upstream-mike-sync-state.json

{
  "schema_version": 3,
  "upstream": "Open-Legal-Products/mike",
  "last_merged_at": "2026-08-20T07:24:31Z",
  "backfill": {
    "enabled": true,
    "started_at": "2026-07-29T00:00:00Z",
    "reason": "Classify the existing 2026 Mike backlog before resuming incremental synchronization."
  },
  "processed": [
    {
      "number": 46,
      "title": "Sync security and backend profile updates",
      "url": "https://github.com/Open-Legal-Products/mike/pull/46",
      "merged_at": "2026-05-08T13:12:04Z",
      "merge_commit_sha": "7f5dd217d74095fe8931357fefad5d9c6dea6c90",
      "decision": "investigate",
      "reason": "Large mixed change spanning backend, auth, provider keys, schemas, dependencies, legal pages, and application behavior.",
      "processed_at": "2026-07-29T03:45:15.646522Z"
    },
    {
      "number": 28,
      "title": "fix(projects): validate folder ownership before folder mutations",
      "url": "https://github.com/Open-Legal-Products/mike/pull/28",
      "merged_at": "2026-05-08T14:55:16Z",
      "merge_commit_sha": "e5a3d6f22230ca7c9714e118a14cfcd056048657",
      "decision": "investigate",
      "reason": "Authorization and project data-boundary fix in protected backend code.",
      "processed_at": "2026-07-29T03:45:15.646537Z"
    },
    {
      "number": 31,
      "title": "docs: add safe local testing guide",
      "url": "https://github.com/Open-Legal-Products/mike/pull/31",
      "merged_at": "2026-05-08T15:05:16Z",
      "merge_commit_sha": "adc2cf2370da42ef22aba643d0761d538202cfb7",
      "decision": "skip",
      "reason": "Safe local-testing guide and frontend secret guidance are already present in ROSS.",
      "processed_at": "2026-07-29T03:45:15.646540Z"
    },
    {
      "number": 48,
      "title": "feat: add OpenAI model support and harden OSS security defaults",
      "url": "https://github.com/Open-Legal-Products/mike/pull/48",
      "merged_at": "2026-05-09T07:07:48Z",
      "merge_commit_sha": "f40c25d07f6dd2d679317b3ec4d4e94bd884f849",
      "decision": "investigate",
      "reason": "Large provider, security, schema, dependency, backend, and behavioral change.",
      "processed_at": "2026-07-29T03:45:15.646542Z"
    },
    {
      "number": 52,
      "title": "fix: handle JSONB shared_with filters and path-style S3",
      "url": "https://github.com/Open-Legal-Products/mike/pull/52",
      "merged_at": "2026-05-10T12:23:13Z",
      "merge_commit_sha": "029181b2ff3e82bd9f44ba160fbc701a87f3e6e9",
      "decision": "investigate",
      "reason": "Changes authorization queries, storage configuration, and production backend behavior.",
      "processed_at": "2026-07-29T03:45:15.646544Z"
    },
    {
      "number": 51,
      "title": "fix(security): scope tabular-review document_ids by access (CWE-639)",
      "url": "https://github.com/Open-Legal-Products/mike/pull/51",
      "merged_at": "2026-05-10T13:03:38Z",
      "merge_commit_sha": "dbbf19697e9911517155f5396269a87c0ecd7e62",
      "decision": "investigate",
      "reason": "High-severity authorization and document data-boundary fix requiring focused review.",
      "processed_at": "2026-07-29T03:45:15.646546Z"
    },
    {
      "number": 21,
      "title": "fix(security): fail fast when download HMAC secret is missing (closes #7)",
      "url": "https://github.com/Open-Legal-Products/mike/pull/21",
      "merged_at": "2026-05-10T18:20:28Z",
      "merge_commit_sha": "0ac2744a8ebc230cb67bf629c09d8d6614ee38fb",
      "decision": "investigate",
      "reason": "Changes cryptographic secret handling and environment configuration.",
      "processed_at": "2026-07-29T03:45:15.646547Z"
    },
    {
      "number": 56,
      "title": "Update OSS setup docs and remove app legal pages",
      "url": "https://github.com/Open-Legal-Products/mike/pull/56",
      "merged_at": "2026-05-10T19:20:05Z",
      "merge_commit_sha": "469ee4adeca12d7cd9c1506c84b1e25f4859ae15",
      "decision": "investigate",
      "reason": "Includes legal-page removal, secret-related setup instructions, schema guidance, and license wording.",
      "processed_at": "2026-07-29T03:45:15.646548Z"
    },
    {
      "number": 62,
      "title": "chore: update Next and Cloudflare dependencies",
      "url": "https://github.com/Open-Legal-Products/mike/pull/62",
      "merged_at": "2026-05-12T05:42:56Z",
      "merge_commit_sha": "56c6051f90ed437efdbaf20d22d48610e05b2925",
      "decision": "investigate",
      "reason": "Dependency and lockfile update exceeds permitted automatic scope.",
      "processed_at": "2026-07-29T03:45:15.646550Z"
    },
    {
      "number": 64,
      "title": "Deployment and project page fixes",
      "url": "https://github.com/Open-Legal-Products/mike/pull/64",
      "merged_at": "2026-05-12T18:38:45Z",
      "merge_commit_sha": "2e8eafc78e56e6100f395e19e4357961de97f59e",
      "decision": "investigate",
      "reason": "Large deployment, schema, backend, and architecture-dependent UI change.",
      "processed_at": "2026-07-29T03:45:15.646551Z"
    },
    {
      "number": 132,
      "title": "refactor: enhance error handling and streamline API key management in LLM modules",
      "url": "https://github.com/Open-Legal-Products/mike/pull/132",
      "merged_at": "2026-05-14T15:57:23Z",
      "merge_commit_sha": "9e7046d4aa6d937cb818b9f99b07704373d414b5",
      "decision": "investigate",
      "reason": "Primarily backend provider and operational error-handling behavior; frontend portion is coupled to it.",
      "processed_at": "2026-07-29T03:45:15.646552Z"
    },
    {
      "number": 136,
      "title": "feat: prevent users from sharing projects and reviews with themselves",
      "url": "https://github.com/Open-Legal-Products/mike/pull/136",
      "merged_at": "2026-05-15T16:06:40Z",
      "merge_commit_sha": "4290104cd07100e4305f311bbd038d225c30bcd2",
      "decision": "investigate",
      "reason": "Sharing restrictions affect authorization and data-boundary behavior across frontend and backend.",
      "processed_at": "2026-07-29T03:45:15.646554Z"
    },
    {
      "number": 137,
      "title": "fix: update encryption key retrieval to use only USER_API_KEYS_ENCRYPTION_SECRET",
      "url": "https://github.com/Open-Legal-Products/mike/pull/137",
      "merged_at": "2026-05-15T16:55:57Z",
      "merge_commit_sha": "aed8c42e94c2eea021b78dd15c9f20982709fec2",
      "decision": "investigate",
      "reason": "Changes encryption-key retrieval in protected backend security code.",
      "processed_at": "2026-07-29T03:45:15.646557Z"
    },
    {
      "number": 138,
      "title": "fix: enforce SUPABASE_URL and SUPABASE_SECRET_KEY presence in server-side client; remove unused supabase-server.ts file",
      "url": "https://github.com/Open-Legal-Products/mike/pull/138",
      "merged_at": "2026-05-15T17:16:51Z",
      "merge_commit_sha": "4ba4d53c3834dbff9881bd8e2d06f3a03017d77e",
      "decision": "investigate",
      "reason": "Changes Supabase secret enforcement and server-side client behavior.",
      "processed_at": "2026-07-29T03:45:15.646558Z"
    },
    {
      "number": 139,
      "title": "docs: add contributing guide",
      "url": "https://github.com/Open-Legal-Products/mike/pull/139",
      "merged_at": "2026-05-15T17:48:03Z",
      "merge_commit_sha": "2f24cae4072073daa6172f6b4fbce8388b084f4a",
      "decision": "skip",
      "reason": "ROSS already has a more complete, repository-specific CONTRIBUTING.md.",
      "processed_at": "2026-07-29T03:45:15.646560Z"
    },
    {
      "number": 146,
      "title": "fix: require dedicated download signing secret",
      "url": "https://github.com/Open-Legal-Products/mike/pull/146",
      "merged_at": "2026-05-16T17:06:53Z",
      "merge_commit_sha": "2bbb62889155693dab553946032ddd3f42ad017d",
      "decision": "investigate",
      "reason": "Changes download-token cryptographic secret requirements.",
      "processed_at": "2026-07-29T03:45:15.646562Z"
    },
    {
      "number": 148,
      "title": "Update document UI, tabular reviews, and storage caching",
      "url": "https://github.com/Open-Legal-Products/mike/pull/148",
      "merged_at": "2026-05-17T16:25:09Z",
