Skip to content

Board

Ticket-style board for house-pipeline work on this repo. Ticket prefix: ODY. This tracks house-pipeline integration/audit work, not Odysseus' own feature development (see ROADMAP.md, GitHub Issues, and docs/pr-blocker-audit.md for that).

Live artifact: deferred (per house pipeline convention - republish here once a live board artifact exists).

Done

  • ODY-2 - Coverage floor enforced in CI: fail_under = 44 (pyproject.toml)

  • enforcing coverage report step in python-tests; floor set 1pt below the 45.96% measured 2026-07-11 (fleet measurement on ANDREWBEDROOMTV, dev 6efc07c, 4420 passed / 111 failed / 21 errors / 6 skipped). Known test FAILURES remain informational (masked with a CI warning) until the suite is green — the floor is a decay ratchet, not a quality gate; coverage from failing tests still counts. Commits fd1a858 + the enforcement fix. 2026-07-11, overnight WT-2566.

  • ODY-1 - House pipeline re-audit: secret pre-scan classification (24 flagged hits, all fixtures/false-positives, none real), Codex security review, docs-set gap-fill (TESTING.md, docs/technical/ARCHITECTURE.md, docs/plain/README.md, this board, docs/MAKING-OF.md chapter 1), test suite run + coverage numbers recorded, CI gap-fill (semgrep.yml SAST job, churn.yml 5x flake-detection job). 2026-07-08.

Backlog (carried over from existing ROADMAP.md / issues, not new)

  • Suite red on dev: 111 failed + 21 errors (measured 2026-07-11) — burn this down, then unmask test failures in python-tests (see ODY-2 note).
  • No mutation testing (mutmut) - full-suite run not "quick" given ~1,300 test files; scoping to a single security-critical module (e.g. core/auth.py) is a reasonable first slice.
  • No hermetic browser E2E harness; frontend behavior coverage currently comes from the tests/streaming/*.mjs Node harness and many *_js.py tests that exercise static JS logic, not a full browser flow.
  • Org migration: origin remote is under pewdiepie-archdaemon, not andrewjonesdev - out of scope for this audit, flagged for the org migration pass.
  • CI installs Python dependencies unpinned (pip install -r requirements.txt with floating package names) - flagged MEDIUM by the Codex security review in this audit. dependency-review.yml already runs pip-audit (advisory) and blocks PRs that add a known-vulnerable dependency, which covers the "don't ship a CVE" case; it does not cover reproducibility (two installs on different days can resolve different versions) or integrity (no hash verification). GitHub Actions are already SHA-pinned; Python packages are not. Fix is hash-pinning (pip-compile --generate-hashes or a uv.lock) plus CI hash verification - deferred as a larger change than this audit's scope.