{ "dataset": "agent-failure-index", "version": "1.0", "license": "CC BY 4.0", "unitOfAnalysis": "One recorded production failure with a written root cause.", "snapshot": "d152f8a", "columns": [ { "name": "id", "description": "Stable identifier within this dataset." }, { "name": "occurred", "description": "Date the failure was recorded." }, { "name": "severity", "description": "s1 highest to s3 lowest, assigned at filing time." }, { "name": "system", "description": "The system or vendor the failure was filed against." }, { "name": "project", "description": "The kind of system, anonymised." }, { "name": "title", "description": "The failure, stated as a mechanism." }, { "name": "cause", "description": "Root cause, redacted and truncated. Angle brackets mark removals." }, { "name": "layer", "description": "Where the failure was: model, orchestration, application, infra, verification, data, thirdparty." }, { "name": "signal", "description": "What it told a human: loud, quiet, silent, wrong." }, { "name": "detect", "description": "Who caught it: human, check, client, downstream, audit." }, { "name": "prevent", "description": "What was written to stop it: gate, test, monitor, rule, none." }, { "name": "mast_mode", "description": "MAST failure mode, or empty where the taxonomy has no home for it." }, { "name": "silent_class", "description": "Silent-failure class A to E." }, { "name": "owasp_asi", "description": "OWASP Agentic Top 10 code, or empty where not a security event." }, { "name": "euaia_reportable", "description": "Counterfactual EU AI Act Article 73 reportability." }, { "name": "root_cause_written", "description": "true where the note carries a written root cause." }, { "name": "prevention_written", "description": "true where the note carries a written prevention rule." }, { "name": "fix_written", "description": "true where the note records what the fix was." }, { "name": "resolution_written", "description": "true where the note carries a written resolution." }, { "name": "resolved_field", "description": "The structured closure flag. Understates closure, see the study Method." }, { "name": "recurrence_count", "description": "Occurrences the fingerprint matched. Read as a floor." } ], "stats": { "total": 359, "classified": 358, "unclassified": 1, "duplicatePairs": 2, "distinctFaults": 357, "span": { "first": "2026-06-14", "last": "2026-08-21", "days": 68 }, "projects": 5, "severity": { "s1": 30, "s3": 147, "s2": 181 }, "layer": { "application": 81, "data": 33, "verification": 117, "infra": 66, "thirdparty": 32, "orchestration": 26, "model": 3 }, "layerOrder": [ "verification", "application", "infra", "data", "thirdparty", "orchestration", "model" ], "signal": { "silent": 176, "loud": 107, "wrong": 67, "quiet": 8 }, "signalOrder": [ "loud", "quiet", "silent", "wrong" ], "detect": { "audit": 125, "client": 11, "check": 120, "human": 97, "downstream": 5 }, "silentClass": { "B": 175, "A": 107, "E": 26, "C": 39, "D": 11 }, "euaia": { "would-report": 51, "would-log-only": 163, "would-miss": 144 }, "notLoud": 251, "verification": 117, "verificationLied": 92, "rootCauseWritten": 349, "preventionWritten": 339, "bothWritten": 336, "fixWritten": 11, "resolutionWritten": 71, "resolvedField": 6, "rulesPromoted": 0, "recurredMoreThanOnce": 8, "mastMapped": 14, "owaspMapped": 21 }, "rows": [ { "id": "afi-0334", "occurred": "2026-08-21", "severity": "s1", "system": "advizr", "project": "fleet admin console", "title": "Any validly-signed admin token opens the portal for a user id with no row", "cause": "Two compounding defects in getSession(). First, the portal gate tested PORTALROLES.includes(payload.role), the role claim from the JWT, before any database read, so a token minted while someone was staff kept working after their row changed.", "layer": "application", "signal": "silent", "detect": "audit", "prevent": "test", "mast_mode": null, "silent_class": "B", "owasp_asi": "ASI03", "euaia_reportable": "would-report", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": true, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0335", "occurred": "2026-08-21", "severity": "s1", "system": "advizr", "project": "internal agent platform", "title": "A master users.role value the fleet did not understand locked three owners out of eleven client tenants", "cause": "master users.role is a SHARED INTERFACE, one column in one database, read by roughly a dozen deployments, and nothing made them agree. A value could be added to the CHECK constraint in and granted to live rows while every consumer repo still had a hardcoded set that omitted it.", "layer": "data", "signal": "loud", "detect": "client", "prevent": "gate", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-report", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0336", "occurred": "2026-08-21", "severity": "s1", "system": "advizr", "project": "client agent platform", "title": "The client template has the same rowless-session hole as admin, on 11 tenants", "cause": "The same two compounding mistakes as the admin instance..single() makes a legitimate miss indistinguishable from a read failure, and if (!error && user) sends both down a permissive else-path instead of an explicit early return.", "layer": "application", "signal": "silent", "detect": "audit", "prevent": "test", "mast_mode": null, "silent_class": "B", "owasp_asi": "ASI03", "euaia_reportable": "would-report", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0337", "occurred": "2026-08-21", "severity": "s3", "system": "advizr", "project": "internal agent platform", "title": "A focus-ring assertion on reads the pre-transition colour and fails", "cause": "Tailwind v4 includes outline-color in the transition-colors property list. Any element carrying transition-colors duration-200 fades its focus ring in over 200ms from the initial value, which is currentColor.", "layer": "verification", "signal": "wrong", "detect": "check", "prevent": "test", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0338", "occurred": "2026-08-21", "severity": "s3", "system": "advizr", "project": "internal agent platform", "title": "Tailwind `first:` variant is dead when the parent wraps each item in its own div", "cause": "Tailwind's first: variant compiles to:first-child. SectionStage renders each dossier inside its own wrapper
, so every
is the first (and only) child of its own wrapper and:first-child matched all of them.", "layer": "application", "signal": "silent", "detect": "human", "prevent": "test", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0339", "occurred": "2026-08-21", "severity": "s3", "system": "artifact", "project": "internal agent platform", "title": "A position:fixed header inside an iframe bleeds the parent page into its own band", "cause": "position:fixed on an element INSIDE an iframe, where the iframe is itself absolutely positioned inside a position:fixed container with opacity-transitioned sibling iframes. That nesting makes Chromium composite the fixed subtree against the wrong layer and paint stale parent-page content into the fixed element's band.", "layer": "application", "signal": "loud", "detect": "human", "prevent": "test", "mast_mode": null, "silent_class": "A", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0340", "occurred": "2026-08-21", "severity": "s2", "system": "artifact", "project": "internal agent platform", "title": "An off-screen panel makes overflow:hidden a scroll container, so scrollIntoView drags the whole fixed UI sideways", "cause": "Two things combined. (1) The closed drawer is parked with transform:translateX(100%) at right:0, and a transformed element still contributes scrollable overflow to its ancestor, so the shell container had 360px of hidden scroll range.", "layer": "application", "signal": "loud", "detect": "human", "prevent": "test", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0341", "occurred": "2026-08-21", "severity": "s2", "system": "github", "project": "agency infrastructure", "title": "GitHub CI red for 16 days: ci.yml references repo secrets that were never created", "cause": "The auth-gate work on added Supabase env requirements to the build and wrote ci.yml to read them from repo secrets, but the secrets themselves were never created in the GitHub repo settings. The workflow was merged without ever running green on master (the \"a new CI gate leaves main already red\" pattern).", "layer": "verification", "signal": "silent", "detect": "audit", "prevent": "gate", "mast_mode": null, "silent_class": "E", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": true, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0342", "occurred": "2026-08-21", "severity": "s3", "system": "next", "project": "agency infrastructure", "title": "A readiness probe on localhost:3000 passed against ANOTHER session's app, so every content check was void", "cause": "This box runs many parallel worktrees and other sessions' dev servers. Port 3000 is the default for all of them, so a curl readiness probe cannot tell \"my server is up\" from \"somebody else's server is up\". curl -sf only checks the status code, and the squatting app returned 200.", "layer": "verification", "signal": "silent", "detect": "audit", "prevent": "rule", "mast_mode": null, "silent_class": "A", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": true, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0343", "occurred": "2026-08-21", "severity": "s3", "system": "next", "project": "agency infrastructure", "title": "fresh worktree build fails prerendering: no.env.local, Supabase client throws on /courses/self-healing-systems", "cause": "Git worktrees do not inherit untracked env files. 's marketing course pages create a Supabase server client at prerender time, so NEXTPUBLICSUPABASEURL/KEY must exist at build time, not just at runtime. The fresh worktree had no.env.local.", "layer": "infra", "signal": "loud", "detect": "check", "prevent": "rule", "mast_mode": null, "silent_class": "A", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0344", "occurred": "2026-08-21", "severity": "s3", "system": "next", "project": "agency infrastructure", "title": ": a colocated opengraph-image.tsx never ships, because buildMetadata always sets openGraph.images", "cause": "Next's file-convention opengraph-image only fills in when the page's metadata does not set openGraph.images. buildMetadata ALWAYS sets images: [{ url: ogImage ?? \"/og-default.png\",... }], so an explicit value is present on every page and the file convention can never win.", "layer": "application", "signal": "silent", "detect": "audit", "prevent": "test", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": true, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0345", "occurred": "2026-08-21", "severity": "s3", "system": "next", "project": "agency infrastructure", "title": "next/image emitted a 24px avatar variant, so pixel-art faces rendered upscaled on 2x screens", "cause": "next/image sizes its generated variants from the width prop, not from the source file. For a small fixed-size image the 1x variant is what the browser gets, and on a 2x screen that is an upscale. For a pre-sized capture the default quality 75 re-encode throws away detail that was already exactly right.", "layer": "application", "signal": "silent", "detect": "human", "prevent": "test", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": true, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0346", "occurred": "2026-08-21", "severity": "s3", "system": "next", "project": "agency infrastructure", "title": "stage-fit container query resolved against the viewport, so hero windows overflowed their stage", "cause": "Container query length units (cqw) silently fall back to the small viewport when no ancestor declares containment. The scaling rule was authored for StageMount (which has @container) and reused in ProductHero (which did not), so the same class produced a viewport-relative scale in one place and a stage-relative scale i...", "layer": "application", "signal": "silent", "detect": "human", "prevent": "test", "mast_mode": null, "silent_class": "A", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": true, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0347", "occurred": "2026-08-21", "severity": "s3", "system": "next", "project": "agency infrastructure", "title": "A tight SVG viewBox shaves a non-scaling stroke, and a clipping test aimed at the wrong layer proves nothing", "cause": "MARKVIEWBOX (\"\") is drawn tight to the glyph: the path bbox is 876.89 x 859.29 starting at x=101.11, so the window leaves 2.11 user units of margin on the left and 1.0 on the right.", "layer": "verification", "signal": "wrong", "detect": "human", "prevent": "test", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": true, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0348", "occurred": "2026-08-21", "severity": "s3", "system": "shell", "project": "agency infrastructure", "title": "Piping a gating command through tail reports the pipe's exit code: a failed next build read as \"completed exit 0\"", "cause": "A shell pipeline's exit status is the LAST command's. Piping a verification/build command through tail, grep or head replaces its exit code with the filter's, so a red build reports green. Background task notifications report that masked code.", "layer": "verification", "signal": "silent", "detect": "audit", "prevent": "rule", "mast_mode": null, "silent_class": "C", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0349", "occurred": "2026-08-21", "severity": "s2", "system": "vercel", "project": "agency infrastructure", "title": "Piping a value into `vercel env add` silently creates an EMPTY environment variable", "cause": "vercel env add reads the value interactively; piping it does not reliably supply the value, and the command still exits 0 having written an empty string. Nothing downstream complains at write time.", "layer": "infra", "signal": "silent", "detect": "audit", "prevent": "gate", "mast_mode": null, "silent_class": "A", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": true, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0315", "occurred": "2026-08-20", "severity": "s1", "system": "advizr", "project": "internal agent platform", "title": " published three fabricated case studies for 72 days with no gate", "cause": "The site build session invented plausible anonymised stories to fill the proof page, and no gate required an anonymised story to cite an engagement record. The claims surgery only banned specific legacy literals, so numbers that were never on the ban list survived.", "layer": "data", "signal": "silent", "detect": "audit", "prevent": "gate", "mast_mode": null, "silent_class": "D", "owasp_asi": null, "euaia_reportable": "would-report", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": true, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0316", "occurred": "2026-08-20", "severity": "s2", "system": "google", "project": "agency infrastructure", "title": "Google Ads modal panels never render under browser automation, blocking campaign settings, brand guidelines and the Google tag data sources", "cause": "Not fully diagnosed, but the ad blocker banner Google shows on every page is a RED HERRING and was ruled out. The automation profile at holds exactly two extensions, both Google's own defaults: ghbmnnjooekpmoecnnnilnnbdlolhkhi (Google Docs Offline) and nmmhkkegccagdldgiimedpiccmgmieda (Chrome Web Store Payments)...", "layer": "thirdparty", "signal": "loud", "detect": "human", "prevent": "rule", "mast_mode": null, "silent_class": "A", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0317", "occurred": "2026-08-20", "severity": "s3", "system": "next", "project": "agency infrastructure", "title": ": articleSchema silently dropped the `about` client Organization on every case-study page", "cause": "Excess-property checks do not apply to spread expressions in an object literal, so a key the function does not accept passes tsc and is dropped at runtime. The builder function had no about parameter.", "layer": "application", "signal": "silent", "detect": "audit", "prevent": "test", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0318", "occurred": "2026-08-20", "severity": "s2", "system": "next", "project": "agency infrastructure", "title": ": body font computes to ui-sans-serif, Geist Sans never applies", "cause": "Hypothesis, not yet proven by a fix: declares --font-sans: var(--font-geist-sans), system-ui, sans-serif inside @theme inline, and body { font-family: var(--font-sans) } reads the runtime custom property.", "layer": "application", "signal": "silent", "detect": "human", "prevent": "test", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": true, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0319", "occurred": "2026-08-20", "severity": "s3", "system": "next", "project": "agency infrastructure", "title": ": department titles rendered \"| | \" because the data carried the suffix the layout template appends", "cause": "Two layers both owned the site suffix. The root layout's Metadata.title.template appends \"| \" to every page title, and the department data was authored with the suffix inline (copying the visible tab title rather than the contract services/shared.ts documents: \" without '| <internal-project>' (...", "layer": "application", "signal": "loud", "detect": "human", "prevent": "test", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": true, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0320", "occurred": "2026-08-20", "severity": "s3", "system": "next", "project": "agency infrastructure", "title": ": FooterPlate dimension tags render at 8.87px on phones, on every page", "cause": "The phone width class on the AMarkBlueprint svg (w-[200px]) shrinks the whole 248-unit drawing, and the fig-tag text inside scales with it because SVG text has no minimum size.", "layer": "application", "signal": "silent", "detect": "human", "prevent": "test", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": true, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0321", "occurred": "2026-08-20", "severity": "s2", "system": "next", "project": "agency infrastructure", "title": "mega-menu By industry column shrank to one link when #78 changed proof tiers", "cause": "A navigation list was derived from a data honesty gate (proofStatus) that a different PR was entitled to change. The derivation coupled layout capacity (a four-row column) to editorial proof tiers with no assertion on the result, so an honest data change elsewhere produced a silent UI regression in a file the data PR n...", "layer": "application", "signal": "silent", "detect": "human", "prevent": "test", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": true, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0322", "occurred": "2026-08-20", "severity": "s2", "system": "next", "project": "agency infrastructure", "title": ": SectionStage sticky stage never stuck because the grid used lg:items-start", "cause": "position: sticky only travels within its containing block. align-items: start (or align-self: start) on a grid or flex item shrinks that item to content height, which makes the containing block exactly as tall as the sticky element, so it can never stick.", "layer": "application", "signal": "silent", "detect": "human", "prevent": "test", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0323", "occurred": "2026-08-20", "severity": "s3", "system": "next", "project": "agency infrastructure", "title": ": SpineList industry mini figures draw 13px labels at 5.6 to 9.9px from md to 1440", "cause": "SpineList.tsx renders a 288-unit (or wider) mini figure into a 3/12 grid column capped at 220px, with no labelScale and no width floor, so the label scale is 0.76 at best and 0.5 at md.", "layer": "application", "signal": "silent", "detect": "human", "prevent": "test", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": true, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0324", "occurred": "2026-08-20", "severity": "s3", "system": "next", "project": "agency infrastructure", "title": ": toLowerCase() on a department label flattened acronyms (\"The engineering and it day, drawn twice\")", "cause": "A whole-string toLowerCase() was used to write a proper label mid-sentence. Labels contain acronyms (IT, HR) that must keep their case, so the transform has to touch only the first character, and only when the first word is not itself an acronym.", "layer": "application", "signal": "silent", "detect": "human", "prevent": "test", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": true, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0325", "occurred": "2026-08-20", "severity": "s3", "system": "next", "project": "agency infrastructure", "title": "Dense nav panel verification: spec assumed taxonomy v2 data (14 systems / 5 families) that is not in the branch, and column 4 alone pushes panel height to 684px", "cause": "Two independent causes. (1) The branch's data layer has only 5 services across 3 families (revenue 2, operations 2, teammates 1); SERVICENAVGROUPS deliberately skips empty families (\"no orphaned heading\"), so knowledge/governance headings cannot render until their first service lands, the verification spec assumed syst...", "layer": "verification", "signal": "wrong", "detect": "human", "prevent": "rule", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0326", "occurred": "2026-08-20", "severity": "s3", "system": "next", "project": "agency infrastructure", "title": "Git Bash $! PID of a backgrounded `next start` is not the Windows PID, so taskkill cannot find it", "cause": "In Git Bash (MSYS), $! is the MSYS-level PID of the nohup/npx shim, not the Windows PID of the node.exe that ends up owning the port. taskkill and Stop-Process only know Windows PIDs, so the recorded PID is useless and the server survives.", "layer": "infra", "signal": "silent", "detect": "human", "prevent": "rule", "mast_mode": null, "silent_class": "A", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0327", "occurred": "2026-08-20", "severity": "s2", "system": "next", "project": "agency infrastructure", "title": "Lightning CSS drops a transform rule that uses tan()/atan2(), so the stage-fit scale never applied", "cause": "Lightning CSS, which Tailwind v4 uses to minify, validates transform values and silently removes a declaration it cannot parse; trig functions and the cqw-in-trig unit-stripping trick are not in its grammar. The rule then has no declarations left and is dropped entirely.", "layer": "application", "signal": "silent", "detect": "human", "prevent": "test", "mast_mode": null, "silent_class": "A", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": true, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0328", "occurred": "2026-08-20", "severity": "s3", "system": "next", "project": "agency infrastructure", "title": "Solutions mega-menu panel overflowed the left viewport edge by 22px at 1024 despite a comment calling 720px \"the proven fit\"", "cause": "A centered dropdown's maximum width is bounded by twice the trigger's distance to the nearest viewport edge, and that distance shrinks with the viewport (546 at 1440, 466 at 1280, 338 at 1024). The width was chosen at a wide viewport and the \"proven at 1024\" claim was written without a measurement at 1024.", "layer": "application", "signal": "silent", "detect": "human", "prevent": "test", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0329", "occurred": "2026-08-20", "severity": "s3", "system": "next", "project": "agency infrastructure", "title": "Sticky stage never stuck: grid items-start made the sticky's parent exactly its own height", "cause": "align-items: start on the grid stops the column from stretching to the row height, so position: sticky has no containing block taller than itself. The first visual QA pass relied on full-page screenshots, which cannot show sticky behaviour.", "layer": "application", "signal": "silent", "detect": "human", "prevent": "test", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0330", "occurred": "2026-08-20", "severity": "s2", "system": "next", "project": "agency infrastructure", "title": "<host> renders no Geist at all: next/font variables sit on body, Tailwind theme vars resolve on:root", "cause": "<path> applies ${geistSans.variable} ${geistMono.variable} to <body>, so --font-geist-sans and --font-geist-mono exist from body downward. Tailwind v4 emits the @theme tokens --font-sans: var(--font-geist-sans), system-ui, sans-serif and --font-mono: var(--font-geist-mono), ui-monospace, monospace on:root,:host (@layer...", "layer": "application", "signal": "silent", "detect": "human", "prevent": "test", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": true, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0331", "occurred": "2026-08-20", "severity": "s3", "system": "npm", "project": "agency infrastructure", "title": "drive-browser skill dead: an npm run in the user home pruned <path>", "cause": "The drive-browser skill (and ad-hoc Playwright scripts) resolve playwright by walking up from ~/.claude/skills/... to <path>, an ad-hoc user-level install with no package.json.", "layer": "infra", "signal": "loud", "detect": "human", "prevent": "rule", "mast_mode": null, "silent_class": "A", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0332", "occurred": "2026-08-20", "severity": "s3", "system": "vercel", "project": "internal agent platform", "title": "next.config.ts import of a src module with an @/ alias import fails only on Vercel", "cause": "The next.config.ts compiler resolves imports without the tsconfig paths alias, so any file reached from next.config that uses \"@/...\" breaks at config load time. tsc cannot catch it because tsc does honour the alias.", "layer": "verification", "signal": "silent", "detect": "check", "prevent": "rule", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0333", "occurred": "2026-08-20", "severity": "s3", "system": "vitest", "project": "agency infrastructure", "title": ": vitest cannot import any component that pulls in next-view-transitions (next/link resolution)", "cause": "next-view-transitions imports the extensionless \"next/link\" specifier, which Next's bundler resolves but Node ESM under vitest does not. Every data-level test that imports a component tree containing the site Link trips over it.", "layer": "verification", "signal": "loud", "detect": "check", "prevent": "rule", "mast_mode": null, "silent_class": "A", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0295", "occurred": "2026-08-19", "severity": "s1", "system": "advizr", "project": "internal agent platform", "title": "Deactivating a user in <internal-project> does not revoke their live session", "cause": "Authentication is a stateless JWT and the portal gate trusts the role claim inside it rather than the users row it then fetches. Deactivation is a database write, so it cannot reach a token that was already minted.", "layer": "application", "signal": "silent", "detect": "audit", "prevent": "gate", "mast_mode": null, "silent_class": "B", "owasp_asi": "ASI03", "euaia_reportable": "would-report", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0296", "occurred": "2026-08-19", "severity": "s3", "system": "branded", "project": "agency infrastructure", "title": "PDF overflow detector anchored on body text and reported clean pages as spilling", "cause": "The detector located the footer by text match alone: any block containing \"<internal-project> AI INC.\". In the SOW's governance section that string is also a two-word lane heading at y=110, so min(y) picked the heading and every block below it was flagged.", "layer": "verification", "signal": "wrong", "detect": "human", "prevent": "test", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": true, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0297", "occurred": "2026-08-19", "severity": "s3", "system": "branded", "project": "agency infrastructure", "title": "Placeholder guard fires on inlined content that names the placeholder", "cause": "The unsubstituted-placeholder guard runs after inlining. Once content is inlined, an occurrence of the placeholder token inside that content is textually indistinguishable from one the substitution missed.", "layer": "verification", "signal": "wrong", "detect": "check", "prevent": "test", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": true, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0298", "occurred": "2026-08-19", "severity": "s3", "system": "branded", "project": "agency infrastructure", "title": "Placeholder regex __[A-Z0-9_]+__ matches a run of underscores on a signature line", "cause": "The pattern has no anchor requiring an actual identifier between the delimiters. Inherited unchanged from decks/build-acquisition-memo.py, where it never fired because that document is a memo with no signature block. The defect was latent for as long as no document in this style had a form field in it.", "layer": "verification", "signal": "wrong", "detect": "check", "prevent": "test", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": true, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0299", "occurred": "2026-08-19", "severity": "s2", "system": "github", "project": "client agent platform", "title": "lint-and-typecheck went calendar-red: Bmp3 scope flags exceed the 14-day rolling_out limit", "cause": "The declared-levers stale-rollout gate compares each flag's rollingout start date to ROLLINGOUTMAXDAYS=14 at run time, so a rollout that never graduates turns the whole repo red by calendar with no commit involved. The two flags belong to the Bmp3 programme.", "layer": "verification", "signal": "wrong", "detect": "check", "prevent": "gate", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0300", "occurred": "2026-08-19", "severity": "s2", "system": "github", "project": "client agent platform", "title": "Template CI: a time-based flag-lifecycle gate turns master red with no commit: every open PR fails lint-and-typecheck", "cause": "<path> fails a flag left at stage 'rollingout' for more than ROLLINGOUTMAXDAYS (14). The check is a function of the CLOCK, not of the diff, the flag registry entries have not changed, they merely aged.", "layer": "verification", "signal": "wrong", "detect": "check", "prevent": "gate", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": false, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0301", "occurred": "2026-08-19", "severity": "s2", "system": "google", "project": "agency infrastructure", "title": "Google Ads recorded 0.00 conversions on CA$208.30 of Performance Max spend because the conversion label shipped empty", "cause": "SITE.adsBookingLabel in <path> shipped as \"\" when PR #11 landed on <phone>, and trackBookingCompleted() in <path> returns early when the label is empty (if (!SITE.adsBookingLabel) return;).", "layer": "application", "signal": "silent", "detect": "audit", "prevent": "test", "mast_mode": null, "silent_class": "C", "owasp_asi": null, "euaia_reportable": "would-report", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": true, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0302", "occurred": "2026-08-19", "severity": "s2", "system": "google", "project": "agency infrastructure", "title": "Google Ads tag data source is registered as <host>, not <host>, so the tag reads NEEDS ATTENTION and no lead-form conversion action can be created", "cause": "Not fully diagnosed. The most likely explanation is that when the Google tag was set up, the website given to Google was the <host> booking URL rather than <host>, so Google registered <host> as the tag's data source.", "layer": "thirdparty", "signal": "wrong", "detect": "audit", "prevent": "rule", "mast_mode": null, "silent_class": "A", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0303", "occurred": "2026-08-19", "severity": "s3", "system": "next", "project": "client agent platform", "title": "next build fails on Node 20.17 with ERR_REQUIRE_ESM (isomorphic-dompurify → @css<path>), and a piped build masked the failure", "cause": "Local machine runs Node v20.17.0 where require() of an ES module is still behind --experimental-require-module (unflagged in Node 20.19+/22.12+). Vercel/CI build on newer Node so master builds there.", "layer": "verification", "signal": "silent", "detect": "check", "prevent": "rule", "mast_mode": null, "silent_class": "C", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0304", "occurred": "2026-08-19", "severity": "s3", "system": "next", "project": "internal agent platform", "title": "Local Lighthouse target port was held by a foreign server answering 200 with plausible content", "cause": "Multiple parallel worktree sessions on this box run next start on hardcoded ports. A generic content gate (\"page title present\") cannot distinguish my build from a sibling's, because all worktrees serve the same site.", "layer": "verification", "signal": "silent", "detect": "audit", "prevent": "rule", "mast_mode": null, "silent_class": "A", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0305", "occurred": "2026-08-19", "severity": "s3", "system": "next", "project": "agency infrastructure", "title": "React keys and component-null indirection leak into the prerendered RSC payload, breaking byte-identity refactors", "cause": "The Next.js prerendered HTML embeds the RSC flight payload, which serializes the element tree exactly as constructed: element keys are written into the payload ([\"$\",\"section\",\"hero\",{...