      "merge_commit_sha": "d39f5806e5d6786706df21a9689dbd669433e100",
      "decision": "investigate",
      "reason": "Large mixed backend/storage/schema and architecture-dependent UI change.",
      "processed_at": "2026-07-29T03:45:15.646564Z"
    },
    {
      "number": 171,
      "title": "Add courtlistener intergration, liquid glass redesign, UI improvements, version control, various fixes",
      "url": "https://github.com/Open-Legal-Products/mike/pull/171",
      "merged_at": "2026-06-08T17:48:41Z",
      "merge_commit_sha": "15c96b0dd4c34cfb96cc0f1c512dd16c34cf333f",
      "decision": "investigate",
      "reason": "Extremely large change spanning schemas, providers, dependencies, backend operations, data boundaries, and UI.",
      "processed_at": "2026-07-29T03:45:15.646565Z"
    },
    {
      "number": 172,
      "title": "feat: implement multi-factor authentication (MFA) setup and verification flow and data deletion and export",
      "url": "https://github.com/Open-Legal-Products/mike/pull/172",
      "merged_at": "2026-06-10T12:46:45Z",
      "merge_commit_sha": "a211b92f38fc8d680d2c053443f67573c0ad1cd7",
      "decision": "investigate",
      "reason": "Large MFA, authentication, privacy, data export, and deletion implementation.",
      "processed_at": "2026-07-29T03:45:15.646567Z"
    },
    {
      "number": 178,
      "title": "Refactor ProjectPageParts and ProjectPageHeader components",
      "url": "https://github.com/Open-Legal-Products/mike/pull/178",
      "merged_at": "2026-06-11T14:24:20Z",
      "merge_commit_sha": "8a2dc05181a1e81dd46bff6eb433e0de2d298e38",
      "decision": "investigate",
      "reason": "Large mixed refactor spanning schemas, backend operations, providers, data behavior, and UI.",
      "processed_at": "2026-07-29T03:45:15.646568Z"
    },
    {
      "number": 180,
      "title": "Modal, header, mobile display and workflow UI updates",
      "url": "https://github.com/Open-Legal-Products/mike/pull/180",
      "merged_at": "2026-06-11T14:44:35Z",
      "merge_commit_sha": "01dfcfe0d489f861a4653dff0a827bf50662d654",
      "decision": "investigate",
      "reason": "Large, architecture-dependent UI/workflow change spanning 34 files and backend production behavior.",
      "processed_at": "2026-07-29T04:29:51.511181Z"
    },
    {
      "number": 183,
      "title": "refactor: add table primitive and migrations by date; feat: add mcp connectors",
      "url": "https://github.com/Open-Legal-Products/mike/pull/183",
      "merged_at": "2026-06-15T09:45:32Z",
      "merge_commit_sha": "457d4a18a4a0a8b60f1a8bb03d33770b6cf9b90d",
      "decision": "investigate",
      "reason": "Large protected change involving migrations, schemas, authentication, provider keys, dependencies, APIs, and MCP connectors.",
      "processed_at": "2026-07-29T04:29:51.511200Z"
    },
    {
      "number": 147,
      "title": "docs: add security reporting guidance",
      "url": "https://github.com/Open-Legal-Products/mike/pull/147",
      "merged_at": "2026-06-26T19:01:04Z",
      "merge_commit_sha": "93f921be907f8339096e0c718febdd6971e70565",
      "decision": "skip",
      "reason": "Already implemented in CONTRIBUTING.md with the correct ROSS-specific private-reporting URL and upstream coordination guidance.",
      "processed_at": "2026-07-29T04:29:51.511204Z"
    },
    {
      "number": 206,
      "title": "Workflows UI excel ppt updates",
      "url": "https://github.com/Open-Legal-Products/mike/pull/206",
      "merged_at": "2026-07-08T10:30:54Z",
      "merge_commit_sha": "e32daad5a4c64a5561e04c53ee12411e3c5e7238",
      "decision": "investigate",
      "reason": "Very large change affecting authentication, migrations, schemas, dependencies, backend behavior, workflows, and frontend architecture.",
      "processed_at": "2026-07-29T04:29:51.511206Z"
    },
    {
      "number": 215,
      "title": "feat: add library and refresh shared table UI",
      "url": "https://github.com/Open-Legal-Products/mike/pull/215",
      "merged_at": "2026-07-16T12:09:55Z",
      "merge_commit_sha": "1d61634a37fd112ef57f746e204be48f3d22fea9",
      "decision": "investigate",
      "reason": "Large library feature crossing migrations, schema, backend APIs, data boundaries, and extensive frontend architecture.",
      "processed_at": "2026-07-29T04:29:51.511208Z"
    },
    {
      "number": 216,
      "title": "feat: refine liquid surfaces and document review panels",
      "url": "https://github.com/Open-Legal-Products/mike/pull/216",
      "merged_at": "2026-07-16T17:25:02Z",
      "merge_commit_sha": "81590ea13769b6429aa63f43012ad6edbf61a5e0",
      "decision": "investigate",
      "reason": "Architecture-dependent presentation refactor touching 27 files, exceeding the 20-file patch limit and relying on earlier upstream UI changes.",
      "processed_at": "2026-07-29T04:29:51.511211Z"
    },
    {
      "number": 218,
      "title": "docs: update readme",
      "url": "https://github.com/Open-Legal-Products/mike/pull/218",
      "merged_at": "2026-07-17T08:19:04Z",
      "merge_commit_sha": "0ed5050b21dade66feddc807d9fc5894bb147072",
      "decision": "skip",
      "reason": "Mike-specific branding and remote image are not portable; current ROSS README already has appropriate fork-specific wording and attribution.",
      "processed_at": "2026-07-29T04:29:51.511213Z"
    },
    {
      "number": 219,
      "title": "feat: refresh workflows and workflow editor UI",
      "url": "https://github.com/Open-Legal-Products/mike/pull/219",
      "merged_at": "2026-07-19T19:06:16Z",
      "merge_commit_sha": "dafac6b0a449a99c4280988e22feaf160eb6fbb9",
      "decision": "investigate",
      "reason": "Workflow behavior and generation changes include protected backend and script files and depend on upstream architecture.",
      "processed_at": "2026-07-29T04:29:51.511215Z"
    },
    {
      "number": 212,
      "title": "fix(db): add missing chat_messages.workflow column (user prompts dropped on reload)",
      "url": "https://github.com/Open-Legal-Products/mike/pull/212",
      "merged_at": "2026-07-21T04:49:07Z",
      "merge_commit_sha": "0843e2909acc584a28a8b2b493de1c92892af06a",
      "decision": "investigate",
      "reason": "Changes database schema and migrations, which are explicitly protected.",
      "processed_at": "2026-07-29T04:44:58.667836Z"
    },
    {
      "number": 228,
      "title": "[Testing 05] test: minimal vitest harness for backend and frontend",
      "url": "https://github.com/Open-Legal-Products/mike/pull/228",
      "merged_at": "2026-07-21T08:21:12Z",
      "merge_commit_sha": "8a34a6457fdf65570dffc1bb2fd674102696e6cf",
      "decision": "investigate",
      "reason": "Large test-harness change requiring dependency manifests and lockfiles.",
      "processed_at": "2026-07-29T04:44:58.667855Z"
    },
    {
      "number": 238,
      "title": "[Fix 01] Batch the directory modal's project fetch (N+1 getProject storm)",
      "url": "https://github.com/Open-Legal-Products/mike/pull/238",
      "merged_at": "2026-07-21T08:51:36Z",
      "merge_commit_sha": "eda088e1437b367fd66c642ba09bb06f2a7e40e5",
      "decision": "investigate",
      "reason": "Changes authenticated backend APIs, Supabase queries, data boundaries, and production request behavior.",
      "processed_at": "2026-07-29T04:44:58.667859Z"
    },
    {
      "number": 237,
      "title": "[Testing 09] test: unit-cover the highest-risk backend libs + raise the coverage ratchet",
      "url": "https://github.com/Open-Legal-Products/mike/pull/237",
      "merged_at": "2026-07-21T10:16:41Z",
      "merge_commit_sha": "948e9bdd4d98380adcdff7deb2a0e6b968e29dac",
      "decision": "investigate",
      "reason": "Very large test and dependency change covering access, storage, provider keys, and other protected areas.",
      "processed_at": "2026-07-29T04:44:58.667861Z"
    },
    {
      "number": 229,
      "title": "[Testing 06] test: unit tests for access control, storage, user API keys and chat doc resolution",
      "url": "https://github.com/Open-Legal-Products/mike/pull/229",
      "merged_at": "2026-07-21T10:16:42Z",
      "merge_commit_sha": "948e9bdd4d98380adcdff7deb2a0e6b968e29dac",
