jsonsets onlyASPNETCORE_ENVIRONMENT, so a laterdotnet run ... -- --mcpprocess falls back toData Source=taskdeck.db. Stdio then cannot find the user the README just told the evaluator to create, and standalone HTTP reads a different API-key store, so the key created through the web app is rejected. The new prerequisite paragraph is therefore still not executable from the advertised source quickstart.Required resolution: make the MCP config/instructions carry the same stable connection string printed by
dev-up(cover Windows and XDG paths), or provide a startup/config path that persists and reuses it automatically. Verify both stdio user resolution and standalone HTTP Bearer-key auth after following the README source quickstart.
LOW
None beyond the medium finding above.
Acceptance criteria and evidence checked
- Read #1302, the PR body, all 6 changed files/full diff, 5 conversation comments, 11 reviews, and all 8 inline threads (including the seven resolved/outdated threads). The thread above is the only unresolved inline thread.
- README positioning now separates shipped pasted-text capture from planned v0.2 transcript evidence; the MCP direct-write exceptions, three modes, Docker/Compose URLs, connector-key requirements, private-only hosted posture, contribution/DCO wording, and archive-message removal otherwise match the final tree.
- Demo pagination is null-safe, follows every page, advances by returned item count, and has tests for null, multi-page, and empty-progress responses.
- GIF metadata at this SHA: 290,752 bytes, 1000×720, 4 frames, SHA-256
1C99C58585189421886882F8412E08F32E05F0417AAA503A65783AB16DDF991F. This matches the prior frame-by-frame review evidence. Seeded-generation provenance is available only through the PR narrative; no committed regeneration recipe was present in the diff. - #1302 remains intentionally incomplete until open PR #1296 establishes the revival direction and open issue #1299 supplies
LICENSING.mdand the permanent link. Public hosted evaluation additionally requires #1297 and an explicitly safe registration mode. - Final-head check rollup is 20/20 successful, but CI Extended run 29220917062 is a real
startup_failurewith zero jobs due to open #1330. Under the repository's zero-failing-CI rule, do not merge even after the documentation finding is fixed until a fresh Extended run is green.
|
Final MCP review fix evidence on |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: ac43e8755f
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
Late connector finding fixed at
The inline P2 has a direct reply and is resolved. Fresh exact-head review/CI requested. #1296/#1299 sequencing, #1297 public-hosting dependency, #1338 HTTP MCP boundary, and CI Extended #1330 continue to block merge. |
|
@codex review |
|
Codex Review: Didn't find any major issues. Keep them coming! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
CI Extended at exact head |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 53359a8177
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| "env": { | ||
| "ASPNETCORE_ENVIRONMENT": "Development" | ||
| "ASPNETCORE_ENVIRONMENT": "Development", | ||
| "ConnectionStrings__DefaultConnection": "Data Source=REPLACE_WITH_THE_ABSOLUTE_taskdeck-dev.db_PATH" |
There was a problem hiding this comment.
When Windows users follow the README and paste the dev-up path (for example C:\Users\...\Taskdeck\taskdeck-dev.db) into this JSON string, the single backslashes are parsed as JSON escapes (\U is invalid, and \t can become a tab), so the MCP config either fails to load or points at the wrong database. Please make the example/guidance JSON-safe for Windows, e.g. require forward slashes or doubled backslashes when replacing this placeholder.
Useful? React with 👍 / 👎.
| -e Jwt__SecretKey=$(openssl rand -base64 48) \ | ||
| -e Connectors__EncryptionKey=$(openssl rand -base64 32) \ | ||
| -e Cors__AllowedOrigins=http://localhost:5000 \ | ||
| -v taskdeck-data:/app/data \ |
There was a problem hiding this comment.
Fresh evidence after the earlier README fix: this cloud-guide command still generates a new Connectors__EncryptionKey each time while mounting the persistent taskdeck-data volume. If an evaluator reruns this local production test after storing connector credentials, the preserved SQLite database is paired with a different key and those credentials become undecryptable; use a reused env file like the README path or make this command explicitly throwaway by avoiding the persistent volume.
Useful? React with 👍 / 👎.
| - `TASKDECK_CONNECTORS_ENCRYPTION_KEY` (generate with: `openssl rand -base64 32`) | ||
| | Mode | Command / endpoint | Intended use | | ||
| |---|---|---| | ||
| | Local stdio | `dotnet run --project backend/src/Taskdeck.Api/Taskdeck.Api.csproj -- --mcp` | Local editor or agent client; zero network listener | |
There was a problem hiding this comment.