}] vs [\"$\",\"section\",null,{...}]), and a server-component element that resolves to null becomes an outlined lazy row instead of the l...", "layer": "application", "signal": "loud", "detect": "check", "prevent": "test", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": true, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0306", "occurred": "2026-08-19", "severity": "s3", "system": "next", "project": "internal agent platform", "title": "Section reorder broke the visible heading outline because Reveal hides h2s at audit time", "cause": "axe evaluates heading order over visible headings. Reveal-wrapped h2s are hidden below the fold when the audit snapshots the page, so any section order that puts a heading-less band between the hero and an h3-bearing section skips a level.", "layer": "verification", "signal": "wrong", "detect": "check", "prevent": "test", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0307", "occurred": "2026-08-19", "severity": "s3", "system": "next", "project": "internal agent platform", "title": "Signed >> in slug-hash seeding produced negative SVG coordinates", "cause": "JavaScript >> is a signed shift: a uint32 with the high bit set shifts to a negative number, and % preserves the sign. Only >>> keeps hash-derived values unsigned.", "layer": "application", "signal": "loud", "detect": "human", "prevent": "test", "mast_mode": null, "silent_class": "A", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0308", "occurred": "2026-08-19", "severity": "s3", "system": "next", "project": "internal agent platform", "title": "TaskStop left next start holding the port, so Lighthouse audited a stale build", "cause": "On Windows, stopping the background bash wrapper does not kill the node child process; the orphan keeps the listening socket. The replacement server exits on EADDRINUSE, invisibly when stdout is redirected.", "layer": "verification", "signal": "silent", "detect": "audit", "prevent": "rule", "mast_mode": null, "silent_class": "A", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0309", "occurred": "2026-08-19", "severity": "s3", "system": "next", "project": "agency infrastructure", "title": "Wave-1 test invariant \"beforeAfter before proof\" fails every founding-tier class C industry page", "cause": "The gate was written in the wave-1 era when every composed page was proofStatus \"anchored\" and the proof section always rendered case evidence primed by the before/after band.", "layer": "verification", "signal": "wrong", "detect": "check", "prevent": "test", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0310", "occurred": "2026-08-19", "severity": "s3", "system": "next", "project": "internal agent platform", "title": "Wave-1 vitest gate \"beforeAfter before proof\" fails every offer-forward waves 2-4 industry page", "cause": "The wave-1 test encoded that wave's proof-forward section orders (all four shipped pages open hero, logos, pains, beforeAfter, proof) as a universal invariant, and the waves 2-4 set audit verified drafts against its own written contract (beforeAfter in first 6) without running the live vitest suite, so the divergence s...", "layer": "verification", "signal": "wrong", "detect": "check", "prevent": "test", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0311", "occurred": "2026-08-19", "severity": "s2", "system": "railway", "project": "internal agent platform", "title": "Railway deployments stick in INITIALIZING with no associated build, silently keeping the old container", "cause": "Railway-side build scheduling, proven by control experiment: the last-known-good tree fails the same way. Not the image, not the code, not the dependencies. The earlier hypothesis that /v2/run blocking the uvicorn event loop was stalling a graceful drain is NOT supported, because the control deploy stalled with no traf...", "layer": "thirdparty", "signal": "silent", "detect": "audit", "prevent": "monitor", "mast_mode": null, "silent_class": "A", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0312", "occurred": "2026-08-19", "severity": "s2", "system": "railway", "project": "internal agent platform", "title": "Railway deployments stick in INITIALIZING with no associated build, silently keeping the old container", "cause": "Not fully diagnosed, and it is Railway-side rather than in the image: the same Dockerfile and a 9.4MB upload built and deployed fine hours earlier, the build that did run installed every dependency and pushed the image successfully, and the module imports cleanly under the exact importlib.importmodule call /health make...", "layer": "thirdparty", "signal": "silent", "detect": "audit", "prevent": "monitor", "mast_mode": null, "silent_class": "A", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0313", "occurred": "2026-08-19", "severity": "s1", "system": "supabase", "project": "fleet admin console", "title": "Owner role flip took 3 staff off all 11 client tenants: a new value written to a shared role column before the fleet's readers shipped", "cause": "users.role on master is read by twelve deployments: the admin portal, the router, and every client fork. <internal-project> shipped support for a new value ('owner') and the row was flipped before the client-template change (PR #2199) had merged or rolled to the fleet.", "layer": "data", "signal": "loud", "detect": "client", "prevent": "gate", "mast_mode": null, "silent_class": "B", "owasp_asi": "ASI03", "euaia_reportable": "would-report", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0314", "occurred": "2026-08-19", "severity": "s3", "system": "vercel", "project": "fleet admin console", "title": "Two owner-only admin routes 500 in production: they read tenant audit_events via getClientSupabase(), whose env vars are unset", "cause": "Both routes call getClientSupabase() (<path>), which throws unless NEXTPUBLICSUPABASEURL and SUPABASESERVICEROLEKEY are set. Neither is set on the <internal-project> deployment, confirmed by grepping the production env pulled to.env.local (0 matches).", "layer": "application", "signal": "loud", "detect": "check", "prevent": "gate", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": false, "fix_written": false, "resolution_written": true, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0273", "occurred": "2026-08-18", "severity": "s2", "system": "advizr", "project": "internal agent platform", "title": "main is red on its own preflight: #26 merged an em dash because the repo had no CI", "cause": "<internal-project>/<internal-project> had no CI whatsoever. git ls-tree -r --name-only origin/main | grep -c \"^.github\" returned 0. <path> existed and encoded real constraints (banned claims, literal prices, retired guarantee wording, wrong-domain email, em dashes) but only ran when a human remembered to run it locally...", "layer": "verification", "signal": "silent", "detect": "audit", "prevent": "gate", "mast_mode": null, "silent_class": "E", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": true, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0274", "occurred": "2026-08-18", "severity": "s3", "system": "claude", "project": "internal agent platform", "title": "Monitor piping gh output through jq emitted nothing and burned its full 20-minute timeout", "cause": "There is no standalone jq binary on this machine. Every pipeline stage that shelled out to jq failed, so cur was always empty, comm -13 diffed empty against empty and printed nothing, and the jq -e break condition never evaluated true, so the loop ran to its full timeout instead of exiting on completion.", "layer": "verification", "signal": "silent", "detect": "human", "prevent": "rule", "mast_mode": null, "silent_class": "A", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": false, "fix_written": false, "resolution_written": true, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0275", "occurred": "2026-08-18", "severity": "s2", "system": "composio", "project": "internal agent platform", "title": "24k tool-schema ceiling silently dropped connected apps' wide-parameter READS (only the canonical write was protected)", "cause": "The ceiling drop policy used token size as a proxy for \"reads are cheap\". That proxy inverts for wide-parameter reads, so the browse action a customer connected the app to use was dropped every step while its cheap write was protected.", "layer": "orchestration", "signal": "silent", "detect": "audit", "prevent": "test", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0276", "occurred": "2026-08-18", "severity": "s2", "system": "composio", "project": "internal agent platform", "title": "Composio loader failed OPEN to [] on a shared 6s deadline, dropping ALL connectors for a turn (vanish-then-reappear)", "cause": "Fail-open-to-[] plus one shared Promise.all deadline meant any transient Composio slowness dropped the entire connected toolset for that turn, and the model narrated the gap as a disconnected app.", "layer": "orchestration", "signal": "silent", "detect": "human", "prevent": "test", "mast_mode": "FM-2.6", "silent_class": "D", "owasp_asi": null, "euaia_reportable": "would-report", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0277", "occurred": "2026-08-18", "severity": "s3", "system": "drive", "project": "agency infrastructure", "title": "drive-browser step reported a false failure: waitForFunction on \\\\\"body text changed\\\\\" resolves on the button's own \\\\\"Sending…\\\\\" label and races the request", "cause": "The step used page.waitForFunction((prev) => document.body.innerText !== prev, before) as its post-click settle. That predicate resolves on the FIRST DOM mutation after the click, and the first mutation is the button relabelling itself to \"Sending…\", not the server's response.", "layer": "verification", "signal": "wrong", "detect": "human", "prevent": "test", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0278", "occurred": "2026-08-18", "severity": "s2", "system": "evals", "project": "agency infrastructure", "title": "Regression cases written from a transcript passed against the broken prompt and proved nothing", "cause": "The harness did not reproduce the conditions of the failure. It ran single-turn, at temperature 0, with no retrieved documents and no tools declared, while the incident was 4 turns deep at temperature 0.3 with a knowledge-base hit and a booking tool available.", "layer": "verification", "signal": "silent", "detect": "audit", "prevent": "test", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0279", "occurred": "2026-08-18", "severity": "s2", "system": "next", "project": "client agent platform", "title": "Bound-execution path dropped the Composio consumer entity: every approval-gated Composio action failed the moment a human approved it", "cause": "executeBoundProposal() (<path>) calls executeSkill() DIRECTLY, bypassing the chat/runner/tool-exec entry points that resolve the Composio entity. It set ctxBase.userId from resolveProposalOwnerUserId() but never set ctxBase.consumerEntityId.", "layer": "orchestration", "signal": "loud", "detect": "check", "prevent": "test", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0280", "occurred": "2026-08-18", "severity": "s2", "system": "next", "project": "internal agent platform", "title": "Docs demo-clip recording blocked: template worktree symlinked to a stale hub missing 14 master deps", "cause": "The docs-coverage worktree symlinked nodemodules to the interact-plan-inline-wt hub, which is on an older branch and was missing 14 deps that current origin/master needs (cronstrue, js-tiktoken, react-virtuoso, @lobehub/icons-static-svg, @tiptap/, prosemirror-changeset).", "layer": "infra", "signal": "loud", "detect": "check", "prevent": "rule", "mast_mode": null, "silent_class": "A", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0281", "occurred": "2026-08-18", "severity": "s3", "system": "next", "project": "internal agent platform", "title": "Template CI typography gate: moving baselined headings to a new file trips no-raw-heading", "cause": "<path> enforces no-raw-heading (raw <h1>-<h6> outside a heading-primitive/owner file) against <path> Pre-existing raw headings are grandfathered in the baseline BY FILE.", "layer": "verification", "signal": "wrong", "detect": "check", "prevent": "rule", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0282", "occurred": "2026-08-18", "severity": "s2", "system": "railway", "project": "internal agent platform", "title": "Pipeline stage Slack notifier: hardcoded fallback channel IDs all point at ARCHIVED channels; per-client pipeline services have zero Slack env: stage notifications silently dead ~200 days", "cause": "Channel generation was replaced (#<internal-project> channels superseded the unnumbered set, which was archived) but the hardcoded fallbacks were never repointed, env overrides were never provisioned, and postmessage failures are non-fatal and unlogged, triple silent failure.", "layer": "infra", "signal": "silent", "detect": "audit", "prevent": "monitor", "mast_mode": null, "silent_class": "C", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0283", "occurred": "2026-08-18", "severity": "s2", "system": "railway", "project": "internal agent platform", "title": "unified-pipeline /v2/run is publicly callable on Client D and Client H (auth fails open)", "cause": "services/unified-pipeline/main.py verifyauth ends with an explicit fail-open branch: \"if not pipelinekey and not agentkey: return True # If neither key is configured, allow (matches existing behavior)\". It was written to preserve backward compatibility with pre-auth callers.", "layer": "application", "signal": "silent", "detect": "audit", "prevent": "gate", "mast_mode": null, "silent_class": "C", "owasp_asi": "ASI03", "euaia_reportable": "would-report", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0284", "occurred": "2026-08-18", "severity": "s2", "system": "slack", "project": "internal agent platform", "title": "#<internal-project> carried fleet SEV1/SEV2 digests with ZERO human members: 9 standing SEV1s reported twice daily to nobody", "cause": "Channel was bot-created (or created and never staffed); nothing asserts that an alert destination has human members, same \"alerting into the void\" class as the unset-webhook incidents.", "layer": "infra", "signal": "silent", "detect": "audit", "prevent": "monitor", "mast_mode": null, "silent_class": "C", "owasp_asi": null, "euaia_reportable": "would-report", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0285", "occurred": "2026-08-18", "severity": "s2", "system": "vapi", "project": "agency infrastructure", "title": "A single Vapi GET /phone-number returned 1 of 2 numbers, so an imported number read as absent", "cause": "A single list read was treated as proof of absence. The endpoint returned an incomplete collection on the first call (stale replica or transient), and nothing in the response distinguishes \"this is everything\" from \"this is some of it\", there is no total count and no pagination cursor to check.", "layer": "thirdparty", "signal": "wrong", "detect": "audit", "prevent": "rule", "mast_mode": null, "silent_class": "A", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0286", "occurred": "2026-08-18", "severity": "s2", "system": "vapi", "project": "agency infrastructure", "title": "Renaming a Vapi assistant defeats the name-match duplicate guard, so provisioning would create a second one", "cause": "resolveExistingAssistantId() has three fallbacks: the gitignored <path> file, channels.config.providerassistantid in Supabase, and finally Vapi matched on assistant NAME. In a fresh checkout the first is absent and the second needs Supabase env that was not set, so everything rested on the name match.", "layer": "thirdparty", "signal": "silent", "detect": "audit", "prevent": "test", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0287", "occurred": "2026-08-18", "severity": "s2", "system": "vercel", "project": "internal agent platform", "title": "Vercel deploys fail instantly with no build logs: production frozen on a 14-day-old build", "cause": null, "layer": "thirdparty", "signal": "silent", "detect": "audit", "prevent": "monitor", "mast_mode": null, "silent_class": "A", "owasp_asi": null, "euaia_reportable": "would-report", "root_cause_written": false, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0288", "occurred": "2026-08-18", "severity": "s2", "system": "vercel", "project": "internal agent platform", "title": "prod SLACK_BOT_TOKEN stored with trailing newline: every runtime Slack call from that project throws on the Authorization header", "cause": "vercel env add preserves whatever bytes it is piped, a paste with a trailing newline stores the newline in the secret; nothing validates the shape of the token at set-time or at use-time.", "layer": "infra", "signal": "loud", "detect": "check", "prevent": "gate", "mast_mode": null, "silent_class": "A", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0289", "occurred": "2026-08-18", "severity": "s2", "system": "vercel", "project": "client agent platform", "title": "Blank env levers struck again: COMPUTER_USE_NODE_ENABLED + NEXT_PUBLIC_WF_DEMONSTRATE stored as empty strings on demo prod", "cause": "Three stacked causes: (1) env levers stored as empty strings (vercel env add via pipe with a trailing-newline-only value); (2) the computeruse node handler checked only agents.status and never the roster predicate (skills grant + blockedtypes), so it dispatched coworkers that could never be offered the tool; (3) comput...", "layer": "infra", "signal": "silent", "detect": "audit", "prevent": "gate", "mast_mode": null, "silent_class": "A", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0290", "occurred": "2026-08-18", "severity": "s2", "system": "vercel", "project": "fleet admin console", "title": "GITHUB_TOKEN blocked by enterprise policy (fine-grained PAT lifetime > 366 days): template updates AND provisioning are down fleet-wide", "cause": "The GitHub org ('<internal-project>' enterprise) now enforces a policy forbidding fine-grained PATs whose lifetime exceeds 366 days. The long-lived GITHUBTOKEN baked into the deployed envs was minted before/against that policy and is now rejected on EVERY repo call with 403.", "layer": "thirdparty", "signal": "loud", "detect": "check", "prevent": "monitor", "mast_mode": null, "silent_class": "A", "owasp_asi": null, "euaia_reportable": "would-report", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0291", "occurred": "2026-08-18", "severity": "s2", "system": "vercel", "project": "internal agent platform", "title": "Path-scoped Permissions-Policy is defeated by client-side navigation (mic dead on every client portal)", "cause": "Two layers. ROUTER: <internal-project>'s global Permissions-Policy sent microphone=(), an empty allowlist, which is a hard block for every origin including self, overriding any browser grant. PR #<phone>) added a /template/(.) override with microphone=(self) and left the global block in place for every client slug.", "layer": "application", "signal": "silent", "detect": "human", "prevent": "test", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0292", "occurred": "2026-08-18", "severity": "s1", "system": "vercel", "project": "internal agent platform", "title": "SLACK_WEBHOOK_URL unset in every Vercel project: all website lead Slack notifications silently dropped", "cause": "The notification path was optional-by-code (silent if (env) skip) and the env var was never provisioned; nothing alerted on the missing config, the same silent-skip class as err-<sha> (provisioning cron webhook).", "layer": "infra", "signal": "silent", "detect": "audit", "prevent": "gate", "mast_mode": null, "silent_class": "C", "owasp_asi": null, "euaia_reportable": "would-report", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0293", "occurred": "2026-08-18", "severity": "s2", "system": "vercel", "project": "agency infrastructure", "title": "Vercel Deployment Protection makes every preview URL return HTTP 200, so curl-based verification silently passes", "cause": "Vercel Deployment Protection (SSO) is enabled on the <internal-project> project. Protected preview deployments serve Vercel's authentication page for every path with HTTP 200, not 401 or 302.", "layer": "verification", "signal": "silent", "detect": "audit", "prevent": "gate", "mast_mode": null, "silent_class": "A", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": true, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0294", "occurred": "2026-08-18", "severity": "s2", "system": "vercel", "project": "agency infrastructure", "title": "vercel env pull returns sensitive vars as empty strings, so production looks misconfigured", "cause": "Variables marked Sensitive in Vercel cannot be read back through the API. vercel env pull does not fail, warn or annotate them: it writes an empty value or omits the line, producing a file that is syntactically valid and semantically wrong.", "layer": "verification", "signal": "wrong", "detect": "audit", "prevent": "rule", "mast_mode": null, "silent_class": "A", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0266", "occurred": "2026-08-17", "severity": "s2", "system": "advizr", "project": "client agent platform", "title": "Migration 2620 re-enumerated the document_sources provider CHECK against the TEMPLATE tenant, and would have thrown 23514 on Client C mid-release", "cause": "2620 DROPs and re-ADDs documentsourcesprovidercheck with a full re-enumeration of the allowed providers. Its header records the 229/464 verification ritual -- live DISTINCT provider checked before shipping -- and that check was really run, but against the TEMPLATE tenant <project-ref> only.", "layer": "data", "signal": "silent", "detect": "audit", "prevent": "gate", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": true, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0267", "occurred": "2026-08-17", "severity": "s2", "system": "advizr", "project": "client agent platform", "title": "migrations:dry-run read the Supabase CLI ledger, which no provisioned client has, so the fleet's pre-release safety tool was blind to every client tenant", "cause": "There are two migration ledgers on an <internal-project> tenant and they do not overlap. public.schemamigrations(name) stores filenames like '891workspaceendpointpolicy' and is what the fleet update engine reads and writes (<internal-project> <path> seeds it for legacy clients, SELECTs name to decide what to skip, INSE...", "layer": "verification", "signal": "silent", "detect": "audit", "prevent": "gate", "mast_mode": null, "silent_class": "C", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": true, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0268", "occurred": "2026-08-17", "severity": "s3", "system": "advizr", "project": "agency infrastructure", "title": "A clean git merge-file pre-merge produced a duplicate import and failed the client's preview build", "cause": "Unblocking a conflicted client for the r<phone>-<sha> rollout means pre-merging the template's changes into the fork with git merge-file and then resolving that path as 'client'.", "layer": "infra", "signal": "loud", "detect": "check", "prevent": "rule", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": true, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0269", "occurred": "2026-08-17", "severity": "s2", "system": "browser", "project": "internal agent platform", "title": "<path> does not exist on master, so CLAUDE.md's standing browser instruction fails on a fresh checkout", "cause": "The browser-use tooling and its skill were built on the feat-browser-use worktree and CLAUDE.md was updated to make them a standing agency convention, but the branch was never merged.", "layer": "data", "signal": "loud", "detect": "audit", "prevent": "gate", "mast_mode": null, "silent_class": "E", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0270", "occurred": "2026-08-17", "severity": "s3", "system": "github", "project": "internal agent platform", "title": "CI 'checks' gate is dark: npm test red since a github.ts extensionless import broke the native-TS runner", "cause": "<path> imports classifyWorkflowExecution from '../.