Gate
Blocked
1 blocked task
Checks manifest validity, high-severity bugs, blocked tasks. Spend is deliberately not one of them.
Next
/audit:run P2.42 more ready 6/146 tasks done · 2 of 7 phases signed off · 3 open bugs
SummaryPhase 0 (framework upgrade) was finished before this project started recording test runs, so nothing in it points at one — the test-gate column says 'Before recording' rather than 'No evidence', and the no-test-evidence gate excuses it instead of failing it. Phase 1 (auth hardening) is signed off and merged: passwords now use Argon2id and login is rate-limited. Phase 2 (input validation) is in progress with one task blocked on a shared template-escaping decision. Phase 3 (performance) is gated behind Phase 2, and Phase 4 writes down the invariants the audit relied on — documentation work, so it declares no test gate at all. Of five tracked bugs, the logout session leak (BUG-4) is fixed and the cart off-by-one (BUG-3) is being fixed red-first; no high-severity bugs remain unresolved. Phase 5 (sync worker resilience) is queued behind the storefront work, in a different part of the stack — a background Go service rather than the storefront's TypeScript — and its gate is a runner named for what it is: go test rather than npm test.
| id | title | status | risk | commit | done UTC | test gate |
|---|---|---|---|---|---|---|
| Active2 phases | ||||||
| P2 Input validation storefront checkout In progress1 blocked 1/4sign-off No evidencetasks 1 Failed1 Gate mutated the tree2 No evidence | ||||||
| Filter tasks by status: | ||||||
| P2.1 | Validate the checkout payload | Done | med | c89ff0a14 | 2026-06-23 16:10 | Gate mutated the treetree mutatedchecks unknown |
metaworked byalex@acme.example (metered on this task) started2026-06-22T09:30:00Z completed2026-06-23T16:10:00Z commit c89ff0a14branchaudit/p2-input-validation task detailsoutcomeMalformed checkouts are turned away early. technicalBoundary validator + 2 regression tests. modelsonnet testsregression test evidenceverdictGate mutated the treetree mutatedchecks unknown run 2026-06-23T16:05:00Z.2f6ac8at2026-06-23T16:05:00Z scopetask attempt1 took1 m 09 s checksnot knowable from this runner treesrc/checkout/validate.ts coveragesrc/checkout/validate.ts lintexit 0 · check count not knowable · 6.0 s npm run linttestexit 0 · check count not knowable · 44.6 s npm testtypecheckexit 0 · check count not knowable · 18.7 s npm run typechecktested at b2d7e58 repository HEAD at execution time; it does not identify the tested state, because a task gate runs before the task commit | ||||||
| P2.2 | Sanitize the product-search query | In progress | high | — | started 2026-07-06 09:00 | No evidence |
metaworked bysara@acme.example (metered on this task) started2026-07-06T09:00:00Z branchaudit/p2-input-validation task detailsmodelopus teststdd test evidenceverdictNo evidence a gate is configured for this task and no run has been recorded against it - absent evidence is not a failure | ||||||
| P2.3 | Escape server-rendered template output | Blocked | med | — | started 2026-07-13 09:15 | Failedno overlapchecks unknown |
metaworked bymilos@acme.example (metered on this task) started2026-07-13T09:15:00Z branchaudit/p2-input-validation task detailsoutcomeBlocked pending a cross-cutting escaping-helper decision. technicalGates still red after 3 attempts: the legacy engine double-escapes some fields; a shared escaping helper is needed. Escalated to the team. modelsonnet testsregression test evidenceverdictFailedno overlapchecks unknown run 2026-07-15T09:40:00Z.13be6dat2026-07-15T09:40:00Z scopetask attempt3 took1 m 03 s checksnot knowable from this runner treeunchanged — git described the tree before and after coverageno declared file was named by the run — the runner named 22 path(s); the work under test declares 1 file(s) failedtest lintexit 0 · check count not knowable · 5.4 s npm run linttestexit 1 · check count not knowable · 40.4 s npm testtypecheckexit 0 · check count not knowable · 18.0 s npm run typechecktested at b2d7e58 repository HEAD at execution time; it does not identify the tested state, because a task gate runs before the task commitEarlier runs (2)2026-07-14 10:05Failedno overlapchecks unknown 2026-07-14T10:05:00Z.c80e172026-07-13 14:20Failedno overlapchecks unknown 2026-07-13T14:20:00Z.5a91c3 | ||||||
