kodi-dev 0.1.1 → 1.0.1

package/board-dist/.next/static/chunks/turbopack-3ec-4w_qyxb-d.js

@@ -0,0 +1 @@
+(globalThis.TURBOPACK||(globalThis.TURBOPACK=[])).push(["object"==typeof document?document.currentScript:void 0,{otherChunks:["static/chunks/1jq4o6yq14o4c.js","static/chunks/0245a4ypel7xx.js","static/chunks/0dw6y-0ffla71.js","static/chunks/3rxl-jt3pdxgx.js"],runtimeModuleIds:[94553]}]),(()=>{let e;if(!Array.isArray(globalThis.TURBOPACK))return;let t="/_next/",r=function(){if(null!=self.TURBOPACK_ASSET_SUFFIX)return self.TURBOPACK_ASSET_SUFFIX;let e=document?.currentScript?.getAttribute?.("src")??"",t=e.indexOf("?");return t>=0?e.slice(t):""}(),n=["NEXT_DEPLOYMENT_ID","NEXT_CLIENT_ASSET_SUFFIX"];var o,l=((o=l||{})[o.Runtime=0]="Runtime",o[o.Parent=1]="Parent",o[o.Update=2]="Update",o);let i=new WeakMap;function s(e,t){this.m=e,this.e=t}let u=s.prototype,a=Object.prototype.hasOwnProperty,c="u">typeof Symbol&&Symbol.toStringTag;function f(e,t,r){a.call(e,t)||Object.defineProperty(e,t,r)}function p(e,t){let r=e[t];return r||(r=h(t),e[t]=r),r}function h(e){return{exports:{},error:void 0,id:e,namespaceObject:void 0}}function d(e,t){f(e,"__esModule",{value:!0}),c&&f(e,c,{value:"Module"});let r=0;for(;r<t.length;){let n=t[r++],o=t[r++];if("number"==typeof o)if(0===o)f(e,n,{value:t[r++],enumerable:!0,writable:!1});else throw Error(`unexpected tag: ${o}`);else"function"==typeof t[r]?f(e,n,{get:o,set:t[r++],enumerable:!0}):f(e,n,{get:o,enumerable:!0})}Object.seal(e)}function m(e,t){(null!=t?p(this.c,t):this.m).exports=e}u.s=function(e,t){let r,n;null!=t?n=(r=p(this.c,t)).exports:(r=this.m,n=this.e),r.namespaceObject=n,d(n,e)},u.j=function(e,t){var r,n;let o,l,s;null!=t?l=(o=p(this.c,t)).exports:(o=this.m,l=this.e);let u=(r=o,n=l,(s=i.get(r))||(i.set(r,s=[]),r.exports=r.namespaceObject=new Proxy(n,{get(e,t){if(a.call(e,t)||"default"===t||"__esModule"===t)return Reflect.get(e,t);for(let e of s){let r=Reflect.get(e,t);if(void 0!==r)return r}},ownKeys(e){let t=Reflect.ownKeys(e);for(let e of s)for(let r of Reflect.ownKeys(e))"default"===r||t.includes(r)||t.push(r);return t}})),s);"object"==typeof e&&null!==e&&u.push(e)},u.v=m,u.n=function(e,t){let r;(r=null!=t?p(this.c,t):this.m).exports=r.namespaceObject=e};let b=Object.getPrototypeOf?e=>Object.getPrototypeOf(e):e=>e.__proto__,y=[null,b({}),b([]),b(b)];function g(e,t,r){let n=[],o=-1;for(let t=e;("object"==typeof t||"function"==typeof t)&&!y.includes(t);t=b(t))for(let r of Object.getOwnPropertyNames(t))n.push(r,function(e,t){return()=>e[t]}(e,r)),-1===o&&"default"===r&&(o=n.length-1);return r&&o>=0||(o>=0?n.splice(o,1,0,e):n.push("default",0,e)),d(t,n),t}function O(e){let t=B(e,this.m);if(t.namespaceObject)return t.namespaceObject;let r=t.exports;return t.namespaceObject=g(r,"function"==typeof r?function(...e){return r.apply(this,e)}:Object.create(null),r&&r.__esModule)}function w(e){let t=e.indexOf("#");-1!==t&&(e=e.substring(0,t));let r=e.indexOf("?");return -1!==r&&(e=e.substring(0,r)),e}function j(){let e,t;return{promise:new Promise((r,n)=>{t=n,e=r}),resolve:e,reject:t}}u.i=O,u.A=function(e){return this.r(e)(O.bind(this))},u.t="function"==typeof require?require:function(){throw Error("Unexpected use of runtime require")},u.r=function(e){return B(e,this.m).exports},u.f=function(e){function t(t){if(t=w(t),a.call(e,t))return e[t].module();let r=Error(`Cannot find module '${t}'`);throw r.code="MODULE_NOT_FOUND",r}return t.keys=()=>Object.keys(e),t.resolve=t=>{if(t=w(t),a.call(e,t))return e[t].id();let r=Error(`Cannot find module '${t}'`);throw r.code="MODULE_NOT_FOUND",r},t.import=async e=>await t(e),t};let k=Symbol("turbopack queues"),U=Symbol("turbopack exports"),C=Symbol("turbopack error");function P(e){e&&1!