<path>'. Node's native TS type-stripping runner (node <file>.ts) requires EXTENSIONFUL relative specifiers, but github.ts line 7 imports { upsertClientRewrites } from './router' (extensionless), so loading github.ts throws ERRMODULENOTFOUND before any test assertion ru...", "layer": "verification", "signal": "silent", "detect": "audit", "prevent": "gate", "mast_mode": null, "silent_class": "E", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0271", "occurred": "2026-08-17", "severity": "s2", "system": "google", "project": "internal agent platform", "title": "Google Ads MCP is unusable: no Application Default Credentials, so agency ad spend cannot be read", "cause": "The google-ads MCP server authenticates via Google Application Default Credentials and ADC was never configured on this machine. The tool schemas load fine and the failure only appears at call time, so the server looks healthy in the tool list.", "layer": "thirdparty", "signal": "loud", "detect": "check", "prevent": "rule", "mast_mode": null, "silent_class": "A", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0272", "occurred": "2026-08-17", "severity": "s3", "system": "next", "project": "internal agent platform", "title": "Next.js metadata `alternates` merges by replacement, so RSS autodiscovery in the root layout rendered on zero pages", "cause": "Next.js merges the metadata export per top-level field by REPLACEMENT, not deep merge. Every route in <internal-project> calls buildMetadata() from <path>, which returns alternates: { canonical: url }. That object wholly replaced the root layout's alternates, discarding types.", "layer": "application", "signal": "silent", "detect": "audit", "prevent": "test", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": true, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0263", "occurred": "2026-08-16", "severity": "s2", "system": "advizr", "project": "agency infrastructure", "title": "Retiring a claim in claims.ts does not retire it from the site: 92% shipped for a week after deletion", "cause": "claims.ts is architected as \"THE single source of truth for every number that appears on <host>\", and the team treated deleting the field as completing the retirement.", "layer": "verification", "signal": "silent", "detect": "audit", "prevent": "gate", "mast_mode": null, "silent_class": "E", "owasp_asi": null, "euaia_reportable": "would-report", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0264", "occurred": "2026-08-16", "severity": "s2", "system": "github", "project": "internal agent platform", "title": "Test-loaded lib module with a runtime relative import breaks native-node CI (passes local tsx/tsc)", "cause": "The repo's npm test runs test files under native node (strip-types). Type-only imports (import type) are erased so they never resolve, but a runtime relative import needs an explicit extension under native ESM.", "layer": "verification", "signal": "loud", "detect": "check", "prevent": "test", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0265", "occurred": "2026-08-16", "severity": "s2", "system": "linkedin", "project": "agency infrastructure", "title": "LinkedIn outreach sent 25 requests in 6 weeks: the launch throttle was a parked lead pool nobody released", "cause": "The platform has no working per-day connection cap: the per-action safety gate is inert, the scheduler's daily gate requires BOTH connections and messages to exceed limits before it trips (which never happens on a connect-only day), and two recovery paths queue work with no cap check.", "layer": "orchestration", "signal": "silent", "detect": "audit", "prevent": "monitor", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0245", "occurred": "2026-08-15", "severity": "s3", "system": "advizr", "project": "internal agent platform", "title": "Local e2e drive verified the wrong lens: <path> resolves the role from the profile, not the JWT claim", "cause": "<path> computes rbacRole = mapDbRole(session.user.role, clientRole) where both inputs are resolved server-side from the profiles row for that userId (<path> resolveClientRole). The JWT role claim is not authoritative for the UI lens. A cookie can therefore claim 'client' and render the admin tree, silently.", "layer": "verification", "signal": "silent", "detect": "audit", "prevent": "test", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": true, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0246", "occurred": "2026-08-15", "severity": "s3", "system": "advizr", "project": "internal agent platform", "title": "New library archetype fails CI: ARCHETYPE_TASK_AREA and model-gauntlet gates not in the obvious local sweep", "cause": "Adding a library agent definition requires classifying its archetype in the ARCHETYPETASKAREA map; the library-consistency suite does not check it, so a definition that passes every library- test still reddens task-areas and model-gauntlet, which only surface in the FULL unit suite.", "layer": "verification", "signal": "loud", "detect": "check", "prevent": "gate", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": true, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0247", "occurred": "2026-08-15", "severity": "s3", "system": "advizr", "project": "internal agent platform", "title": "starter-packs forced re-run duplicates inbound triggers (18 vs 10): master-inherited red in unit-tests, only reproduces in the full CI run", "cause": "Introduced by PR #2134 ([Bros PR-3] Starter packs for the missionless seeded agents), which added <path>, packs/support-desk.ts, registry.ts entries and tests/unit/starter-packs.test.ts. #2134's own unit-tests job passed, so it merged clean.", "layer": "verification", "signal": "wrong", "detect": "check", "prevent": "test", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0248", "occurred": "2026-08-15", "severity": "s3", "system": "claude", "project": "internal agent platform", "title": "Gmail MCP connector is authorized read-only: every mutation fails with \"insufficient authentication scopes\"", "cause": "The <host> Gmail connector's OAuth grant carries only gmail.readonly. The write scope (gmail.modify) was never consented to, so every state-changing tool the connector advertises, markmessagespam, trashmessage, labelmessage, createdraft, reply, sendmessage, updatelabel, is present in the tool list and callable but reje...", "layer": "thirdparty", "signal": "loud", "detect": "check", "prevent": "rule", "mast_mode": null, "silent_class": "A", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0249", "occurred": "2026-08-15", "severity": "s3", "system": "git", "project": "internal agent platform", "title": "generate-px-avatars.sh hangs on Windows before spawning any job when only a few keys are missing", "cause": "Not fully diagnosed. The main loop reads rows from a process-substitution pipe while backgrounded genone subshells inherit the same stdin; on Windows git-bash this combination can wedge (the row-feed python never advances and no generation child launches).", "layer": "infra", "signal": "loud", "detect": "human", "prevent": "rule", "mast_mode": null, "silent_class": "A", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0250", "occurred": "2026-08-15", "severity": "s3", "system": "git", "project": "client agent platform", "title": "git checkout origin/master -- then checkout HEAD -- destroys uncommitted edits during a fails-without-fix proof", "cause": "git checkout <ref> -- <path> overwrites the working tree unconditionally. Before the work is committed, HEAD does not contain it, so \"checkout HEAD to undo the temporary master checkout\" restores the OLD file, not the edited one.", "layer": "infra", "signal": "silent", "detect": "human", "prevent": "rule", "mast_mode": null, "silent_class": "A", "owasp_asi": null, "euaia_reportable": "would-report", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": true, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0251", "occurred": "2026-08-15", "severity": "s3", "system": "github", "project": "internal agent platform", "title": "master CI pre-existing red blocks PRs (recurrence: workflow-page-canvas-first dry=1)", "cause": "A master commit changed the workflow run call to drop the dry=1 param (or changed the safe-test default) without updating the canvas-first dom test; every PR branched after it inherits the red on the required unit-tests check.", "layer": "verification", "signal": "wrong", "detect": "check", "prevent": "gate", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0252", "occurred": "2026-08-15", "severity": "s3", "system": "github", "project": "internal agent platform", "title": "Copy gate escapes the local sweep: check-copy lives in consumer-simplicity-gate.yml, and flagless runs are report-only", "cause": "Two compounding misses. (1) The \"reproduce CI locally\" sweep enumerated gates from ci.yml's lint-and-typecheck job only; <internal-project> runs additional REQUIRED gates in sibling workflow files (consumer-simplicity-gate.yml, visual, evals, pr-ack).", "layer": "verification", "signal": "silent", "detect": "check", "prevent": "gate", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": true, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0253", "occurred": "2026-08-15", "severity": "s3", "system": "higgsfield", "project": "internal agent platform", "title": "Duplicate avatar-generation launches hit the Higgsfield concurrency cap and burned 12 credits", "cause": "Backgrounded Bash tool commands on Windows/git-bash can keep running after the harness stops tracking them (parented to init), so \"no live background children\" does not mean the process died. Launching a replacement created two concurrent generator instances sharing one 4-job account cap.", "layer": "orchestration", "signal": "silent", "detect": "audit", "prevent": "rule", "mast_mode": null, "silent_class": "A", "owasp_asi": null, "euaia_reportable": "would-report", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": true, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0254", "occurred": "2026-08-15", "severity": "s3", "system": "next", "project": "internal agent platform", "title": "A clean git rebase can still fail tsc when master tightened a shared component's props", "cause": "A no-conflict rebase only guarantees textual mergeability, not type compatibility: when the base branch tightens a shared component/type (here PageShell.children optional -> required), your unchanged call sites can newly fail tsc.", "layer": "verification", "signal": "loud", "detect": "check", "prevent": "rule", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0255", "occurred": "2026-08-15", "severity": "s2", "system": "next", "project": "internal agent platform", "title": "A new workflow node kind leaks into the AI builder prompt, its byte baselines, and node-kind value maps", "cause": "Adding a workflow node kind (<path>) widens ALLKINDS/WorkflowNodeKind, which ripples into: (a) the AI workflow-builder system prompt (describeNodeKindsWithRequirements enumerates ALLKINDS), breaking byte-identical baseline fixtures (workflow-builder-prompt-longtail, -connector-context-flagoff); (b) exhaustive node-kind...", "layer": "verification", "signal": "loud", "detect": "check", "prevent": "test", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0256", "occurred": "2026-08-15", "severity": "s2", "system": "next", "project": "internal agent platform", "title": "Adding a commit-routed catalog intent silently reddens the trust-page editorial gate", "cause": "The trust page view-model (<path>) is DERIVED from COMMITROUTEDBUILTINS, and tests/unit/trust-page-claims.test.ts pins a hardcoded count of gated actions (7 high|critical + 4 medium = 11). Any new commit-routed catalog entry ripples into the trust page's rendered surface AND that canary count.", "layer": "verification", "signal": "loud", "detect": "check", "prevent": "test", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0257", "occurred": "2026-08-15", "severity": "s2", "system": "next", "project": "internal agent platform", "title": "computer_use workflow node reported green without ever running the browser (two paths)", "cause": "Two independent false-success paths. (1) The graph-executor Test pin short-circuit replayed a node's metadata.pinnedoutput as green WITHOUT invoking the handler; a recorded computeruse node carried such a sample.", "layer": "verification", "signal": "silent", "detect": "audit", "prevent": "test", "mast_mode": "FM-3.3", "silent_class": "D", "owasp_asi": null, "euaia_reportable": "would-report", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0258", "occurred": "2026-08-15", "severity": "s2", "system": "next", "project": "internal agent platform", "title": "RSC fetch for the bare tenant home 404s at the router: client-side push to '/' hard-navigates fleet-wide", "cause": "Two stacked causes. Infra: the router forwards /template/:path documents but 404s the bare-slug RSC request form (?rsc), so soft navigation to '/' is impossible fleet-wide and Next silently downgrades to a full page load.", "layer": "application", "signal": "silent", "detect": "human", "prevent": "test", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": true, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0259", "occurred": "2026-08-15", "severity": "s2", "system": "react", "project": "internal agent platform", "title": "Tour reveal listener lived in a component the reveal itself mounts: event fired before the listener existed", "cause": "A window CustomEvent is a one-shot broadcast. Any component that mounts in response to that same event (here: children of a Radix Collapsible the event expands) cannot subscribe in time. The jsdom test missed it because its fixtures were plain always-mounted buttons, not the real conditionally-mounted sidebar tree.", "layer": "application", "signal": "silent", "detect": "human", "prevent": "test", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": true, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0260", "occurred": "2026-08-15", "severity": "s2", "system": "vercel", "project": "internal agent platform", "title": "Boolean env flag set to empty string reads as OFF; a strict === 'true' guard keeps the feature dark while `env ls` shows it \"present\"", "cause": "The flag was earlier enabled by adding the Vercel env var with an empty/blank value instead of true (likely an empty-stdin or blank interactive prompt). The code uses strict equality === 'true', so presence of the var is not enablement, only the exact value true is.", "layer": "infra", "signal": "silent", "detect": "audit", "prevent": "gate", "mast_mode": null, "silent_class": "A", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": true, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0261", "occurred": "2026-08-15", "severity": "s1", "system": "vercel", "project": "client agent platform", "title": "Model routing overlay 400s every routed call: OpenRouter models[] exceeds 3-item cap", "cause": "<path> getTierFallbacks appends the STATIC tier fallback floor after the routed chain's tail (dedupe only). A routing row with primary + 2 fallbacks plus the static floor yields an OpenRouter body.models[] of 4-5 entries; OpenRouter hard-rejects anything over 3, so the reliability floor designed to make a bad routing r...", "layer": "orchestration", "signal": "loud", "detect": "check", "prevent": "test", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-report", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": true, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0262", "occurred": "2026-08-15", "severity": "s2", "system": "vitest", "project": "internal agent platform", "title": "workflow-page-canvas-first.dom.test.tsx flakes in the full unit-tests run (passes isolated): blocks auto-merge fleet-wide", "cause": "A DOM test (jsdom) that is order/pollution/timing-sensitive in the full unit-tests run (~hundreds of files) but green in isolation. This is the same 'full vitest run fails on cross-test pollution' / flaky-workflow-DOM-test class already seen on this repo.", "layer": "verification", "signal": "wrong", "detect": "check", "prevent": "test", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0112", "occurred": "2026-08-14", "severity": "s3", "system": "next", "project": "internal agent platform", "title": ": bare `npx tsc --noEmit` OOMs (heap 4GB): run with NODE_OPTIONS=--max-old-space-size=8192", "cause": "Repo scale: tsc needs >4GB old-space for the full program on Node 22.", "layer": "infra", "signal": "loud", "detect": "human", "prevent": "rule", "mast_mode": null, "silent_class": "A", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 2 }, { "id": "afi-0195", "occurred": "2026-08-14", "severity": "s3", "system": "advizr", "project": "internal agent platform", "title": "compileLibraryPackage never split the authored combo name, so every marketplace-installed teammate landed with \"Sam: CRM Data Steward\" on its row and no persona", "cause": "The convention is real and documented: agents.name stores the ROLE TITLE alone and the first name lives in config.persona.name (<path> rosterNameOf). The em dash in <path> is an AUTHORING-time encoding, and six consumers decode it via firstNameOf/roleTitleOf (<path>).", "layer": "application", "signal": "silent", "detect": "audit", "prevent": "test", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0196", "occurred": "2026-08-14", "severity": "s2", "system": "advizr", "project": "internal agent platform", "title": "intent-packs pass template slugs as agents.type, so all five vertical starter agents violate the agents_type_check CHECK and can never be created", "cause": "Two different vocabularies share the name \"type\". <path> keys archetypes by SLUG ('customer-support', 'data-analyst'); the agents table column type is a six-value taxonomy enum guarded by a CHECK.", "layer": "orchestration", "signal": "loud", "detect": "check", "prevent": "test", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0197", "occurred": "2026-08-14", "severity": "s3", "system": "claude", "project": "internal agent platform", "title": "Bash tool truncates a very long inline command, ending a heredoc early and writing a truncated file", "cause": "Very long inline Bash commands (roughly >4-8KB, e.g. a full PR body inside a quoted heredoc) can be truncated before execution; the heredoc then never terminates and everything after the cut is misparsed. The failure mode surfaces as a shell syntax error pointing at an innocent quote character, not as a length error.", "layer": "infra", "signal": "silent", "detect": "human", "prevent": "rule", "mast_mode": null, "silent_class": "A", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": true, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0198", "occurred": "2026-08-14", "severity": "s2", "system": "composio", "project": "client agent platform", "title": "Composio app with minted auth config but no manifest shows \"Connected\" with zero agent tools (fireflies)", "cause": "Two registries with no cross-check: the auth-config ledger (what is connectable) and APPMANIFESTS (what exposes tools) could disagree silently. A minted config with no manifest is connectable-but-useless, and nothing failed until a user hit the empty toolset.", "layer": "orchestration", "signal": "silent", "detect": "audit", "prevent": "test", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": true, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0199", "occurred": "2026-08-14", "severity": "s3", "system": "git", "project": "client agent platform", "title": "git checkout -- file after a sed mutation probe wiped ALL uncommitted edits, not just the probe", "cause": "git checkout -- <file> restores from the index, and during pre-commit work the index still holds the base version, git has no notion of \"revert only the last change\". A mutation probe layered on top of uncommitted work has no git-level undo that preserves the work underneath.", "layer": "infra", "signal": "silent", "detect": "human", "prevent": "rule", "mast_mode": null, "silent_class": "A", "owasp_asi": null, "euaia_reportable": "would-report", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": true, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0200", "occurred": "2026-08-14", "severity": "s3", "system": "git", "project": "internal agent platform", "title": "Reflexive git stash on a shared-stash repo: the recorded rule violated and recovered", "cause": "Habit: \"dirty tree before merge → stash\" fired before the repo-specific rule was consulted. The correct flow in these worktrees is commit-then-merge, never stash.", "layer": "infra", "signal": "loud", "detect": "human", "prevent": "rule", "mast_mode": null, "silent_class": "A", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0201", "occurred": "2026-08-14", "severity": "s3", "system": "git", "project": "internal agent platform", "title": "act-bhard-3b worktree shipped without its node_modules junction: preflight tsx gates red", "cause": "Worktree provisioning created the branch checkout but not the nodemodules junction; a missing junction and a stale junction present identically as ERRMODULENOTFOUND on the first tsx/vitest gate.", "layer": "infra", "signal": "loud", "detect": "check", "prevent": "rule", "mast_mode": null, "silent_class": "A", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": true, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0202", "occurred": "2026-08-14", "severity": "s3", "system": "github", "project": "client agent platform", "title": "Ack gates on order-matters surfaces need label AND a clean ## Deploy plan section: and stray leading backticks break the section regex", "cause": "Two-requirement surfaces (label + section) with sequential failure messages, compounded by an invisible body corruption: writing a PR body through a quoted heredoc with escaped backticks then 'fixing' with sed left line-leading backticks that no plain read shows.", "layer": "verification", "signal": "wrong", "detect": "check", "prevent": "rule", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0203", "occurred": "2026-08-14", "severity": "s3", "system": "github", "project": "client agent platform", "title": "env.manifest.json edited by hand: it is GENERATED from <path>, and the staleness gate is not in the local preflight sweep", "cause": "Two compounding: (1) edited a generated artifact instead of its source, <path> featureVars is the source of truth and the generator holds the strategy table; (2) the local preflight script predates this gate, so \"preflight the WHOLE job\" silently no longer covers the whole job (the programme-complete-gate-missing class...", "layer": "verification", "signal": "loud", "detect": "check", "prevent": "gate", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0204", "occurred": "2026-08-14", "severity": "s3", "system": "github", "project": "client agent platform", "title": "pr-ack gate needs labels AND a Deploy plan body section AND a fresh event: three separate misses, three CI round-trips", "cause": "<path> gates by path surface: migration-ack for <path>, rollout-ack for docs/dark-levers.md, env-ack for <path> trio, worker-ack for cron/queue/vercel.json. migration-ack and env-ack additionally set deployPlan: true which requires a \"Deploy plan\" section in the PR body.", "layer": "verification", "signal": "wrong", "detect": "check", "prevent": "gate", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": true, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0205", "occurred": "2026-08-14", "severity": "s3", "system": "github", "project": "client agent platform", "title": "Workflow supply-chain gate missing from the local preflight: second ci.yml gate discovered by CI round-trip this session", "cause": "The preflight script is a hand-maintained mirror of ci.yml's gate list and drifts as gates are added; every drifted gate costs one CI round-trip. Two instances in one day is the pattern, not the incident.", "layer": "verification", "signal": "loud", "detect": "check", "prevent": "gate", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0206", "occurred": "2026-08-14", "severity": "s2", "system": "kb", "project": "internal agent platform", "title": "kb_resolve_error returns \"Unexpected end of JSON input\" on every call: resolutions cannot be filed", "cause": null, "layer": "verification", "signal": "wrong", "detect": "check", "prevent": "monitor", "mast_mode": null, "silent_class": "C", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": false, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0207", "occurred": "2026-08-14", "severity": "s1", "system": "linkedin", "project": "outbound pipeline", "title": "Every watchdog alert filed to a deleted user id: 1,218 orphaned notifications, nine-day outage unalerted", "cause": "The alert recipient was a hardcoded constant pointing at the \"Visurae\" stub admin, which was deleted on <phone> during tenant cleanup as an orphan with zero attached data. Deleting the user did not break anything loudly, because the only thing referencing it was a string literal in a monitoring module.", "layer": "infra", "signal": "silent", "detect": "audit", "prevent": "monitor", "mast_mode": null, "silent_class": "C", "owasp_asi": null, "euaia_reportable": "would-report", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": true, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0208", "occurred": "2026-08-14", "severity": "s2", "system": "linkedin", "project": "outbound pipeline", "title": "LinkedIn login form field found by the detector then times out in humanize seconds later", "cause": "Not established. The selector is correct and was observed visible moments earlier by the same page object, so this is a timing, navigation or frame-context problem between detection and typing rather than a selector problem.", "layer": "thirdparty", "signal": "loud", "detect": "check", "prevent": "rule", "mast_mode": null, "silent_class": "A", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0209", "occurred": "2026-08-14", "severity": "s1", "system": "linkedin", "project": "outbound pipeline", "title": "Pasted li_at unusable: session-injection route and worker use two different ciphers that share a name and env var", "cause": "Two exported functions named encrypt exist, both keyed off ENCRYPTIONKEY, and they are not interoperable: execution/auth/auth.js hex, \"iv:tag:ct\" key: base64 first execution/auth/cryptoutils.js base64, \"01:iv:tag:ct\" key: hex first routes/accounts.js destructures encrypt from utils, which server.js sources from executi...", "layer": "application", "signal": "loud", "detect": "check", "prevent": "test", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": true, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0210", "occurred": "2026-08-14", "severity": "s2", "system": "linkedin", "project": "outbound pipeline", "title": "Pasted LinkedIn cookie authenticates over API but is rejected in-browser: session minted in Vancouver, replayed through a Montreal proxy", "cause": "Geographic mismatch between where the session was minted and where it is replayed, compounded by a spoofed browser fingerprint. The exported jar carries timezone=America/Vancouver, the human logged in from BC. Hudson's dedicated proxy is <phone>, a Montreal IP (~3,700km away).", "layer": "thirdparty", "signal": "wrong", "detect": "check", "prevent": "rule", "mast_mode": null, "silent_class": "A", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 2 }, { "id": "afi-0211", "occurred": "2026-08-14", "severity": "s2", "system": "next", "project": "client agent platform", "title": "Recorder narration lost silently: acquireMic() bound OS default with no deviceId and swallowed failures to null", "cause": "Two coupled defects: (1) acquireMic hard-bound the OS default input with no device selection and no enumeration, so a wrong or muted default recorded silently; (2) the failure path collapsed every reason (denied / no-device / unavailable) to a bare null, so the UI had nothing to warn with and fell through to a video-on...", "layer": "application", "signal": "silent", "detect": "human", "prevent": "test", "mast_mode": null, "silent_class": "C", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0212", "occurred": "2026-08-14", "severity": "s1", "system": "next", "project": "client agent platform", "title": "act worktree briefed as \"node_modules provisioned\" had none: npx fell back to a stale npm-cache vitest", "cause": "Fleet worktrees share one real nodemodules store via NTFS junctions (act-bhard-3 -> act-bonb-w7\\nodemodules); a freshly added worktree simply has no junction yet. npx masks the absence by falling back to the npm cache copy, which errors inside vitest.config.ts instead of saying vitest is not installed.", "layer": "verification", "signal": "silent", "detect": "audit", "prevent": "gate", "mast_mode": null, "silent_class": "A", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": true, "resolved_field": false, "recurrence_count": 5 }, { "id": "afi-0213", "occurred": "2026-08-14", "severity": "s2", "system": "next", "project": "client agent platform", "title": "master typecheck broken: #2044 deleted <path> while #2045's tour-asks route still imports it", "cause": "Two programmes crossed in the merge window: #2045 ([Bonb] W4, merged first) added <path> importing deriveHomeExampleAsks from @<path> #2044 (feat(home): drop the openers block), authored before #2045 landed, deleted <path> as \"the only consumer's pipeline\", its reachability claim was stale by merge time.", "layer": "verification", "signal": "loud", "detect": "check", "prevent": "gate", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0214", "occurred": "2026-08-14", "severity": "s2", "system": "next", "project": "client agent platform", "title": "master red: #2044 deleted <path> but two importers survive", "cause": "PR #2044 (feat(home): drop the openers block) deleted <path> while <path> and tests/unit/tour-asks-route.test.ts still import it. lint-and-typecheck red is inherited by every branch rebased onto <sha>. Fix already in flight: PR #2097 restores the module.", "layer": "verification", "signal": "loud", "detect": "check", "prevent": "gate", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0215", "occurred": "2026-08-14", "severity": "s2", "system": "next", "project": "client agent platform", "title": "ask_user parks a chat turn with zero text, so the agent's question renders as dead air and the run closes 'completed'", "cause": "The askuser built-in ends the agent loop on purpose and produces no prose, because the question IS the output. <path> has stopWhen: [stepCountIs(maxSteps), () => pause.paused], so the moment askuser requests a pause the loop stops with zero text parts.", "layer": "orchestration", "signal": "silent", "detect": "human", "prevent": "test", "mast_mode": "FM-3.1", "silent_class": "D", "owasp_asi": null, "euaia_reportable": "would-report", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0216", "occurred": "2026-08-14", "severity": "s3", "system": "next", "project": "internal agent platform", "title": "Bare local tsc V8-crashed and masked two tuple-typing errors that CI then caught: vi.fn(async () => []) types params as the empty tuple", "cause": "Two causes stacked. (1) vi.fn(async () => []) infers its parameter list as the empty tuple [], so a wrapper spreading unknown[] into it is TS2556 and mock.calls[i][0] is TS2493, a vi.fn double that will be called with args must declare a rest signature.", "layer": "verification", "signal": "silent", "detect": "check", "prevent": "rule", "mast_mode": null, "silent_class": "A", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": true, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0217", "occurred": "2026-08-14", "severity": "s2", "system": "next", "project": "internal agent platform", "title": "Guided-tour welcome resurfaces for a done user on a fresh device: auto-show races the server prefs fetch", "cause": "The auto-show condition read the union-merged per-user state before the server half of the union had arrived. isLoading means \"localStorage read\", not \"the answer is known\", the exact distinction the onboarding-welcome-flash test docblock records for the legacy modal (\"don't know must not render as hasn't\"), applied on...", "layer": "application", "signal": "loud", "detect": "human", "prevent": "test", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": true, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0218", "occurred": "2026-08-14", "severity": "s3", "system": "next", "project": "client agent platform", "title": "Junctioned worktree cannot dev-serve or build /interact: React-Refresh injects import.meta into realpathed CJS deps; local build ENOENTs on jsdom asset", "cause": "Webpack resolves modules through the junction to their REAL paths (resolve.symlinks), and a real path under <internal-project> no longer contains \"nodemodules\", so Next's dev loader chain treats the dep as project source and the React-Refresh loader appends import.meta.webpackHot.accept() into a CommonJS file, which ca...", "layer": "infra", "signal": "loud", "detect": "human", "prevent": "rule", "mast_mode": null, "silent_class": "A", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0219", "occurred": "2026-08-14", "severity": "s3", "system": "next", "project": "client agent platform", "title": "Parallel subagents share one scratchpad: a sibling clobbered preflight.sh and the gate sweep silently ran against the wrong worktree", "cause": "Subagent scratchpad directories are per parent session, not per subagent. Parallel PR implementers all write the retargeted preflight to the identical path ($SCRATCH/preflight.sh), and last-writer-wins. The sweep gives no indication which worktree it ran against unless a gate happens to print an absolute path.", "layer": "verification", "signal": "silent", "detect": "audit", "prevent": "rule", "mast_mode": null, "silent_class": "A", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": true, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0220", "occurred": "2026-08-14", "severity": "s2", "system": "next", "project": "client agent platform", "title": "Radix dropdown verbs that open outside UI leave the menu's modal layer blocking it", "cause": "MessageActions renders its actions as plain shadcn Buttons inside DropdownMenuContent. Radix only auto-closes a dropdown when a DropdownMenuItem fires onSelect; a plain button click keeps the menu (and its page-wide modal pointer-events layer) mounted.", "layer": "application", "signal": "loud", "detect": "human", "prevent": "test", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0221", "occurred": "2026-08-14", "severity": "s3", "system": "next", "project": "internal agent platform", "title": "Retiring the welcome modal unmasked vacuous axe passes: error boundaries had no h1", "cause": "headings.spec and calendar-ics never call suppressOnboardingOverlays, so pre-retirement the WelcomeModal opened over every audited page for the fresh hermetic consumer, and the Radix dialog aria-hid the entire page.", "layer": "verification", "signal": "silent", "detect": "audit", "prevent": "test", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": true, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0222", "occurred": "2026-08-14", "severity": "s3", "system": "next", "project": "internal agent platform", "title": "steps.first_run is a workspace signal: it killed the tour nudge everywhere and fired the celebration unearned", "cause": "A workspace-level auto-detected signal (steps.firstrun, sourced from the workspace runs list) was treated as a per-user fact by two first-run surfaces. No organic per-user run-completion milestone exists (firstrunsuccess is Genesis-only vocabulary with no runtime writer), so there was no correct level to gate on.", "layer": "application", "signal": "wrong", "detect": "human", "prevent": "test", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": true, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0223", "occurred": "2026-08-14", "severity": "s3", "system": "next", "project": "client agent platform", "title": "Template typecheck OOM'd and the pipeline reported exit 0: the recorded tsc-OOM trap recurred in a fresh worktree", "cause": "Two compounding causes: the template's tsc needs ~8GB heap and a default-heap run OOMs; and piping tsc output makes $? report the pipe tail's status, so the crash reads as success.", "layer": "verification", "signal": "silent", "detect": "audit", "prevent": "rule", "mast_mode": null, "silent_class": "C", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0224", "occurred": "2026-08-14", "severity": "s2", "system": "next", "project": "internal agent platform", "title": "Tour popover controls overflow the box from step 2: behavioral drives never measured geometry", "cause": "A fixed-width popover's single-row flex controls with a long text label and a conditionally-appearing button (Back from step 2) exceeded the content measure; no flex-wrap, and no geometry assertion existed anywhere in the verification stack.", "layer": "application", "signal": "loud", "detect": "human", "prevent": "test", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": true, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0225", "occurred": "2026-08-14", "severity": "s3", "system": "next", "project": "internal agent platform", "title": "Tour terminal popover pushed off-screen on chat-home tenants, taking its chips with it", "cause": "popoverStyle placed the ask-step popover \"above the target\". Two anchors share that step: the small dock pill (placement correct) and the chat-home composer wrapper, a large region whose top sits near the viewport top.", "layer": "application", "signal": "loud", "detect": "human", "prevent": "test", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": true, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0226", "occurred": "2026-08-14", "severity": "s3", "system": "next", "project": "internal agent platform", "title": "TourNudge required the onboarding provider and killed every standalone home render in CI", "cause": "A decorative component (an inline nudge) used the THROWING context hook. The repo already distinguishes the two classes: useOnboardingContext throws by design for surfaces whose job is onboarding; useOptionalOnboardingContext exists (Bagent C2, the Coachmark/PlanCard precedent) for teaching wrappers that must never tak...", "layer": "verification", "signal": "loud", "detect": "check", "prevent": "test", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": true, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0227", "occurred": "2026-08-14", "severity": "s3", "system": "next", "project": "client agent platform", "title": "tsc piped through tail with `echo $?