Because this command is now the copyable stdio MCP launch path, the project launch profile can corrupt the protocol before Taskdeck starts: backend/src/Taskdeck.Api/Properties/launchSettings.json enables dotnetRunMessages, and dotnet run with launch settings writes a startup banner to stdout (see dotnet/sdk#45640), which MCP clients parse as non-JSON before JSON-RPC begins. Use --no-launch-profile (and preferably a prebuilt/no-build launch) or a published executable for the stdio config.
Useful? React with 👍 / 👎.
| printf 'Jwt__SecretKey=%s\nConnectors__EncryptionKey=%s\n' \ | ||
| "$(openssl rand -base64 48)" \ | ||
| "$(openssl rand -base64 32)" \ | ||
| > deploy/.env.docker-run |
There was a problem hiding this comment.
This stores long-lived JWT and connector keys under deploy/, but the repo's .dockerignore does not exclude deploy/.env.docker-run or .env.*; after the first run, every later docker build ... . sends that secret file in the build context (and remote/buildx builders may retain it) even though Git ignores it. Put the file outside the Docker context or add an explicit .dockerignore exclusion before recommending this persistent path.
Useful? React with 👍 / 👎.
Summary
/api/boardsresponse.Closes #1302
Direction dependency: #1296
Related registration gate: #1297
Related licensing gate: #1299
Related release path: #1303
Related MCP security blocker: #1338
Verification
npx vitest --run tests/demo-seed.spec.ts tests/demo-shared.spec.ts- initial 19 passed.client-onboarding, six queue turns, fixed RNG seed - passed; 40 events, six proposal executions, six applies, zero autopilot errors, 11 screenshots.npx vitest --run tests/demo-shared.spec.ts- 6 passed, including null, multi-page, and no-progress pagination cases.npm run typecheck- passed.npm run build- passed.npx vitest --run- 297 files / 3,759 tests passed.taskdeck://boardsread passed against the same absolute SQLite DB./mcpreturned 404 while the accidental root route initialized outside the intended middleware boundary; no HTTP success is claimed, and [Bug] Map and authenticate HTTP MCP on the same /mcp route #1338 tracks the FULL-tier security repair.git diff --checkpassed.node scripts/check-docs-governance.mjs- passed.npx --yes markdown-link-check README.md --quiet- passed after it caught and prompted removal of a real 404 Discussions link.git diff --check- passed.Review fixes
Fresh independent review and bot feedback were handled in one batched push:
All eight inline bot threads were replied to with commit evidence and resolved. A consolidated finding-to-commit mapping is posted in the PR conversation.
Docs impact
README.mdanddocs/platform/CLOUD_DEPLOYMENT_GUIDE.mdnow reflect the proposed revival direction and make their dependency on docs: revival pivot (ADR-0044) - open-beta direction, REVIVAL_PLAN spine, canonical doc sync #1296 explicit.docs/STATUS.mdanddocs/IMPLEMENTATION_MASTERPLAN.mdare intentionally untouched because their direction sections belong to maintainer-owned docs: revival pivot (ADR-0044) - open-beta direction, REVIVAL_PLAN spine, canonical doc sync #1296/docs: generalist expansion wave (ADR-0046) - REVIVAL_PLAN Phase 4, artefact intake + dossiers + generalist reach, twin-app deferral #1328.Assumption / merge dependencies
Assumption: link the beta license statement to live tracker #1299 instead of adding or linking a nonexistent
LICENSING.md. Reason: #1299 owns the complete licensing posture and follows this issue in the authorized queue; a partial legal-position document would collide with that scope, while a dead relative link fails this issue's link check. Reversible by: after #1299 lands, replace the tracker link with relativeLICENSING.mdand rerun link verification.This PR is not merge-eligible until #1296 lands and #1299 supplies the final licensing link. Any public hosted evaluation additionally requires #1297 plus an explicitly safe registration mode.
Risks
CI status
4fe6cc41: 20 checks succeeded; final-headac43e875CI is running after the MCP documentation fix.startup_failurebefore jobs were created because of the shared reusable-workflow permission defect tracked in CI Extended startup-fails at reusable Gitleaks permission boundary #1330.Under the overnight zero-failing-check rule, that startup failure is real and this PR is not merge-eligible even apart from its #1296/#1299 content dependencies. Final-head required/Extended results must be accounted separately after completion.