==e.status&&(e.status=1,e.forEach(e=>e.queueCount--),e.forEach(e=>e.queueCount--?e.queueCount++:e()))}u.a=function(e,t){let r=this.m,n=t?Object.assign([],{status:-1}):void 0,o=new Set,{resolve:l,reject:i,promise:s}=j(),u=Object.assign(s,{[U]:r.exports,[k]:e=>{n&&e(n),o.forEach(e),u.catch(()=>{})}}),a={get:()=>u,set(e){e!==u&&(u[U]=e)}};Object.defineProperty(r,"exports",a),Object.defineProperty(r,"namespaceObject",a),e(function(e){let t=e.map(e=>{if(null!==e&&"object"==typeof e){if(k in e)return e;if(null!=e&&"object"==typeof e&&"then"in e&&"function"==typeof e.then){let t=Object.assign([],{status:0}),r={[U]:{},[k]:e=>e(t)};return e.then(e=>{r[U]=e,P(t)},e=>{r[C]=e,P(t)}),r}}return{[U]:e,[k]:()=>{}}}),r=()=>t.map(e=>{if(e[C])throw e[C];return e[U]}),{promise:l,resolve:i}=j(),s=Object.assign(()=>i(r),{queueCount:0});function u(e){e!==n&&!o.has(e)&&(o.add(e),e&&0===e.status&&(s.queueCount++,e.push(s)))}return t.map(e=>e[k](u)),s.queueCount?l:r()},function(e){e?i(u[C]=e):l(u[U]),P(n)}),n&&-1===n.status&&(n.status=0)};let v=function(e){let t=new URL(e,"x:/"),r={};for(let e in t)r[e]=t[e];for(let t in r.href=e,r.pathname=e.replace(/[?#].*/,""),r.origin=r.protocol="",r.toString=r.toJSON=(...t)=>e,r)Object.defineProperty(this,t,{enumerable:!0,configurable:!0,value:r[t]})};function R(e,t){throw Error(`Invariant: ${t(e)}`)}v.prototype=URL.prototype,u.U=v,u.z=function(e){throw Error("dynamic usage of require is not supported")},u.g=globalThis;let S=s.prototype,$=new Map;u.M=$;let E=new Map,_=new Map;async function T(e,t,r){let n;if("string"==typeof r)return M(e,t,q(r));let o=r.included||[],l=o.map(e=>!!$.has(e)||E.get(e));if(l.length>0&&l.every(e=>e))return void await Promise.all(l);let i=r.moduleChunks||[],s=i.map(e=>_.get(e)).filter(e=>e);if(s.length>0){if(s.length===i.length)return void await Promise.all(s);let r=new Set;for(let e of i)_.has(e)||r.add(e);for(let n of r){let r=M(e,t,q(n));_.set(n,r),s.push(r)}n=Promise.all(s)}else{for(let o of(n=M(e,t,q(r.path)),i))_.has(o)||_.set(o,n)}for(let e of o)E.has(e)||E.set(e,n);await n}S.l=function(e){return T(l.Parent,this.m.id,e)};let x=Promise.resolve(void 0),A=new WeakMap;function M(t,r,n){let o=e.loadChunkCached(t,n),i=A.get(o);if(void 0===i){let e=A.set.bind(A,o,x);i=o.then(e).catch(e=>{let o;switch(t){case l.Runtime:o=`as a runtime dependency of chunk ${r}`;break;case l.Parent:o=`from module ${r}`;break;case l.Update:o="from an HMR update";break;default:R(t,e=>`Unknown source type: ${e}`)}let i=Error(`Failed to load chunk ${n} ${o}${e?`: ${e}`:""}`,e?{cause:e}:void 0);throw i.name="ChunkLoadError",i}),A.set(o,i)}return i}function q(e){return`${t}${e.split("/").map(e=>encodeURIComponent(e)).join("/")}${r}`}S.L=function(e){return M(l.Parent,this.m.id,e)},S.R=function(e){let t=this.r(e);return t?.default??t},S.P=function(e){return`/ROOT/${e??""}`},S.q=function(e,t){m.call(this,`${e}${r}`,t)},S.b=function(e,t,o,l){let i="SharedWorker"===e.name,s=[o.map(e=>q(e)).reverse(),r];for(let e of n)s.push(globalThis[e]);let u=new URL(q(t),location.origin),a=JSON.stringify(s);return i?u.searchParams.set("params",a):u.hash="#params="+encodeURIComponent(a),new e(u,l?