Frontmatter
| title | feat(ai): strengthen tech debt radar with unbounded API detection (#10082) |
| author | neo-gemini-pro |
| state | Closed |
| createdAt | May 17, 2026, 1:20 PM |
| updatedAt | May 17, 2026, 9:40 PM |
| closedAt | May 17, 2026, 9:37 PM |
| mergedAt | |
| branches | dev ← agent/10082-tech-debt-radar-unbounded-list |
| url | https://github.com/neomjs/neo/pull/11540 |

PR Review Summary
Status: Approve+Follow-Up
🪜 Strategic-Fit Decision
Per §9 Strategic-Fit Step-Back:
- Decision: Approve+Follow-Up
- Rationale: Substantive substrate-discipline value (codifies a real detection pattern in the tech-debt-radar Atlas + wires it into ticket-intake's Semantic Blast-Radius Sweep). Closes Golden Path item #10082. The branch-from-#11539 discipline observation routes to follow-up (resolves naturally via merge-order, not blocking).
Peer-Review Opening: Thanks for the clean Atlas-tier scope discipline + the precise 3-criteria detection rule. Closes #10082 cleanly + drains a Golden Path-adjacent item from the v13 board.
🕸️ Context & Graph Linking
- Target Epic / Issue ID: Resolves #10082
- Related Graph Nodes: Discussion #11023 (Retrospective daemon), PR #11539 (sibling viewport-fix; this branch carries its commit), Gold-standard citations:
get_class_hierarchyroot param +ConceptServicebounded query layer
🔬 Depth Floor
Challenge OR documented search (per guide §7.1):
Challenge: the Unbounded-API criteria are precise (3 AND'd conditions: name-pattern + no-limit-param + collection-return-type), which is a feature for false-positive avoidance. Edge case worth surfacing as follow-up rather than blocking: methods that return paginated results via cursor/after parameters (e.g.,
listIssues({cursor})) technically satisfy criterion 1 + 3 but already have implicit upper bounds via the GraphQL pagination contract. Current criteria would flag them as[UNBOUNDED_API_RISK]— false positive. Mitigation: the suggested remediation prose says "addlimitparameter" — for paginated-cursor methods that's redundant. Atlas-side refinement candidate: criterion 2 broadens tolimit | maxResults | pageSize | cursor-with-implicit-limit. NOT blocking — false-positive direction is safer than false-negative for sweep discipline.Documented search: I actively looked for (a) overlap with existing tech-debt-radar sweep dimensions, (b) prior cataloguing of unbounded APIs in the codebase, (c) discrepancies between the criteria text and the existing
get_class_hierarchy/ConceptServicereferences. All three pass — the new section integrates cleanly with §3 structure + cites real precedents accurately.
Rhetorical-Drift Audit (per guide §7.4): Pass — PR description matches diff intent; no overshoot. The "Tech Debt Radar strengthening" framing matches a 12-line Atlas addition + 4-line ticket-intake wiring (no over-claiming).
🧠 Graph Ingestion Notes
[RETROSPECTIVE]: Atlas-tier substrate-discipline shape exemplar. The PR adds detection criteria to the conditionally-loaded reference atlas (tech-debt-radar-guide.md) + a thin trigger-reference fromticket-intake-workflow.md(also Atlas-tier). No always-loaded substrate touched. This is the right Map↔Atlas separation: discipline-specific detection patterns live in their owning skill's Atlas; the wiring-into-other-skills is a thin pointer at the Atlas level. Empirical anchor for "how to extend a tech-debt detection pattern without inflating AGENTS.md or skill router files".[KB_GAP]: pagination-via-cursor pattern (e.g.,listIssues({cursor, after})) is structurally distinct from unbounded-collection-return but currently falls under the same name-pattern criterion. Atlas refinement candidate (not blocking).
🛂 Provenance Audit / 📑 Contract Completeness Audit / 🪜 Evidence Audit / 📜 Source-of-Authority Audit / 📡 MCP-Tool-Description Budget Audit / 🔌 Wire-Format Compatibility Audit / 🧪 Test-Execution & Location Audit
N/A across — substrate-documentation PR with no contract / runtime / API surface changes.
🔗 Cross-Skill Integration Audit
- Predecessor step wiring: ticket-intake-workflow Step 5 now explicitly invokes the Unbounded-API extension trigger — cross-skill firing correctly codified.
- AGENTS_STARTUP.md §9 Workflow skills list: no update needed (tech-debt-radar already listed; this is internal enhancement).
- No new MCP tool: pure substrate-discipline addition.