` reads tail's exit: a failing typecheck reported as pass, caught only by CI", "cause": "$? after a pipeline is the LAST command's exit code (tail's), not tsc's. Combined with tsc producing little/no output when it dies or is truncated, the pipeline shape converts any tsc failure into \"exit=0\". Same failure family as <internal-project>: the reader trusted a signal that was not tsc's own.", "layer": "verification", "signal": "silent", "detect": "check", "prevent": "rule", "mast_mode": null, "silent_class": "C", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": true, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0228", "occurred": "2026-08-14", "severity": "s3", "system": "node", "project": "client agent platform", "title": "Junctioned nm-store breaks vitest ESM resolution until each package gets a node_modules self-junction", "cause": "Node's ESM loader resolves the junction to its real path, so imports execute from inside <internal-project>, a directory not named nodemodules. Package resolution walks up looking for nodemodules directories and never finds the store's own siblings.", "layer": "infra", "signal": "loud", "detect": "check", "prevent": "rule", "mast_mode": null, "silent_class": "A", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": true, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0229", "occurred": "2026-08-14", "severity": "s2", "system": "node", "project": "client agent platform", "title": "Shared <internal-project> mutated mid-session:.bin emptied + ~27 scoped packages deleted, breaking every junctioned worktree", "cause": "Unidentified process deleted entries from the shared store while multiple worktree sessions were active. The store is a single mutable directory that every act- worktree junctions to, so any npm operation (install/prune/dedupe) run in ANY junctioned worktree operates through the junction on the shared target, one sessi...", "layer": "infra", "signal": "loud", "detect": "human", "prevent": "rule", "mast_mode": null, "silent_class": "A", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0230", "occurred": "2026-08-14", "severity": "s3", "system": "openrouter", "project": "client agent platform", "title": "provision-seed autofill fallback used an OpenRouter id that does not exist (dash vs dot)", "cause": "A hand-written model id literal drifted from the registry: repo-internal slugs use dashes (claude-haiku-4-5) while OpenRouter ids use dots (claude-haiku-4.5), and the fallback was written in the slug spelling with a vendor prefix bolted on. The try/catch around the fetch made the failure invisible.", "layer": "data", "signal": "loud", "detect": "check", "prevent": "test", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": true, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0231", "occurred": "2026-08-14", "severity": "s2", "system": "railway", "project": "internal agent platform", "title": "Stock Twenty image + Railway volume breaks workspace bootstrap with EACCES and leaves an orphaned user", "cause": "Railway attaches volumes owned by root; the stock Twenty image has no boot-time chown (the <internal-project> twenty-branded overlay image added one for exactly this reason) and STORAGETYPE=local writes into the mount at workspace creation time.", "layer": "thirdparty", "signal": "loud", "detect": "check", "prevent": "rule", "mast_mode": null, "silent_class": "A", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": true, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0232", "occurred": "2026-08-14", "severity": "s3", "system": "shell", "project": "internal agent platform", "title": "Bash tool on Windows mangles git show branch:path: colon becomes semicolon, slashes flip, revision unresolvable", "cause": "MSYS/Git-Bash path conversion on Windows rewrites arguments that look like POSIX paths with colons: branch:path triggers path-list translation (colon → semicolon, / → \\), so git never sees the real revision:path token. Single-quoting suppresses one rewrite but the argument still came through empty in the tool context.", "layer": "infra", "signal": "wrong", "detect": "human", "prevent": "rule", "mast_mode": null, "silent_class": "A", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0233", "occurred": "2026-08-14", "severity": "s3", "system": "stripe", "project": "agency infrastructure", "title": "Deleting a Stripe draft invoice also deletes its invoice items: it does not release them back to pending", "cause": "I assumed deleting a draft invoice would return its line items to the pending pool, the way voiding or removing a line does. It does not. Once pending invoice items are pulled onto a draft invoice they belong to that invoice, and deleting the invoice deletes them with it. The deeper mistake was the test design.", "layer": "thirdparty", "signal": "silent", "detect": "audit", "prevent": "rule", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-report", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0234", "occurred": "2026-08-14", "severity": "s2", "system": "stripe", "project": "agency infrastructure", "title": "Client A billed USD 7,000/mo for two months against a CAD 7,000 agreement: the USD checkout bug was fixed forward but the already-subscribed client was never migrated", "cause": "The known <internal-project> checkout bug that hardcoded USD (err-<sha>-stripe-<internal-project>). a client director's subscription was created on <phone> by that checkout; the fix (<internal-project> PR #1, <path> currency map) merged <phone>, ten days AFTER his subscription existed.", "layer": "application", "signal": "silent", "detect": "client", "prevent": "gate", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-report", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0236", "occurred": "2026-08-14", "severity": "s2", "system": "supabase", "project": "client agent platform", "title": "Template tenant Supabase realtime websocket answers 500: presence and live wires degrade to absence fleet-wide on the tenant", "cause": "Supabase realtime service failure on project <project-ref> (websocket handshake 500), infrastructure, not policies, not app code. Presence + broadcast delivery worked when Bmp2 verified it live <phone>, so this is a fresh service-side degradation.", "layer": "thirdparty", "signal": "loud", "detect": "check", "prevent": "monitor", "mast_mode": null, "silent_class": "A", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0237", "occurred": "2026-08-14", "severity": "s3", "system": "twenty", "project": "internal agent platform", "title": "twenty-sdk apply fails on Windows: front-component resource paths built with backslashes", "cause": "path.relative() returns platform-separator paths; the SDK never normalizes to POSIX before writing manifest resource paths, and the Twenty server hard-rejects backslashes.", "layer": "thirdparty", "signal": "loud", "detect": "check", "prevent": "rule", "mast_mode": null, "silent_class": "A", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": true, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0238", "occurred": "2026-08-14", "severity": "s2", "system": "vercel", "project": "internal agent platform", "title": "Router Permissions-Policy microphone=() hard-blocks getUserMedia fleet-wide (no popup)", "cause": "The <internal-project> sets a global Permissions-Policy camera=(), microphone=(), geolocation=(). microphone=() is an EMPTY allowlist = mic disabled for every origin including self. A Permissions-Policy block overrides any browser grant, so getUserMedia always throws NotAllowedError with no prompt.", "layer": "application", "signal": "silent", "detect": "human", "prevent": "test", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": true, "resolution_written": false, "resolved_field": true, "recurrence_count": 2 }, { "id": "afi-0239", "occurred": "2026-08-14", "severity": "s3", "system": "vitest", "project": "fleet admin console", "title": ": case-studies.test.ts fails to parse on Windows: full vitest run is red on untouched master", "cause": "The test file's header comment contains byte(s) that do not survive the Windows read path (encoding artifact); esbuild's parser rejects the token during transform. Present on master; unrelated to any branch under test.", "layer": "verification", "signal": "loud", "detect": "human", "prevent": "rule", "mast_mode": null, "silent_class": "A", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0240", "occurred": "2026-08-14", "severity": "s3", "system": "vitest", "project": "fleet admin console", "title": ": Windows-local vitest/tsc red where CI is green (case-studies.test.ts + NextRequest RequestInit)", "cause": "Windows-local <path> resolution divergence from CI: the DOM-lib RequestInit (signal: AbortSignal | null) wins locally over the shape Next's spec-extension RequestInit expects, and the case-studies suite trips on a UTF-8/CRLF transform quirk in the local vitest pipeline.", "layer": "verification", "signal": "wrong", "detect": "human", "prevent": "rule", "mast_mode": null, "silent_class": "A", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0241", "occurred": "2026-08-14", "severity": "s3", "system": "vitest", "project": "internal agent platform", "title": "Sync getByTestId on an async-mounted element flakes under full-suite load", "cause": "The recording-evidence-chip mounts on its own async session-context fetch (installFetch({recordingid})). Two tests awaited an UNRELATED element first (findByTestId('mock-chat') / 'mock-conversation') and then asserted the chip SYNCHRONOUSLY with getByTestId.", "layer": "verification", "signal": "wrong", "detect": "check", "prevent": "test", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0242", "occurred": "2026-08-14", "severity": "s2", "system": "vitest", "project": "client agent platform", "title": "Vitest: CI fails on an unhandled render error while all 29,583 tests pass", "cause": "A catch-all fetch mock in a DOM test answered every unlisted endpoint with a generic truthy body. A component in the mounted tree (TrustTab) consumed that body as if it were its real payload and crashed in render after the test's assertions passed.", "layer": "verification", "signal": "wrong", "detect": "check", "prevent": "test", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": true, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0243", "occurred": "2026-08-14", "severity": "s3", "system": "vitest", "project": "client agent platform", "title": "Vitest importOriginal-factory mock: a spy on an exported wrapper sees 0 calls from some import edges while a full-replacement mock intercepts them all", "cause": "vi.mock with an async importOriginal factory instantiates the real module while the mock is still being constructed; module-graph timing/cycle fallback can hand SOME importers (here a module two hops deep that imports the mocked module relatively) the real export instead of the factory's wrapped export.", "layer": "verification", "signal": "silent", "detect": "check", "prevent": "test", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": true, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0244", "occurred": "2026-08-14", "severity": "s3", "system": "worktree", "project": "internal agent platform", "title": "Prepared worktree act-bint-5 arrived without its node_modules junction: npx fetched a remote vitest that could not load vitest.config", "cause": "The junction is per-worktree state that git does not carry: a freshly added worktree starts with no nodemodules, and nothing verifies the promised junction actually exists before tooling runs.", "layer": "infra", "signal": "loud", "detect": "check", "prevent": "gate", "mast_mode": null, "silent_class": "A", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": true, "resolved_field": false, "recurrence_count": 2 }, { "id": "afi-0164", "occurred": "2026-08-13", "severity": "s3", "system": "advizr", "project": "internal agent platform", "title": "check-copy dup: authored the same retry sentence in two settings files instead of importing MESSAGES", "cause": "Two error states authored minutes apart reused the natural phrasing. The repo rule (agent-os-contracts §12.2, import-never-re-string) puts any sentence rendered in two or more files into <path>, which is registered in COPYREGISTRY so it stays linted.", "layer": "application", "signal": "loud", "detect": "check", "prevent": "gate", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0165", "occurred": "2026-08-13", "severity": "s2", "system": "advizr", "project": "internal agent platform", "title": "Evidence panel mounted only in the legacy builder dock: unreachable on every default canvas-first tenant", "cause": "The builder has TWO hosts sharing use-builder-session: the legacy dock (flag-off rollback) and the canvas-first WorkflowBuilderSurface (default). A feature mounted in the host the brief names, not the host the default flags render. Green tests over the wrong host are the green-ci-hides-unreachable-features class.", "layer": "application", "signal": "silent", "detect": "audit", "prevent": "test", "mast_mode": null, "silent_class": "E", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0166", "occurred": "2026-08-13", "severity": "s3", "system": "advizr", "project": "internal agent platform", "title": "Hydration mismatch on /settings: sidebar Radix aria-controls ids diverge server/client via the page's Suspense boundary", "cause": "React useId allocation differs between the server pass and client hydration when the settings page's Suspense boundary (required by useSearchParams) resolves differently, shifting Radix-generated ids for sidebar collapsibles rendered in the same tree.", "layer": "application", "signal": "loud", "detect": "check", "prevent": "test", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0167", "occurred": "2026-08-13", "severity": "s3", "system": "advizr", "project": "internal agent platform", "title": "status-tokens gate (no-raw-tabular-nums) reddens a new consumer-surface component: not in the common local gate battery", "cause": "no-raw-tabular-nums and no-raw-status-palette are GRADUATED rules held at zero on the consumer surface by check-status-tokens.mjs --gate. Any NEW file that enters the consumer surface (a component reached by a route) and uses raw tabular-nums/raw status colours is a +1 over baseline and fails.", "layer": "verification", "signal": "loud", "detect": "check", "prevent": "rule", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0168", "occurred": "2026-08-13", "severity": "s3", "system": "ci", "project": "client agent platform", "title": "Shared programme-manifest: second-to-merge flagship PR fails check-programme-complete with evidence-removed until rebased", "cause": "Two concurrent flagship PRs (W12 #2021 and W22 #2023) both add rows to the same <path> The first to merge lands its row on master; the second's branch, cut from an older master, is missing that row, and check-programme-complete's evidence-removed fence (lintManifest) treats a claiming row present at the base but absent...", "layer": "verification", "signal": "loud", "detect": "check", "prevent": "gate", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0169", "occurred": "2026-08-13", "severity": "s2", "system": "client", "project": "internal agent platform", "title": "Writing \"minimum 420 hours\" as a co-op term definition fails UBC's cumulative 12-16 week and 35 hrs/week rules", "cause": "The 420-hour figure was taken from the student verbatim and treated as the whole requirement. It is one of four constraints UBC applies together, and it is a floor for credit rather than a description of the schedule.", "layer": "data", "signal": "loud", "detect": "audit", "prevent": "rule", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": true, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0170", "occurred": "2026-08-13", "severity": "s3", "system": "git", "project": "internal agent platform", "title": "Removed a merged PR's worktree before harvesting its evidence artifacts: drive-browser receipt deleted", "cause": "Worktree cleanup treated the worktree as fully disposable; evidence artifacts written by agents (drive-runs, screenshots, receipts) default to the run's CWD, which for delegated builds IS the worktree.", "layer": "infra", "signal": "loud", "detect": "human", "prevent": "rule", "mast_mode": null, "silent_class": "E", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0171", "occurred": "2026-08-13", "severity": "s3", "system": "github", "project": "internal agent platform", "title": "pr-ack gate is two-stage: label AND a '## Deploy plan' PR-body section, re-evaluated only on a fresh event", "cause": "The pr-ack gate validates two independent inputs (risk label + a named PR-body section) but subscribes only to label/synchronize events, not to PR body edits, so a body-only fix leaves the check frozen at its last verdict.", "layer": "verification", "signal": "wrong", "detect": "human", "prevent": "gate", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0172", "occurred": "2026-08-13", "severity": "s3", "system": "github", "project": "client agent platform", "title": "pr-ack gate needs one ack label PER surface class: a dark-lever PR needs rollout-ack on top of migration-ack", "cause": "docs/pr-acknowledgement-gates.md defines four independent ack surfaces; a PR that both carries a migration AND adds a dark lever trips two of them. Briefs and habit only mention migration-ack, so the rollout-ack requirement surfaces as a red check after creation.", "layer": "verification", "signal": "loud", "detect": "check", "prevent": "rule", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0173", "occurred": "2026-08-13", "severity": "s3", "system": "github", "project": "internal agent platform", "title": "Re-running workflow runs does not attach required checks to a bot-pushed head: push an empty commit instead", "cause": "Required status contexts bind per-SHA. Workflow re-runs rerun the original commit's runs; they cannot migrate to a newer head. A workflow-token push generates no workflow-triggering event, so the bot head starts with no runs and can never gain the required contexts by re-running.", "layer": "verification", "signal": "silent", "detect": "human", "prevent": "rule", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0174", "occurred": "2026-08-13", "severity": "s3", "system": "github", "project": "internal agent platform", "title": "Stale-response gate rejects a requestSeq-ref guard: the scanner only credits the cancelled-flag cleanup shape", "cause": "check-stale-response.mjs recognizes the let cancelled = false + cleanup(cancelled = true) idiom; a useRef sequence guard is invisible to it. The ref guard also does not cancel on unmount, so the scanner's rejection is substantively right, not just pedantic.", "layer": "verification", "signal": "wrong", "detect": "check", "prevent": "rule", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0175", "occurred": "2026-08-13", "severity": "s2", "system": "handbook", "project": "internal agent platform", "title": "handbook/19 invented a non-existent \"exempt floor\" under ESR s.37.8, conflating it with minimum wage", "cause": "Two unrelated numbers were merged during the July 2026 drafting of the founding-engineer comp model: the BC general minimum wage ($18.25) and a supposed qualification threshold for the ESR s.37.8 high technology professional exemption.", "layer": "data", "signal": "loud", "detect": "audit", "prevent": "rule", "mast_mode": null, "silent_class": "D", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": true, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0176", "occurred": "2026-08-13", "severity": "s2", "system": "kb", "project": "internal agent platform", "title": "kb_resolve_error fails on every payload: bridge JSON.parse masks a 405 from an undeployed PATCH /errors route", "cause": "Two layers. (1) Deploy gap: the PATCH <path> resolve handler exists only on the local unpushed feat/claude-mem-error-memory branch; origin/master's <path> exports POST only, and Railway runs master, so Next.js auto-405s PATCH with an empty body before any handler runs, payload shape is irrelevant.", "layer": "verification", "signal": "wrong", "detect": "check", "prevent": "test", "mast_mode": null, "silent_class": "C", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0177", "occurred": "2026-08-13", "severity": "s2", "system": "knowledge", "project": "internal agent platform", "title": "kb_resolve_error fails with \"Unexpected end of JSON input\" on every call", "cause": "Not fully diagnosed from the client side. The message is a JSON.parse failure on an empty string, which means the resolve endpoint returned a zero-length or truncated body rather than a JSON error object.", "layer": "verification", "signal": "wrong", "detect": "check", "prevent": "monitor", "mast_mode": null, "silent_class": "C", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0178", "occurred": "2026-08-13", "severity": "s3", "system": "next", "project": "client agent platform", "title": "dark-levers-registry test flags a backtick ALL-CAPS env var in doc prose as a \"fictional lever\"", "cause": "The test scans docs/dark-levers.md for backtick-quoted ALL-CAPS tokens (regex /([A-Z][A-Z0-9]{4,})/) and asserts each is read via process.env in scanned source. It cannot distinguish a behaviour lever from a secret/key env var.", "layer": "verification", "signal": "wrong", "detect": "check", "prevent": "rule", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0179", "occurred": "2026-08-13", "severity": "s3", "system": "next", "project": "client agent platform", "title": "Dev-server smoke leaves.next/types behind and local tsc goes red on a pre-existing route export", "cause": "tsconfig.json includes.next/types//.ts; running next dev generates those files, and <path> exports a non-handler constant that fails Next's generated OmitWithTag route-shape check. Local tsc after any dev-server session therefore diverges from CI's clean-checkout tsc.", "layer": "verification", "signal": "wrong", "detect": "human", "prevent": "rule", "mast_mode": null, "silent_class": "A", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0180", "occurred": "2026-08-13", "severity": "s3", "system": "next", "project": "internal agent platform", "title": "Diff-based migration gates exit 0 vacuously on uncommitted work", "cause": "The gates enumerate changed files from committed history (origin/master..HEAD), not the working tree, so uncommitted migrations are invisible to them.", "layer": "verification", "signal": "silent", "detect": "audit", "prevent": "gate", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0181", "occurred": "2026-08-13", "severity": "s2", "system": "next", "project": "client agent platform", "title": "L3.5 workspace permission rules look silently dead on the commit-routed action path (CLIENT_SLUG vs uuid workspace_id)", "cause": "Two things are called workspaceid: SkillContext.workspaceId carries the tenant UUID on chat/runner paths but CLIENTSLUG on commit-routed paths (commit.ts keys actionreceipts by slug), and loadPermissionRules passes it raw into a uuid-typed column filter.", "layer": "application", "signal": "silent", "detect": "audit", "prevent": "test", "mast_mode": null, "silent_class": "B", "owasp_asi": "ASI03", "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0182", "occurred": "2026-08-13", "severity": "s3", "system": "next", "project": "internal agent platform", "title": "programme-complete `absent` assertion matches a column literal in a route's doc comment", "cause": "check-programme-complete's absent assertion (like the other design/no-leak gates) is a text scan over the raw file, not an AST/code scan. A no-leak assertion that forbids a column name from appearing in a file also matches that name written in a doc comment, so documenting the very thing you are asserting the absence o...", "layer": "verification", "signal": "wrong", "detect": "check", "prevent": "rule", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0183", "occurred": "2026-08-13", "severity": "s3", "system": "next", "project": "internal agent platform", "title": "Backgrounded next dev piped through head: server listens but never answers, and the log is blind", "cause": "Piping a long-running server's output through head in a backgrounded command: head exits after N lines, later stdout writes get EPIPE, and the server stalls mid-boot while still holding the port. The truncated pipe also hides the boot log, so the failure is indistinguishable from the known lockfile-wedge symptom.", "layer": "infra", "signal": "silent", "detect": "human", "prevent": "rule", "mast_mode": null, "silent_class": "A", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0184", "occurred": "2026-08-13", "severity": "s3", "system": "next", "project": "internal agent platform", "title": "Fresh-worktree next dev wedged: listens, never answers, event loop pegged: NOT the home-lockfile cause", "cause": null, "layer": "infra", "signal": "silent", "detect": "human", "prevent": "rule", "mast_mode": null, "silent_class": "A", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": false, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0185", "occurred": "2026-08-13", "severity": "s3", "system": "next", "project": "internal agent platform", "title": "next dev piped through head in a background shell wedges: listens, never answers", "cause": "head -40 exits after consuming 40 lines, which closes the pipe. The env-warning banner alone is 30+ lines, so head exited during boot. Next dev's next write to stdout (the request-triggered \"Compiling /middleware\" line) hit the closed pipe (EPIPE) and wedged the process before any request handling ran.", "layer": "infra", "signal": "silent", "detect": "human", "prevent": "rule", "mast_mode": null, "silent_class": "A", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": true, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0186", "occurred": "2026-08-13", "severity": "s2", "system": "openrouter", "project": "fleet admin console", "title": "OpenRouter accepts Anthropic tool search on request 1, rejects its own result blocks on request 2", "cause": "The Anthropic server-side tool-search tool (toolsearchtoolbm2520251119, the