      "decision": "investigate",
      "reason": "Large test-harness and dependency change involving access control, storage, and provider keys.",
      "processed_at": "2026-07-29T04:44:58.667863Z"
    },
    {
      "number": 234,
      "title": "[Docs 02] docs: testing policy in CONTRIBUTING + PR template",
      "url": "https://github.com/Open-Legal-Products/mike/pull/234",
      "merged_at": "2026-07-21T14:16:02Z",
      "merge_commit_sha": "39dc609f9545b7b09ced5a9693a7bedb85d5dc3d",
      "decision": "skip",
      "reason": "ROSS already has stronger repository-specific testing and PR guidance in CONTRIBUTING.md; the remaining PR-template file is under prohibited .github.",
      "processed_at": "2026-07-29T04:44:58.667869Z"
    },
    {
      "number": 232,
      "title": "[CI 03] ci: build and test workflow for backend and frontend",
      "url": "https://github.com/Open-Legal-Products/mike/pull/232",
      "merged_at": "2026-07-22T08:07:57Z",
      "merge_commit_sha": "73b9cd16921d38b0d1f16004bbf6fb025686932a",
      "decision": "investigate",
      "reason": "CI and release-control workflow under .github is explicitly protected.",
      "processed_at": "2026-07-29T04:44:58.667871Z"
    },
    {
      "number": 235,
      "title": "[Lint 04] fix: burn down frontend eslint errors; make CI lint blocking",
      "url": "https://github.com/Open-Legal-Products/mike/pull/235",
      "merged_at": "2026-07-22T08:33:53Z",
      "merge_commit_sha": "7d2ba4b87ff50cabe0e7d2b0ec992f246477830d",
      "decision": "investigate",
      "reason": "Mixed architecture-dependent lint change includes .github CI controls and MFA-related code; automatic partial extraction is unsafe.",
      "processed_at": "2026-07-29T04:44:58.667873Z"
    },
    {
      "number": 230,
      "title": "[Testing 07] test: component and hook unit tests for the web app",
      "url": "https://github.com/Open-Legal-Products/mike/pull/230",
      "merged_at": "2026-07-22T08:59:39Z",
      "merge_commit_sha": "2ec89a7c52b1d479cb20abad9b85d6dfa7e09761",
      "decision": "investigate",
      "reason": "Oversized test change (23,219 lines) coupled to new dependencies, manifests, lockfiles, and test infrastructure.",
      "processed_at": "2026-07-29T05:02:17.300175Z"
    },
    {
      "number": 240,
      "title": "ci: guard against silently merge-corrupted lockfiles",
      "url": "https://github.com/Open-Legal-Products/mike/pull/240",
      "merged_at": "2026-07-23T10:27:52Z",
      "merge_commit_sha": "7460b065e5f159cee56e5fe335c184b9aa00d5ef",
      "decision": "skip",
      "reason": "ROSS already has equivalent repository-neutral lockfile merge protection in .gitattributes; the remaining CI change is protected.",
      "processed_at": "2026-07-29T05:02:17.300191Z"
    },
    {
      "number": 233,
      "title": "[Testing 08] test: route-level integration tests + real-Supabase auth/RLS suites",
      "url": "https://github.com/Open-Legal-Products/mike/pull/233",
      "merged_at": "2026-07-23T13:48:55Z",
      "merge_commit_sha": "c0ff4404b34f76d2a36a10280f50596a53ad51e9",
      "decision": "investigate",
      "reason": "Large integration-test change involving authentication, RLS, schemas, Supabase, backend behavior, manifests, and lockfiles.",
      "processed_at": "2026-07-29T05:02:17.300196Z"
    },
    {
      "number": 220,
      "title": "[Testing 12] test: Playwright e2e suite + CI merge gate (auth, chat, projects, tabular, workflows)",
      "url": "https://github.com/Open-Legal-Products/mike/pull/220",
      "merged_at": "2026-07-25T16:16:20Z",
      "merge_commit_sha": "dad4b9d21a27d356a1f1230de919f6bd69e9994b",
      "decision": "investigate",
      "reason": "Oversized E2E suite spanning authentication, MFA, CI, dependencies, lockfiles, scripts, and application configuration.",
      "processed_at": "2026-07-29T05:02:17.300198Z"
    },
    {
      "number": 258,
      "title": "chore(backend): sync bun.lock with vitest/supertest devDeps",
      "url": "https://github.com/Open-Legal-Products/mike/pull/258",
      "merged_at": "2026-07-25T16:36:24Z",
      "merge_commit_sha": "154051ae4498750247d5c9be053bab2b630362a3",
      "decision": "investigate",
      "reason": "Lockfile and dependency synchronization is explicitly excluded from automatic inclusion.",
      "processed_at": "2026-07-29T05:02:17.300201Z"
    },
    {
      "number": 236,
      "title": "[Docs 13] docs(e2e): exact ANTHROPIC_API_KEY setup to enable the 4 LLM-gated specs",
      "url": "https://github.com/Open-Legal-Products/mike/pull/236",
      "merged_at": "2026-07-25T16:49:58Z",
      "merge_commit_sha": "9b42994a7feb6bd53cbb060292d0a92ea05f03e2",
      "decision": "investigate",
      "reason": "Architecture-dependent E2E/CI changes involving provider keys, secrets configuration, models, and protected workflow files.",
      "processed_at": "2026-07-29T05:02:17.300203Z"
    },
    {
      "number": 186,
      "title": "[codex] Remove unused Supabase request auth helper",
      "url": "https://github.com/Open-Legal-Products/mike/pull/186",
      "merged_at": "2026-07-25T17:49:54Z",
      "merge_commit_sha": "416b32b17fc33c7e65044677db5c3a2ad29fb592",
      "decision": "investigate",
      "reason": "Although framed as dead-code cleanup, it modifies authentication and Supabase code plus related integration mocks.",
      "processed_at": "2026-07-29T05:02:17.300205Z"
    },
    {
      "number": 193,
      "title": "Restrict project folder deletion to owners",
      "url": "https://github.com/Open-Legal-Products/mike/pull/193",
      "merged_at": "2026-07-26T10:21:51Z",
      "merge_commit_sha": "4d1b792d6810eb1dd072e789874c9ea6422fd8ac",
      "decision": "investigate",
      "reason": "Changes authorization behavior for project-folder deletion and therefore requires dedicated security review.",
      "processed_at": "2026-07-29T05:02:17.300207Z"
    },
    {
      "number": 175,
      "title": "Require review owner for tabular settings edits",
      "url": "https://github.com/Open-Legal-Products/mike/pull/175",
      "merged_at": "2026-07-26T17:51:06Z",
      "merge_commit_sha": "a3ab1b38956e92659566d0ba9c7270ace3f73bdc",
      "decision": "investigate",
      "reason": "Changes backend authorization for review title and document membership. This protected, security-sensitive behavior requires ROSS-specific authorization and threat analysis.",
      "processed_at": "2026-07-29T05:06:58.577327Z"
    },
    {
      "number": 270,
      "title": "Discover workflow packs from YAML manifests",
      "url": "https://github.com/Open-Legal-Products/mike/pull/270",
      "merged_at": "2026-07-27T16:34:42Z",
      "merge_commit_sha": "e89d3230db40193c540a6b38d8f301ae76377a1a",
      "decision": "skip",
      "reason": "Non-portable and already documented as architecturally incompatible: ROSS discovers governed workflows directly from system SKILL.md files, not pack.yaml directories.",
      "processed_at": "2026-07-29T05:06:58.577345Z"
    },
    {
      "number": 263,
      "title": "Db pagination for tabular reviews",
      "url": "https://github.com/Open-Legal-Products/mike/pull/263",
      "merged_at": "2026-07-30T17:58:46Z",
      "merge_commit_sha": "469478b18c9dd61259f9287fbbbc5a6ae9c8bcc2",
      "decision": "investigate",
      "reason": "Large, architecture-dependent database pagination change spanning migrations, schema, Supabase integration, backend behavior, APIs, and frontend state. It exceeds the automatic-adoption limits and touches protected areas.",
      "processed_at": "2026-07-30T20:51:01.868434Z"
    },
    {
      "number": 276,
      "title": "fix(frontend): require public env vars at build time",
      "url": "https://github.com/Open-Legal-Products/mike/pull/276",
      "merged_at": "2026-07-31T08:17:37Z",
      "merge_commit_sha": "14de15093f16c0dac013c43e71892c1d89fac12b",
      "decision": "investigate",
      "reason": "Changes required build-time environment validation and documentation involving Supabase/provider configuration and production build behavior—explicitly protected areas. The proposed Next.js configuration also does not account for ROSS’s existing security and standalone-build architecture.",
