docs: ticket sweep handoff — state, findings, remaining work

[JMAN730]

Records where the ticket sweep stopped so it can resume on another machine.

Closed this session

Six design tickets, each with full reasoning posted before closing: #22, #23, #30, #33, #39, #40. Both map bodies (#25, #18) updated with a decision entry per closed ticket.

Security findings (not yet fixed)

• Live credential leak on main — OpenAIProvider.kt:65 interpolates the raw 401 body (which echoes the key's first 8 + last 4 chars) into an IOException, which reaches logcat, task_history, the Logs screen, a persisted chat message, and then off-device via AgentLoop.kt:413 feeding the last 10 messages into the next request.
• Cross-vendor exfiltration — CustomOpenAIProvider.isAvailable() returns true unconditionally while defaulting to api.openai.com/v1, so an unconfigured provider sends prompts, notification bodies, and screenshots to OpenAI with an empty bearer.
• Merge-order constraint — PR feat: on-device crash log, plus CI to run the tests #36 should not merge ahead of the redaction work; its Share button dumps Throwable.message verbatim.

Also corrected

Map #25 asserted that executeWithFallback ships the cross-provider fallback. It has zero call sites and has never run — the live path is getActiveProvider. Map body fixed.

Open question

#34 is titled "post upstream", but AGENTS.md forbids writing to yashab-cyber/opendroid. Nothing has been posted upstream; needs a decision before #34 runs.

Full detail, including the remaining 13 issues in dependency order, in the added file.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: df50aa0eb7

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[greptile-apps]

Confidence Score: 4/5

Safe to merge once the #37 and #42 branching omission is addressed; all other docs are well-structured and internally consistent

Tickets #37 and #42 are listed under 'Ready now, no blockers' but both require branching from PR #36's branch rather than main. Unlike #46, which explicitly tells the agent to choose between waiting for the related PR or branching from its branch, #37 and #42 give no such instruction. An agent using the frontier-query logic will claim either ticket and branch from main; the Room migration for #37 then runs against the wrong schema, and with .fallbackToDestructiveMigration() active, the user's database is silently dropped at the next app launch.

Files Needing Attention: docs/agents/ticket-sweep-handoff.md — the #37 and #42 entries under 'Ready now, no blockers' need explicit branching instructions matching those already present for #46

Important Files Changed

Filename	Overview
docs/agents/ticket-sweep-handoff.md	Core handoff document recording sweep state, open findings, and resume instructions; #37 and #42 listed as 'Ready now, no blockers' but carry an implicit branch dependency on PR #36 without the explicit guidance given to #46
docs/agents/issue-tracker.md	Establishes gh CLI conventions and wayfinder operations; the blocked_by REST endpoint and Resolve/map-edit contradiction are flagged in prior threads
docs/agents/triage-labels.md	Maps canonical triage roles to tracker label strings; column header 'Label in mattpocock/skills' is a leftover template artifact
AGENTS.md	New top-level agent guidance file establishing fork as the only issue tracker and pointing to domain, issue-tracker, and triage-labels docs
docs/agents/domain.md	Documents single-context repo structure and instructs agents to read CONTEXT.md + ADRs before exploring; no issues found

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[Driving session reads\nticket-sweep-handoff.md] --> B[Frontier query:\npick next unblocked ticket]
    B --> C{Ticket stacks on\nan unmerged PR?}
    C -->|#37 and #42 stacks on PR 36\nbut NO explicit instruction| D[Agent assumes main and branches from main]
    C -->|#46 stacks on PR 38\nexplicit either/or given| E{PR #38 merged?}
    C -->|#31 / #32 / #24\nno branch dep| F[Branch from main]
    E -->|Yes| F
    E -->|No| G[Branch from PR #38 branch]
    D --> H[Room schema mismatch with fallbackToDestructiveMigration active causes user DB to be silently dropped]
    F --> I[Spawn ticket agent max 2 at a time]
    G --> I
    I --> J[1. Read AGENTS.md and issue-tracker.md]
    J --> K[2. Post findings comment and close ticket before polishing]
    K --> L[3. Leave context pointer as comment on closed ticket]
    L --> M[Driving session appends batch to map Decisions-so-far]
    M --> N{More tickets?}
    N -->|Yes| B
    N -->|No| O[Close maps #25 and #18 when all children done]

Loading

_{Reviews (3): Last reviewed commit: "docs: reconcile the map-edit rule betwee..." | Re-trigger Greptile}

[JMAN730]

@claude can you fix the greptile review

[JMAN730]

Review addressed in c74ed34. Three of the four findings were valid and are fixed; one is not correct and the doc is unchanged there.

Fixed

• Add --repo to every issue and PR example (codex, P1) — valid. Every gh issue and gh pr example in issue-tracker.md now carries --repo JMAN730/opendroid.
• Exempt gh api from the every-call --repo instruction (codex, P2) — valid, confirmed: gh api --help lists no --repo flag. Both the resume step and the tracker note now scope the instruction to gh issue/gh pr and say to put the repository in the endpoint path for gh api.
• "Landed" is ambiguous — PR feat: centralize and refresh the Anthropic Claude model catalog #38 has not merged (greptile, P1) — valid. That entry now states feat: centralize and refresh the Anthropic Claude model catalog #38 has not merged, says its commits live only on JMAN730/to-spec-branch-name, and gives both sequencing options.
• Live credential-leak fix has no tracking ticket (greptile, P2) — valid. Filed as Strip raw provider response bodies from thrown exceptions #46, referenced from both finding 1 and the ready-now list.

Not fixed — the finding is incorrect

Non-standard GitHub REST endpoint for blocked_by (greptile, P1). The endpoint exists and works on this repo. Run against the live API:

$ gh api repos/JMAN730/opendroid/issues/34/dependencies/blocked_by
[{"url":"https://api.github.com/repos/JMAN730/opendroid/issues/29", ...

It returns #29, the blocker recorded on #34 — a 200 with the dependency, not a 404. dependencies/blocked_by is GitHub's REST surface for issue dependencies and is distinct from sub_issues, which represents parent/child rather than blocking. The two are used for different edges and the doc already describes both separately. Left as written.

[JMAN730]

Second round addressed in 54ddb43.

Resolve step in issue-tracker.md contradicts step 4 here (greptile, P1) — valid, and the "who does it centrally" gap was real. Both files now say the same thing: during a sweep the ticket agent leaves its context pointer as a comment on the ticket it just closed, and the driving session appends to the map after each batch. Added as an explicit step 5 naming the owner and the trigger, with a cross-reference from issue-tracker.md's Resolve step, and a note that deferring all map edits to the end of the sweep is the exact failure this handoff exists to recover from.

Resolved the three remaining threads: the two codex ones are fixed in c74ed34, and the blocked_by endpoint one is answered above with a live API response showing a 200 rather than the predicted 404. Checks are green.