ops(post-v1.30.0): source-truth audit, roadmap/TODO reconciliation, repo/app housekeeping and next-wave reset

[qnbs]

Purpose

Run immediately after v1.30.0 VERIFIED. This is the structured reset from the focused desktop at-rest encryption milestone back to the broader WorldScript roadmap.

START_AFTER = v1.30.0 VERIFIED
PRIMARY_INPUT = #445 + v1.30.0 release evidence
GOAL = CURRENT_TRUTH + CLEAN_CONTROL_PLANE + NEXT_WAVE_READY

Phase A — at-rest closure audit

• audit security(core/R-15): renderer-neutral encrypted desktop storage, durable migration & identity binding #445 and all Gate 2–7 child owners;
• verify Desktop atomic writes: fsync temp file + parent directory before/after rename for true crash durability #357/Desktop fs-data key-rotation migration is not crash-resumable (mixed-key state possible) #359/Desktop fs reads/writes don't participate in the encryption-migration admission lock (race window during disable/rotate) #360/Bind desktop fs-backed ciphertext to its record identity (AAD) to prevent cross-file substitution #361 dispositions;
• verify released artifacts match claims;
• scan for residual plaintext/legacy authority references, stale TODOs, obsolete migration flags, orphan compatibility code and dead feature gates;
• confirm security/privacy/help text says exactly what v1.30.0 provides.

Phase B — roadmap / TODO / ledger truth

Coordinate existing owners instead of duplicating them:

• docs(roadmap): reconcile root v2 status with native roadmap and Core migration ledger #559 root roadmap/native roadmap/Core Migration Ledger reconciliation;
• docs(authority): keep README.md, GitBook EN/DE and DeepWiki continuously accurate and source-truth aligned #724 README/GitBook/DeepWiki authority truth;
• security(truth): consolidate user-visible security/privacy claims across storage, providers, PWA, collaboration & supply chain #549 security/privacy claim truth;
• update ROADMAP.md, TODO.md, native roadmap and migration ledger from live evidence;
• verify every numbered GitHub reference against its actual object/state.

Phase C — repo/app housekeeping

Use #877 as bounded repo-hygiene owner and expand only when live audit proves new debt. Cover stale branches/worktrees, safe pnpm/store/cache hygiene, merged PR branch cleanup, Vercel preview retention #627, stale generated reports/graph artifacts, temporary/handoff files, dormant config/policy copies, dependency-policy comment drift, obsolete feature flags/migrations from the cutover and stale release artifacts/previews not needed for rollback. Preserve unresolved rescue/evidence material.

Phase D — dependency/toolchain freshness audit

• re-fetch deferred dependency/security/toolchain owners;
• reassess RustCrypto build(deps): bump getrandom from 0.2.17 to 0.3.4 in /crates #883–build(deps): bump aes from 0.8.4 to 0.9.1 in /crates #887 against current MSRV;
• re-evaluate Tauri stack toolchain(tauri): align JS/CLI/Rust Tauri 2.x versions and establish a bounded transitional update policy #573;
• re-evaluate Node/TypeScript/Playwright/toolchain owners from live graph;
• do not batch unrelated majors merely to clear dashboards.

Phase E — quality/security audit

• fresh CodeQL/OSV/Dependabot/GitGuardian/Socket/CodeAnt state;
• mutation evidence;
• CI/reviewer governance drift;
• packaged test harness health;
• release: make tag-time publishing depend on the security audit (Tauri release + GHCR) #911 release security pipeline state;
• open P0/P1 inventory and stale issue truth.

Phase F — control-plane reset

Produce one current prioritized matrix: P0 immediate, P1 short term, P2 medium term, deferred with evidence, blocked on maintainer decision, terminal/close. Update GitHub + Linear; close superseded owners only with evidence; never mass-close by text matching.

Exit

• source truth synchronized;
• no stale release/R-15 execution instructions remain authoritative;
• repo/app housekeeping complete or bounded;
• next highest-priority engineering lane selected/admitted;
• autonomous development resumes from clean current state.

Adaptive reviewer / repository-learning audit

After v1.30.0 is VERIFIED, consume #780 and the multi-reviewer orchestrator owner to perform a deliberate learning/rationalization pass:

• compare which reviewers caught unique material defects during v1.30 versus duplicated/noisy signal;
• reconcile live reviewer availability, quota semantics, config authority and documented roles;
• verify no advisory provider silently became direct/transitive merge authority;
• audit dashboard-vs-repo configuration drift (including DeepSource);
• decide whether DeepSource JavaScript can be admitted against the then-current TypeScript toolchain;
• inspect stale suppressions/ignore patterns and dead integrations;
• convert repeated finding classes into types/tests/deterministic guards where warranted;
• consolidate AGENTS/instruction/CI/reviewer docs around one canonical durable policy;
• evaluate the Kimi fallback / multi-reviewer orchestrator rollout using measured signal, latency and cost;
• remove or demote low-value duplication only with evidence;
• preserve human/admin authorization boundaries and least privilege.

This is the broad optimization point. During the v1.30 critical path, only small directly useful review-learning changes should be pulled forward.

[qnbs]

Linear control-plane mirror

• Linear: QNB-173
• Project: v1.30.0 — Complete Desktop At-Rest Encryption
• Project URL: https://linear.app/qnbs/project/v1300-complete-desktop-at-rest-encryption-1ea741fa2ae5

GitHub remains the implementation/evidence source of truth; Linear tracks sequencing, priority, dependencies and milestone progress.

[qnbs]

Pre-release docs checkpoint relationship — 2026-10-01

#932 / QNB-176 now owns the bounded pre-v1.30 README/GitBook/DeepWiki/DEV.to parity + release-adjacent housekeeping pass after Gate 7 and before tag/release freeze.

This does not shrink #927. Post-release, consume #932's resulting truth/evidence and then perform the deeper reset already owned here: complete roadmap/TODO/source-truth reconciliation, repository/app hygiene, reviewer/tool learning audit, dependency/toolchain freshness and next-program reprioritization.

Do not redo #932 mechanically; inspect what changed during publication/released-artifact verification and only reconcile remaining/new drift.