      "processed_at": "2026-07-31T09:08:20.775321Z"
    },
    {
      "number": 242,
      "title": "[Security 1/9] SSRF guardrails for server-side connector fetches",
      "url": "https://github.com/Open-Legal-Products/mike/pull/242",
      "merged_at": "2026-08-02T16:28:00Z",
      "merge_commit_sha": "57bd8776a898f0556ebe9810ed6a37814cb32980",
      "decision": "investigate",
      "reason": "Security, SSRF, OAuth egress, dependencies, and backend production behavior are protected areas. ROSS also has a divergent MCP implementation requiring security review.",
      "processed_at": "2026-08-04T20:07:31.007189Z"
    },
    {
      "number": 245,
      "title": "[Security 3/9] Production CORS allowlist with fail-safe denial",
      "url": "https://github.com/Open-Legal-Products/mike/pull/245",
      "merged_at": "2026-08-02T17:26:52Z",
      "merge_commit_sha": "961457c70bd44850f8d22d96e4a32f97c4759bdf",
      "decision": "skip",
      "reason": "ROSS already implements a stricter runtime-configured CORS allowlist and explicit denial middleware; the upstream implementation is superseded.",
      "processed_at": "2026-08-04T20:07:31.007212Z"
    },
    {
      "number": 273,
      "title": "Remove dead jsonLimitForPath abstraction",
      "url": "https://github.com/Open-Legal-Products/mike/pull/273",
      "merged_at": "2026-08-02T19:07:07Z",
      "merge_commit_sha": "133ecb3f6af528ac699948e7d00a5cc4747e9d11",
      "decision": "investigate",
      "reason": "The dead abstraction still exists in ROSS, but changing request-body parsing affects backend production behavior and backend/src is excluded from the patch.",
      "processed_at": "2026-08-04T20:07:31.007217Z"
    },
    {
      "number": 253,
      "title": "[Testing 17] test(backend): document-integrity unit tests + ratchet raise",
      "url": "https://github.com/Open-Legal-Products/mike/pull/253",
      "merged_at": "2026-08-02T19:08:19Z",
      "merge_commit_sha": "7d1ea6f9b0900e4b860b74296f33b8aaef9815c0",
      "decision": "investigate",
      "reason": "The backend tests may be useful, but they require backend/src and test-configuration changes and depend on Mike-specific coverage assumptions.",
      "processed_at": "2026-08-04T20:07:31.007221Z"
    },
    {
      "number": 255,
      "title": "[Testing 18] test(frontend): API-client/SSE tests + coverage ratchet",
      "url": "https://github.com/Open-Legal-Products/mike/pull/255",
      "merged_at": "2026-08-02T19:09:33Z",
      "merge_commit_sha": "2266446b0d26f735865b8cd3bb153b28e7d11b17",
      "decision": "investigate",
      "reason": "The bundle mechanically flags this 1,354-line change as too large; it also includes CI, dependencies, a lockfile, configuration, and API/SSE behavior tests.",
      "processed_at": "2026-08-04T20:07:31.007224Z"
    },
    {
      "number": 279,
      "title": "feat: content hashes on document versions + signed project export manifest",
      "url": "https://github.com/Open-Legal-Products/mike/pull/279",
      "merged_at": "2026-08-03T07:12:25Z",
      "merge_commit_sha": "25833cb71fe72eaf39f1af8b9dd5fa734b39ae1d",
      "decision": "investigate",
      "reason": "Large cryptographic and data-integrity change spanning schemas, migrations, environment configuration, exports, public endpoints, and backend production behavior.",
      "processed_at": "2026-08-04T20:07:31.007228Z"
    },
    {
      "number": 280,
      "title": "feat: add workflow slash triggers",
      "url": "https://github.com/Open-Legal-Products/mike/pull/280",
      "merged_at": "2026-08-03T08:26:09Z",
      "merge_commit_sha": "afe163a3f0152d61204d7792464192dec595cb25",
      "decision": "investigate",
      "reason": "The UI portion depends on new backend workflow behavior, shared types, README claims, and build scripts; it is an architecture-dependent feature rather than presentation-only UI.",
      "processed_at": "2026-08-04T20:07:31.007231Z"
    },
    {
      "number": 246,
      "title": "[Security 19] security posture: SECURITY.md, CodeQL, secret scan, Scorecard",
      "url": "https://github.com/Open-Legal-Products/mike/pull/246",
      "merged_at": "2026-08-03T08:28:25Z",
      "merge_commit_sha": "3775d534c3a62db2808b8820a4ad9dd5cfaf1d63",
      "decision": "skip",
      "reason": "ROSS already has a ROSS-specific security policy and extensive controlled workflows. Mike-specific hosted-service, release, secret-scanning, and governance changes are protected and non-portable.",
      "processed_at": "2026-08-04T20:07:31.007234Z"
    },
    {
      "number": 274,
      "title": "feat: add folder-grouped tabular review rows",
      "url": "https://github.com/Open-Legal-Products/mike/pull/274",
      "merged_at": "2026-08-03T12:50:47Z",
      "merge_commit_sha": "5f78bb22c7ff69c348d7eab41ec7fcad8d61ede3",
      "decision": "investigate",
      "reason": "Large, architecture-dependent feature spanning migrations, schemas, backend behavior, APIs, and UI; exceeds automatic-adoption limits.",
      "processed_at": "2026-08-04T21:16:34.954101Z"
    },
    {
      "number": 281,
      "title": "test(frontend): fix the red main — pay down the coverage regression from #274/#263/#280",
      "url": "https://github.com/Open-Legal-Products/mike/pull/281",
      "merged_at": "2026-08-03T13:47:07Z",
      "merge_commit_sha": "c6aa6bea677aed13ab8b4057d9e80fbce7a55822",
      "decision": "skip",
      "reason": "Tests target upstream tabular-review, Supabase, and API behavior absent or divergent in ROSS; ROSS also lacks the referenced Vitest setup.",
      "processed_at": "2026-08-04T21:16:34.954115Z"
    },
    {
      "number": 248,
      "title": "[Security 5/9] Nonce-based spotlighting of untrusted content in prompts",
      "url": "https://github.com/Open-Legal-Products/mike/pull/248",
      "merged_at": "2026-08-03T14:21:06Z",
      "merge_commit_sha": "20c0ed2676b674b75fe8a6ee996bc6dd132b5e06",
      "decision": "investigate",
      "reason": "Security-sensitive prompt-injection mitigation affecting backend request and tool execution paths; prohibited from automatic inclusion.",
      "processed_at": "2026-08-04T21:16:34.954121Z"
    },
    {
      "number": 282,
      "title": "Self-hosted Docker stack (embedded Supabase + storage + email) and local Ollama models (supersedes #196)",
      "url": "https://github.com/Open-Legal-Products/mike/pull/282",
      "merged_at": "2026-08-04T03:26:29Z",
      "merge_commit_sha": "fc69119220a2f8a93b39a723ddefd2bd8dedaad1",
      "decision": "investigate",
      "reason": "Large infrastructure and deployment change involving Docker, embedded Supabase, storage, provider models, environment configuration, and APIs.",
      "processed_at": "2026-08-04T21:16:34.954124Z"
    },
    {
      "number": 284,
      "title": "test(frontend): lower branch coverage floor to 80%",
      "url": "https://github.com/Open-Legal-Products/mike/pull/284",
      "merged_at": "2026-08-04T04:13:50Z",
      "merge_commit_sha": "33073c43b4f6eef6c55ba228a7447ac787461b42",
      "decision": "skip",
      "reason": "The referenced Vitest coverage configuration is absent in ROSS, and lowering an upstream-specific coverage threshold is non-portable.",
      "processed_at": "2026-08-04T21:16:34.954126Z"
    },
    {
      "number": 174,
      "title": "Confirm destructive folder deletes in chat explorer",
      "url": "https://github.com/Open-Legal-Products/mike/pull/174",
      "merged_at": "2026-08-04T04:19:54Z",
      "merge_commit_sha": "b44cec7542f1d70b08cbf4b8ba5a419c3c14a372",
      "decision": "investigate",
      "reason": "Changes destructive deletion behavior and depends on upstream explorer architecture; requires deliberate behavioral review despite its UI elements.",
      "processed_at": "2026-08-04T21:16:34.954129Z"
    },
    {
      "number": 283,
      "title": "fix: validate project chat request bodies before side effects",
      "url": "https://github.com/Open-Legal-Products/mike/pull/283",
      "merged_at": "2026-08-04T06:59:56Z",
      "merge_commit_sha": "ba979eea2e5da42339b10e4ecb5fcc2d1b75dc28",
      "decision": "investigate",