| P2.4 | Add zod schemas for cart mutations | Pending | low | — | — | No evidence |
metabranchaudit/p2-input-validation task detailsmodelhaiku waits onP2.1 testsgate-only test evidenceverdictNo evidence a gate is configured for this task and no run has been recorded against it - absent evidence is not a failure | ||||||
| BF1 Bugfix batch 1 In progress 1/2sign-off No evidencetasks 1 Passed1 No checks ran | ||||||
| Filter tasks by status: | ||||||
| BF1.1 | Fix BUG-3: cart total off-by-one with stacked discounts | In progress | med | — | started 2026-07-20 11:00 | No checks rancoverage unknown |
metaworked bysara@acme.example (metered on this task) started2026-07-20T11:00:00Z branchaudit/bf1-bugfix-batch-1 task detailsmodelsonnet teststdd test evidenceverdictNo checks rancoverage unknown run 2026-07-20T13:22:00Z.a05d29at2026-07-20T13:22:00Z scopetask attempt1 took15.4 s checksnone ran treeunchanged — git described the tree before and after coverageunknown — this runner printed no file paths, so coverage is not knowable from its output testexit 0 · check count not knowable · 12.2 s npm testprecommitexit 0 · 0 check(s) · 3.1 s pre-commit run --all-filestested at a1b2c3d repository HEAD at execution time; it does not identify the tested state, because a task gate runs before the task commit | ||||||
| BF1.2 | Fix BUG-4: logout leaves the session cookie | Done | high | — | 2026-07-21 18:05 | Passed |
metaworked bymilos@acme.example (metered on this task) started2026-07-21T09:40:00Z completed2026-07-21T18:05:00Z branchaudit/bf1-bugfix-batch-1 task detailsoutcomeLogging out now actually ends the session. technicalCookie cleared with an expired Set-Cookie and the session revoked server-side; 1 red-first test. modelopus teststdd test evidenceverdictPassed run 2026-07-21T18:01:00Z.7c4e0bat2026-07-21T18:01:00Z scopetask attempt1 took46.1 s checks24 ran treeunchanged — git described the tree before and after coveragesrc/auth/logout.ts, src/auth/session.ts testexit 0 · check count not knowable · 37.6 s npm testprecommitexit 0 · 24 check(s) · 8.4 s pre-commit run --all-filestested at a1b2c3d repository HEAD at execution time; it does not identify the tested state, because a task gate runs before the task commit | ||||||
| Pending3 phases | ||||||
| P3 Performance pass storefront Pendingheld by P2 0/2sign-off No evidencetasks 2 No evidence | ||||||
| Filter tasks by status: | ||||||
| P3.1 | Memoize the product-list selector | Pending | low | — | — | No evidence |
metatask detailsmodelhaiku testsregression test evidenceverdictNo evidence a gate is configured for this task and no run has been recorded against it - absent evidence is not a failure | ||||||
| P3.2 | Lazy-load below-the-fold images | Pending | low | — | — | No evidence |
metatask detailsmodelhaiku testsgate-only test evidenceverdictNo evidence a gate is configured for this task and no run has been recorded against it - absent evidence is not a failure | ||||||
| P4 Documentation auth checkout Pending 0/1sign-off No gate configuredtasks 1 No gate configured | ||||||
| Filter tasks by status: | ||||||
| P4.1 | Write down the auth and checkout invariants | Pending | low | — | — | No gate configured |
metatask detailsmodelhaiku testsgate-only test evidenceverdictNo gate configured this task declares no tests.gate and its phase declares no testGate, so no gate would run for it | ||||||
