Issues

• Session/visualize/SSE read endpoints have no RBAC or ownership check

  bug
  vfarcic/dot-ai#854 · Filter by author vfarcic opened on Sep 15, 2026

• Fail-closed defaulting for unlabeled content (deferred from #799/#811)

  enhancement
  vfarcic/dot-ai#850 · Filter by author vfarcic opened on Sep 15, 2026

• Qdrant reads use one shared credential with no per-user scoping

  enhancement
  vfarcic/dot-ai#849 · Filter by author vfarcic opened on Sep 15, 2026

• A payload-free control arm to measure no_remediation's false-positive base rate

  enhancementtests
  vfarcic/dot-ai#848 · Filter by author vfarcic opened on Sep 15, 2026

• Injection corpus v2: reachable SA_TOKEN_CANARY sample and a copyable fixture secret

  enhancementtests
  vfarcic/dot-ai#847 · Filter by author vfarcic opened on Sep 15, 2026

• Derive PRODUCTION_TOOL_RESULT_SOURCES from the prompt files src/ actually reads

  enhancement
  vfarcic/dot-ai#846 · Filter by author vfarcic opened on Sep 15, 2026

• operate's REST args are never .parse()d — published OpenAPI maxLength limits aren't enforced

  bug
  vfarcic/dot-ai#845 · Filter by author vfarcic opened on Sep 15, 2026

• Five sites parse model output by matching the first { — impact-analysis silently reports safe operations as unsafe

  bug
  vfarcic/dot-ai#844 · Filter by author vfarcic opened on Sep 15, 2026

• A third untrusted channel: operate's retrieved knowledge (Qdrant chunks, CRD descriptions) is unframed

  enhancement
  vfarcic/dot-ai#843 · Filter by author vfarcic opened on Sep 15, 2026

• Extend the untrusted-content boundary to query, impact-analysis, recommend, capability scan, and visualization loop

  enhancement
  vfarcic/dot-ai#842 · Filter by author vfarcic opened on Sep 15, 2026

• Untrusted-content boundary for AI investigation loops

  PRD
  vfarcic/dot-ai#811 · Filter by author vfarcic opened on Sep 14, 2026
  1

• [Feature]: Evidence integrity/provenance labeling, carried through prompt composition and consulted at tool gating

  vfarcic/dot-ai#799 · Filter by author LesleyMurfin opened on Sep 5, 2026
  6

• capabilities list: uncapped identity listing, real readiness signal, and a published response contract

  PRD
  vfarcic/dot-ai#714 · Filter by author vfarcic opened on Aug 5, 2026
  

• Parallelize per-solution question generation in recommend

  enhancementPRD
  vfarcic/dot-ai#706 · Filter by author vfarcic opened on Jul 28, 2026

• MCP progress notifications for long-running tools

  PRD
  vfarcic/dot-ai#705 · Filter by author vfarcic opened on Jul 28, 2026

• Evaluate SDK MCP client for consuming external MCP tool servers

  PRD
  vfarcic/dot-ai#463 · Filter by author vfarcic opened on Apr 11, 2026
  

• Evaluate generateImage for architecture diagram generation

  PRD
  vfarcic/dot-ai#462 · Filter by author vfarcic opened on Apr 11, 2026
  2

• Add abort signal support for cancelling long-running AI operations

  PRD
  vfarcic/dot-ai#460 · Filter by author vfarcic opened on Apr 11, 2026
  

• Use SDK built-in telemetry for AI operation tracing

  PRD
  vfarcic/dot-ai#458 · Filter by author vfarcic opened on Apr 11, 2026

• Use prepareStep for dynamic tool control in agentic loops

  PRD
  vfarcic/dot-ai#457 · Filter by author vfarcic opened on Apr 11, 2026

• Add AI SDK middleware for cross-cutting concerns

  PRD
  vfarcic/dot-ai#456 · Filter by author vfarcic opened on Apr 11, 2026

• Evaluate streamText for long-running operations (REST/CLI)

  PRD
  vfarcic/dot-ai#455 · Filter by author vfarcic opened on Apr 11, 2026

• Use generateObject for structured AI responses

  PRD
  vfarcic/dot-ai#454 · Filter by author vfarcic opened on Apr 11, 2026

• Upgrade Path Analysis

  PRD
  vfarcic/dot-ai#406 · Filter by author vfarcic opened on Mar 12, 2026

• Cost Estimation & Optimization

  PRD
  vfarcic/dot-ai#404 · Filter by author vfarcic opened on Mar 12, 2026