      "reason": "Backend request validation changes public request handling, side effects, and data boundaries; protected operational behavior.",
      "processed_at": "2026-08-04T21:16:34.954131Z"
    },
    {
      "number": 287,
      "title": "Default local signup to autoconfirm and streamline setup docs",
      "url": "https://github.com/Open-Legal-Products/mike/pull/287",
      "merged_at": "2026-08-04T08:29:03Z",
      "merge_commit_sha": "1ff6e7f1d2f46e87d035619719a9c41a6c33d896",
      "decision": "investigate",
      "reason": "Intertwines documentation with authentication defaults, environment settings, Supabase, deployment, provider keys, and cryptographic export guidance.",
      "processed_at": "2026-08-04T21:16:34.954133Z"
    },
    {
      "number": 289,
      "title": "docs: simplify Docker quick start",
      "url": "https://github.com/Open-Legal-Products/mike/pull/289",
      "merged_at": "2026-08-04T09:35:07Z",
      "merge_commit_sha": "7219da42d253902bd8e2a67533d574b27113307f",
      "decision": "investigate",
      "reason": "Documentation-only, but it changes instructions involving secrets, provider keys, Supabase, object storage, and Docker operational setup. ROSS also uses a different environment-file architecture.",
      "processed_at": "2026-08-04T21:21:24.430853Z"
    },
    {
      "number": 249,
      "title": "[Security 6/9] Server-side citation verification against source text",
      "url": "https://github.com/Open-Legal-Products/mike/pull/249",
      "merged_at": "2026-08-04T11:24:49Z",
      "merge_commit_sha": "8313af19b98ebfb6609ce97aa1962ef094db7b05",
      "decision": "investigate",
      "reason": "Large security-sensitive change affecting backend citation verification, data boundaries, shared types, and frontend behavior; it exceeds the mechanical gate and requires architectural review.",
      "processed_at": "2026-08-04T21:21:24.430873Z"
    },
    {
      "number": 256,
      "title": "[Testing 16] ci: run the RLS/stack integration suite on every PR",
      "url": "https://github.com/Open-Legal-Products/mike/pull/256",
      "merged_at": "2026-08-06T07:26:17.000Z",
      "merge_commit_sha": "1b00314d9f09d37f3fcdc7bed4c236e2e7dcbcac",
      "decision": "investigate",
      "outcome": "needs-decision",
      "status": "needs-decision",
      "risk": "none",
      "capability": "Supabase stack security CI",
      "series_id": "testing-16-stack-ci",
      "dependencies": [],
      "prerequisites": [
        "Security and architecture approval",
        "ROSS-native Supabase/RLS integration harness",
        "Approved schema bootstrap strategy"
      ],
      "reason": "Useful security validation, but it changes CI infrastructure and exercises RLS, schemas, and migrations; those boundaries require human approval.",
      "architecture_brief": null,
      "implementation_plan": [],
      "next_review_at": null,
      "processed_at": "2026-08-07T21:42:12.218Z"
    },
    {
      "number": 243,
      "title": "[Testing 20] test(e2e): accessibility scans + nightly run (stacked on #220)",
      "url": "https://github.com/Open-Legal-Products/mike/pull/243",
      "merged_at": "2026-08-06T07:35:10.000Z",
      "merge_commit_sha": "b0ee67e4d5f309d0ca1aa46c7323ba72091f1ca2",
      "decision": "adapt",
      "outcome": "adapted",
      "status": "terminal",
      "risk": "none",
      "capability": "Accessible control names",
      "series_id": "testing-20-accessibility",
      "dependencies": [
        "#220"
      ],
      "prerequisites": [],
      "reason": "ROSS has the same three unlabeled controls. Adopt only presentation-neutral aria-labels; exclude the new dependency, lockfile, nightly CI, and Mike-specific E2E documentation.",
      "architecture_brief": null,
      "implementation_plan": [],
      "next_review_at": null,
      "processed_at": "2026-08-07T21:42:12.218Z"
    },
    {
      "number": 291,
      "title": "test(frontend): cover every lib wrapper and restore the coverage ratchet",
      "url": "https://github.com/Open-Legal-Products/mike/pull/291",
      "merged_at": "2026-08-06T10:58:49.000Z",
      "merge_commit_sha": "9179dd2b77e16dc61be0a2dd80d8be3bbe4b17d2",
      "decision": "investigate",
      "outcome": "needs-test-harness",
      "status": "retryable",
      "risk": "none",
      "capability": "Frontend wrapper coverage ratchet",
      "series_id": "frontend-lib-coverage",
      "dependencies": [],
      "prerequisites": [
        "ROSS-native frontend unit-test and coverage harness",
        "Focused mapping of tests to ROSS-specific API wrappers"
      ],
      "reason": "The tests may be useful, but ROSS has no frontend Vitest configuration and its API wrappers materially diverge from Mike’s routes and provider assumptions.",
      "architecture_brief": null,
      "implementation_plan": [],
      "next_review_at": null,
      "processed_at": "2026-08-07T21:42:12.218Z"
    },
    {
      "number": 221,
      "title": "[Feature 14] feat: Word add-in — chat, tracked-changes rewrites, workflows and projects in Word",
      "url": "https://github.com/Open-Legal-Products/mike/pull/221",
      "merged_at": "2026-08-06T13:25:49.000Z",
      "merge_commit_sha": "c059e6ce487e1f344ed7a3a8a4eb67e985003fe4",
      "decision": "investigate",
      "outcome": "needs-decision",
      "status": "needs-decision",
      "risk": "none",
      "capability": "Microsoft Word add-in",
      "series_id": "word-addin",
      "dependencies": [],
      "prerequisites": [
        "Product and architecture decision",
        "Security, privacy, authentication, and data-boundary review",
        "Public API and deployment design",
        "Complete bounded patch evidence"
      ],
      "reason": "This is a large new client surface involving authentication, document data, public APIs, dependencies, and deployment; its patch was also omitted by the observation bound.",
      "architecture_brief": null,
      "implementation_plan": [],
      "next_review_at": null,
      "processed_at": "2026-08-07T21:42:12.218Z"
    },
    {
      "number": 296,
      "title": "Fix Word add-in semver dependency",
      "url": "https://github.com/Open-Legal-Products/mike/pull/296",
      "merged_at": "2026-08-06T15:52:59.000Z",
      "merge_commit_sha": "204d2d533a075c74fc69f8b283c70fb4e94ec104",
      "decision": "skip",
      "outcome": "deferred",
      "status": "terminal",
      "risk": "none",
      "capability": "Word add-in semver declaration",
      "series_id": "word-addin",
      "dependencies": [
        "#221"
      ],
      "prerequisites": [
        "Approved and present Word add-in architecture",
        "Dependency and lockfile review"
      ],
      "reason": "ROSS has no Word add-in, and dependency or lockfile changes are ineligible; reconsider only if #221 is separately approved and implemented.",
      "architecture_brief": null,
      "implementation_plan": [],
      "next_review_at": null,
      "processed_at": "2026-08-07T21:42:12.218Z"
    },
    {
      "number": 308,
      "title": "Pagination Part 2",
      "url": "https://github.com/Open-Legal-Products/mike/pull/308",
      "merged_at": "2026-08-12T09:50:34.000Z",
      "merge_commit_sha": "26f4597b2120a00daf00594df161308cb8c5093c",
      "decision": "investigate",
      "outcome": "needs-decision",
      "status": "needs-decision",
      "risk": "none",
      "capability": "collection-pagination-v2",
      "series_id": "pagination-v2",
      "dependencies": [],
      "prerequisites": [
        "ROSS-native pagination architecture review",
        "Schema, API, authorization, and data-boundary review",
        "Complete bounded patch evidence"
      ],
      "reason": "Potentially useful at ROSS scale, but evidence is metadata-only and the capability changes schemas, migrations, APIs, and data access controls.",
      "architecture_brief": null,
      "implementation_plan": [],
      "next_review_at": null,
      "processed_at": "2026-08-12T17:45:16.027Z"
    },
    {
      "number": 311,
      "title": "fix(word-addin): WKWebView completion scroll jump + streaming performance (stacked on #299)",
      "url": "https://github.com/Open-Legal-Products/mike/pull/311",
      "merged_at": "2026-08-12T10:03:13.000Z",