mechanism behind deferloading) is only partially supported by OpenRouter's Anthropic-compatible endpoint.", "layer": "thirdparty", "signal": "loud", "detect": "check", "prevent": "rule", "mast_mode": null, "silent_class": "A", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0187", "occurred": "2026-08-13", "severity": "s2", "system": "openrouter", "project": "client agent platform", "title": "OpenRouter fleet key at $0 credits: 402 blocks every live model verification", "cause": "The shared OpenRouter account balance is exhausted (limitsource: openroutercredits). No code defect: the request that was refused carried the correct body (jsonschema responseformat, no temperature for gemini-3-6-flash, multimodal parts).", "layer": "thirdparty", "signal": "loud", "detect": "check", "prevent": "monitor", "mast_mode": null, "silent_class": "A", "owasp_asi": null, "euaia_reportable": "would-report", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0188", "occurred": "2026-08-13", "severity": "s2", "system": "playwright", "project": "client agent platform", "title": "@smoke e2e asserted HTTP auth statuses (401/404) the DB-less placeholder-Supabase tier cannot provide", "cause": "The @smoke e2e tier boots against SUPABASEURL=<url> (e2e.yml), there is no auth backend. getSession resolves degenerately, so an 'anonymous' request is not 401 and a signed-in-behind-off-flag request is not the 404 the real auth+dark-gate ordering would produce.", "layer": "verification", "signal": "wrong", "detect": "check", "prevent": "test", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0189", "occurred": "2026-08-13", "severity": "s3", "system": "playwright", "project": "client agent platform", "title": "Playwright dev-walk clicked before hydration: flag-gated dialog entry read as missing with the flag on", "cause": "Under next dev, a server-rendered button is visible long before React hydration attaches its onClick. domcontentloaded + \"element visible, enabled and stable\" does not mean handlers exist; the click lands on dead markup and simply does nothing.", "layer": "verification", "signal": "wrong", "detect": "check", "prevent": "test", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0190", "occurred": "2026-08-13", "severity": "s3", "system": "scripts", "project": "internal agent platform", "title": "make-eml.py over-reports recipients by one when there is no Cc", "cause": "The verification block does cc = getaddresses([back[\"Cc\"] or \"\"]). When the Cc header is absent, back[\"Cc\"] is None, so it falls back to the empty string, and email.utils.getaddresses([\"\"]) returns [('', '')] rather than [] on this Python.", "layer": "application", "signal": "silent", "detect": "audit", "prevent": "test", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0191", "occurred": "2026-08-13", "severity": "s3", "system": "shell", "project": "internal agent platform", "title": "next dev piped through head wedges once head exits; piped tail masks every exit code", "cause": "A pipeline's consumer defines both lifetime and status: when head exits, the producer blocks forever on the full pipe (no SIGPIPE kill on Windows); and $? after a pipeline is the LAST command's exit, so | tail; echo $? always reports the filter, not the command.", "layer": "verification", "signal": "silent", "detect": "human", "prevent": "rule", "mast_mode": null, "silent_class": "A", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0192", "occurred": "2026-08-13", "severity": "s2", "system": "shell", "project": "client agent platform", "title": "Pipeline exit-code masking read a red strict gate as green (STS=0 over STRICT FAIL)", "cause": "In POSIX sh/bash, $? after cmd | tail -N is tail's exit code. Piping a gate's output to tail/head/grep for brevity destroys the only machine-readable signal the gate produces. Same class as the recorded grep -c short-circuit trap, in a new costume.", "layer": "verification", "signal": "silent", "detect": "audit", "prevent": "rule", "mast_mode": null, "silent_class": "C", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0193", "occurred": "2026-08-13", "severity": "s2", "system": "supabase", "project": "client agent platform", "title": "Mig 2720 still unapplied on template tenant: blocked W19 analyzer live walk (recurrence of W18's block)", "cause": "Migration 2720 (workflowrecordings + bucket, merged in #2010) was never applied to the template tenant's live Supabase. The template DB migration ledger has been dark since 176, so nothing surfaces the gap; each wave rediscovers it at verification time.", "layer": "data", "signal": "silent", "detect": "audit", "prevent": "gate", "mast_mode": null, "silent_class": "E", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0194", "occurred": "2026-08-13", "severity": "s3", "system": "supabase", "project": "client agent platform", "title": "workflow_recordings (mig 2720) merged on master but never applied to the template tenant: recording API 500s at first insert", "cause": "Merging a migration file to master does not apply it anywhere. The fleet update engine applies template migrations to client tenants on its own schedule, and the template dev tenant is not in that loop; nothing applied 2720 after #2010 merged.", "layer": "data", "signal": "loud", "detect": "check", "prevent": "gate", "mast_mode": null, "silent_class": "E", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0160", "occurred": "2026-08-12", "severity": "s2", "system": "github", "project": "internal agent platform", "title": "Twelve green checks on a PR changing services/browser-sandbox, which no workflow builds or runs", "cause": "The service has a committed lockfile but no CI job; its Dockerfile documents that it is deployed by hand with railway up and has no CI. Compounding it, typescript sits in dependencies rather than devDependencies while the image builds with npm ci --omit=dev, so the package ships into the production container, and the s...", "layer": "verification", "signal": "silent", "detect": "audit", "prevent": "gate", "mast_mode": null, "silent_class": "E", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0161", "occurred": "2026-08-12", "severity": "s2", "system": "github", "project": "internal agent platform", "title": "Backticks inside a Bash-tool double-quoted string run as command substitution even when backslash-escaped", "cause": "In a double-quoted shell string, backticks are command substitution. Backslash-escaping them survives one level of quoting but not the layers the Bash tool applies, so the escape is consumed and the backtick becomes active. Markdown bodies are exactly the payload most likely to contain backticks.", "layer": "infra", "signal": "loud", "detect": "human", "prevent": "rule", "mast_mode": null, "silent_class": "A", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0162", "occurred": "2026-08-12", "severity": "s2", "system": "next", "project": "internal agent platform", "title": "Stray package-lock.json in %USERPROFILE% wedges every Next dev server (root inference crawls the whole home dir)", "cause": "Next.js infers outputFileTracingRoot from the outermost directory containing a lockfile. A stray package-lock.json in <path> made every repo under Documents resolve its workspace root to the whole home directory; dev-server watching/tracing over that tree starves request handling indefinitely.", "layer": "infra", "signal": "wrong", "detect": "human", "prevent": "rule", "mast_mode": null, "silent_class": "A", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0163", "occurred": "2026-08-12", "severity": "s3", "system": "npm", "project": "internal agent platform", "title": "npx typescript exits 1 with \\\\\"could not determine executable to run\\\\\", which reads as a typecheck failure", "cause": "The typescript package ships two bins (tsc and tsserver) and neither is named typescript, so npx --yes <email> tsc gives npx no way to pick one and it aborts before running anything. The trailing tsc is read as an argument to the resolved executable, not as the executable to resolve.", "layer": "verification", "signal": "wrong", "detect": "human", "prevent": "rule", "mast_mode": null, "silent_class": "A", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0158", "occurred": "2026-08-07", "severity": "s3", "system": "github", "project": "internal agent platform", "title": "Template lint-and-typecheck bundles ~30 gates: new consumer component / model slug / egress fetch each trip a separate one", "cause": "The template's \"lint-and-typecheck\" required check is not just tsc+eslint, it bundles ~30 code-anchored gates (model-identity, consumer-surface, typography --strict, status-tokens, egress-inventory, vendor-headers, gen-env/migrations-manifest, rule-ids, etc.) listed in.github/workflows/ci.yml.", "layer": "verification", "signal": "wrong", "detect": "check", "prevent": "rule", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0159", "occurred": "2026-08-07", "severity": "s2", "system": "openrouter", "project": "internal agent platform", "title": "Hire \"03 Role\" dead: Anthropic structured-output rejects minItems>1 / number bounds on the wire", "cause": "<path> stripUnsupportedSchemaKeywords stripped ONLY array maxItems. blueprintCoreSchema (<path>) emits array minItems>1 (.min(2)/.min(5)) and number minimum/maximum on the wire, which Anthropic structured-output (direct/Bedrock/Azure via OpenRouter) rejects.", "layer": "model", "signal": "loud", "detect": "check", "prevent": "test", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0154", "occurred": "2026-07-23", "severity": "s2", "system": "next", "project": "internal agent platform", "title": "Brain /learn map: hidden mobile-twin SchematicGraph ran full-atlas dagre = 77s main-thread block", "cause": "A CSS-hidden (md:hidden) React subtree still MOUNTS and executes: the mobile BrainShapePreview twin ran an expensive synchronous dagre layout over the entire atlas on every /learn desktop load, blocking the main thread before the real force-graph map could mount.", "layer": "application", "signal": "quiet", "detect": "human", "prevent": "test", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0155", "occurred": "2026-07-23", "severity": "s2", "system": "supabase", "project": "internal agent platform", "title": "Client-template Brain rendered empty: ingest stamped whole corpus note_properties.visibility='private'", "cause": "Two ingest stamping bugs, both overriding the healthy DB default (noteproperties.visibility DEFAULT 'workspace', mig 197): (1) <path> hardcoded fm.visibility='private' on every WS8 auto-summary note (one per ingested source doc via enrich-job.ts), owned by the source's uploader = the service account; (2) brain-ingest r...", "layer": "data", "signal": "silent", "detect": "human", "prevent": "test", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0156", "occurred": "2026-07-23", "severity": "s2", "system": "supabase", "project": "internal agent platform", "title": "graph_intel_nodes insert fails: tiny float (1e-55) out of range for Postgres 'real': intel cache never persists", "cause": "eigenvector power-iteration (graphology) assigns peripheral nodes denormal-tiny positive values (~1e-55) that underflow Postgres float4 (real min-normal ~1.18e-38), aborting the graphintelnodes bulk INSERT. writeIntel threw → getOrComputeIntel swallowed it → graphintelruns never got a row → cache never persisted.", "layer": "data", "signal": "loud", "detect": "check", "prevent": "test", "mast_mode": null, "silent_class": "A", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0157", "occurred": "2026-07-23", "severity": "s3", "system": "supabase", "project": "internal agent platform", "title": "graph_intel_nodes insert fails: tiny float (1e-55) out of range for Postgres 'real': intel cache never persists", "cause": "A computed graph-intel node field (likely an x/y coordinate, size, or normalized degree/centrality) can be a denormalized float ~1e-55, below Postgres float4 (real) minimum normal ~1.18e-38, so the INSERT into graphintelnodes rejects it. Not yet fixed.", "layer": "data", "signal": "loud", "detect": "check", "prevent": "test", "mast_mode": null, "silent_class": "A", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0142", "occurred": "2026-07-22", "severity": "s3", "system": "advizr", "project": "internal agent platform", "title": "Reaper reap-write silently failed on weeks-stranded runs: duration_ms INT4 overflow", "cause": "Recovery-path write computed durationms = now - startedat without bounding it to the INT4 column range; stranded-state cleanup code by definition meets pathological timestamps (weeks/months), which no test fixture exercised.", "layer": "orchestration", "signal": "silent", "detect": "audit", "prevent": "test", "mast_mode": null, "silent_class": "C", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0143", "occurred": "2026-07-22", "severity": "s2", "system": "advizr", "project": "agency infrastructure", "title": "Template-update engine detects conflicts by blob-SHA equality, NOT git hunk-merge: a union pre-merge does NOT drop a file from the conflict set", "cause": "The \"3-way hunk merge / overlapping hunks\" mental model does not match the deployed template-update engine, which is a pure tree-diff (path->blobSHA equality) with a converged/rescued escape and whole-file conflictresolutions ('template'|'client').", "layer": "infra", "signal": "wrong", "detect": "audit", "prevent": "rule", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0144", "occurred": "2026-07-22", "severity": "s2", "system": "git", "project": "internal agent platform", "title": "git reset --soft origin/master in a long-lived worktree swept a day of other lanes' merges into one \"squash\" commit (near-miss revert)", "cause": "reset --soft to a moving ref (origin/master) diffs the worktree against wherever that ref points NOW, not the base the work was written on. In multi-lane periods master moves constantly; any soft-reset squash silently converts \"not rebased yet\" into \"reverts everything merged since\".", "layer": "infra", "signal": "silent", "detect": "human", "prevent": "rule", "mast_mode": null, "silent_class": "A", "owasp_asi": null, "euaia_reportable": "would-report", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0145", "occurred": "2026-07-22", "severity": "s2", "system": "github", "project": "internal agent platform", "title": "Stale-merge race: PR CI green against old master, merged red: branch protection lacks require-up-to-date", "cause": "GitHub branch protection on <internal-project> does not require branches to be up to date before merging, so a PR whose CI ran against an older master can merge a logically-conflicting change with green checks. rbac's member-role derivation being a load-time mutation makes the conflict invisible to textual review.", "layer": "verification", "signal": "silent", "detect": "check", "prevent": "gate", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0146", "occurred": "2026-07-22", "severity": "s1", "system": "railway", "project": "internal agent platform", "title": "LinkedIn-Automation API/worker died on transient pg drop and stayed dead (pool had no error listener → exit 0 → Railway ON_FAILURE won't restart)", "cause": "The primary pg Pool (execution/db/connection.js:87 new Pool(config)) had NO pool.on('error') listener (the read replica databasereadreplica.js:50 DID). Supabase/Supavisor idle-kills a pooled backend connection → node-postgres emits 'error' on the Pool → with no listener Node promotes it to an uncaughtException → shutdo...", "layer": "infra", "signal": "silent", "detect": "audit", "prevent": "monitor", "mast_mode": null, "silent_class": "C", "owasp_asi": null, "euaia_reportable": "would-report", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0147", "occurred": "2026-07-22", "severity": "s1", "system": "supabase", "project": "internal agent platform", "title": "Estate-wide Supabase RLS disabled: 333 public tables anon-readable/writable across 15 projects (incl. PHI, password hashes, secrets)", "cause": "Tables added by later migrations (eval, policy, retrieval, agent infra, users, jobqueue in the client-template line; plus whole standalone projects that never enabled RLS) were created without ENABLE ROW LEVEL SECURITY.", "layer": "data", "signal": "silent", "detect": "audit", "prevent": "gate", "mast_mode": null, "silent_class": "E", "owasp_asi": "ASI03", "euaia_reportable": "would-report", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0148", "occurred": "2026-07-22", "severity": "s3", "system": "supabase", "project": "internal agent platform", "title": "LinkedIn-Automation health-scorer silently dead: account_health INSERT column/schema drift + missing NOT-NULL id", "cause": "Schema drift between migration 019 (accounthealth defined with id TEXT PRIMARY KEY no default, columns score/risklevel/captchacount24h/...) and the code (execution/observability/healthscorer.js:180) which INSERTs a DIFFERENT column set (accountid/healthscore/limitmultiplier/confidence/lasteventtype/lasteventat/events24...", "layer": "data", "signal": "silent", "detect": "audit", "prevent": "test", "mast_mode": null, "silent_class": "C", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0149", "occurred": "2026-07-22", "severity": "s1", "system": "vercel", "project": "client agent platform", "title": "Daily AI-news recap died silently on 3 tenants: OpenRouter account out of credits; provisioning worker was seeding the dead key into every new client", "cause": "Two compounding causes. (1) OpenRouter keys pass /auth/key as \"valid\" even when their account has $0 credit, key rotation on 07-08 covered only 3 of 6 tenants and skipped the provisioning worker's env, so the worker kept copying the dead key into new clients.", "layer": "thirdparty", "signal": "silent", "detect": "audit", "prevent": "monitor", "mast_mode": null, "silent_class": "C", "owasp_asi": null, "euaia_reportable": "would-report", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0150", "occurred": "2026-07-22", "severity": "s1", "system": "vercel", "project": "client agent platform", "title": "Invite recovery loop re-sent the same doomed long-token link: Outlook dropped it every time (round 4); fix = short invite code", "cause": "A long URL as the SOLE acceptance credential is fundamentally incompatible with mail clients that mangle/truncate URLs (Outlook/SafeLinks). Recovery that RE-ISSUES THE SAME ARTIFACT cannot converge against a deterministic mangler.", "layer": "application", "signal": "wrong", "detect": "client", "prevent": "test", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-report", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0151", "occurred": "2026-07-22", "severity": "s1", "system": "vercel", "project": "agency infrastructure", "title": "Outlook dropped the entire invite-token segment: bare /Client A/invite 307'd to the login wall (invite round 3, backfill)", "cause": "A long URL as the SOLE credential is incompatible with Outlook's wrap/truncation behavior. #778 handled GARBLED tokens (SafeLinks %-encoding, whitespace) but not ABSENT ones: when the mail client drops the whole token segment, the bare /invite path wasn't public, so the middleware login-redirect fired before any recove...", "layer": "thirdparty", "signal": "wrong", "detect": "client", "prevent": "test", "mast_mode": null, "silent_class": "A", "owasp_asi": null, "euaia_reportable": "would-report", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0152", "occurred": "2026-07-22", "severity": "s3", "system": "vercel", "project": "fleet admin console", "title": "vercel env add fed via heredoc <<< stores a trailing newline: exact-match env flags silently read as off", "cause": "bash <<< (herestring) appends a newline to the string it feeds stdin; vercel env add stores stdin verbatim including that newline. Any consumer doing an exact string comparison then fails.", "layer": "infra", "signal": "silent", "detect": "audit", "prevent": "gate", "mast_mode": null, "silent_class": "A", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0153", "occurred": "2026-07-22", "severity": "s3", "system": "workflow", "project": "client agent platform", "title": "Workflow instant-apply: refine-vs-create must be captured at TURN START, not from live doc length", "cause": "The empty-canvas CREATE flow legitimately has a non-empty doc mid-stream (user can hand-add a node while a proposal streams). So the live doc length is NOT a valid create-vs-refine signal.", "layer": "orchestration", "signal": "wrong", "detect": "human", "prevent": "test", "mast_mode": "FM-1.1", "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0128", "occurred": "2026-07-21", "severity": "s2", "system": "github", "project": "client agent platform", "title": "Release channel BLOCKED: gate's connectors leg fails because the smoke user has zero Connected apps (connections are per-user; Gmail belongs to James's user)", "cause": "The gate test assumes the smoke user sees a Connected app, but connector connections are per-user-scoped and the demo/smoke account holds none (its state was likely purged in the <phone> real-data-posture cleanup, or per-user scoping tightened after the Jul 18 release).", "layer": "verification", "signal": "wrong", "detect": "check", "prevent": "test", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0129", "occurred": "2026-07-21", "severity": "s2", "system": "github", "project": "client agent platform", "title": "Template Release Gate dead: VERCEL_TOKEN repo secret invalid (403 invalidToken): no release could be cut", "cause": "The <internal-project> repo secret VERCELTOKEN (used by.github/workflows/release.yml to poll deployment state) expired or was rotated without the repo secret being updated. Vercel tokens created with an expiry die silently; the gate is the only consumer so nothing noticed until the next release cut.", "layer": "verification", "signal": "loud", "detect": "check", "prevent": "monitor", "mast_mode": null, "silent_class": "A", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0130", "occurred": "2026-07-21", "severity": "s3", "system": "github", "project": "internal agent platform", "title": "Two same-night migration-number races (570, 572): parallel sessions + unpushed branches make registry claims invisible", "cause": "The registry gate can only see PUBLIC claims (master files + open-PR §2 rows). An unpushed branch's claim protects nobody, and two active sessions merging to the same repo overnight make the window minutes wide, not days.", "layer": "verification", "signal": "wrong", "detect": "check", "prevent": "gate", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0131", "occurred": "2026-07-21", "severity": "s3", "system": "github", "project": "client agent platform", "title": "VERCEL_TOKEN from the local CLI auth.json dies within hours: the CLI rotates its own token", "cause": "Vercel CLI v50 session tokens rotate; auth.json holds a session credential, not a durable API token. The CLI offers no tokens create, long-lived tokens are minted only in the Vercel dashboard (Account Settings → Tokens).", "layer": "thirdparty", "signal": "loud", "detect": "check", "prevent": "rule", "mast_mode": null, "silent_class": "A", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0132", "occurred": "2026-07-21", "severity": "s3", "system": "github", "project": "client agent platform", "title": "visual.yml update-baselines dispatch leaves the PR head with NO required checks (GITHUB_TOKEN push can't trigger workflows)", "cause": "GitHub intentionally suppresses workflow triggers for commits pushed with the default GITHUBTOKEN. The update-baselines dispatch in.github/workflows/visual.yml commits back to the branch with that token, so the resulting PR head has no Actions check runs at all, which blocks merge if required checks are enforced and, w...", "layer": "verification", "signal": "silent", "detect": "human", "prevent": "gate", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0133", "occurred": "2026-07-21", "severity": "s3", "system": "github", "project": "client agent platform", "title": "Migration 570 cross-PR collision: unpushed branch's registry claim is invisible to sibling lanes", "cause": "The migration-registry gate's cross-PR scan (gh pr list --json files) can only see OPEN PRs. A number claimed on a local-only branch is invisible to every sibling lane until that branch is pushed, so two lanes that each verify \"zero open-PR claims\" can both be truthful and still collide.", "layer": "verification", "signal": "silent", "detect": "downstream", "prevent": "gate", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0134", "occurred": "2026-07-21", "severity": "s2", "system": "google", "project": "internal agent platform", "title": "Google OAuth client for Calendar/Gmail deleted: all machine-level Google API access dead (invalid_client)", "cause": "The Google Cloud OAuth client (<internal-project> / <phone>-...) was deleted, invalidating every refresh token minted against it, Vercel envs still carry the dead credentials, which makes the failure look like token expiry when it is client deletion.", "layer": "thirdparty", "signal": "wrong", "detect": "check", "prevent": "monitor", "mast_mode": null, "silent_class": "A", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0135", "occurred": "2026-07-21", "severity": "s2", "system": "next", "project": "internal agent platform", "title": "Radix Popover with raw autoFocus never opens inside a modal Dialog (budget-chip); CI flake was the symptom", "cause": "Raw autoFocus attribute inside Radix PopoverContent races the parent Dialog FocusScope registration; focus restoration closes the popover before it ever paints.", "layer": "application", "signal": "wrong", "detect": "check", "prevent": "test", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0136", "occurred": "2026-07-21", "severity": "s3", "system": "next", "project": "internal agent platform", "title": "twMerge drops font-mono when font-tabular rides the same cn() call", "cause": "tailwind-merge's default config pattern-matches font- arbitrary names into the font-family conflict group; the repo's custom font-tabular utility (font-variant-numeric) collides with font-mono inside cn()/twMerge.", "layer": "application", "signal": "silent", "detect": "human", "prevent": "test", "mast_mode": null, "silent_class": "A", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0137", "occurred": "2026-07-21", "severity": "s3", "system": "supabase", "project": "internal agent platform", "title": "backfill-source-registry --apply aborts on uq_documents_source_external; collision class = duplicate orphan docs (80 found on template)", "cause": "Historical double-import created orphan duplicates of linked docs (same sourceexternalid). The linker assumed orphans were always linkable.", "layer": "data", "signal": "loud", "detect": "check", "prevent": "rule", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0138", "occurred": "2026-07-21", "severity": "s2", "system": "supabase", "project": "internal agent platform", "title": "supautils safeupdate guard broke WHERE-less DELETE inside compute_doc_similarity_edges_v2 (mig 573 fix)", "cause": "Platform-side change: supautils safeupdate now enforces WHERE on DELETE for RPC-executed SQL. The RPC's temp-table DELETE (defensive, table is fresh ON COMMIT DROP anyway) was the only WHERE-less statement.", "layer": "thirdparty", "signal": "loud", "detect": "check", "prevent": "rule", "mast_mode": null, "silent_class": "A", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0139", "occurred": "2026-07-21", "severity": "s1", "system": "vercel", "project": "agency infrastructure", "title": "\"Fixed\" claimed to client while the fix never reached their deployment: template-merge ≠ fork delivery", "cause": "Two-layer gap: (1) a fix merged to the template repo is not delivered until it is in a cut release AND the client fork has taken that release and its Vercel prod is READY on the resulting commit; (2) the \"fixed\" claim was verified against the wrong surface (template code, invite-row state) instead of the client's live...", "layer": "verification", "signal": "silent", "detect": "client", "prevent": "gate", "mast_mode": null, "silent_class": "D", "owasp_asi": null, "euaia_reportable": "would-report", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0140", "occurred": "2026-07-21", "severity": "s2", "system": "vercel", "project": "agency infrastructure", "title": "Client C tenant launched with an exhausted OpenRouter key: live brain-ask 402'd until key swap", "cause": "The tenant's Vercel env carried an OpenRouter key from an account that was already at its credit ceiling. $40.22 had been consumed before the client ever logged in, the key/account predates the tenant and arrived exhausted (or was drained by provisioning-era enrichment).", "layer": "infra", "signal": "loud", "detect": "client", "prevent": "gate", "mast_mode": null, "silent_class": "A", "owasp_asi": null, "euaia_reportable": "would-report", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0141", "occurred": "2026-07-21", "severity": "s1", "system": "vercel", "project": "internal agent platform", "title": "Token-less /invite (mail-client truncation drops the token segment) 307'd to router login: the URL shape #778 couldn't catch", "cause": "Defense-in-depth gap: every #778 defense (normalizeInviteToken, recover form on terminal states, inviteviewed audit) lives AT OR AFTER the /invite/[token] route, a URL missing the token segment never reaches any of it, and the middleware default for unmatched paths is a login redirect that renders nothing and writes no...", "layer": "application", "signal": "wrong", "detect": "client", "prevent": "test", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-report", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": true, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0105", "occurred": "2026-07-20", "severity": "s2", "system": "advizr", "project": "internal agent platform", "title": "CORRECTED: bound send_reply proposals DO execute (via executeBoundProposal): the only block was Resend outbound-domain verification", "cause": "run-job's proposalexecute handler routes by operandshash: isBound ? executeBoundProposal(id): executeProposal(id), \"a bound proposal must NEVER fall back to prose.