Issues

• Dependabot lockfix: cp follows a symlink at the lock destination

  mforce/cluckwork#1373 · Filter by author mforce opened on Oct 26, 2026

• Flaky integration test: StolenLease MCP connect gets no reply

  area:apibug
  mforce/cluckwork#1372 · Filter by author mforce opened on Oct 26, 2026

• chore(deps): take MessagePack 3.x once StreamJsonRpc supports it

  dependencies.NET
  mforce/cluckwork#1352 · Filter by author mforce opened on Oct 23, 2026

• Data Protection: keep reading keys protected by the previous certificate after a rotation

  mforce/cluckwork#1338 · Filter by author mforce opened on Oct 21, 2026 · Platform hardening

• Two-factor: tell a user at sign-in when someone else changed or bypassed their two-factor

  mforce/cluckwork#1337 · Filter by author mforce opened on Oct 21, 2026 · Two-factor authentication (TOTP)

• Two-factor: let an Owner require it for other roles

  mforce/cluckwork#1336 · Filter by author mforce opened on Oct 21, 2026 · Two-factor authentication (TOTP)

• Connected apps: configurable approval lifetime that forces reconnect

  mforce/cluckwork#1335 · Filter by author mforce opened on Oct 21, 2026

• Passkey slice 4: sign in with a passkey instead of a password

  area:apiarea:frontendepic-320priority:tier4size:Lslice
  mforce/cluckwork#1285 · Filter by author mforce opened on Oct 12, 2026 · Passkeys

• Passkey slice 3: register, name and remove passkeys, with Owner removal and recover-admin

  area:apiarea:frontendepic-320priority:tier4size:Lslice
  mforce/cluckwork#1284 · Filter by author mforce opened on Oct 12, 2026 · Passkeys

• Passkey slice 2: mockups for passkey registration and sign-in

  area:frontendepic-320priority:tier4size:Mslice
  mforce/cluckwork#1283 · Filter by author mforce opened on Oct 12, 2026 · Passkeys

• Passkey slice 1: design record for passkey sign-in

  area:apiepic-320priority:tier4size:Lslice
  mforce/cluckwork#1282 · Filter by author mforce opened on Oct 12, 2026 · Passkeys

• 2FA slice 8: every Owner must use two-factor authentication

  area:apiarea:frontendepic-1273priority:tier3size:Mslice
  mforce/cluckwork#1281 · Filter by author mforce opened on Oct 12, 2026 · Two-factor authentication (TOTP)
  1

• 2FA slice 7: turn off and reset TOTP, by the user, an Owner, or recover-admin

  area:apiarea:frontendepic-1273priority:tier3size:Mslice
  mforce/cluckwork#1280 · Filter by author mforce opened on Oct 12, 2026 · Two-factor authentication (TOTP)
  1

• 2FA slice 6: TOTP code as a step-up factor, including connected-app consent

  area:apiarea:frontendepic-1273priority:tier3size:Mslice
  mforce/cluckwork#1279 · Filter by author mforce opened on Oct 12, 2026 · Two-factor authentication (TOTP)
  1

• 2FA slice 5: TOTP code as a second step at login

  area:apiarea:frontendepic-1273priority:tier3size:Lslice
  mforce/cluckwork#1278 · Filter by author mforce opened on Oct 12, 2026 · Two-factor authentication (TOTP)
  1

• 2FA slice 4: TOTP enrolment on the Account page, with recovery codes

  area:apiarea:frontendepic-1273priority:tier3size:Lslice
  mforce/cluckwork#1277 · Filter by author mforce opened on Oct 12, 2026 · Two-factor authentication (TOTP)
  1

• 2FA slice 3: tenant guard on AspNetUserTokens and TOTP secret storage

  area:apiepic-1273priority:tier3size:Mslice
  mforce/cluckwork#1276 · Filter by author mforce opened on Oct 12, 2026 · Two-factor authentication (TOTP)
  1

• Two-factor authentication (TOTP) at login and as a step-up factor

  area:apiarea:frontendepicepic-1273priority:tier3
  mforce/cluckwork#1273 · Filter by author mforce opened on Oct 12, 2026 · Two-factor authentication (TOTP)
  1

• Lift the Dependabot Roslyn hold when EF Core Design moves past Roslyn 5.0

  dependencies.NET
  mforce/cluckwork#1112 · Filter by author mforce opened on Oct 6, 2026 · Platform hardening
  1

• web+api: replace the Dashboard's 10,000-row drain ceiling with a proper morning-brief design

  enhancementpriority:tier4
  mforce/cluckwork#942 · Filter by author mforce opened on Sep 23, 2026

• Alert centre: durable per-farm alerts with an SPA surface (specs §17.1)

  alertsarea:apiarea:frontendpriority:tier3slice
  mforce/cluckwork#803 · Filter by author mforce opened on Sep 13, 2026 · Alerts
  1

• Consider migrating the SPA's hand-rolled login to OpenIddict once it is proven for MCP

  area:apideferredenhancementepic-788priority:tier3
  mforce/cluckwork#793 · Filter by author mforce opened on Sep 12, 2026
  4

• Future: coupon codes as the discount mechanism, instead of typed prices

  area:apiarea:domainarea:frontendneeds-scopepriority:tier4size:Lslice
  mforce/cluckwork#730 · Filter by author mforce opened on Sep 8, 2026
  4

• Alerts: raise an alert-centre entry for a large discount at confirm

  alertsarea:apiarea:frontendpriority:tier4size:Mslice
  mforce/cluckwork#728 · Filter by author mforce opened on Sep 8, 2026 · Alerts
  3

• SPA: per-locale i18n splitting — all 3 language catalogs ship eagerly, conflicts with the no-flash init invariant

  area:frontendpriority:tier4slice
  mforce/cluckwork#597 · Filter by author mforce opened on Aug 24, 2026
  2