Verified defects in shipped code (file:line citations in the tracker).
- Every validation rejection is read as an approval.
ValidationFunction does response.toUpperCase().contains("VALID") — and "INVALID" contains "VALID". The gate can never reject. Zero tests on the class.
- The "production default" Postgres store cannot write to Postgres. Both Postgres stores emit
MERGE INTO ... KEY (col) VALUES (...), which is H2-proprietary; PostgreSQL 15 MERGE has no KEY clause. Invisible because every test runs H2.
- Three transient-field NPEs that only fire once a job is distributed (field initializers do not run on deserialization). One of them makes robots.txt silently fail open in any serialized crawler.
- Unguarded
ServiceLoader iteration over the VectorStore SPI throws NoClassDefFoundError for any consumer on a default build. The correct guarded pattern already exists 50 lines up in the same file.
- Guardrail redaction never reaches the transcript. The raw reply is persisted before guardrails run, and only the returned object is redacted — so blocked content is replayed into the next prompt.
docker-compose-session.yml pins a Flink 1.20.1 image while the project targets 2.2.1; since Flink is provided, jobs cannot run on it.
Roadmap epic. Detailed findings, file:line citations and sub-tasks live in the AI-grind tracker (project AGS), which is the source of truth for this work. Local dev — build, test, tracking, profiling — is managed with AI-grind.
Tracked as AGS-5 in the devtools-mcp tracker.
Verified defects in shipped code (file:line citations in the tracker).
ValidationFunctiondoesresponse.toUpperCase().contains("VALID")— and"INVALID"contains"VALID". The gate can never reject. Zero tests on the class.MERGE INTO ... KEY (col) VALUES (...), which is H2-proprietary; PostgreSQL 15 MERGE has noKEYclause. Invisible because every test runs H2.ServiceLoaderiteration over the VectorStore SPI throwsNoClassDefFoundErrorfor any consumer on a default build. The correct guarded pattern already exists 50 lines up in the same file.docker-compose-session.ymlpins a Flink 1.20.1 image while the project targets 2.2.1; since Flink isprovided, jobs cannot run on it.Roadmap epic. Detailed findings, file:line citations and sub-tasks live in the AI-grind tracker (project
AGS), which is the source of truth for this work. Local dev — build, test, tracking, profiling — is managed with AI-grind.Tracked as
AGS-5in the devtools-mcp tracker.