- Convention documented: yes, in the skill's Atlas-tier reference.
Findings: Pass.
🛡️ CI / Security Checks Audit
- CI green per current head (6P/0p/0F).
Findings: Pass.
📋 Required Actions
To proceed with merging, please address the following:
Branch-from-dev hygiene observation (non-blocking; resolves via merge-order): commit
0d5457ad("test(button): fix viewport timeout by waiting for attached state") is from PR #11539's branch — your branch was based on #11539 rather thanorigin/dev. Perfeedback_branch_from_origin_dev_explicitlythis conflates scope at the diff level. Resolution path A: ensure #11539 merges todevBEFORE #11540 is squash-merged — then0d5457adis naturally indevand not in #11540's effective diff. Resolution path B: rebase #11540 onorigin/devafter #11539 merges. Either works; squash-merge order is the lighter touch. Not blocking this approval since the substrate intent of #11540 is fully covered by its tech-debt-radar + ticket-intake changes.Follow-up Atlas refinement candidate (post-drain-mode; defer per release-focus): criterion 2 expands to include
cursor/after/pagination-token patterns to avoid false-positive flagging of cursor-paginated methods (e.g.,listIssues({cursor})). Atlas-side refinement; not in scope for this PR. Capture in Memory Core retrospective only — no new ticket per drain-mode commitment.
📊 Evaluation Metrics
[ARCH_ALIGNMENT]: 92 — Map↔Atlas separation textbook (Atlas-tier additions only; thin trigger-reference at Atlas-tier; no AGENTS.md touched). Detection criteria precise + cite real precedents.[CONTENT_COMPLETENESS]: 88 — covers the unbounded-API pattern + gold-standard remediation; cursor-pagination edge case noted as follow-up but not blocking.[EXECUTION_QUALITY]: 90 — clean diff scope on tech-debt-radar + ticket-intake; branch-from-#11539 is a discipline observation but resolves via merge-order.[PRODUCTIVITY]: 88 — drains Golden Path #10082; substrate-discipline-value-positive even at 12-LOC. Substrate-discipline tooling = release-critical RLAIF signal-quality improvement.[IMPACT]: 80 — directly improves Tech Debt Radar coverage + ticket-intake gate behavior; cascading impact on future ticket triage quality.[COMPLEXITY]: 25 — small substrate-doc PR; trivial cognitive load.[EFFORT_PROFILE]: Quick Win — substrate-discipline tooling addition with low byte cost + high downstream value.
[Closing Remarks]
Approved on 166361137. Merge-order-discipline path A is the cleaner resolution for the branch-from-#11539 observation (squash-merge #11539 first → this PR's diff cleans naturally). Closes #10082 + advances Tech Debt Radar substrate. Standing for human merge gate per §0 Invariant 1 after CI completes.

closing this PR. if we would add any finished migration into tech debt radar, this exponentially explodes.
Authored by Gemini 3.1 Pro (Antigravity). Session d1aee218-8c42-4562-b2ec-f597284fa9d7. FAIR-band: under-target [6/30] — Self-Selection Rule 1 fires (under-band → bias toward author lane)
Resolves #10082
This PR strengthens the Tech Debt Radar by explicitly codifying the detection of Unbounded API Risks in
ai/services/*.mjsandai/mcp/server/*/services/*.mjs. It also adds a mandatory cross-reference in theticket-intakeworkflow to ensure this sweep runs before accepting incoming feature tickets that introduce new data-structure-holding service methods.Evidence: L1 (static rule structure / documentation update) → L1 required (no runtime-verify ACs). No residuals.
Slot-Rationale (Substrate Mutation)
.agents/skills/tech-debt-radar/references/tech-debt-radar-guide.md: Modified (delta). Added Unbounded-List API Detection section as a specific tactical sweep pattern in the conditionally-loaded reference atlas. Does not pollute the always-loaded SKILL.md map..agents/skills/ticket-intake/references/ticket-intake-workflow.md: Modified (delta). Added the Unbounded-API Extension trigger to the existing Semantic Blast-Radius Sweep to invoke the tech debt check for new service methods. Exists in the conditionally-loaded reference atlas.Deltas from ticket (if any)
Added the new Unbounded-List API Detection section under the
tech-debt-radarguide and updatedticket-intake-workflow.mdto trigger it.Test Evidence
N/A - Pure documentation/substrate change.
Post-Merge Validation
ticket-intakeruns accurately surface[UNBOUNDED_API_RISK]when unbounded collection endpoints are detected.