      "merge_commit_sha": "7fd0f92741cd8be618915a2b6279bc1fbde7fc99",
      "decision": "skip",
      "outcome": "incompatible",
      "status": "terminal",
      "risk": "none",
      "capability": "word-chat-scroll-stability",
      "series_id": "word-addin-chat-299",
      "dependencies": [
        "Mike PR #299"
      ],
      "prerequisites": [
        "ROSS Word add-in surface",
        "Upstream series dependency #299"
      ],
      "reason": "ROSS has web-assistant chat seams but no matching Word add-in surface; transplanting WebKit-specific behavior would not be a complete ROSS-native capability.",
      "architecture_brief": null,
      "implementation_plan": [],
      "next_review_at": null,
      "processed_at": "2026-08-12T17:45:16.027Z"
    },
    {
      "number": 271,
      "title": "feature: add workspace history of actions (History page + audit_events)",
      "url": "https://github.com/Open-Legal-Products/mike/pull/271",
      "merged_at": "2026-08-12T16:37:29.000Z",
      "merge_commit_sha": "53cb54e8070e96b7febb4d446610ea574a59b6ed",
      "decision": "investigate",
      "outcome": "needs-decision",
      "status": "needs-decision",
      "risk": "none",
      "capability": "workspace-action-history",
      "series_id": "workspace-audit-history",
      "dependencies": [],
      "prerequisites": [
        "Governance and audit-retention decision",
        "Privacy/export/deletion policy review",
        "Authorization and shared-project visibility review",
        "ROSS-native schema and migration design"
      ],
      "reason": "An action-history capability may be valuable, but it materially changes governance, privacy, authorization, schemas, exports, and data retention.",
      "architecture_brief": null,
      "implementation_plan": [],
      "next_review_at": null,
      "processed_at": "2026-08-12T17:45:16.027Z"
    },
    {
      "number": 254,
      "title": "[Testing 21] test depth: mutation testing + SSE load harness (on-demand)",
      "url": "https://github.com/Open-Legal-Products/mike/pull/254",
      "merged_at": "2026-08-12T16:51:01.000Z",
      "merge_commit_sha": "9df42324a1369e5c08e3867497f36d1a88e5aa80",
      "decision": "investigate",
      "outcome": "needs-test-harness",
      "status": "retryable",
      "risk": "none",
      "capability": "mutation-and-sse-depth-testing",
      "series_id": "testing-21",
      "dependencies": [
        "Mike PR #210"
      ],
      "prerequisites": [
        "Isolated synthetic/non-confidential test environment",
        "ROSS-specific mutation scope and thresholds",
        "Approved staging load-test target and credentials handling",
        "Bounded evaluation of runtime cost and false positives"
      ],
      "reason": "The testing capability is useful, but it introduces dependencies and CI/load infrastructure and requires a safe ROSS-specific evaluation harness before adoption.",
      "architecture_brief": null,
      "implementation_plan": [],
      "next_review_at": null,
      "processed_at": "2026-08-12T17:45:16.027Z"
    },
    {
      "number": 293,
      "title": "[Testing 17] ci: schema-drift check — fresh install vs upgraded deployment must converge",
      "url": "https://github.com/Open-Legal-Products/mike/pull/293",
      "merged_at": "2026-08-12T18:15:09.000Z",
      "merge_commit_sha": "1af9231040d5692a83e32440d11e118b80bd243d",
      "decision": "investigate",
      "outcome": "needs-decision",
      "status": "needs-decision",
      "risk": "none",
      "capability": "schema-path-convergence",
      "series_id": "testing-schema-convergence",
      "dependencies": [
        "Mike PR #256"
      ],
      "prerequisites": [
        "Security and architecture approval",
        "ROSS-native Supabase/RLS integration harness",
        "Approved schema-baseline and migration strategy"
      ],
      "reason": "Useful drift detection, but it changes CI, schemas, migrations, grants, and Supabase security validation—all protected boundaries.",
      "architecture_brief": null,
      "implementation_plan": [],
      "next_review_at": null,
      "processed_at": "2026-08-14T17:36:31.479Z"
    },
    {
      "number": 320,
      "title": "fix(word-addin): review fixes for #299 — WebKit e2e gate, streaming perf, and correctness edges",
      "url": "https://github.com/Open-Legal-Products/mike/pull/320",
      "merged_at": "2026-08-12T19:33:00.000Z",
      "merge_commit_sha": "d6b13153ccafdff0baa0d9d8e568e2ab58b5339f",
      "decision": "skip",
      "outcome": "incompatible",
      "status": "terminal",
      "risk": "none",
      "capability": "word-addin-review-hardening",
      "series_id": "word-addin-chat-299",
      "dependencies": [
        "Mike PR #299"
      ],
      "prerequisites": [
        "Approved ROSS Word add-in architecture",
        "Implemented Mike PR #299-equivalent capability"
      ],
      "reason": "ROSS has no Word add-in surface; the WebKit, Office identity, streaming, and modal fixes cannot form a complete native capability independently of #299.",
      "architecture_brief": null,
      "implementation_plan": [],
      "next_review_at": null,
      "processed_at": "2026-08-14T17:36:31.479Z"
    },
    {
      "number": 317,
      "title": "Refactor settings and enable local MFA",
      "url": "https://github.com/Open-Legal-Products/mike/pull/317",
      "merged_at": "2026-08-13T08:23:20.000Z",
      "merge_commit_sha": "7ec5a8657ad12affb20ffd6a200d94f3abe689ec",
      "decision": "investigate",
      "outcome": "needs-decision",
      "status": "needs-decision",
      "risk": "none",
      "capability": "settings-and-local-mfa",
      "series_id": "settings-security",
      "dependencies": [],
      "prerequisites": [
        "Authentication and MFA security review",
        "Product decision on Account-to-Settings migration",
        "Legal-quality review of prompt changes",
        "Deployment configuration review"
      ],
      "reason": "The settings presentation work is inseparable from MFA, authentication, provider-key, prompt, and deployment behavior requiring human judgment.",
      "architecture_brief": null,
      "implementation_plan": [],
      "next_review_at": null,
      "processed_at": "2026-08-14T17:36:31.479Z"
    },
    {
      "number": 299,
      "title": "feat(word-addin): align chat UI with web app",
      "url": "https://github.com/Open-Legal-Products/mike/pull/299",
      "merged_at": "2026-08-13T09:46:08.000Z",
      "merge_commit_sha": "7d5c065307beac4109df889ac61ff3944f6e7d4c",
      "decision": "investigate",
      "outcome": "needs-decision",
      "status": "needs-decision",
      "risk": "none",
      "capability": "word-addin-chat-workspace",
      "series_id": "word-addin-chat-299",
      "dependencies": [
        "Mike PR #221"
      ],
      "prerequisites": [
        "Product and architecture approval for a ROSS Word add-in",
        "Security, privacy, authentication, and data-boundary review",
        "Public API, schema, dependency, and deployment design",
        "ROSS-specific Ontario and beta-boundary UX review"
      ],
      "reason": "This expands a previously undecided Word add-in into persistent chat and document workflows across protected APIs, schemas, dependencies, and data boundaries.",
      "architecture_brief": null,
      "implementation_plan": [],
      "next_review_at": null,
      "processed_at": "2026-08-14T17:36:31.479Z"
    },
    {
      "number": 329,
      "title": "fix(workflows): review fixes — chat-path crash, catalog rewrite, silent UI failures",
      "url": "https://github.com/Open-Legal-Products/mike/pull/329",
      "merged_at": "2026-08-13T13:11:56.000Z",
      "merge_commit_sha": "b03d6ec62751cf8f6d970969b948e52113d54550",
      "decision": "investigate",
      "outcome": "retryable",
      "status": "retryable",
      "risk": "none",
      "capability": "workflow-restructure-hardening",
      "series_id": "workflow-restructure-309",
      "dependencies": [
        "Mike PR #309",
        "Mike PR #299"
      ],
      "prerequisites": [
        "Decision and implementation for the #309 workflow model",
        "Approved workflow provenance and catalog policy",
