# Implementation Backlog

> Source: source-code audit conducted on 19 October 2026. This is a delivery backlog, not proof that an issue has been fixed. Keep the status and evidence current as work progresses.

## Priority rules

| Priority | Meaning | Expected action |
| --- | --- | --- |
| P0 | Active exposure or severe unauthorized access risk | Contain immediately; fix before next release. |
| P1 | High security, data-integrity, or production reliability risk | Schedule in the current sprint. |
| P2 | Important quality, maintainability, or operational risk | Plan in the next one or two sprints. |
| P3 | Improvement or product enhancement | Prioritize against business value. |

## P0 — contain immediately

| ID | Work item | Why it matters | Acceptance criteria | Status |
| --- | --- | --- | --- | --- |
| SEC-001 | Rotate exposed provider credentials and remove concrete values from `apps/backend/.env.example` | Committed secrets must be considered compromised. | Each affected provider credential is revoked/rotated; no live secret remains in tracked files; deployment values come from an approved secret store; secret scanning is enabled. | Open |
| SEC-002 | Restrict public registration | `POST /api/register` issues a token. It is unsuitable for an internal agency tool unless intentionally invitation-based. | Registration is removed from production, protected by an admin/invitation flow, or gated with verified email and explicit approval; integration tests prove an unapproved user cannot use operational APIs. | Open |

## P1 — current sprint

| ID | Work item | Why it matters | Acceptance criteria | Status |
| --- | --- | --- | --- | --- |
| AUTH-001 | Apply `active.user` to Upwork and Fiverr route groups | Module routes currently use `auth:sanctum` without the core inactive-user guard. | Disabled/deleted users receive 403 and their token is revoked on every protected core and module endpoint. | Open |
| AUTH-002 | Add explicit permissions to token-only module routes | Lookup endpoints and Fiverr image upload are broadly token-accessible. | Every route has documented least-privilege access; upload, account, payment, and lead lookups are permission-protected; tests cover 401/403/200 cases. | Open |
| API-001 | Reconcile frontend service calls with backend routes | The UI contains calls for proposal scrape, assignment and active-template detail routes that are absent from route definitions. | Remove dead client calls or implement documented endpoints; contract tests and API reference match. | Open |
| API-002 | Stabilize route matching | Dynamic routes can be fragile when declared before static/specific routes. | Routes are ordered most-specific first and use numeric/slug constraints; `route:list`/feature tests verify expected dispatch. | Open |
| SEC-003 | Add rate limits | Login, password reset, upload and AI/OCR endpoints need abuse protection. | Named throttles apply by IP/account; responses do not reveal reset-account existence; rate-limit events are logged. | Open |
| OPS-001 | Add CI | No committed CI workflow validates a change before merge. | Pull request checks run clean dependency install, backend tests, frontend lint/build, and dependency/security scan. | Open |

## P2 — next sprint

| ID | Work item | Why it matters | Acceptance criteria | Status |
| --- | --- | --- | --- | --- |
| TEST-001 | Expand automated coverage | Visible tests are narrow and root coverage configuration does not include module source. | Feature tests cover auth, RBAC, lifecycle transitions, upload validation and exports; CI publishes coverage including `Modules/*/app`. | Open |
| OPS-002 | Make frontend tooling reproducible | Current checkout resolves an incompatible ESLint and has no Vite executable. | A clean `npm ci && npm run lint && npm run build` succeeds using the lockfile and documented Node version. | Open |
| API-003 | Publish an OpenAPI contract | Route tables alone cannot prevent integration drift. | `openapi.yaml` is versioned, linted, and generated/verified against route tests; Swagger/Redoc is available in non-production or authenticated docs. | Open |
| RES-001 | Queue and harden external work | AI/OCR, external scraping and exports can be slow, expensive, and failure-prone. | Jobs have timeout, retry/backoff, idempotency key, provider error mapping and observable status; requests do not hold web workers unnecessarily. | Open |
| OBS-001 | Add operational observability | Production debugging needs safe, structured evidence. | Structured logs include request/correlation IDs; dashboards/alerts cover queue failures, export failures, 5xx rate, OCR cost and latency; secrets/PII are redacted. | Open |
| DATA-001 | Define retention and backup policy | The platform stores client data, uploads and financial references. | Documented retention owner, restore test cadence, encrypted backups, RPO/RTO target and deletion process exist. | Open |

## P3 — product and documentation improvements

| ID | Work item | Outcome | Status |
| --- | --- | --- | --- |
| UX-001 | Add in-product contextual help linked to the Bangla user manual | Faster onboarding and fewer workflow errors. | Open |
| UX-002 | Add explicit activity timeline/status transition explanations | Operators can understand why actions are unavailable. | Open |
| DOC-001 | Maintain a change log and release notes | Users and support know what changed. | Open |
| DOC-002 | Add database schema and data dictionary | Faster onboarding and safer reporting/integrations. | Open |
| REP-001 | Define report ownership and data-quality checks | Reports are trusted for decisions. | Open |

## Delivery checklist template

Use this record for every backlog item before closing it:

```md
### ITEM-ID — concise title
- Owner:
- PR / change link:
- Risk addressed:
- Tests added or run:
- Deployment/migration step:
- Rollback step:
- Evidence (log, screenshot, test output):
- Reviewed by:
- Closed date:
```