| P5 Sync worker resilience worker Pending 0/1sign-off No evidencetasks 1 No evidence | ||||||
| Filter tasks by status: | ||||||
| P5.1 | Cap the retry backoff | Pending | med | — | — | No evidence |
metatask detailsmodelsonnet teststdd test evidenceverdictNo evidence a gate is configured for this task and no run has been recorded against it - absent evidence is not a failure | ||||||
| Archived2 phases | ||||||
| P0 Framework upgrade storefront Done 2/2sign-off Before recordingtasks 2 Before recording | ||||||
| Filter tasks by status: | ||||||
| P0.1 | Move the app bootstrap onto the new framework entry point | Done | med | — | 2026-05-27 14:30 | Before recording |
metaworked bysara@acme.example (metered on this task) started2026-05-26T09:00:00Z completed2026-05-27T14:30:00Z branchaudit/p0-framework-upgrade task detailsoutcomeThe storefront boots on the supported framework line. technicalNew entry point; compatibility shim deleted; 1 regression test. modelsonnet testsregression test evidenceverdictBefore recording this finished before the moment this plan could first have recorded a run, so no gate result could exist for it - excused, not missing - the plan states recording began 2026-06-02T15:38:00Z and the earliest recorded run is 2026-06-02T15:38:00Z; the earlier of the two is the boundary, because work before it could not have been recorded | ||||||
| P0.2 | Port the route table to the new router API | Done | low | — | 2026-05-28 09:40 | Before recording |
metaworked bymilos@acme.example (metered on this task) started2026-05-27T15:00:00Z completed2026-05-28T09:40:00Z branchaudit/p0-framework-upgrade task detailsoutcomeEvery page still resolves to the same route it did before. technicalRoute table ported; 1 regression test over the resolved route list. modelhaiku waits onP0.1 testsregression test evidenceverdictBefore recording this finished before the moment this plan could first have recorded a run, so no gate result could exist for it - excused, not missing - the plan states recording began 2026-06-02T15:38:00Z and the earliest recorded run is 2026-06-02T15:38:00Z; the earlier of the two is the boundary, because work before it could not have been recorded | ||||||
| P1 Auth hardening auth Done 2/2sign-off Passedchecks unknowntasks 2 Passed | ||||||
| Filter tasks by status: | ||||||
| P1.1 | Hash passwords with Argon2id | Done | high | — | 2026-06-02 15:40 | Passedchecks unknown |
metaworked bymilos@acme.example (metered on this task) started2026-06-02T09:10:00Z completed2026-06-02T15:40:00Z branchaudit/p1-auth-hardening work item#1421 task detailsoutcomePasswords are now stored with a modern, memory-hard hash. technicalargon2id via the platform crypto lib; migration-on-login path added; 2 new tests. modelopus teststdd test evidenceverdictPassedchecks unknown run 2026-06-02T15:38:00Z.4c1ba7at2026-06-02T15:38:00Z scopetask attempt1 took47.3 s checksnot knowable from this runner treeunchanged — git described the tree before and after coveragesrc/auth/hash.ts, src/auth/session.ts lintexit 0 · check count not knowable · 5.1 s npm run linttestexit 0 · check count not knowable · 41.9 s npm testtested at 0f3a9d1 repository HEAD at execution time; it does not identify the tested state, because a task gate runs before the task commit | ||||||
| P1.2 | Rate-limit the login endpoint | Done | med | — | 2026-06-09 12:20 | Passedno overlapchecks unknown |
