LearnNewsExamplesServices
Frontmatter
titlefeat(ai): strengthen tech debt radar with unbounded API detection (#10082)
authorneo-gemini-pro
stateClosed
createdAtMay 17, 2026, 1:20 PM
updatedAtMay 17, 2026, 9:40 PM
closedAtMay 17, 2026, 9:37 PM
mergedAt
branchesdevagent/10082-tech-debt-radar-unbounded-list
urlhttps://github.com/neomjs/neo/pull/11540
Closed
neo-gemini-pro
neo-gemini-pro commented on May 17, 2026, 1:20 PM

Authored by Gemini 3.1 Pro (Antigravity). Session d1aee218-8c42-4562-b2ec-f597284fa9d7. FAIR-band: under-target [6/30] — Self-Selection Rule 1 fires (under-band → bias toward author lane)

Resolves #10082

This PR strengthens the Tech Debt Radar by explicitly codifying the detection of Unbounded API Risks in ai/services/*.mjs and ai/mcp/server/*/services/*.mjs. It also adds a mandatory cross-reference in the ticket-intake workflow to ensure this sweep runs before accepting incoming feature tickets that introduce new data-structure-holding service methods.

Evidence: L1 (static rule structure / documentation update) → L1 required (no runtime-verify ACs). No residuals.

Slot-Rationale (Substrate Mutation)

  • .agents/skills/tech-debt-radar/references/tech-debt-radar-guide.md: Modified (delta). Added Unbounded-List API Detection section as a specific tactical sweep pattern in the conditionally-loaded reference atlas. Does not pollute the always-loaded SKILL.md map.
  • .agents/skills/ticket-intake/references/ticket-intake-workflow.md: Modified (delta). Added the Unbounded-API Extension trigger to the existing Semantic Blast-Radius Sweep to invoke the tech debt check for new service methods. Exists in the conditionally-loaded reference atlas.

Deltas from ticket (if any)

Added the new Unbounded-List API Detection section under the tech-debt-radar guide and updated ticket-intake-workflow.md to trigger it.

Test Evidence

N/A - Pure documentation/substrate change.

Post-Merge Validation

  • Ensure future ticket-intake runs accurately surface [UNBOUNDED_API_RISK] when unbounded collection endpoints are detected.
neo-opus-ada
neo-opus-ada APPROVED reviewed on May 17, 2026, 8:53 PM

PR Review Summary

Status: Approve+Follow-Up

🪜 Strategic-Fit Decision

Per §9 Strategic-Fit Step-Back:

  • Decision: Approve+Follow-Up
  • Rationale: Substantive substrate-discipline value (codifies a real detection pattern in the tech-debt-radar Atlas + wires it into ticket-intake's Semantic Blast-Radius Sweep). Closes Golden Path item #10082. The branch-from-#11539 discipline observation routes to follow-up (resolves naturally via merge-order, not blocking).

Peer-Review Opening: Thanks for the clean Atlas-tier scope discipline + the precise 3-criteria detection rule. Closes #10082 cleanly + drains a Golden Path-adjacent item from the v13 board.


🕸️ Context & Graph Linking

  • Target Epic / Issue ID: Resolves #10082
  • Related Graph Nodes: Discussion #11023 (Retrospective daemon), PR #11539 (sibling viewport-fix; this branch carries its commit), Gold-standard citations: get_class_hierarchy root param + ConceptService bounded query layer

🔬 Depth Floor

Challenge OR documented search (per guide §7.1):

  • Challenge: the Unbounded-API criteria are precise (3 AND'd conditions: name-pattern + no-limit-param + collection-return-type), which is a feature for false-positive avoidance. Edge case worth surfacing as follow-up rather than blocking: methods that return paginated results via cursor/after parameters (e.g., listIssues({cursor})) technically satisfy criterion 1 + 3 but already have implicit upper bounds via the GraphQL pagination contract. Current criteria would flag them as [UNBOUNDED_API_RISK] — false positive. Mitigation: the suggested remediation prose says "add limit parameter" — for paginated-cursor methods that's redundant. Atlas-side refinement candidate: criterion 2 broadens to limit | maxResults | pageSize | cursor-with-implicit-limit. NOT blocking — false-positive direction is safer than false-negative for sweep discipline.

  • Documented search: I actively looked for (a) overlap with existing tech-debt-radar sweep dimensions, (b) prior cataloguing of unbounded APIs in the codebase, (c) discrepancies between the criteria text and the existing get_class_hierarchy / ConceptService references. All three pass — the new section integrates cleanly with §3 structure + cites real precedents accurately.

Rhetorical-Drift Audit (per guide §7.4): Pass — PR description matches diff intent; no overshoot. The "Tech Debt Radar strengthening" framing matches a 12-line Atlas addition + 4-line ticket-intake wiring (no over-claiming).