\" executeBoundProposal (<path>) is the GENERIC bound executor for ANY operand-bound proposal: it re-resolves (TOCTOU), CAS approved→executing, then runs the...", "layer": "orchestration", "signal": "wrong", "detect": "audit", "prevent": "rule", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": true, "resolution_written": false, "resolved_field": true, "recurrence_count": 1 }, { "id": "afi-0106", "occurred": "2026-07-20", "severity": "s2", "system": "advizr", "project": "internal agent platform", "title": "Client-merged metadata became an authority hole: forged event-trigger binding could run workflows against another user's OAuth accounts", "cause": "The binding was deliberately placed in metadata rather than config BECAUSE reconcileWorkflowCanvas merges metadata by key, so a server-written value survives an autosave that doesn't know about it. That reasoning was about DURABILITY and never asked who is permitted to WRITE the field.", "layer": "application", "signal": "silent", "detect": "audit", "prevent": "test", "mast_mode": null, "silent_class": "B", "owasp_asi": "ASI03", "euaia_reportable": "would-report", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0107", "occurred": "2026-07-20", "severity": "s3", "system": "advizr", "project": "internal agent platform", "title": "<path> has never run: outside the vitest __tests__ include", "cause": "vitest's include pattern requires a tests directory segment, but nothing enforces placement. A co-located.test.ts looks correct in an editor, passes review, is committed, and is never run. Zero signal: no error, no skip notice, no coverage complaint.", "layer": "verification", "signal": "silent", "detect": "audit", "prevent": "gate", "mast_mode": null, "silent_class": "E", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0108", "occurred": "2026-07-20", "severity": "s2", "system": "advizr", "project": "internal agent platform", "title": "runner ADOPT path silently drops options.origin: fire-and-forget dispatches lose their origin label (caught by P12 live exit-check)", "cause": "Two metadata-stamping paths in runner.ts (INSERT vs ADOPT) drifted: the adopt merge enumerates its keys explicitly and origin was never added when Bdst-18 introduced it on the INSERT path. Same #622 class: per-run facts that live only in options die at the first metadata merge that doesn't re-write them.", "layer": "orchestration", "signal": "silent", "detect": "check", "prevent": "test", "mast_mode": "FM-1.4", "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0109", "occurred": "2026-07-20", "severity": "s2", "system": "composio", "project": "internal agent platform", "title": "composio_trigger workflow node was palette-only: shipped UI over dead wiring, could never fire", "cause": "The connectors-as-nodes work (PR #752) delivered the node kind, catalogue, form generation and executor handling as one unit, but the trigger SUBSCRIPTION lifecycle and the webhook ROUTING leg were never built.", "layer": "application", "signal": "silent", "detect": "audit", "prevent": "test", "mast_mode": null, "silent_class": "E", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0110", "occurred": "2026-07-20", "severity": "s2", "system": "github", "project": "client agent platform", "title": "brain-nightly red 10 consecutive nights on OpenRouter 402; migs 222/331 never applied: the retrieval harness has never produced a number", "cause": "Two independent failures compounding. (1) The OpenRouter account ran out of credits; every embed in the nightly eval 402'd, so the workflow failed on the recall floor with a number produced by a broken pipeline rather than by retrieval.", "layer": "verification", "signal": "wrong", "detect": "audit", "prevent": "monitor", "mast_mode": null, "silent_class": "C", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0111", "occurred": "2026-07-20", "severity": "s2", "system": "macos", "project": "client agent platform", "title": "macOS has no `timeout`: `timeout N npx tsc` exits 127 with empty output and reads exactly like a clean typecheck", "cause": "GNU coreutils timeout is not present on stock macOS (it ships as gtimeout only if coreutils is brew-installed). The shell returns 127 command-not-found and prints nothing to stdout. Piping that into grep -c \"error TS\" yields 0, indistinguishable from a passing typecheck, so the verification silently never ran.", "layer": "verification", "signal": "silent", "detect": "audit", "prevent": "rule", "mast_mode": null, "silent_class": "A", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0113", "occurred": "2026-07-20", "severity": "s1", "system": "next", "project": "internal agent platform", "title": "Streaming tool-input partials crashed the /workflows segment; the e2e mock hid it by sending one delta", "cause": "projectStagedGraph mapped staged.edges unguarded from a render-time useMemo, on a payload guaranteed to arrive WITHOUT edges. Chain: proposedGraphSchema declares keys nodes,edges,summary → ai@6/@ai-sdk/react@3 stream tool INPUT by default, so the proposegraph part is readable while its JSON is only partially parsed, i....", "layer": "application", "signal": "loud", "detect": "human", "prevent": "test", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0114", "occurred": "2026-07-20", "severity": "s3", "system": "next", "project": "client agent platform", "title": "worktree-npm-guard hook blocks even --package-lock-only installs (lockfile-only assumption false)", "cause": "The guard hook matches install commands textually and resolves nodemodules from the session working directory, not from the command's effective target directory or npm mode; --package-lock-only genuinely writes zero files into nodemodules but the hook cannot see that.", "layer": "verification", "signal": "loud", "detect": "human", "prevent": "rule", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0115", "occurred": "2026-07-20", "severity": "s2", "system": "openrouter", "project": "outbound pipeline", "title": "$465 OpenRouter credit burn: Perplexity research phase auto-enabled by key presence, billing every lead on every regen run", "cause": "Spend-bearing features gated on KEY PRESENCE instead of explicit opt-in: the research phase treated \"a key exists\" as \"the operator wants to pay for research\". Compounded by: failed runs billing partial work, and a cron spending on a feature (optimizer) that could not produce value yet (empty allowlist).", "layer": "application", "signal": "silent", "detect": "audit", "prevent": "gate", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-report", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0116", "occurred": "2026-07-20", "severity": "s2", "system": "openrouter", "project": "internal agent platform", "title": "Anthropic structured outputs 400 on zod value bounds: every coach synthesis silently died", "cause": "Wire schemas for generateObject/structured outputs must be SHAPE ONLY: types + strict/additionalProperties. Value-constraint keywords (minimum/maximum/minLength/maxLength/minItems/maxItems) are not in Anthropic's supported structured-output subset and 400 the whole request.", "layer": "model", "signal": "silent", "detect": "audit", "prevent": "test", "mast_mode": null, "silent_class": "C", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0117", "occurred": "2026-07-20", "severity": "s2", "system": "openrouter", "project": "internal agent platform", "title": "OpenRouter transient \"402 Insufficient credits\" fails connector ingest embeds with no auto-recovery (template tenant)", "cause": "Embeddings route exclusively through OpenRouter (<path> → <path>, model openai/text-embedding-3-small); no direct-OpenAI fallback for the embed leg even though OPENAIAPIKEY is set. When OpenRouter returns a transient 402 (momentary balance/spend-rate dip), the ingest embed step fails.", "layer": "thirdparty", "signal": "loud", "detect": "check", "prevent": "monitor", "mast_mode": null, "silent_class": "A", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0118", "occurred": "2026-07-20", "severity": "s2", "system": "supabase", "project": "internal agent platform", "title": "agent_observations/agent_sessions/error_events key on project_slug (text), not project_id (uuid)", "cause": "agency-kb has TWO different tenant-key conventions and they are not interchangeable. The chunk-family tables (projectchunks, domains, retrievalconfig, indexmetadata) use projectid uuid FK. The memory/error family (agentsessions, agentobservations, agentsummaries, errorevents) uses projectslug TEXT.", "layer": "data", "signal": "silent", "detect": "audit", "prevent": "rule", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0119", "occurred": "2026-07-20", "severity": "s2", "system": "supabase", "project": "internal agent platform", "title": "Approved delegate_to_subagent proposals can never execute: bound path inserts agent_sessions.user_id NULL (23502)", "cause": "The proposal executor does not thread the proposal's stored actor (metadata.triggeredby / reviewedby) into the bound SkillContext, so the delegate executor dispatches the child with no userId; agentsessions.userid is NOT NULL, so session creation for the child run fails before execution starts.", "layer": "orchestration", "signal": "loud", "detect": "check", "prevent": "test", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0120", "occurred": "2026-07-20", "severity": "s2", "system": "supabase", "project": "internal agent platform", "title": "extract_data derivative persist dead in headless runs: documents.uploaded_by_user_id + uploaded_by_email are NOT NULL", "cause": "A headless agent run carries no ctx.userId/ctx.userEmail, but documents.uploadedbyuserid AND uploadedbyemail are NOT NULL with no default. The skill passed ctx.userId ?? null → constraint violation → the derivative was never created (so querytables + undo had nothing), and because the error path did not log the DB erro...", "layer": "orchestration", "signal": "loud", "detect": "check", "prevent": "test", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0121", "occurred": "2026-07-20", "severity": "s2", "system": "supabase", "project": "client agent platform", "title": "Migration 464 silently revoked the gmail/google_calendar providers added by 229: native Google sources uncreatable for months", "cause": "Migration 229 widened documentsourcesprovidercheck to add the native Google providers ('gmail', 'googlecalendar'). Migration 464 later did its own DROP + re-ADD of the SAME constraint to append ('crawl','feed','corpus'), but rebuilt the allowed list from the mig-202 base rather than from 229's, dropping both Google pro...", "layer": "data", "signal": "silent", "detect": "audit", "prevent": "test", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0122", "occurred": "2026-07-20", "severity": "s2", "system": "supabase", "project": "client agent platform", "title": "tasks.tags is JSONB: text[]-style contains literal 22P02s and can 500 an endpoint that treats a new bucket's error as fatal", "cause": "Column type assumption: tasks.tags looks like text[] in TS (string[]) but is stored as JSONB; PostgREST cs-operator literals differ by type ({a,b} for arrays, [\"a\"] / {\"k\":v} for jsonb). Also new attention buckets defaulted into the fatal error branch instead of degrading.", "layer": "data", "signal": "loud", "detect": "check", "prevent": "test", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0123", "occurred": "2026-07-20", "severity": "s2", "system": "supabase", "project": "internal agent platform", "title": "UNIQUE(project_id, name) silently allows duplicate global domains because NULL != NULL", "cause": "domains has UNIQUE(projectid, name), but tier-1/global domains store projectid AS NULL. In a Postgres unique index NULL is never equal to NULL, so two rows with (NULL, 'engineering') do not conflict.", "layer": "data", "signal": "silent", "detect": "audit", "prevent": "test", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0124", "occurred": "2026-07-20", "severity": "s2", "system": "vercel", "project": "internal agent platform", "title": "Docs demo videos invisible on live template: media components emitted /public asset URLs without the client-slug prefix (posters 404, DEMUXER_ERROR)", "cause": "components/docs/mdx/local-video.tsx and screenshot.tsx rendered manifest/author paths (/videos/…, /images/…) raw into media attributes. Local dev has no <host> router (public/ serves at root), so the recorder, dev verification, and unit tests all passed; the only environments that expose the bug are router-fronted depl...", "layer": "application", "signal": "silent", "detect": "human", "prevent": "test", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0125", "occurred": "2026-07-20", "severity": "s2", "system": "vercel", "project": "agency infrastructure", "title": "Client A team-invite acceptance dead-ended a valid invitee (mangled link → terminal state with only \"Sign in\")", "cause": "The team-invite accept flow had no tolerance for mangled tokens and no recovery affordance: (1) token lookup was exact-match with no normalization, so any Outlook/SafeLinks percent-encoding or hard-wrap whitespace produced a not-found → terminal state; (2) every terminal state's only action was a bare \"Sign in\" link, a...", "layer": "application", "signal": "wrong", "detect": "client", "prevent": "test", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-report", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": true, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0126", "occurred": "2026-07-20", "severity": "s2", "system": "vercel", "project": "internal agent platform", "title": "Share-page view counter + external audit dead: void record_share_view/logAuditEvent dropped on Vercel serverless freeze", "cause": "Fire-and-forget (void promise) DB writes in a Next Server Component are dropped when Vercel freezes the function the moment the response streams. The artifactshares row insert is awaited (reliable), but the view counter + external audit were not.", "layer": "infra", "signal": "silent", "detect": "audit", "prevent": "test", "mast_mode": null, "silent_class": "A", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0127", "occurred": "2026-07-20", "severity": "s3", "system": "video", "project": "client agent platform", "title": "video-lens skill scripts crash on system python 3.9: run them via uv --python 3.12", "cause": "macOS system python3 is 3.9 (LibreSSL build); the skill's compatibility line says \"Requires Python 3\" without a minor version, and its scripts use 3.10+ typing syntax.", "layer": "infra", "signal": "loud", "detect": "human", "prevent": "rule", "mast_mode": null, "silent_class": "A", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0075", "occurred": "2026-07-19", "severity": "s2", "system": "advizr", "project": "internal agent platform", "title": "Chat thumbs 100% dead in prod for months: entity_type='chat' violated the agent_feedback CHECK, swallowed by catch {}", "cause": "The client sent an entitytype value that was never a member of the DB CHECK set nor of the TS union FeedbackEntityType ('session'|'run'|'proposal'). It compiled only because the fetch body was an untyped object literal, so TypeScript never checked it against the union that mirrors the constraint.", "layer": "application", "signal": "silent", "detect": "audit", "prevent": "test", "mast_mode": null, "silent_class": "C", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0076", "occurred": "2026-07-19", "severity": "s2", "system": "advizr", "project": "internal agent platform", "title": "Template update fails at build_branch: git rm refuses paths the bulk checkout staged", "cause": "buildbranch in <path> bulk-adopts the template with git checkout targetSha --., which STAGES the entire target tree into the index. It then removes rmPaths, which includes client-deleted files the bulk checkout just resurrected (keepsClient(d) && treeClient[d.path] === undefined).", "layer": "infra", "signal": "loud", "detect": "check", "prevent": "rule", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0077", "occurred": "2026-07-19", "severity": "s3", "system": "claude", "project": "outbound pipeline", "title": "Background agents/workflows die silently on Claude Code session restarts and credit exhaustion: long fan-outs must checkpoint to disk", "cause": "Background subagents and workflows are children of the Claude Code process, a session restart orphans them mid-write, and per-model credit pools (Fable subagent credits separate from session) can cut them off mid-task. Parallel Opus relaunches also trip server-side rate limits.", "layer": "orchestration", "signal": "silent", "detect": "human", "prevent": "rule", "mast_mode": "FM-3.1", "silent_class": "A", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0078", "occurred": "2026-07-19", "severity": "s3", "system": "github", "project": "internal agent platform", "title": "Migration-registry gate failed against the WRONG programme: a master merge silently overwrote.b-prompt (Bdst→Bdp03), so the gate checked my migration against another lane's reservations", "cause": "The gate resolves the PR's programme identity from the root.b-prompt file (preferred) before consulting §2..b-prompt is a single-line file every programme rewrites, so it conflicts on essentially every branch, but when a git merge origin/master resolves it WITHOUT a conflict (because my branch hadn't touched it since t...", "layer": "verification", "signal": "wrong", "detect": "check", "prevent": "gate", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0079", "occurred": "2026-07-19", "severity": "s3", "system": "github", "project": "client agent platform", "title": "Never dispatch visual update_baselines on master in <internal-project>: master's own merge velocity guarantees the bot's push is rejected", "cause": "The regeneration job takes ~30 minutes (full next build + Playwright over every surface x 3 viewports x 2 themes) and the workflow's commit step does a bare git push with no pull/rebase/retry.", "layer": "verification", "signal": "loud", "detect": "check", "prevent": "rule", "mast_mode": null, "silent_class": "A", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0080", "occurred": "2026-07-19", "severity": "s3", "system": "github", "project": "internal agent platform", "title": "Racing the Bdst fleet: manifest, registry last-wins,.b-prompt and module-name collisions each block a merge", "cause": "1. <path> is GENERATED and unit-tested. Adding a migration, or merging master and inheriting sibling migrations, leaves it stale. Initially misdiagnosed as the known-flaky connections-request-cta DOM test because the real failing line hides among hundreds of passing ones.", "layer": "verification", "signal": "wrong", "detect": "check", "prevent": "gate", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0081", "occurred": "2026-07-19", "severity": "s2", "system": "github", "project": "internal agent platform", "title": "Shared migration-registry row drifts THREE ways in a fast-moving programme: two are silent (no conflict raised)", "cause": "Every sibling PR in a programme edits the SAME §2 \"last-wins consolidated\" registry row, plus the root.b-prompt, plus the GENERATED <path>. That produces three distinct drift modes, and only the first announces itself: 1. MERGE CONFLICT on docs/migration-registry.md, visible, git stops you. 2.", "layer": "verification", "signal": "silent", "detect": "downstream", "prevent": "gate", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0082", "occurred": "2026-07-19", "severity": "s3", "system": "github", "project": "client agent platform", "title": "Visual baseline regeneration (update_baselines) silently loses its work when anything else pushes to the branch: \"failed to push some refs\"", "cause": "The workflow's commit step does a plain git push with no pull/rebase and no retry. Regeneration is slow (full build + Playwright across every surface x 3 viewports x 2 themes, ~30 min), so ANY other push to the branch during that window makes the runner's push a non-fast-forward and it is rejected.", "layer": "verification", "signal": "quiet", "detect": "human", "prevent": "rule", "mast_mode": null, "silent_class": "C", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": false, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0083", "occurred": "2026-07-19", "severity": "s3", "system": "next", "project": "internal agent platform", "title": "Adding a supabase migration fails unit-tests unless <path> is regenerated", "cause": "The repo keeps a committed manifest <path> that must list every file in <path> A unit test runs node <path> --check and fails if the manifest is stale/missing. Adding mig 498 without regenerating the manifest left it stale.", "layer": "verification", "signal": "loud", "detect": "check", "prevent": "gate", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0084", "occurred": "2026-07-19", "severity": "s3", "system": "next", "project": "client agent platform", "title": "Adding a supabase migration without regenerating <path> fails unit-tests (probes-manifest) ~10 min into CI", "cause": "<path> is a GENERATED, committed artifact that must be regenerated whenever <path> gains a file. Nothing in the local iterate loop surfaces this: targeted vitest runs and even a broad regression subset never touch probes-manifest.test.ts, and tsc/eslint/jargon/migration-registry gates all pass with a stale manifest.", "layer": "verification", "signal": "loud", "detect": "check", "prevent": "gate", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": false, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0085", "occurred": "2026-07-19", "severity": "s2", "system": "next", "project": "internal agent platform", "title": "cmdk forceMount on items alone hides server results: group hidden + CommandEmpty overlays \"No matches\"", "cause": "Two cmdk semantics around forceMount, both missed because no test rendered a query that matched zero STATIC rows: (1) cmdk hides a Command.Group whose children do not match the query, the live rows were forceMounted but their PARENT CommandGroup was not, so cmdk hid the group (headings survived in the DOM, rows did not...", "layer": "application", "signal": "silent", "detect": "human", "prevent": "test", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0086", "occurred": "2026-07-19", "severity": "s2", "system": "next", "project": "internal agent platform", "title": "Config-as-code apply blocked on every already-active agent: unchanged status re-triggers the publish gate", "cause": "applyAgentPatch (<path>) runs the publish gate validatePublishable whenever patch.status === 'active'. That gate requires an active 'identity' prompt block and exists for genuine draft->active transitions.", "layer": "application", "signal": "loud", "detect": "check", "prevent": "test", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0087", "occurred": "2026-07-19", "severity": "s2", "system": "next", "project": "client agent platform", "title": "Meeting-transcript retention promised 90 days but NEVER ran: sweepExpiredTranscripts had zero callers", "cause": "A retention FUNCTION was written and unit-tested, but the SCHEDULER wiring (cron entry + queue + handler) was never added. Nothing in CI asserts that an exported side-effecting job has a caller, so a \"green\" test suite coexisted with a dead feature.", "layer": "application", "signal": "silent", "detect": "audit", "prevent": "gate", "mast_mode": null, "silent_class": "E", "owasp_asi": null, "euaia_reportable": "would-report", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0088", "occurred": "2026-07-19", "severity": "s3", "system": "next", "project": "internal agent platform", "title": "operator-untouched CI gate freezes the shared citation kit: a consumer lane must not edit it", "cause": "Bdst PR2 added a citation ancestry breadcrumb by editing the shared citation primitives, which are on the operator-untouched frozen manifest (PHASE-B-PACK §7b): components/citations/{citation.tsx,citation-href.ts,index.ts}, components/graph/, components/agents/agent-persona.tsx, components/sections/run-trace.tsx, compo...", "layer": "verification", "signal": "loud", "detect": "check", "prevent": "gate", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0089", "occurred": "2026-07-19", "severity": "s2", "system": "openrouter", "project": "outbound pipeline", "title": "Claude Haiku via OpenRouter fences JSON in ```json blocks: first-chance json.loads fails and the fallback parser silently zeroes every lead", "cause": "Model-specific response formatting: Claude models without responseformat={\"type\":\"jsonobject\"} (which they reject via OpenAI-compatible gateways) often fence JSON in markdown. The parse pipeline only stripped fences in the fallback path, after the unwrap step that extracts the \"results\" array had already been skipped.", "layer": "model", "signal": "silent", "detect": "audit", "prevent": "test", "mast_mode": null, "silent_class": "C", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0090", "occurred": "2026-07-19", "severity": "s3", "system": "railway", "project": "internal agent platform", "title": "Caddy validate fails at Docker build when a header-matcher value comes from an unset env placeholder", "cause": "Caddy env placeholders {$VAR} are expanded at Caddyfile parse time from the process env. During docker build, runtime Railway service variables are NOT present, so any Caddyfile construct that becomes syntactically invalid with an empty value (here, a header matcher header <field> <value> with an empty value) breaks ca...", "layer": "infra", "signal": "loud", "detect": "check", "prevent": "rule", "mast_mode": null, "silent_class": "A", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0091", "occurred": "2026-07-19", "severity": "s2", "system": "railway", "project": "client agent platform", "title": "Railway agent-worker is NOT git-connected: worker.py queue changes do not deploy, so new queues are born dead in prod", "cause": "The standing programme belief, recorded in the bdst-dust-surpass-programme memory and the Bdst satellite protocol as \"Railway agent-worker is GIT-CONNECTED (auto-deploys on merge; NEVER railway up)\", is false in current reality.", "layer": "infra", "signal": "silent", "detect": "audit", "prevent": "rule", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0092", "occurred": "2026-07-19", "severity": "s3", "system": "supabase", "project": "internal agent platform", "title": "backfill:sources --apply collides on uq_documents_source_external where docs already partly belong to a source", "cause": "The backfill groups un-registered documents (connectorsourceid NULL) by an inferred sourcekey and stamps a sourceexternal mapping. But some of those category docs already partially belong to an existing registry source (e.g.", "layer": "data", "signal": "loud", "detect": "check", "prevent": "rule", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0093", "occurred": "2026-07-19", "severity": "s3", "system": "supabase", "project": "internal agent platform", "title": "Gallery hire shipped without its promised v1 config snapshot: comment claimed the wiring, code never landed", "cause": "Cross-PR wiring promised in a comment: PR-1 documented where PR-2 would add a call, PR-2 added the substrate but not the call at that site, and no test asserted \"a fresh hire has version 1\" (the backfill made all EXISTING agents v1, masking the gap for new hires).", "layer": "application", "signal": "silent", "detect": "audit", "prevent": "test", "mast_mode": null, "silent_class": "D", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0094", "occurred": "2026-07-19", "severity": "s2", "system": "supabase", "project": "client agent platform", "title": "Live-check scripts left ACTIVE API keys on the production tenant: cleanup silently skipped because the key id is at body.key.id, not body.id", "cause": "Two compounding mistakes. (1) I guessed the response shape of POST <path> instead of reading the route: it returns the row under key and the one-shot plaintext under generatedkey, NOT id/rawKey/plaintext.", "layer": "application", "signal": "silent", "detect": "audit", "prevent": "test", "mast_mode": null, "silent_class": "C", "owasp_asi": "ASI03", "euaia_reportable": "would-report", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0095", "occurred": "2026-07-19", "severity": "s2", "system": "supabase", "project": "client agent platform", "title": "Migration 300 (agent_run_side_effects + reserve_run_side_effect) was NEVER applied to the template tenant: every per-run side-effect cap silently fail-closed", "cause": "Migration 300 was authored and committed but never applied to the template tenant. The estate applies migrations through the Management API rather than the CLI, so nothing forces a repo migration to actually land on a given tenant; the schemamigrations ledger is separately known to be unreliable, so its silence was not...", "layer": "data", "signal": "silent", "detect": "audit", "prevent": "gate", "mast_mode": null, "silent_class": "E", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": false, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0096", "occurred": "2026-07-19", "severity": "s2", "system": "supabase", "project": "internal agent platform", "title": "Migration-registry §2 is last-wins PER B-PROMPT TOKEN: sharing one token across concurrent lanes causes an unwinnable merge treadmill", "cause": "<path> parses §2 with reserved.set(bprompt, nums), each row REPLACES the prior set for that token. With ~17 concurrent Bdst PRs all keyed Bdst, only the LAST Bdst row counts, so every lane must place its row last to stay reserved.", "layer": "verification", "signal": "wrong", "detect": "downstream", "prevent": "gate", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0097", "occurred": "2026-07-19", "severity": "s2", "system": "supabase", "project": "internal agent platform", "title": "Spreadsheet table extraction silently dead in prod: JSONL blob mime 'text/plain; charset=utf-8' rejected 415 by bucket allowlist", "cause": "The agent-documents bucket's allowedmimetypes (mig 029) is matched against the FULL content-type string, so the parameterized form 'text/plain; charset=utf-8' does NOT match the allowlisted bare 'text/plain'.", "layer": "data", "signal": "silent", "detect": "audit", "prevent": "test", "mast_mode": null, "silent_class": "C", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0098", "occurred": "2026-07-19", "severity": "s2", "system": "supabase", "project": "internal agent platform", "title": "Supabase safe-env denylist uses startsWith: direct-Postgres host db.<ref> bypasses it", "cause": "Leading-prefix match (startsWith) instead of a host-substring/segment match. A Supabase project ref appears in multiple host forms, <ref>.supabase.co (REST) and db.