metaworked byalex@acme.example (metered on this task) started2026-06-08T10:00:00Z completed2026-06-09T12:20:00Z branchaudit/p1-auth-hardening task detailsoutcomeRepeated failed logins are now throttled. technicalSliding-window limiter keyed by IP and account; 1 regression test. modelsonnet waits onP1.1 testsregression test evidenceverdictPassedno overlapchecks unknown run 2026-06-09T12:17:00Z.9e02f5at2026-06-09T12:17:00Z scopetask attempt1 took43.2 s checksnot knowable from this runner treeunchanged — git described the tree before and after coverageno declared file was named by the run — the runner named 12 path(s); the work under test declares 1 file(s) lintexit 0 · check count not knowable · 4.9 s npm run linttestexit 0 · check count not knowable · 38.2 s npm testtested at 9a1f0c2 repository HEAD at execution time; it does not identify the tested state, because a task gate runs before the task commit | ||||||
| No phase matches these filters. | ||||||
Usage
4 phases · 3 people · 4 models · 5 sessions · 2026-05-26 to 2026-07-21 · rates as of 2026-08-06, the project's usage.pricing in .claude/audit.config.json; rows are priced at global routing; the ledger does not read a request's inference geo; 0 row(s) at the rate stamped when written, 232 priced again at the rate in effect on their date
tokens
90.3M-64%
1,282 messages
equivalent cost
$102.60-3%
not a bill — subscription plans have no per-token charge
cache hit
93%
input side bills at 20% of fresh-token rates
cost per task
$11.41
Of the plan's 6 done task(s), 6 are priced; main-loop spend is not attributed to a task.
attributed
96%
87% down to a specific task
Tokens per day
Deltas above compare 2026-06-22 to 2026-07-21 with the 30 days before it.
15.8M7.9M
05-2605-2806-0106-0406-0806-1006-1606-2206-2507-0107-0607-1007-1607-21
Author chips scope the per-author views of this section (the By author list, and the per-author panels in Detail) — the tiles and trend above stay project-wide, and the task table records no author to filter by. The panel has the full drill-down.
By phase
P0 Framework upgrade32.7M · $19.80
P1 Auth hardening31.6M · $29.13
BF1 Bugfix batch 115.5M · $20.18
P2 Input validation6.4M · $27.40
Uncategorized4.0M · $6.09
By model
claude-sonnet-554.9M · $53.18
claude-opus-525.8M · $43.96
claude-haiku-4-58.9M · $2.47
claude-fable-5765.3K · $2.99
By author
sara@acme.example31.2M · $32.20
milos@acme.example30.9M · $37.63
alex@acme.example28.2M · $32.77
Budget
P2 Input validation110%$27.40 of $25.00 · over
P0 Framework upgrade79%$19.80 of $25.00
P1 Auth hardening73%$29.13 of $40.00
All budgeted phases$76.33 of $90.00
4 phase(s) have no budgetUSD set and are not shown here — they are not phases at zero.
Detail — monthly activity, per-author split, phase composition, unit economics, model routing, hourly pattern
Month by month
Ledger columns are this ledger's spend by calendar month. Plan columns count the whole project by event month — a task in its completedAt month, a bug in its reportedAt month, a fix in the month its linked task completed (the same derivation the bug list uses), a phase in its mergedAt month.
| month | tokens | cost | msgs | tasks done | bugs | fixed | merged |
|---|---|---|---|---|---|---|---|
| 2026-05 | 33.1M | $20.26 | 374 | 2 | 0 | 0 | 1 |
| 2026-06 | 37.1M | $44.84 | 605 | 3 | 3 | 0 | 1 |
| 2026-07 | 20.0M | $37.49 | 303 | 1 | 2 | 1 | 0 |
Each author, by model
Every panel shares one axis (2026-05-26 to 2026-07-21, one column per day) and one scale (peak 12.6M tokens per column), so heights and positions compare directly across people. A column too small to draw shows as a hairline — some spend, below this chart's resolution; hover it for the dates and the count.
sara@acme.example
claude-fable-5
claude-haiku-4-5
claude-opus-5
claude-sonnet-5
milos@acme.example
claude-fable-5
claude-haiku-4-5
claude-opus-5
claude-sonnet-5
alex@acme.example
claude-fable-5
claude-haiku-4-5
claude-opus-5
claude-sonnet-5
Phase composition by model
claude-fable-5claude-haiku-4-5claude-opus-5claude-sonnet-5
P0 Framework upgrade32.7M
P1 Auth hardening31.6M
BF1 Bugfix batch 115.5M
P2 Input validation6.4M
-- Uncategorized4.0M
Unit economics
Remaining 8 task(s) project to $75.69–$125.95 at the p25–p75 per-task rate.