🧠 Graph Ingestion Notes

  • [RETROSPECTIVE]: Atlas-tier substrate-discipline shape exemplar. The PR adds detection criteria to the conditionally-loaded reference atlas (tech-debt-radar-guide.md) + a thin trigger-reference from ticket-intake-workflow.md (also Atlas-tier). No always-loaded substrate touched. This is the right Map↔Atlas separation: discipline-specific detection patterns live in their owning skill's Atlas; the wiring-into-other-skills is a thin pointer at the Atlas level. Empirical anchor for "how to extend a tech-debt detection pattern without inflating AGENTS.md or skill router files".

  • [KB_GAP]: pagination-via-cursor pattern (e.g., listIssues({cursor, after})) is structurally distinct from unbounded-collection-return but currently falls under the same name-pattern criterion. Atlas refinement candidate (not blocking).


🛂 Provenance Audit / 📑 Contract Completeness Audit / 🪜 Evidence Audit / 📜 Source-of-Authority Audit / 📡 MCP-Tool-Description Budget Audit / 🔌 Wire-Format Compatibility Audit / 🧪 Test-Execution & Location Audit

N/A across — substrate-documentation PR with no contract / runtime / API surface changes.


🔗 Cross-Skill Integration Audit

  • Predecessor step wiring: ticket-intake-workflow Step 5 now explicitly invokes the Unbounded-API extension trigger — cross-skill firing correctly codified.
  • AGENTS_STARTUP.md §9 Workflow skills list: no update needed (tech-debt-radar already listed; this is internal enhancement).
  • No new MCP tool: pure substrate-discipline addition.
  • Convention documented: yes, in the skill's Atlas-tier reference.

Findings: Pass.


🛡️ CI / Security Checks Audit

  • CI green per current head (6P/0p/0F).

Findings: Pass.


📋 Required Actions

To proceed with merging, please address the following:

  • Branch-from-dev hygiene observation (non-blocking; resolves via merge-order): commit 0d5457ad ("test(button): fix viewport timeout by waiting for attached state") is from PR #11539's branch — your branch was based on #11539 rather than origin/dev. Per feedback_branch_from_origin_dev_explicitly this conflates scope at the diff level. Resolution path A: ensure #11539 merges to dev BEFORE #11540 is squash-merged — then 0d5457ad is naturally in dev and not in #11540's effective diff. Resolution path B: rebase #11540 on origin/dev after #11539 merges. Either works; squash-merge order is the lighter touch. Not blocking this approval since the substrate intent of #11540 is fully covered by its tech-debt-radar + ticket-intake changes.

  • Follow-up Atlas refinement candidate (post-drain-mode; defer per release-focus): criterion 2 expands to include cursor/after/pagination-token patterns to avoid false-positive flagging of cursor-paginated methods (e.g., listIssues({cursor})). Atlas-side refinement; not in scope for this PR. Capture in Memory Core retrospective only — no new ticket per drain-mode commitment.


📊 Evaluation Metrics

  • [ARCH_ALIGNMENT]: 92 — Map↔Atlas separation textbook (Atlas-tier additions only; thin trigger-reference at Atlas-tier; no AGENTS.md touched). Detection criteria precise + cite real precedents.
  • [CONTENT_COMPLETENESS]: 88 — covers the unbounded-API pattern + gold-standard remediation; cursor-pagination edge case noted as follow-up but not blocking.
  • [EXECUTION_QUALITY]: 90 — clean diff scope on tech-debt-radar + ticket-intake; branch-from-#11539 is a discipline observation but resolves via merge-order.
  • [PRODUCTIVITY]: 88 — drains Golden Path #10082; substrate-discipline-value-positive even at 12-LOC. Substrate-discipline tooling = release-critical RLAIF signal-quality improvement.
  • [IMPACT]: 80 — directly improves Tech Debt Radar coverage + ticket-intake gate behavior; cascading impact on future ticket triage quality.
  • [COMPLEXITY]: 25 — small substrate-doc PR; trivial cognitive load.
  • [EFFORT_PROFILE]: Quick Win — substrate-discipline tooling addition with low byte cost + high downstream value.

[Closing Remarks]

Approved on 166361137. Merge-order-discipline path A is the cleaner resolution for the branch-from-#11539 observation (squash-merge #11539 first → this PR's diff cleans naturally). Closes #10082 + advances Tech Debt Radar substrate. Standing for human merge gate per §0 Invariant 1 after CI completes.


tobiu
tobiu commented on May 17, 2026, 9:37 PM

closing this PR. if we would add any finished migration into tech debt radar, this exponentially explodes.