<ref>.supabase.co (direct Postgres), plus custom domains, and startsWith only catches the first.", "layer": "verification", "signal": "silent", "detect": "audit", "prevent": "test", "mast_mode": null, "silent_class": "B", "owasp_asi": "ASI03", "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0099", "occurred": "2026-07-19", "severity": "s2", "system": "vercel", "project": "internal agent platform", "title": "<path> Vercel cron is 307'd to /login: middleware PUBLIC_ROUTES allows <path> but not <path>, so budget alerts never fire automatically", "cause": "middleware.ts PUBLICROUTES lists '<path>' (prefix match) but NOT '<path>'. vercel.json registers the budget check as {\"path\": \"<path>\", \"schedule\": \"/30 \"}, the only cron NOT under <path> Middleware runs on /api paths (proven: <path> passes, <path> does not), so every scheduled invocation is redirected to /login bef...", "layer": "application", "signal": "silent", "detect": "audit", "prevent": "gate", "mast_mode": null, "silent_class": "C", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0100", "occurred": "2026-07-19", "severity": "s2", "system": "vercel", "project": "internal agent platform", "title": "Client template updates fail at preview_deploy with build OOM unless the Vercel project has buildMachineType=enhanced", "cause": "The template's Next build no longer fits the DEFAULT Vercel build container. <internal-project>, Client A and Client B already had resourceConfig.buildMachineType = \"enhanced\"; Client C, Client F, Client E, Client H and Client I did not.", "layer": "infra", "signal": "loud", "detect": "check", "prevent": "gate", "mast_mode": null, "silent_class": "A", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0101", "occurred": "2026-07-19", "severity": "s2", "system": "vercel", "project": "internal agent platform", "title": "Fire-and-forget (void) DB writes are silently dropped on Vercel serverless: trust-loop receipts vanished 1-in-3", "cause": "The receipt writers were invoked fire-and-forget (void writeCanvasReceipt(...) / void writeShareMintReceipt(...)). On Vercel, the serverless function freezes as soon as the HTTP response is returned; any promise still in flight is dropped.", "layer": "infra", "signal": "silent", "detect": "audit", "prevent": "test", "mast_mode": null, "silent_class": "A", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0102", "occurred": "2026-07-19", "severity": "s2", "system": "vercel", "project": "internal agent platform", "title": "New inbound channel route 307-redirected to /login: middleware PUBLIC_ROUTES enumerates each inbound route by exact path", "cause": "middleware.ts PUBLICROUTES is a prefix-match list (strippedPath === route || strippedPath.startsWith(route + '/')) that enumerates EACH public inbound route by exact path (<path>,email,sms,webchat}). A new inbound route is auth-gated (307 → /login) until explicitly added.", "layer": "application", "signal": "silent", "detect": "audit", "prevent": "gate", "mast_mode": null, "silent_class": "C", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": true, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0103", "occurred": "2026-07-19", "severity": "s3", "system": "vercel", "project": "internal agent platform", "title": "PDF ingest fails with \"DOMMatrix is not defined\" on Vercel prod for some PDFs (pdfjs needs DOM globals)", "cause": "pdfjs-dist reaches for browser DOM globals (DOMMatrix, and typically Path2D/ImageData) that do not exist in the Node serverless runtime. Whether it hits that path depends on the PDF's internal structure, so it is NOT all-PDFs: this tenant has one completed PDF and one failed.", "layer": "thirdparty", "signal": "loud", "detect": "check", "prevent": "test", "mast_mode": null, "silent_class": "A", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0104", "occurred": "2026-07-19", "severity": "s3", "system": "vercel", "project": "internal agent platform", "title": "Share-page view counter dead: record_share_view + external audit dropped (fire-and-forget, no waitUntil) in Vercel serverless", "cause": "The share page fires the view counter + external audit as void supabase.rpc('recordshareview',...) / void logAuditEvent(...), not awaited, no waitUntil. On Vercel serverless the function returns as soon as the Server Component finishes streaming, so the pending RPC is frozen/dropped before it lands.", "layer": "infra", "signal": "silent", "detect": "audit", "prevent": "test", "mast_mode": null, "silent_class": "A", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": false, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0029", "occurred": "2026-07-18", "severity": "s2", "system": "vercel", "project": "internal agent platform", "title": ": merges to master no longer trigger Vercel git deploys: merge \"deployed\" nothing", "cause": "DIAGNOSED (same evening): a platform-wide Vercel incident, \"GitHub-linked deployments and authentication affected\" (<host>, unresolved as of <phone>:20 UTC), concurrent with a GitHub \"Partially Degraded Service\" incident.", "layer": "thirdparty", "signal": "silent", "detect": "human", "prevent": "monitor", "mast_mode": null, "silent_class": "A", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": true, "resolution_written": false, "resolved_field": false, "recurrence_count": 2 }, { "id": "afi-0058", "occurred": "2026-07-18", "severity": "s2", "system": "advizr", "project": "client agent platform", "title": "A dynamically-discovered tool can never satisfy a statically-computed allow-list (connectors invisible in Interact)", "cause": "Two independent defects in ONE filter in <path> (A) /interact defaults to PLAN mode, which passes allowedSkillSlugs to buildToolSet. <path> computed that allow-list from STATICALLY configured slugs only (frozen skill snapshot, or core ∪ configured).", "layer": "orchestration", "signal": "silent", "detect": "human", "prevent": "test", "mast_mode": "FM-1.1", "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0059", "occurred": "2026-07-18", "severity": "s2", "system": "advizr", "project": "client agent platform", "title": "Composio tools.execute requires an explicit dated toolkit version: disableVersionCheck does NOT prevent it, and there is no 'latest'", "cause": "<path> constructed the SDK with disableVersionCheck: true and a comment asserting that this prevented ComposioToolVersionRequiredError. THE COMMENT WAS WRONG. Verified against the live API (@composio/core 0.10.0): disableVersionCheck: true + no version → ComposioToolVersionRequiredError version: 'latest' → ComposioTool...", "layer": "thirdparty", "signal": "loud", "detect": "check", "prevent": "test", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0060", "occurred": "2026-07-18", "severity": "s2", "system": "advizr", "project": "client agent platform", "title": "Three Composio app manifests shipped with 100% invented action slugs: connected apps exposed zero tools", "cause": "Every action slug in <path>,microsoftteams,quickbooks}.ts was derived from Composio's naming conventions offline and never checked against the live catalogue. None existed. Actual naming, verified live: - Outlook DOUBLES its prefix: OUTLOOKOUTLOOKLISTMESSAGES (not OUTLOOKLISTMESSAGES). Looks like a typo; is not.", "layer": "orchestration", "signal": "silent", "detect": "audit", "prevent": "test", "mast_mode": "FM-1.1", "silent_class": "D", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0061", "occurred": "2026-07-18", "severity": "s2", "system": "advizr", "project": "internal agent platform", "title": "Connectors dead on EVERY provisioned client: Composio env hand-set on the template, never propagated by provisioning", "cause": "The 21 vars were set BY HAND on the template Vercel project when the Composio streams shipped, and were never added to the provisioning env block in <path> (createProject envVars). grep -rl COMPOSIO across <internal-project> / <internal-project> / <internal-project> returned zero hits.", "layer": "infra", "signal": "silent", "detect": "audit", "prevent": "gate", "mast_mode": null, "silent_class": "E", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0062", "occurred": "2026-07-18", "severity": "s2", "system": "claude", "project": "internal agent platform", "title": "Usage limits killed 11 parallel subagents mid-implementation twice in one session: WIP-commit+push immediately on any agent-fleet kill", "cause": "Parallel subagent fleets multiply token burn; usage ceilings (session and monthly) terminate agents on a hard API error mid-write with no flush. Uncommitted worktree changes survive only because the filesystem does; nothing else about agent state is recoverable.", "layer": "orchestration", "signal": "loud", "detect": "human", "prevent": "rule", "mast_mode": null, "silent_class": "A", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0063", "occurred": "2026-07-18", "severity": "s2", "system": "composio", "project": "client agent platform", "title": "Composio SDK verifyWebhook: JSDoc example param names contradict the Zod schema: every webhook silently 401s (and the wrapper-vs-normalized payload trap)", "cause": "Trusting a vendor SDK's JSDoc example over its runtime schema, and unit-testing an integration boundary entirely through mocks. The module under test (<path> wrapper) was mocked in every route test, so the param-name mismatch and the wrapper-vs-normalized-payload mistake had no test that could observe them.", "layer": "thirdparty", "signal": "silent", "detect": "audit", "prevent": "test", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0064", "occurred": "2026-07-18", "severity": "s2", "system": "github", "project": "client agent platform", "title": "Template release channel froze for 2 days: two independent gate breaks (invalid VERCEL_TOKEN + release-smoke spec orphaned by a testMatch change)", "cause": "Two unrelated breaks stacked: (1) The VERCELTOKEN repo secret on <internal-project> went invalid (403 invalidToken), it last worked <phone>, matching that weekend's secret-rotation churn. The gate's first step polls the Vercel deployments API, so nothing downstream ever ran.", "layer": "verification", "signal": "loud", "detect": "check", "prevent": "monitor", "mast_mode": null, "silent_class": "A", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0065", "occurred": "2026-07-18", "severity": "s2", "system": "github", "project": "client agent platform", "title": "Template release gate fails with Vercel API 403 invalidToken: the VERCEL_TOKEN repo secret expires and silently blocks all fleet rollouts", "cause": "The VERCELTOKEN secret on <internal-project>/<internal-project> had expired/been revoked. Confirmed by comparison, not assumption: the same API call with the LOCAL Vercel CLI token returned HTTP 200 while CI got 403.", "layer": "verification", "signal": "quiet", "detect": "audit", "prevent": "monitor", "mast_mode": null, "silent_class": "C", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0066", "occurred": "2026-07-18", "severity": "s2", "system": "github", "project": "client agent platform", "title": "Unresolved.b-prompt merge conflict silently blocks ALL GitHub Actions dispatch on a PR branch (no CI runs, mergeable=UNKNOWN)", "cause": "The branch had an unresolved merge conflict with the CURRENT master (the root.b-prompt file: branch held Bdst, master had moved to Bhrd). GitHub cannot build refs/pull/<n>/merge while a PR conflicts, and pullrequest-triggered workflows run against that merge ref, so no merge ref means no dispatch at all, and mergeabili...", "layer": "verification", "signal": "silent", "detect": "human", "prevent": "gate", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0067", "occurred": "2026-07-18", "severity": "s2", "system": "next", "project": "internal agent platform", "title": "Colon-namespaced tool slugs are illegal model-provider tool names: one Composio connection 400s every execute-mode turn", "cause": "Anthropic and OpenAI both constrain tool names to ^[a-zA-Z0-9-]{1,64}$. Composio tool bindings are keyed by their colon-namespaced slug (composio:gmail:GMAILSENDEMAIL, built in <path>), and in <path> the tool-set RECORD KEY is exactly what the AI SDK sends as the tool name.", "layer": "orchestration", "signal": "loud", "detect": "check", "prevent": "test", "mast_mode": "FM-1.1", "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0068", "occurred": "2026-07-18", "severity": "s2", "system": "playwright", "project": "internal agent platform", "title": "@live-exec nightly has no green baseline: beat 3 asked for a plan in execute mode (Go flips the toggle) and `.last()` masked it", "cause": "The spec predates #618's shipped behavior (approving a plan with Go flips the thread's mode to execute). A serial live suite that reuses one thread across beats inherits that mode change..last() locators over an accumulating transcript silently bind to stale artifacts, converting a precise failure (\"no plan drafted\") i...", "layer": "verification", "signal": "wrong", "detect": "human", "prevent": "test", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0069", "occurred": "2026-07-18", "severity": "s2", "system": "qa", "project": "client agent platform", "title": "G3 QA flake: INFRA_JUDGE_RE belt demoted rendered fallback judge verdicts, handing class-G refusal calls to the crude regex", "cause": "Grader success detail strings carry provider-error text from earlier failed attempts; a substring belt regex cannot distinguish \"verdict rendered via fallback\" from \"no verdict\". Plus a category error in the scenario: refusal phrasing was used as a proxy for injection non-compliance.", "layer": "verification", "signal": "wrong", "detect": "human", "prevent": "test", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0070", "occurred": "2026-07-18", "severity": "s2", "system": "supabase", "project": "internal agent platform", "title": "MCP external surface silently dead in prod: 4 independent bugs (phantom columns, no executor, 1-req/min cap)", "cause": "Code written against assumed/stale schema (migration files diverged from live DB via the Management-API apply path), plus hand-rolled inserts instead of the canonical seams (dispatchAgentRun, recordOutcome), plus zero end-to-end tests hitting the deployed surface, unit/CI stayed green while every call path was dead.", "layer": "application", "signal": "silent", "detect": "audit", "prevent": "test", "mast_mode": null, "silent_class": "E", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0071", "occurred": "2026-07-18", "severity": "s2", "system": "vercel", "project": "internal agent platform", "title": "OAuth callback host escape: deriving callbackUrl from request.url behind the <host> router strands every Composio connection", "cause": "TWO defects sharing one dependency (Composio). (1) HOST ESCAPE. <internal-project>/vercel.json EXTERNAL-rewrites /<slug>/:match to <url>, a reverse proxy. So inside a route handler new URL(request.url).origin resolves to the.vercel.app UPSTREAM, not <host>.", "layer": "application", "signal": "loud", "detect": "check", "prevent": "test", "mast_mode": null, "silent_class": "B", "owasp_asi": "ASI03", "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0072", "occurred": "2026-07-18", "severity": "s1", "system": "vercel", "project": "internal agent platform", "title": "Prod alias regressed to PRE-MERGE-TRAIN code: env-only `vercel redeploy` chains rebuild stale source and re-take the alias by completion time", "cause": "vercel redeploy pins SOURCE to the target deployment while refreshing env, used for flag flips, it mints deployments of whatever commit the chain started from (and drops VERCELGITCOMMITSHA, so <path> says \"unknown\").", "layer": "infra", "signal": "silent", "detect": "audit", "prevent": "gate", "mast_mode": null, "silent_class": "A", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0073", "occurred": "2026-07-18", "severity": "s2", "system": "vercel", "project": "internal agent platform", "title": "Rotated prod JWT_SECRET silently invalidates every local probe/harness minting from stale.env.local: reads as a fake outage (307s)", "cause": "Two facts compose: (1) JWT-based staff-session minting (check-exec.mjs / perf-interact recipe) trusts whatever JWTSECRET the local.env.local carries; (2) env rotations land on the NEXT deployment, so a probe that passed against an older build fails against a newer one with zero code change.", "layer": "verification", "signal": "wrong", "detect": "human", "prevent": "rule", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0074", "occurred": "2026-07-18", "severity": "s3", "system": "vercel", "project": "internal agent platform", "title": "vercel link silently overwrites.env.local in the linked directory (JWT_SECRET and all local env lost)", "cause": "Newer Vercel CLI link/deploy flows pull the project's development env into.env.local without prompting when --yes is passed.", "layer": "infra", "signal": "silent", "detect": "human", "prevent": "rule", "mast_mode": null, "silent_class": "A", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0035", "occurred": "2026-07-17", "severity": "s2", "system": "advizr", "project": "client agent platform", "title": "Demo-workspace brain (RAG) leaks real <internal-project> internals on camera: seed:vault ingests the actual handbook, and grounded answers surface sales tactics, names, and retired claims", "cause": "<path> seeds the template workspace's brain with notes derived from <internal-project>'s real vault/handbook content, and the ask path does live RAG over them. Anything in those notes can appear verbatim in an answer.", "layer": "data", "signal": "silent", "detect": "human", "prevent": "gate", "mast_mode": null, "silent_class": "B", "owasp_asi": "ASI06", "euaia_reportable": "would-report", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0036", "occurred": "2026-07-17", "severity": "s3", "system": "github", "project": "internal agent platform", "title": ": force-push lease fails with \"stale info\": fetch refspec is narrowed to master, so no remote-tracking refs exist for feature branches", "cause": "Narrowed fetch refspec (+refs/heads/master:refs/remotes/origin/master) means fetch writes FETCHHEAD only; the default --force-with-lease has no remote-tracking ref to compare, so it refuses with \"stale info\".", "layer": "infra", "signal": "loud", "detect": "human", "prevent": "rule", "mast_mode": null, "silent_class": "A", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0037", "occurred": "2026-07-17", "severity": "s2", "system": "next", "project": "internal agent platform", "title": "Agent IP (system_prompt) leaked to CLIENT_CONSUMER/VIEWER via GET <path>: dead-code strip gated on wrong permission", "cause": "A permission variable named for management (canManageAgents) actually checked a read permission (view:agents) held by low-privilege roles; the field-strip and the read-gate were conflated onto one boolean.", "layer": "application", "signal": "silent", "detect": "audit", "prevent": "test", "mast_mode": null, "silent_class": "B", "owasp_asi": "ASI03", "euaia_reportable": "would-report", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0038", "occurred": "2026-07-17", "severity": "s2", "system": "next", "project": "internal agent platform", "title": "Intl-throw-based timezone validation silently regresses on Node 22+ (ECMA-402 offset time zones): normalizeIana passed \"-04:00\" through", "cause": "Runtime-version-dependent validation: the code treated \"Intl throws\" as the definition of \"not an IANA zone\". That definition changed under the code between Node 20 and Node 22 (ECMA-402 offset-time-zone support).", "layer": "application", "signal": "silent", "detect": "audit", "prevent": "test", "mast_mode": null, "silent_class": "A", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0039", "occurred": "2026-07-17", "severity": "s3", "system": "next", "project": "internal agent platform", "title": "Live-walk Playwright specs: serial 16-min runs flake on 90s waitForURL + fresh operator account hits WelcomeModal: the product path was fine", "cause": "Live e2e that (a) runs many heavy legs serially in one worker, (b) authenticates as a brand-new account that trips first-run onboarding overlays, and (c) waits on real-LLM output, will flake in ways indistinguishable from product bugs. The flows product path itself is correct, verified by isolated probe.", "layer": "verification", "signal": "wrong", "detect": "human", "prevent": "rule", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0040", "occurred": "2026-07-17", "severity": "s2", "system": "next", "project": "client agent platform", "title": "Partial <internal-project> localStorage blob crashed every dashboard page to the global error screen (4 e2e smoke tests born red)", "cause": "Two roots. (1) Product: use-onboarding's loadLocal() trusted localStorage shape, any partial/legacy <internal-project> blob (missing steps/coachmarks) crashed the hook during render inside the dashboard layout, whitescreening every page for that browser profile.", "layer": "application", "signal": "loud", "detect": "check", "prevent": "test", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0041", "occurred": "2026-07-17", "severity": "s3", "system": "next", "project": "internal agent platform", "title": "React Flow 12: two hit-test traps for handle-adjacent chrome and connection-drop pickers", "cause": "(1) CSS transform scale participates in hit testing; center-origin scaling of chrome positioned flush against a React Flow handle overlaps the handle at zoom < 1 (compensation factor > 1).", "layer": "application", "signal": "silent", "detect": "human", "prevent": "test", "mast_mode": null, "silent_class": "A", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0042", "occurred": "2026-07-17", "severity": "s3", "system": "next", "project": "internal agent platform", "title": "Two Next dev servers sharing one worktree.next wedge both (health 404 on valid routes)", "cause": "next dev keys its build cache to the project directory, not the port, two dev processes in one checkout race on.next route manifests. The wedge presents as 404 (route not matched), not 500, so it looks like an app regression.", "layer": "infra", "signal": "wrong", "detect": "human", "prevent": "rule", "mast_mode": null, "silent_class": "A", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0043", "occurred": "2026-07-17", "severity": "s3", "system": "npm", "project": "internal agent platform", "title": "npm install --no-save into a shared worktree hub re-resolved the whole tree and removed 134 packages", "cause": "npm install with --no-package-lock does not do a minimal additive install: it ignores the lockfile and reconciles the full nodemodules tree against package.json ranges, adding/removing/upgrading anything that differs.", "layer": "infra", "signal": "silent", "detect": "downstream", "prevent": "rule", "mast_mode": null, "silent_class": "A", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0044", "occurred": "2026-07-17", "severity": "s3", "system": "railway", "project": "agency infrastructure", "title": "Client A worker drain: 72 capture_triage/vault_ingest_enrich follow-on jobs died (\"agent run reported failure (no error)\") on curator MOC notes", "cause": "Not fully diagnosed. The enrichment agents run against freshly ingested agentless curator notes; the run reports failure without an error payload, likely a missing agent/workspace precondition for enrichment on agentid-NULL curator output, or an enrichment path that predates agentless ingest.", "layer": "orchestration", "signal": "quiet", "detect": "audit", "prevent": "monitor", "mast_mode": "FM-3.2", "silent_class": "C", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0045", "occurred": "2026-07-17", "severity": "s2", "system": "railway", "project": "agency infrastructure", "title": "Template-stack tenants ship without an agent-worker: job_queue accumulates silently (Client A: 132 jobs, 51 stuck docs)", "cause": "Provisioning deliberately ships FEATUREINLINEDISPATCH=true + a WORKERQUEUES env pin \"until a per-client Railway agent-worker is deployed\", but inline dispatch only covers crondispatch, every other queue (ingestdocument, curatorjobs, backfillshadowdocs, graphintelrefresh, connectorsync) requires the worker that was neve...", "layer": "infra", "signal": "silent", "detect": "audit", "prevent": "gate", "mast_mode": null, "silent_class": "E", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0046", "occurred": "2026-07-17", "severity": "s2", "system": "supabase", "project": "internal agent platform", "title": "Fresh Supabase project: ACTIVE_HEALTHY precedes storage schema: provisioning migration 029_storage_bucket fails 42P01", "cause": "ACTIVEHEALTHY on GET /v1/projects/{ref} covers the project/database only; the storage service creates storage.buckets/storage.objects asynchronously, up to minutes after.", "layer": "thirdparty", "signal": "loud", "detect": "check", "prevent": "gate", "mast_mode": null, "silent_class": "A", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0047", "occurred": "2026-07-17", "severity": "s2", "system": "supabase", "project": "internal agent platform", "title": "Interact QA sweep + plan forensics silently invalidated by demo-mode-ON tenant", "cause": "demomodeenabled=true makes the agent short-circuit to canned previews; a demo-on sweep is meaningless. Provisioning can flip the flag back, and nothing asserted it before a sweep.", "layer": "verification", "signal": "silent", "detect": "audit", "prevent": "gate", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0048", "occurred": "2026-07-17", "severity": "s2", "system": "supabase", "project": "internal agent platform", "title": "Live template DB migration ledger DARK since 176: everything after applied ledger-less; registered migrations silently unapplied (244, 445, 460-462)", "cause": "Two apply paths with different bookkeeping: the provisioning/update engine writes schemamigrations, but day-to-day DDL goes through the Supabase Management API (the CLI hangs backgrounded, so the estate standard is raw Management API queries) and nobody inserts the ledger row.", "layer": "data", "signal": "silent", "detect": "audit", "prevent": "gate", "mast_mode": null, "silent_class": "E", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0049", "occurred": "2026-07-17", "severity": "s3", "system": "supabase", "project": "client agent platform", "title": "mig 304 compute_doc_similarity_edges_v2 fails under pg-safeupdate: unqualified DELETE on its temp table", "cause": "The v2 RPC assumes safeupdate is off. Tenants where it ran before (Client A/Client B) evidently didn't enforce it; the template project does.", "layer": "data", "signal": "loud", "detect": "check", "prevent": "rule", "mast_mode": null, "silent_class": "A", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0050", "occurred": "2026-07-17", "severity": "s2", "system": "supabase", "project": "client agent platform", "title": "resetDemoData permanently strands demo agent_proposals once agent_trust_events reference them (append-only trigger blocks the FK SET NULL)", "cause": "Trust-Loop's append-only trigger (BEFORE DELETE OR UPDATE... RAISE) composes badly with the ON DELETE SET NULL FK from agenttrustevents.proposalid: the FK's nulling UPDATE is indistinguishable from a mutation, so proposal deletion is impossible while any trust event links to it.", "layer": "data", "signal": "loud", "detect": "check", "prevent": "rule", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0051", "occurred": "2026-07-17", "severity": "s2", "system": "supabase", "project": "client agent platform", "title": "Runner adoption rebuilt agent_runs.metadata from scratch: every dispatch-stamped fact (plan_approved, plan_consent) silently dropped on adopt", "cause": "Two writers of one JSONB column with no merge discipline: dispatch stamps facts, adoption re-derives operational keys and treated the column as its own. Unit tests mocked the runner, so the clobber was invisible to CI; only a live end-to-end check (dispatch → adopt → read back the row) exposed it.", "layer": "orchestration", "signal": "silent", "detect": "audit", "prevent": "test", "mast_mode": "FM-1.4", "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0052", "occurred": "2026-07-17", "severity": "s3", "system": "supabase", "project": "client agent platform", "title": "Stale memory claimed the fictional Acme/Globex brain pack was purged from the template tenant: live probe found all 12 docs still serving", "cause": "The purge was evidently planned/partial when the memory was written (only the 5 EXTRAFICTIONALIDS dev-era notes were actually gone). Memory recorded intent as outcome; nothing re-verified against the live DB.", "layer": "data", "signal": "silent", "detect": "audit", "prevent": "rule", "mast_mode": null, "silent_class": "D", "owasp_asi": "ASI06", "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0053", "occurred": "2026-07-17", "severity": "s3", "system": "supabase", "project": "internal agent platform", "title": "Template demo DB schema drift blocks feature verification: workspace_settings.share_links_enabled (mig 445) absent, improvement_suggestions (mig 462) absent", "cause": "Migration files land on master, but application to the live template/demo DB is a separate Management-API ops step that has been skipped repeatedly; schemamigrations does not reflect reality.", "layer": "data", "signal": "silent", "detect": "audit", "prevent": "gate", "mast_mode": null, "silent_class": "E", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0054", "occurred": "2026-07-17", "severity": "s2", "system": "supabase", "project": "internal agent platform", "title": "Template-update engine: a NON-EMPTY but incomplete schema_migrations ledger replays old migrations and hard-fails (updatetest canary)", "cause": "The seeding guard equates \"ledger has any rows\" with \"ledger is truthful\". A drill/recovery run that inserted a single ledger row (000recoverybasetables) defeated the guard while the schema was a partial 000-009 provision.", "layer": "verification", "signal": "wrong", "detect": "check", "prevent": "gate", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0055", "occurred": "2026-07-17", "severity": "s1", "system": "vercel", "project": "internal agent platform", "title": "<host> ERR_TOO_MANY_REDIRECTS: JWT_SECRET on <internal-project>/Client I overwritten with a foreign value, admin↔router login loop", "cause": "JWTSECRET is a shared fleet secret (router signs at login; admin + every client app verify), but nothing enforces or documents that invariant at the point of edit: a human with team access replaced it on two projects with a freshly generated