Of the plan's 6 done task(s), 6 are priced; main-loop spend is not attributed to a task.
$5.36 on tasks that needed more than one attempt (1 task(s), 5% of spend) · $5.36 on tasks that ended blocked (1 task(s)).
Retried spend is not the same as wasted spend: the ledger buckets by hour, not by attempt, so a task that retried and then landed did not burn every attempt for nothing. Only the blocked figure is spend with no outcome (the same task is in both figures here).
Most expensive tasks
Cost band from this project's own completed tasks (median / p90): typical ≤ $10.08 · high ≤ $15.74 · outlier above. Of the plan's 6 done task(s), 6 are priced; main-loop spend is not attributed to a task.
| id | title | cost band | cost | attempts |
|---|---|---|---|---|
| P1.2 | Rate-limit the login endpoint | outlier | $15.90 | 1 |
| P0.1 | Move the app bootstrap onto the new framework entry point | outlier | $15.74 | 1 |
| BF1.2 | Fix BUG-4: logout leaves the session cookie | high | $15.52 | 1 |
| P2.1 | Validate the checkout payload | high | $10.08 | 1 |
| P1.1 | Hash passwords with Argon2id | typical | $9.46 | 1 |
Model cost within each risk band
Compared inside a band on purpose. Hard work is routed to the stronger model deliberately, so a raw spend-per-task comparison across bands would flag that working system as a fault.
Of the plan's 6 done task(s), 6 are priced; main-loop spend is not attributed to a task.
| risk | model | tasks | cost/task | mean attempts |
|---|---|---|---|---|
| high | claude-opus-5 | 3 | $11.19 | 1.0 |
| med | claude-sonnet-5 | 5 | $10.01 | 1.4 |
| low | claude-haiku-4-5 | 1 | $1.74 | 1.0 |
When the tokens are spent (UTC)
All data · 2026-05-26 to 2026-07-21
| 00 | 06 | 12 | 18 | |||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Mon | ||||||||||||||||||||||||
| Tue | ||||||||||||||||||||||||
| Wed | ||||||||||||||||||||||||
| Thu | ||||||||||||||||||||||||
| Fri | ||||||||||||||||||||||||
| Sat | ||||||||||||||||||||||||
| Sun |
0 5.3M tokens/hour
Bugs
| id | title | status | severity | task | fixedIn | test gate | ADO |
|---|---|---|---|---|---|---|---|
| BUG-1 | Product images 404 intermittently on Safari | Open | med | — | — | no fix task yet | — |
| BUG-2 | Checkout is slow on 3G mobile | Triaged | low | — | — | no fix task yet | — |
| BUG-3 | Cart total off-by-one with stacked discounts | In progress | med | BF1.1 | — | No checks rancoverage unknown via BF1.1 | #1508 |
| BUG-4 | Logout does not clear the session cookie | Fixed | high | BF1.2 | — | Passed via BF1.2 | — |
| BUG-5 | Dark-mode label contrast below AA | Won’t fix | low | — | — | no fix task yet | — |
Ready now
P2.4Add zod schemas for cart mutations storefront checkout- In P2 — Input validation. Cleared: depends on P2.1 (done)
P4.1Write down the auth and checkout invariants auth checkout- In P4 — Documentation. Nothing blocked it — ready from the start.
P5.1Cap the retry backoff worker- In P5 — Sync worker resilience. Nothing blocked it — ready from the start.