PavlokPager — Project Board¶
Live Kanban of all PavlokPager work. Ticket prefix PP-. Mirrors the WorkWingman board
convention: cards flip on every transition (start / in-review / done), and this file is the
source of truth the HTML artifact renders from.
Live board artifact: docs/board.html (open in a browser).
Last updated: 2026-07-08
Done¶
| ID | Title | Notes |
|---|---|---|
| PP-1 | Core CLI: login/setup/vibe/beep/zap/page/test/log | .NET 10 global tool pavlok |
| PP-2 | Escalation ladders (gentle/normal/urgent) | urgent = vibe 80 → beep 100 → zap 100 ×5 |
| PP-3 | Safety rails: maxZap clamp + 3-pages/8h budget + audit log | exit 3 on budget refusal |
| PP-4 | pavlok-page Claude skill |
when/how to page; bundled in-repo under skill/ |
| PP-5 | Token auth: login + setup + PAVLOK_API_KEY |
DPAPI at rest; live-verified on band |
| PP-6 | Package + install as .NET global tool | dotnet pack + tool install; v1.1.0 |
| PP-7 | Council review gate (Codex + Gemini, pre-Grok seat) | 8 correctness/quality fixes (573ee28) |
| PP-8 | Security hardening from Codex OWASP scan | no argv secrets, redacted output, 0600/0700 (ed946c7) |
| PP-9 | Private GitHub repo + push | github.com/andrewjonesdev/PavlokPager |
| PP-10 | Docs: technical + plain + making-of + C4/sequence/state diagrams | cfa1036 |
| PP-11 | Semgrep SAST (Docker) + CI workflow + MCP registered | 0 findings; actions SHA-pinned |
| PP-12 | Unit tests (xUnit + Bogus, mocked HTTP) | 59 tests, isolated PAVLOK_HOME sandbox |
| PP-13 | Stryker mutation testing | config + local tool; score 63.06% (break 60, low 70, high 85) |
| PP-14 | CI: test + mutation job | runs on every push alongside Semgrep |
| PP-18 | Org-migration re-audit: self-hosted CI runners, churn job, doc-set completion | root TESTING.md, docs/plain/README.md, .env.example, README ## Security, tests.yml/security.yml moved to [self-hosted, home-ci, windows] + churn job, Semgrep invocation switched to docker run (Windows has no native binary) |
Backlog¶
| ID | Title | Notes |
|---|---|---|
| PP-15 | Optional: publish to nuget.org so dotnet tool install works without a local source |
needs npm/nuget account decision |
| PP-16 | Optional: hosted Atlassian Jira sync (if desired over this board) | needs Atlassian creds + MCP |
| PP-17 | Optional: --password-stdin documented recipe for headless setup |
convenience |
Legend¶
Transitions are logged here on every move (Backlog → In progress → In review → Done), and the HTML artifact is re-rendered to match. No card jumps straight to Done without passing In review.