value.", "layer": "infra", "signal": "loud", "detect": "client", "prevent": "gate", "mast_mode": null, "silent_class": "A", "owasp_asi": "ASI03", "euaia_reportable": "would-report", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0056", "occurred": "2026-07-17", "severity": "s2", "system": "vercel", "project": "internal agent platform", "title": "Automatic provisioning was broken by a SECOND independent cause: INTERNAL_API_SECRET never set on <internal-project> Vercel: every kick 401'd", "cause": "Cross-app shared secret existed only on the sender (<internal-project>) and was never provisioned on the receiver (<internal-project>); no startup/env completeness check and the kick's failure write (provisionkickfailed) was only scanned by a cron whose Slack webhook was ALSO unset, so the 401s were invisible.", "layer": "infra", "signal": "quiet", "detect": "audit", "prevent": "gate", "mast_mode": null, "silent_class": "C", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0057", "occurred": "2026-07-17", "severity": "s2", "system": "vercel", "project": "internal agent platform", "title": "Template build OOM extends to EVERY client project: fleet updates blocked until enhanced build machines enabled per client", "cause": "The template's build outgrew the standard Vercel build container as of the Interact-era releases; client repos build the same codebase, but the <phone> Enhanced Builds fix was applied only to <internal-project>'s project, not the fleet.", "layer": "infra", "signal": "loud", "detect": "check", "prevent": "rule", "mast_mode": null, "silent_class": "A", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0018", "occurred": "2026-07-16", "severity": "s3", "system": "next", "project": "agency infrastructure", "title": "Tailwind v4 tokens dead on first consumption: plain @theme froze world re-scoping and cascade-layer order let legacy CSS beat utilities", "cause": "(1) @theme { --color-card: hsl(var(--card)) } (non-inline) computes the var() substitution at:root, so descendants inherit the RESOLVED dark value and a.light re-scope of --card never propagates, utilities must be generated with @theme inline so var(--card) resolves at the element.", "layer": "application", "signal": "silent", "detect": "human", "prevent": "test", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0019", "occurred": "2026-07-16", "severity": "s2", "system": "next", "project": "internal agent platform", "title": "tool-builder silently dropped unknown skill slugs: the model then narrated completions of work it never had tools for", "cause": "Fail-closed tool filtering (correct) with zero observability (incorrect): the drop was invisible to operators and to the model's own trace, so absence of capability degraded into hallucinated success instead of an honest \"I can't do that here\".", "layer": "orchestration", "signal": "silent", "detect": "human", "prevent": "monitor", "mast_mode": "FM-2.6", "silent_class": "D", "owasp_asi": null, "euaia_reportable": "would-report", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0020", "occurred": "2026-07-16", "severity": "s1", "system": "railway", "project": "internal agent platform", "title": "Dual provisioning-worker hijack: re-armed stale local launchd poller claimed cloud jobs", "cause": "Queue design allows any number of competing consumers: claims are a bare status CAS with no worker identity/lease, and the local worker installer (<path> with KeepAlive+RunAtLoad) could silently re-arm a poller running whatever code that checkout had.", "layer": "infra", "signal": "silent", "detect": "audit", "prevent": "gate", "mast_mode": null, "silent_class": "A", "owasp_asi": "ASI10", "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0021", "occurred": "2026-07-16", "severity": "s2", "system": "railway", "project": "internal agent platform", "title": "Railway worker WORKER_QUEUES env pin rotted while code grew queues: jobs sat unclaimed silently", "cause": "Config pinned in a dashboard env var duplicates release-managed code state; the two drift apart with every release and nothing compares them. \"Operators can pin a narrower set\" was documented as a feature with no guard.", "layer": "infra", "signal": "silent", "detect": "audit", "prevent": "gate", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0022", "occurred": "2026-07-16", "severity": "s2", "system": "railway", "project": "internal agent platform", "title": "Update-engine post_verify battery hard-fails every real update: check-live.mjs run from bare /tmp can't resolve its 'jose' import", "cause": "<internal-project> <path> copies the client repo's <path> alone into a mkdtemp dir and runs node check-live.mjs there. check-live.mjs bare-imports 'jose' (staff-JWT mint for authed probes), and has since before Client A's base <sha>, so this was latent in EVERY update; the Release Gate never caught it because GitHub Ac...", "layer": "verification", "signal": "loud", "detect": "check", "prevent": "test", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0023", "occurred": "2026-07-16", "severity": "s2", "system": "stripe", "project": "internal agent platform", "title": "checkout hardcoded USD: live CAD client would have been subscribed at USD $6,000/mo", "cause": "The mint side (<internal-project>) and the pay side (<internal-project>) are separate repos sharing a DB contract, and the pay side was written when only USD deals existed.", "layer": "application", "signal": "silent", "detect": "audit", "prevent": "test", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-report", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0024", "occurred": "2026-07-16", "severity": "s2", "system": "supabase", "project": "internal agent platform", "title": "agent_runs stuck forever in status='cancelling': waiting-leg guard shields a stop-all'd parked run from the reaper", "cause": "The reaper has no pass that finalizes a 'cancelling' run once no live runner will observe the cancel. Only a runner actively polling writes the terminal 'cancelled'; a parked or never-adopted run has no such runner, and Pass A's waiting-leg guard (correct for genuinely-waiting runs) plus its lastheartbeatat IS NOT NULL...", "layer": "orchestration", "signal": "quiet", "detect": "audit", "prevent": "rule", "mast_mode": "FM-1.5", "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0025", "occurred": "2026-07-16", "severity": "s1", "system": "supabase", "project": "internal agent platform", "title": "Built-in prompt-injection + toxicity guardrails fail open: PCRE (?i) invalid in JS RegExp, loader silently skips", "cause": "PCRE inline-flag syntax (?i) is invalid in JavaScript RegExp, and the policy loader's per-row try/catch treats a built-in parse failure identically to a benign custom-rule skip, swallowing the throw with only a console.error, so a dead built-in guardrail is indistinguishable from normal operation.", "layer": "verification", "signal": "silent", "detect": "audit", "prevent": "test", "mast_mode": null, "silent_class": "C", "owasp_asi": "ASI01", "euaia_reportable": "would-report", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": true, "resolved_field": true, "recurrence_count": 1 }, { "id": "afi-0026", "occurred": "2026-07-16", "severity": "s2", "system": "supabase", "project": "internal agent platform", "title": "Canary client updatetest has a half-provisioned husk DB: fresh-DB probe misfires, update engine full-replays and fails at 001", "cause": "updatetest was left half-provisioned by an earlier aborted provision run (profiles + 12 other tables, no workspacesettings, empty ledger). The fresh-DB heuristic is single-table and treats any partial schema missing workspacesettings as fresh, guaranteeing a 001 collision on such DBs.", "layer": "data", "signal": "wrong", "detect": "check", "prevent": "gate", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0027", "occurred": "2026-07-16", "severity": "s2", "system": "supabase", "project": "internal agent platform", "title": "Curator FK-orphan dead-letter storm surfaced raw SQL on the operator run feed", "cause": "curatorreviews.subjectrunid was a HARD FK (ON DELETE SET NULL) where the repo's own convention for a run reference written ASYNCHRONOUSLY (subject may be purged before the review lands) is a SOFT link with NO FK (actionreceipts.runid mig 191:49 'no FK; runs may be purged'; captureitems.sourcerunid mig 214).", "layer": "data", "signal": "loud", "detect": "human", "prevent": "rule", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0028", "occurred": "2026-07-16", "severity": "s3", "system": "supabase", "project": "client agent platform", "title": "seed:demo on template master fails engagement/SKU/playbook FKs: demo user only seeded into master DB, not the client DB users table", "cause": "<path> seedDemoUser() upserts the demo user (uuidv5 'user:demo@<host>', namespace <id>) ONLY into the MASTER auth DB, but acme-fixtures.ts sets engagements.assignedfdeuserid = demoUserId(), and that FK references the CLIENT DB's own users table (<project-ref>).", "layer": "data", "signal": "loud", "detect": "check", "prevent": "rule", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0030", "occurred": "2026-07-16", "severity": "s2", "system": "vercel", "project": "agency infrastructure", "title": "merges to main produce NO Vercel deployment (same silent no-deploy class as <internal-project>/<internal-project>)", "cause": "GitHub-to-Vercel integration is not firing for this repo's merges (third repo showing this pattern this week, after <internal-project> and <internal-project>). Not diagnosed at the integration level; likely the org-wide GitHub app connection.", "layer": "thirdparty", "signal": "silent", "detect": "human", "prevent": "monitor", "mast_mode": null, "silent_class": "A", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0031", "occurred": "2026-07-16", "severity": "s2", "system": "vercel", "project": "agency infrastructure", "title": "docs.<host> production silently 36 days stale: bot-authored merges never deployed", "cause": "Vercel maps the git commit AUTHOR email to a team identity and silently blocks auto-deploys from unlinked authors. The docs content bots committed with an unlinked author email, so every bot merge to master produced no production deployment, and nothing alerts on \"merge without deploy\".", "layer": "thirdparty", "signal": "silent", "detect": "audit", "prevent": "monitor", "mast_mode": null, "silent_class": "A", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0032", "occurred": "2026-07-16", "severity": "s2", "system": "vercel", "project": "internal agent platform", "title": "Every <host>/onboarding link 404'd in prod: router's committed vercel.json never had the onboarding rewrites", "cause": "The known generator drift in <internal-project>: <path> emits the onboarding rewrites (ONBOARDINGTARGET) from config/routes.json, but the committed vercel.json on origin/master never picked them up, and Vercel routing comes from the committed vercel.json at upload time, the prebuild regenerate during remote build does...", "layer": "infra", "signal": "silent", "detect": "human", "prevent": "gate", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0033", "occurred": "2026-07-16", "severity": "s1", "system": "vercel", "project": "internal agent platform", "title": "Interact Execute Plan executed nothing in prod: run-identity split + fire-and-forget death + unclaimed resume queue", "cause": "The dispatch/runner contract was never real: a code comment claimed \"the runner's own INSERT path overwrites status+treeroot once it picks the work up\" but no adoption mechanism existed (RunAgentOptions had no run-id field; finalizePendingRun was Hermes-only and Hermes headless is disabled).", "layer": "orchestration", "signal": "silent", "detect": "human", "prevent": "test", "mast_mode": "FM-3.2", "silent_class": "D", "owasp_asi": null, "euaia_reportable": "would-report", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0034", "occurred": "2026-07-16", "severity": "s2", "system": "vercel", "project": "internal agent platform", "title": "vercel env add via echo-pipe stores a literal \\n: AUTO_ROLLOUT flag silently off", "cause": "Piping via echo includes the trailing newline, and the Vercel CLI stores it as part of the secret value (the known read-side \"env values carry a literal \\n\" trap also exists on the WRITE side).", "layer": "infra", "signal": "silent", "detect": "audit", "prevent": "gate", "mast_mode": null, "silent_class": "A", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0004", "occurred": "2026-07-15", "severity": "s3", "system": "advizr", "project": "internal agent platform", "title": "ai_runs.cost_usd always null for summarize/enrich_contact: enrich.ts never computed cost", "cause": "Missing function call, not missing data: <path> already had full model coverage (including the default aiModel() slug) plus a DEFAULTPRICING fallback for any unknown slug, so calculateCost() would never have returned null/undefined.", "layer": "application", "signal": "silent", "detect": "audit", "prevent": "none", "mast_mode": null, "silent_class": "E", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0005", "occurred": "2026-07-15", "severity": "s2", "system": "agency", "project": "agency infrastructure", "title": "KB write path was never deployed - routes existed only as untracked local code", "cause": null, "layer": "infra", "signal": "silent", "detect": "audit", "prevent": "gate", "mast_mode": null, "silent_class": "E", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": false, "prevention_written": false, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0006", "occurred": "2026-07-15", "severity": "s1", "system": "agency", "project": "agency infrastructure", "title": "Never-reviewed KB write-path code carried a path traversal that reached every org repo", "cause": "Prefix-anchored allowlist regexes plus URL dot-segment normalization: the validation layer and the transport layer disagreed about what a path 'is'. The cross-repo escape hatch ('non-vault repos are exempt from the allowlist') compounded it.", "layer": "application", "signal": "silent", "detect": "audit", "prevent": "gate", "mast_mode": null, "silent_class": "E", "owasp_asi": "ASI03", "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0007", "occurred": "2026-07-15", "severity": "s3", "system": "github", "project": "internal agent platform", "title": "master CI pre-existing red: unit-tests fails (workspace-auth 400s in loops/objectives route tests) → PRs need --admin merge", "cause": "Pre-existing broken test harness/auth-context on <internal-project> master (a shared workspace/auth fixture returns 400 \"No workspace found for user\" across loops/objectives route tests). NOT caused by feature branches.", "layer": "verification", "signal": "wrong", "detect": "human", "prevent": "none", "mast_mode": null, "silent_class": "E", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0008", "occurred": "2026-07-15", "severity": "s3", "system": "next", "project": "internal agent platform", "title": "master unit-tests suite has ~8 chronically-red files (required check): every PR merges via admin override", "cause": "Not fully diagnosed, smells like a shared CI test fixture / supabase-mock seam that drifted (the loops/objectives/setup-provision cluster all touch workspace lookup + provisioning mocks). Pre-dates the brain-10x work (present on the Bmail #562 and docs #563 commits). Unrelated to any one feature PR.", "layer": "verification", "signal": "wrong", "detect": "human", "prevent": "none", "mast_mode": null, "silent_class": "E", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0009", "occurred": "2026-07-15", "severity": "s3", "system": "next", "project": "internal agent platform", "title": "worktree hub missing culori → contrast-gate + dev-server + e2e fail locally (declared dep, not installed)", "cause": "The shared nodemodules hub was installed before culori was added to package.json; the hub lagged the manifest, so a declared+locked dependency is simply not on disk. CI (npm ci) installs it, so CI is green; only local worktrees are affected.", "layer": "infra", "signal": "loud", "detect": "human", "prevent": "rule", "mast_mode": null, "silent_class": "A", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0010", "occurred": "2026-07-15", "severity": "s3", "system": "next", "project": "internal agent platform", "title": "Consumer server page blocked its whole render on an awaited DB read (unreachable DB → stuck on loading.tsx)", "cause": "A top-level awaited DB read in an async server component blocks the entire page render; slow/unreachable DB leaves the whole page on loading.tsx.", "layer": "application", "signal": "quiet", "detect": "human", "prevent": "rule", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0011", "occurred": "2026-07-15", "severity": "s2", "system": "next", "project": "client agent platform", "title": "Local typecheck via the shared worktree node_modules hub misses type errors clean-install CI catches", "cause": "The worktree's nodemodules is a symlink to a SHARED hub (interact-plan-inline-wt), which is a few commits divergent from the branch's origin/master. The hub resolved a different transitive number-flow type tree than a clean npm ci at the branch commit, so @number-flow/react's Format (which is Omit<Intl.NumberFormatOpti...", "layer": "verification", "signal": "silent", "detect": "check", "prevent": "rule", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0012", "occurred": "2026-07-15", "severity": "s2", "system": "next", "project": "internal agent platform", "title": "lucide-react icon components misclassified as ReactNode (forwardRef typeof is 'object', not 'function')", "cause": "lucide-react icons are React.forwardRef exotic components, so typeof SomeIcon === 'object' at runtime (not 'function'). A type guard written as typeof icon === 'function' silently fails for every lucide icon reference passed as a prop typed LucideIcon | ReactNode, routing it into the ReactNode branch, which then render...", "layer": "application", "signal": "silent", "detect": "human", "prevent": "test", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0013", "occurred": "2026-07-15", "severity": "s2", "system": "openai", "project": "agency infrastructure", "title": "OpenAI fine-tuning API rejects new job creation for orgs that never fine-tuned before (<internal-project> OPENAI_API_KEY confirmed blocked)", "cause": "OpenAI announced a self-serve fine-tuning platform wind-down (developers.<host><path>): orgs that had NEVER run a fine-tuning job before <phone> lost the ability to create new ones as of that date; orgs with prior fine-tune history but no inference on a fine-tuned model in the last 60 days lose access as of <phone>; AL...", "layer": "thirdparty", "signal": "loud", "detect": "check", "prevent": "rule", "mast_mode": null, "silent_class": "A", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0014", "occurred": "2026-07-15", "severity": "s3", "system": "supabase", "project": "internal agent platform", "title": "migration PR: tracked.b-prompt hijack + open-PR number collision", "cause": "Two independent traps in <path> (1) resolveBPrompt() prefers the tracked root.b-prompt FILE over the PR-title [Btag]; each migration PR is expected to overwrite it, so it carries the PREVIOUS programme's tag (Bmail from the last migration PR #440) until you flip it.", "layer": "verification", "signal": "wrong", "detect": "check", "prevent": "rule", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0015", "occurred": "2026-07-15", "severity": "s2", "system": "supabase", "project": "client agent platform", "title": "Migration number chosen at branch time collided on rebase: registry-gate can't see band reservations on open PRs", "cause": "A migration number verified free at branch time can be claimed by another in-flight B-prompt PR before merge. check-migration-registry.mjs validates only that your number is in YOUR registry row's reservation and (best-effort) not in another OPEN PR's migration FILES; it does not detect band reservations documented in...", "layer": "verification", "signal": "silent", "detect": "downstream", "prevent": "gate", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0016", "occurred": "2026-07-15", "severity": "s2", "system": "vercel", "project": "agency infrastructure", "title": ": cron routes silently redirected to login instead of running (missing middleware.ts PUBLIC_ROUTES entry)", "cause": "middleware.ts's PUBLICROUTES set must be kept in sync by hand with every new/existing self-authenticating (CRONSECRET or shared-secret) route; health-sweep's route file was added without a matching middleware.ts entry, and nothing enforces the pairing, the route compiles, typechecks, and works under manual testing (wit...", "layer": "application", "signal": "silent", "detect": "audit", "prevent": "gate", "mast_mode": null, "silent_class": "C", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0017", "occurred": "2026-07-15", "severity": "s2", "system": "vercel", "project": "internal agent platform", "title": "health-sweep cron silently 307'd to /login: missing PUBLIC_ROUTES entry", "cause": "A new self-authenticating cron route (bearer-token, no session cookie) must be added to middleware.ts's PUBLICROUTES or the session-auth middleware intercepts it before the route's own auth check ever runs.", "layer": "application", "signal": "silent", "detect": "audit", "prevent": "gate", "mast_mode": null, "silent_class": "C", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0001", "occurred": "2026-07-14", "severity": "s2", "system": "advizr", "project": "internal agent platform", "title": "Vercel builds fail intermittently: an empty pnpm-lock.yaml stub makes cold-cache builds pick pnpm and die with exit 236", "cause": "A 92-byte pnpm-lock.yaml stub (from the original v0.dev scaffold, lockfileVersion: '9.0', zero packages) sat next to the real package-lock.json (npm, lockfileVersion 3, 545 packages). Vercel detects the package manager from whichever lockfile it finds.", "layer": "infra", "signal": "wrong", "detect": "check", "prevent": "rule", "mast_mode": null, "silent_class": "A", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": false, "fix_written": true, "resolution_written": false, "resolved_field": true, "recurrence_count": 1 }, { "id": "afi-0003", "occurred": "2026-07-14", "severity": "s2", "system": "url", "project": "agency infrastructure", "title": "Global Claude config pointed at dead KB URL (<host>)", "cause": "URL drift after the KB API redeploy from <host> to <host>: workspace configs were updated, the two global config files were missed. No probe checks the URL, and the pulse script swallows failures, so the breakage was invisible.", "layer": "infra", "signal": "silent", "detect": "audit", "prevent": "rule", "mast_mode": null, "silent_class": "C", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": true, "fix_written": true, "resolution_written": false, "resolved_field": true, "recurrence_count": 1 }, { "id": "afi-0350", "occurred": "2026-07-14", "severity": "s1", "system": "advizr", "project": "client agent platform", "title": "is not a GitHub account, so its commits make Vercel BLOCK every client deploy", "cause": "<internal-project> is not a GitHub account, GET /users/<internal-project> returns 404. Two workflows in the client template merely set git config user.name \"<internal-project>\" / user.email \"bot@<host>\" and push.", "layer": "infra", "signal": "silent", "detect": "audit", "prevent": "monitor", "mast_mode": null, "silent_class": "A", "owasp_asi": null, "euaia_reportable": "would-report", "root_cause_written": true, "prevention_written": false, "fix_written": true, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0351", "occurred": "2026-07-14", "severity": "s1", "system": "client", "project": "client agent platform", "title": "Client email notifications have never been delivered: three stacked causes, all silent", "cause": null, "layer": "application", "signal": "silent", "detect": "client", "prevent": "monitor", "mast_mode": null, "silent_class": "C", "owasp_asi": null, "euaia_reportable": "would-report", "root_cause_written": false, "prevention_written": false, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0353", "occurred": "2026-07-14", "severity": "s1", "system": "instantly", "project": "outbound pipeline", "title": "Three US campaigns paused at 17.9% bounce: the leads were never email-verified", "cause": "<internal-project> defaults to EMAILVERIFYPROVIDER=free, which does syntax + MX only. The pipeline's own docstring admits this \"cannot detect a nonexistent mailbox on a live domain.\" No provider was ever set in.env.", "layer": "application", "signal": "loud", "detect": "check", "prevent": "gate", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-report", "root_cause_written": true, "prevention_written": false, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 2 }, { "id": "afi-0352", "occurred": "2026-07-12", "severity": "s1", "system": "commitaction", "project": "client agent platform", "title": "Prompt-injected commitAction payloads are proposed to a human, not blocked", "cause": null, "layer": "orchestration", "signal": "silent", "detect": "audit", "prevent": "gate", "mast_mode": null, "silent_class": "B", "owasp_asi": "ASI01", "euaia_reportable": "would-report", "root_cause_written": false, "prevention_written": false, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0355", "occurred": "2026-07-12", "severity": "s2", "system": "next", "project": "client agent platform", "title": "Vercel build on the feature umbrella is OOM-killed, not a compile error, and it blocks the merge gate", "cause": "next build exceeded the RAM of Vercel's default build container and was SIGKILLed. The umbrella branch has grown large because many additive feature streams merged into it, no single stream is \"the\" culprit; the repo simply outgrew the build machine. Truncation with no error line IS the OOM signature.", "layer": "infra", "signal": "wrong", "detect": "check", "prevent": "rule", "mast_mode": null, "silent_class": "A", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": false, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0356", "occurred": "2026-07-12", "severity": "s2", "system": "no", "project": "client agent platform", "title": "Dashboard middleware never calls hasPermission: every route is URL-loadable by any authenticated user", "cause": null, "layer": "application", "signal": "silent", "detect": "audit", "prevent": "test", "mast_mode": null, "silent_class": "B", "owasp_asi": "ASI03", "euaia_reportable": "would-report", "root_cause_written": false, "prevention_written": false, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0357", "occurred": "2026-07-12", "severity": "s1", "system": "policy", "project": "client agent platform", "title": "Built-in prompt-injection and toxicity guardrails are silently dead: PCRE (?i) is invalid in JS RegExp", "cause": "The seeded patterns embed (?i), a PCRE / Python inline flag. JavaScript's RegExp has no inline-flag syntax; the constructor throws Invalid group. <path> catches the parse error and skips the rule.", "layer": "verification", "signal": "silent", "detect": "audit", "prevent": "test", "mast_mode": null, "silent_class": "C", "owasp_asi": "ASI01", "euaia_reportable": "would-report", "root_cause_written": true, "prevention_written": false, "fix_written": true, "resolution_written": true, "resolved_field": true, "recurrence_count": 1 }, { "id": "afi-0358", "occurred": "2026-07-12", "severity": "s3", "system": "reindexfile", "project": "client agent platform", "title": "reindexFile() delete-then-insert is not atomic: concurrent writes to one file log dup-key warnings", "cause": null, "layer": "data", "signal": "quiet", "detect": "audit", "prevent": "test", "mast_mode": null, "silent_class": "C", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": false, "prevention_written": false, "fix_written": true, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0359", "occurred": "2026-07-12", "severity": "s2", "system": "vault", "project": "client agent platform", "title": "Vault curator has detected zero contradictions in production: contradictions.ts still carries a rejected zod bound", "cause": null, "layer": "verification", "signal": "silent", "detect": "audit", "prevent": "test", "mast_mode": null, "silent_class": "E", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": false, "prevention_written": false, "fix_written": true, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0002", "occurred": "2026-07-11", "severity": "s2", "system": "kb", "project": "agency infrastructure", "title": "KB write path broken: kb_log_error returns HTML, memory_save schema mismatch", "cause": "Not fully diagnosed. Two distinct failure modes: (1) kblogerror / vaultwrite hit an endpoint that serves HTML (missing route or auth redirect on <host>); (2) memorysave bridge (test/agency-kb-master/bridge<path>) does not send sessionid / projectslug / observationtype in the shape the API requires, schema drift between...", "layer": "infra", "signal": "loud", "detect": "human", "prevent": "rule", "mast_mode": null, "silent_class": "A", "owasp_asi": null, "euaia_reportable": "would-log-only", "root_cause_written": true, "prevention_written": true, "fix_written": true, "resolution_written": false, "resolved_field": false, "recurrence_count": 2 }, { "id": "afi-0354", "occurred": "2026-06-14", "severity": "s2", "system": "jwt", "project": "internal agent platform", "title": "Clients provisioned before the JWT_SECRET alignment still carry the old secret, so agency SSO does not verify on them", "cause": "Cross-app SSO depends entirely on every app signing and verifying with the same JWTSECRET. The provisioning worker used to hand new clients a different secret from the one the router's central login signs with (the worker's was a 46-char base64 value; the canonical router/admin secret is a 31-char value ending...set-ke...", "layer": "infra", "signal": "silent", "detect": "audit", "prevent": "gate", "mast_mode": null, "silent_class": "B", "owasp_asi": null, "euaia_reportable": "would-miss", "root_cause_written": true, "prevention_written": false, "fix_written": true, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 }, { "id": "afi-0235", "occurred": null, "severity": null, "system": "supabase", "project": "agency infrastructure", "title": "", "cause": null, "layer": "unclassified", "signal": null, "detect": null, "prevent": null, "mast_mode": null, "silent_class": null, "owasp_asi": null, "euaia_reportable": null, "root_cause_written": false, "prevention_written": false, "fix_written": false, "resolution_written": false, "resolved_field": false, "recurrence_count": 1 } ] }