        "ROSS-native focused workflow/add-in test harness"
      ],
      "reason": "The fixes may be valuable, but they target the unimplemented #309 architecture and cannot be evaluated independently; retry after its product and governance decisions.",
      "architecture_brief": null,
      "implementation_plan": [],
      "next_review_at": "2026-08-28T00:00:00.000Z",
      "processed_at": "2026-08-14T17:36:31.479Z"
    },
    {
      "number": 309,
      "title": "feat(workflows): restructure workflows and quick actions",
      "url": "https://github.com/Open-Legal-Products/mike/pull/309",
      "merged_at": "2026-08-13T13:49:20.000Z",
      "merge_commit_sha": "3382734de884b763630b4670764e0f246d48469f",
      "decision": "investigate",
      "outcome": "needs-decision",
      "status": "needs-decision",
      "risk": "none",
      "capability": "editable-workflow-catalog",
      "series_id": "workflow-restructure-309",
      "dependencies": [
        "Mike PR #299"
      ],
      "prerequisites": [
        "Product decision on defaults and quick actions",
        "Governance decision on reviewed-source attribution and provenance",
        "Schema, authorization, storage, API, and data-boundary review",
        "Ontario-specific workflow catalog evaluation"
      ],
      "reason": "The redesign changes schemas, APIs, storage, defaults, and provenance; removing provenance tracking conflicts with ROSS reviewed-source governance unless explicitly approved.",
      "architecture_brief": null,
      "implementation_plan": [],
      "next_review_at": null,
      "processed_at": "2026-08-14T17:36:31.479Z"
    },
    {
      "number": 332,
      "title": "fix(db): enforce auth user foreign keys",
      "url": "https://github.com/Open-Legal-Products/mike/pull/332",
      "merged_at": "2026-08-13T16:24:15.000Z",
      "merge_commit_sha": "867f735e92a9965000d98b34c1d2d453867877cc",
      "decision": "investigate",
      "outcome": "needs-decision",
      "status": "needs-decision",
      "risk": "none",
      "capability": "auth-user-referential-integrity",
      "series_id": "database-identity-integrity",
      "dependencies": [
        "Mike PR #293"
      ],
      "prerequisites": [
        "Schema and migration review",
        "Authentication and deletion-semantics review",
        "ROSS-native upgrade and rollback validation",
        "Backup and production rollout plan"
      ],
      "reason": "Referential integrity is useful, but converting identity columns and introducing cascading deletion materially affects schemas, authentication, retention, and production data.",
      "architecture_brief": null,
      "implementation_plan": [],
      "next_review_at": null,
      "processed_at": "2026-08-14T17:36:31.479Z"
    },
    {
      "number": 333,
      "title": "fix: make project sharing email matching case-insensitive",
      "url": "https://github.com/Open-Legal-Products/mike/pull/333",
      "merged_at": "2026-08-13T16:59:55.000Z",
      "merge_commit_sha": "e335bfabd078a304e1b7f7f854479a70028be4c4",
      "decision": "investigate",
      "outcome": "needs-decision",
      "status": "needs-decision",
      "risk": "none",
      "capability": "case-insensitive-project-sharing",
      "series_id": "project-sharing-authorization",
      "dependencies": [],
      "prerequisites": [
        "Authorization and data-boundary review",
        "Migration and legacy-data review",
        "Focused ROSS sharing regression harness"
      ],
      "reason": "ROSS already lowercases new invitations and some access checks, but legacy normalization and remaining query consistency alter authorization and production data.",
      "architecture_brief": null,
      "implementation_plan": [],
      "next_review_at": null,
      "processed_at": "2026-08-14T17:36:31.479Z"
    },
    {
      "number": 334,
      "title": "fix: log storage errors and reuse Supabase admin client",
      "url": "https://github.com/Open-Legal-Products/mike/pull/334",
      "merged_at": "2026-08-13T17:35:35.000Z",
      "merge_commit_sha": "8c678e65b8d410f22faf8f95ea0e201a664e2d9b",
      "decision": "investigate",
      "outcome": "needs-decision",
      "status": "needs-decision",
      "risk": "none",
      "capability": "admin-client-storage-hardening",
      "series_id": null,
      "dependencies": [],
      "prerequisites": [
        "Security and architecture review of shared service-role client lifecycle",
        "Privacy review of logging storage object keys",
        "Authentication and MFA regression evaluation"
      ],
      "reason": "Potentially useful hardening, but it changes authentication/MFA and privileged Supabase-client behavior and logs storage identifiers; these require human security, privacy, and architecture decisions.",
      "architecture_brief": null,
      "implementation_plan": [],
      "next_review_at": null,
      "processed_at": "2026-08-15T14:58:17.842Z"
    },
    {
      "number": 342,
      "title": "feat: refine quick actions and directory navigation",
      "url": "https://github.com/Open-Legal-Products/mike/pull/342",
      "merged_at": "2026-08-15T17:53:46.000Z",
      "merge_commit_sha": "d79c9a4261e479e8df50ee51932c1c6312a108ff",
      "decision": "investigate",
      "outcome": "needs-decision",
      "status": "needs-decision",
      "risk": "none",
      "capability": "assistant-quick-actions-directory-navigation",
      "series_id": "quick-actions-navigation",
      "dependencies": [],
      "prerequisites": [
        "complete bounded patch evidence",
        "ROSS architecture and product review",
        "security, privacy, legal-source, and data-boundary review"
      ],
      "reason": "Metadata describes useful navigation and quick-action capabilities, but the omitted 100-file patch mixes them with schemas, migrations, authentication-adjacent routes, APIs, and data operations that require human judgment and cannot be reconstructed safely.",
      "architecture_brief": null,
      "implementation_plan": [],
      "next_review_at": null,
      "processed_at": "2026-08-16T14:36:55.944Z"
    },
    {
      "number": 343,
      "title": "refactor: make frontend icons canonical",
      "url": "https://github.com/Open-Legal-Products/mike/pull/343",
      "merged_at": "2026-08-15T19:03:38.000Z",
      "merge_commit_sha": "a6ec11386b41d5476b1116f15af7e36c847190ed",
      "decision": "skip",
      "outcome": "incompatible",
      "status": "terminal",
      "risk": "none",
      "capability": "frontend-canonical-shared-icons",
      "series_id": "quick-actions-navigation",
      "dependencies": [
        "#342"
      ],
      "prerequisites": [],
      "reason": "This refactor depends on the shared icon/add-in structure introduced by #342. Current ROSS has neither that shared icon package nor the Word add-in consumer, and its frontend assets are ROSS-specific, so the capability has no applicable native seam.",
      "architecture_brief": null,
      "implementation_plan": [],
      "next_review_at": null,
      "processed_at": "2026-08-16T14:36:55.944Z"
    },
    {
      "number": 345,
      "title": "Normalize assistant sources and unify frontend and Word UI",
      "url": "https://github.com/Open-Legal-Products/mike/pull/345",
      "merged_at": "2026-08-17T03:12:52.000Z",
      "merge_commit_sha": "c0ef3e3b08648fe9293d9c4cc7dc8c21de0a6bbf",
      "decision": "investigate",
      "outcome": "retryable",
      "status": "retryable",
      "risk": "none",
      "capability": "unified-source-document-presentation",
      "series_id": null,
      "dependencies": [],
      "prerequisites": [
        "A bounded upstream patch with code-level evidence",
        "ROSS-native mapping to provider-neutral source and citation contracts",
        "Verification of reviewed-source attribution and Ontario coverage boundaries"
      ],
      "reason": "Potentially useful source normalization and shared web/Word presentation, but metadata alone cannot support safe adoption. The change spans dependencies, APIs, citation verification, legal-source behavior, and data-boundary-sensitive interfaces; retry when bounded code evidence is available.",
