code wiki / findings
findings: the wiki's own work backlog
each regeneration runs the detectors; every finding is filed into the debt board with a stable description (idempotent -- refiling the same finding is a no-op). Fix the issue and the next regen drops the finding. This is the loop: code → wiki → findings → backlog → work → code.
| sev | scope | finding |
|---|---|---|
| 4 | codewiki | Orphan libraries exist (modules with no main and zero importers = dead-code candidates). Live list: https://nishifamily.com/code/kinds -- triage each: wire a caller, or retire (rule 13). |
| 4 | codewiki | Unresolved import targets exist (a module imports a name not found under this root -- generated, drifted, or dead imports). https://nishifamily.com/code/index -- reconcile or remove. |
| 5 | capabilities | MCP capabilities are exposed without a schema row (callable but undocumented -- an agent can invoke them without learning what they do). https://nishifamily.com/code/exposure -- add a title via /api/tools/register (title creates the schema row) per capability. |
| 5 | exposure | Deployed elfs without MCP allowlist rows exist (dark capabilities). Live list: https://nishifamily.com/code/exposure -- decide expose vs retire per capability. |
| 6 | shipped-drift | Deployed binaries are OLDER than their own source: a fix that lives only in the tree is not shipped, and nothing else in the ecosystem answers that question -- it was rediscovered five separate times by hand in one day. Rebuild and redeploy each, or explain the divergence. Confirm with a REPRODUCTION first: an mtime delta is a hypothesis about shipped state, not proof. Standing gauge: https://nishifamily.com/code/exposure |
| 7 | codewiki-debt | Landmine markers present (dual-copy / stale-tree / footgun hazards documented in source). https://nishifamily.com/code/debt -- these are the traps that silently regress; review + neutralize each. |
| 7 | codewiki-debt | landmine in nx_types (high blast radius -- widely imported). Review and neutralize the hazard, then add a gate tooth so it cannot recur. https://nishifamily.com/code/nx_types |
| 7 | codewiki-debt | landmine in nx_http_server (high blast radius -- widely imported). Review and neutralize the hazard, then add a gate tooth so it cannot recur. https://nishifamily.com/code/nx_http_server |
| 7 | codewiki-debt | landmine in nx_parse (high blast radius -- widely imported). Review and neutralize the hazard, then add a gate tooth so it cannot recur. https://nishifamily.com/code/nx_parse |
| 7 | codewiki-debt | landmine in nx_vcodec (high blast radius -- widely imported). Review and neutralize the hazard, then add a gate tooth so it cannot recur. https://nishifamily.com/code/nx_vcodec |
| 7 | codewiki-debt | landmine in nx_bodyatlas (high blast radius -- widely imported). Review and neutralize the hazard, then add a gate tooth so it cannot recur. https://nishifamily.com/code/nx_bodyatlas |
| 7 | codewiki-debt | landmine in nx_kill_portable (high blast radius -- widely imported). Review and neutralize the hazard, then add a gate tooth so it cannot recur. https://nishifamily.com/code/nx_kill_portable |
| 7 | codewiki-debt | landmine in nx_html_entities (high blast radius -- widely imported). Review and neutralize the hazard, then add a gate tooth so it cannot recur. https://nishifamily.com/code/nx_html_entities |
| 7 | codewiki-debt | landmine in nx_pattern_emit6 (high blast radius -- widely imported). Review and neutralize the hazard, then add a gate tooth so it cannot recur. https://nishifamily.com/code/nx_pattern_emit6 |
| 5 | codewiki-debt | Workaround/hack markers present (code that works around a defect rather than fixing it). https://nishifamily.com/code/debt -- replace each with a real fix where the root cause now allows it. |
| 5 | codewiki-debt | Gotcha/trap/caveat markers present (documented traps future work must not step on). https://nishifamily.com/code/debt -- consider a gate tooth so the trap cannot recur silently. |
| 4 | codewiki-debt | TODO/FIXME/unfinished markers present (declared-incomplete work). https://nishifamily.com/code/debt -- convert each to a tracked backlog item or finish it. |
| 5 | codewiki-debt | Third-party/foreign-dependency markers present (the sovereignty tax). https://nishifamily.com/code/debt and /code/sovereignty -- plan the first-byte-up replacement per dependency. |
| 7 | codewiki-debt | Security markers present (CWE/vuln/exploit notes in source). https://nishifamily.com/code/debt -- verify each is closed and gated, not merely noted. |
| 7 | codewiki-debt | security note in nx_https_fetch_follow (high blast radius -- widely imported). Review and neutralize the hazard, then add a gate tooth so it cannot recur. https://nishifamily.com/code/nx_https_fetch_follow |
| 7 | codewiki-debt | security note in nx_x25519 (high blast radius -- widely imported). Review and neutralize the hazard, then add a gate tooth so it cannot recur. https://nishifamily.com/code/nx_x25519 |
| 7 | codewiki-debt | security note in nx_parse (high blast radius -- widely imported). Review and neutralize the hazard, then add a gate tooth so it cannot recur. https://nishifamily.com/code/nx_parse |
| 7 | codewiki-debt | security note in nx_qed_freek (high blast radius -- widely imported). Review and neutralize the hazard, then add a gate tooth so it cannot recur. https://nishifamily.com/code/nx_qed_freek |
| 7 | codewiki-debt | security note in nx_directors_note (high blast radius -- widely imported). Review and neutralize the hazard, then add a gate tooth so it cannot recur. https://nishifamily.com/code/nx_directors_note |
| 7 | codewiki-debt | security note in nx_lib_fetch (high blast radius -- widely imported). Review and neutralize the hazard, then add a gate tooth so it cannot recur. https://nishifamily.com/code/nx_lib_fetch |
| 7 | codewiki-debt | security note in nx_dr_verify (high blast radius -- widely imported). Review and neutralize the hazard, then add a gate tooth so it cannot recur. https://nishifamily.com/code/nx_dr_verify |
| 7 | codewiki-debt | security note in nx_pathway (high blast radius -- widely imported). Review and neutralize the hazard, then add a gate tooth so it cannot recur. https://nishifamily.com/code/nx_pathway |
| 4 | codewiki-debt | Performance-debt markers present (quadratic/O(n^2)/slow-path notes). https://nishifamily.com/code/debt -- measure before optimizing; the note is a lead, the ruler decides. |
| 5 | codewiki-debt | Deprecated/retire markers present (code flagged for removal still in the tree). https://nishifamily.com/code/debt -- migrate consumers then soft-delete (rule 13). |
| 5 | bounds-law/tree | Taste-bound consts present: cap/max constants lack measurement provenance in the adjacent comment; apply the bounds law (derive from a measured table or scale with the input; when a bound bites the fix is architecture, never a different number). Standing gauge: https://nishifamily.com/code/debt |
| 5 | substring-classifier/tree | Substring classifiers present: a line that tests a substring AND decides on it. A needle cannot distinguish a thing from a mention of a thing -- this exact shape produced four defects (sev 5-9) on 2026-07-30: a documented CWE prevention filed as a hazard, the edge SSOT flagged as a stale copy for carrying _v2, a one-shot worker classified a daemon by name and left unshippable, and route matching reading body bytes as a request line. Read the structure instead: parse the field, declare the role in data, bound the scan. Standing gauge: https://nishifamily.com/code/debt |
| 5 | codewiki-atlas | Atlas-unmapped families present: eligible families carry no domain row in the atlas conf. https://nishifamily.com/code/atlas -- add the family-to-domain row (rule 11: extend the conf); conformance rises at the next regen. |