Tracking: 2026-09-07 app audit backlog

[charlesrhoward]

Backlog from the 2026-09-07 audit of Control, the coordinator backend and the app shell. Each linked issue is self-contained: where the bug is, what to change, and the exit criteria including the test that must fail before the fix. Work top to bottom. Tick an item when its PR merges.

P0: correctness and safety

• Parallel Codex workers kill their shared sandbox and the coordinator misreports the failure #434 (start here)
• Coordinator can open a pull request without operator approval #408
• Approval policy should derive from tool access level, not a hand-maintained name list #409
• "Commit & push" defaults to main when the branch is unknown #410
• Reserved slugs miss control, delivery, observe and five top-level routes #411
• /api/repos fetched without the active-team header shows personal repos inside a team scope #412

P1: reliability and user-visible classes of bug

• Control session list treats a failed fetch as "No sessions yet" #413
• /control shows the new-mission screen before it knows whether sessions exist #414
• Selecting a session can silently do nothing, and auto-restore fails closed #415
• Control pickers show "New project…", "Model" and "No repository" while data is still loading #416
• First message of a new mission can be lost without a trace #417
• Killed Control turns stay "streaming" for 17 minutes before the reaper runs #418
• Validate the Control permissions string and warn on "Approve Edits" with Codex #419
• No server-side lock prevents two coordinator turns on one conversation #420
• Backfill repo_id for legacy Control sessions #421
• Route-segment errors are never reported to Sentry and replace the whole shell #422
• Library and pane mutations ignore res.ok and show changes that were never saved #423
• Investigate the 30 to 40 second cold start after every production deploy #424

P2: hygiene, coverage, performance, accessibility

• Mobile Control has no session list and no way to start a session #425
• Command palette cannot find Control sessions or the Control page #426
• 33 API routes crash with a 500 on a malformed JSON body #427
• Adopt zod for request bodies, starting with the untested team and connections routes #428
• Dashboard ships the Supabase realtime client and Shiki in every page bundle #429
• Icon-only buttons have no accessible name and status dots are colour-only #430
• Remove the permanently-off Vercel integration flags and the dead migrate route #431
• Project combobox cannot create a project from the name you typed #432

Rules that apply to every item: files stay under 500 lines, regression tests go red before green (see TESTING.md), PR bodies follow the template. Test placement follows the repo convention: pure logic gets a colocated vitest test under lib/, API routes get a tests/unit/ suite, user-visible behaviour gets a Playwright case in the matching tests/e2e/ spec.

https://claude.ai/code/session_01SQ4nS96XYRztd5w9QkubPf