      "architecture_brief": null,
      "implementation_plan": [],
      "next_review_at": null,
      "processed_at": "2026-08-17T14:42:51.565Z"
    },
    {
      "number": 348,
      "title": "Align Word tracked-change edit cards with frontend",
      "url": "https://github.com/Open-Legal-Products/mike/pull/348",
      "merged_at": "2026-08-18T03:28:03.000Z",
      "merge_commit_sha": "a2571b53d66ab7b28b5babcae3f49f133009610a",
      "decision": "investigate",
      "outcome": "needs-test-harness",
      "status": "retryable",
      "risk": "none",
      "capability": "tracked-change-card-alignment",
      "series_id": null,
      "dependencies": [],
      "prerequisites": [
        "Focused ROSS frontend component-test harness for single-card and multi-card tracked-change rendering"
      ],
      "reason": "ROSS already has precise minimal DOCX edits, Accept/Reject/View ordering, and native pill-button styling; it has no Word add-in. The remaining useful single-card simplification is presentation-only but needs regression coverage before adoption.",
      "architecture_brief": null,
      "implementation_plan": [],
      "next_review_at": null,
      "processed_at": "2026-08-18T14:52:29.475Z"
    },
    {
      "number": 350,
      "title": "feat: expand model routing and assistant input workflows",
      "url": "https://github.com/Open-Legal-Products/mike/pull/350",
      "merged_at": "2026-08-19T00:56:33.000Z",
      "merge_commit_sha": "c83a238805605cfe09a82f1deb13acd6364e806b",
      "decision": "investigate",
      "outcome": "needs-decision",
      "status": "needs-decision",
      "risk": "none",
      "capability": "router-aware-assistant-workflows",
      "series_id": "model-routing-350",
      "dependencies": [],
      "prerequisites": [
        "Security and architecture review",
        "Provider-key and data-boundary review",
        "Schema, migration, API, and deployment review",
        "ROSS-specific legal-source and beta-boundary evaluation"
      ],
      "reason": "The useful routing, input, and version-panel capabilities are inseparable from provider keys, schemas, APIs, deployment, and data-boundary changes protected from automatic adoption.",
      "architecture_brief": null,
      "implementation_plan": [],
      "next_review_at": null,
      "processed_at": "2026-08-19T14:53:01.702Z"
    },
    {
      "number": 352,
      "title": "docs: simplify and reorganize project guides",
      "url": "https://github.com/Open-Legal-Products/mike/pull/352",
      "merged_at": "2026-08-19T00:57:13.000Z",
      "merge_commit_sha": "83b5ce0573ec05fbdd487c048a93962bdc2f0f64",
      "decision": "skip",
      "outcome": "equivalent",
      "status": "terminal",
      "risk": "none",
      "capability": "repository-guide-organization",
      "series_id": null,
      "dependencies": [],
      "prerequisites": [],
      "reason": "ROSS already has a repository-specific README, documentation map, local-development guidance, verification instructions, and governed deployment and release runbooks; Mike-specific and Word-add-in guidance is not applicable.",
      "architecture_brief": null,
      "implementation_plan": [],
      "next_review_at": null,
      "processed_at": "2026-08-19T14:53:01.702Z"
    },
    {
      "number": 353,
      "title": "Model routing hardening",
      "url": "https://github.com/Open-Legal-Products/mike/pull/353",
      "merged_at": "2026-08-19T09:45:07.000Z",
      "merge_commit_sha": "64e2865a1fd0c9182d02b639d656492b7c098896",
      "decision": "investigate",
      "outcome": "needs-decision",
      "status": "needs-decision",
      "risk": "none",
      "capability": "model-router-hardening",
      "series_id": "model-routing-350",
      "dependencies": [
        "Mike PR #350"
      ],
      "prerequisites": [
        "Decision on PR #350 router architecture",
        "Security review of model allowlists and provider-key spending",
        "Schema and migration review",
        "Focused ROSS router integration harness"
      ],
      "reason": "The hardening is valuable only with #350’s router architecture and changes authorization-like model controls, provider-key use, migrations, and database behavior.",
      "architecture_brief": null,
      "implementation_plan": [],
      "next_review_at": null,
      "processed_at": "2026-08-19T14:53:01.702Z"
    },
    {
      "number": 354,
      "title": "[Ask input findings] Ask-inputs caps and failed-submit recovery",
      "url": "https://github.com/Open-Legal-Products/mike/pull/354",
      "merged_at": "2026-08-19T09:47:11.000Z",
      "merge_commit_sha": "c02d07ed45f6fb229b39b841e56791fa315765db",
      "decision": "investigate",
      "outcome": "needs-test-harness",
      "status": "retryable",
      "risk": "none",
      "capability": "ask-input-submit-integrity",
      "series_id": "model-routing-350",
      "dependencies": [
        "Mike PR #350",
        "Mike PR #353"
      ],
      "prerequisites": [
        "ROSS-native request-validation tests for both chat routes",
        "Frontend failed-submit recovery tests",
        "Synthetic/non-confidential prompt replay evaluation"
      ],
      "reason": "ROSS has a native ask-input seam and could benefit from consistent answer caps and failed-submit recovery, but its request architecture differs and lacks the focused regression coverage needed before changing API behavior.",
      "architecture_brief": null,
      "implementation_plan": [],
      "next_review_at": null,
      "processed_at": "2026-08-19T14:53:01.702Z"
    },
    {
      "number": 355,
      "title": "[Document panel updates] Version-panel resilience",
      "url": "https://github.com/Open-Legal-Products/mike/pull/355",
      "merged_at": "2026-08-19T10:31:59.000Z",
      "merge_commit_sha": "f9659461aa63d49ae03b0d865ca7fe6efe30db66",
      "decision": "investigate",
      "outcome": "needs-decision",
      "status": "needs-decision",
      "risk": "none",
      "capability": "version-panel-resilience",
      "series_id": "model-routing-350",
      "dependencies": [
        "Mike PR #350",
        "Mike PR #353",
        "Mike PR #354"
      ],
      "prerequisites": [
        "Version-aware panel architecture from PR #350 or a ROSS-native equivalent",
        "Product and legal judgment on substituting current content for deleted cited versions",
        "Focused tab-identity and citation-version tests"
      ],
      "reason": "ROSS lacks the upstream version-resolution seam, and silently replacing a cited deleted version with current bytes presents a product and legal-source integrity judgment.",
      "architecture_brief": null,
      "implementation_plan": [],
      "next_review_at": null,
      "processed_at": "2026-08-19T14:53:01.702Z"
    },
    {
      "number": 347,
      "title": "[Word] Edit cards: reliable resolution on web + Mac, markdown context, and multi-occurrence editing (replace one or all)",
      "url": "https://github.com/Open-Legal-Products/mike/pull/347",
      "merged_at": "2026-08-20T07:24:31.000Z",
      "merge_commit_sha": "7269447e33cc64186f6fee9ec468fc2090d8b6f1",
      "decision": "skip",
      "outcome": "equivalent",
      "status": "terminal",
      "risk": "none",
      "capability": "multi-edit-resolution",
      "series_id": "edit-card-resolution",
      "dependencies": [],
      "prerequisites": [],
      "reason": "ROSS already supports ID-based individual and bulk tracked-edit resolution, optimistic rollback, DOCX viewing, and Markdown chat rendering through its web-native seams. The remaining changes target an absent Word add-in architecture, and the omitted patch cannot be reconstructed or applied.",
      "architecture_brief": null,
      "implementation_plan": [],
      "next_review_at": null,
      "processed_at": "2026-08-20T14:54:22.022Z"
    }
  ],
  "policy": "v2",
  "metrics": {
    "by_outcome": {
      "needs-decision": 70,
      "equivalent": 13,
      "adapted": 1,
      "needs-test-harness": 4,
      "deferred": 1,
      "incompatible": 3,
      "retryable": 2
    },
    "by_status": {
      "needs-decision": 70,
      "terminal": 18,
      "retryable": 6
    },
    "by_risk": {
      "none": 94
    }
  }
}