{...l,type:void 0}:void 0)};let N=/\.js(?:\?[^#]*)?(?:#.*)?$/,K=/\.css(?:\?[^#]*)?(?:#.*)?$/;function L(e){return K.test(e)}u.w=function(t,r,n){return e.loadWebAssembly(l.Parent,this.m.id,t,r,n)},u.u=function(t,r){return e.loadWebAssemblyModule(l.Parent,this.m.id,t,r)};let I={};u.c=I;let B=(e,t)=>{let r=I[e];if(r){if(r.error)throw r.error;return r}return W(e,l.Parent,t.id)};function W(e,t,r){let n=$.get(e);if("function"!=typeof n)throw Error(function(e,t,r){let n;switch(t){case 0:n=`as a runtime entry of chunk ${r}`;break;case 1:n=`because it was required from module ${r}`;break;case 2:n="because of an HMR update";break;default:R(t,e=>`Unknown source type: ${e}`)}return`Module ${e} was instantiated ${n}, but the module factory is not available.`}(e,t,r));let o=h(e),l=o.exports;I[e]=o;let i=new s(o,l);try{n(i,o,l)}catch(e){throw o.error=e,e}return o.namespaceObject&&o.exports!==o.namespaceObject&&g(o.exports,o.namespaceObject),o}function F(t){let r,n=function(e){if("string"==typeof e)return e;if(e)return{src:e.getAttribute("src")};if("u">typeof TURBOPACK_NEXT_CHUNK_URLS)return{src:TURBOPACK_NEXT_CHUNK_URLS.pop()};throw Error("chunk path empty but not in a worker")}(t[0]);return 2===t.length?r=t[1]:(r=void 0,!function(e,t){let r=1;for(;r<e.length;){let n,o=r+1;for(;o<e.length&&"function"!=typeof e[o];)o++;if(o===e.length)throw Error("malformed chunk format, expected a factory function");let l=e[o];for(let l=r;l<o;l++){let r=e[l],o=t.get(r);if(o){n=o;break}}let i=n??l,s=!1;for(let n=r;n<o;n++){let r=e[n];t.has(r)||(s||(i===l&&Object.defineProperty(l,"name",{value:"module evaluation"}),s=!0),t.set(r,i))}r=o+1}}(t,$)),e.registerChunk(n,r)}let X=new Map;function D(e){let t=X.get(e);if(!t){let r,n;t={resolved:!1,loadingStarted:!1,promise:new Promise((e,t)=>{r=e,n=t}),resolve:()=>{t.resolved=!0,r()},reject:n},X.set(e,t)}return t}e={async registerChunk(e,r){let n=function(e){if("string"==typeof e)return e;let r=decodeURIComponent(e.src.replace(/[?#].*$/,""));return r.startsWith(t)?r.slice(t.length):r}(e);if(D("string"==typeof e?q(e):e.src).resolve(),null!=r){for(let e of r.otherChunks)D(q("string"==typeof e?e:e.path));if(await Promise.all(r.otherChunks.map(e=>T(l.Runtime,n,e))),r.runtimeModuleIds.length>0)for(let e of r.runtimeModuleIds)!function(e,t){let r=I[t];if(r){if(r.error)throw r.error;return}W(t,l.Runtime,e)}(n,e)}},loadChunkCached:(e,t)=>(function(e,t){let r=D(t);if(r.loadingStarted)return r.promise;if(e===l.Runtime)return r.loadingStarted=!0,L(t)&&r.resolve(),r.promise;if("function"==typeof importScripts)if(L(t));else if(N.test(t))self.TURBOPACK_NEXT_CHUNK_URLS.push(t),importScripts(t);else throw Error(`can't infer type of chunk from URL ${t} in worker`);else{let e=decodeURI(t);if(L(t))if(document.querySelectorAll(`link[rel=stylesheet][href="${t}"],link[rel=stylesheet][href^="${t}?"],link[rel=stylesheet][href="${e}"],link[rel=stylesheet][href^="${e}?"]`).length>0)r.resolve();else{let e=document.createElement("link");e.rel="stylesheet",e.href=t,e.onerror=()=>{r.reject()},e.onload=()=>{r.resolve()},document.head.appendChild(e)}else if(N.test(t)){let n=document.querySelectorAll(`script[src="${t}"],script[src^="${t}?"],script[src="${e}"],script[src^="${e}?"]`);if(n.length>0)for(let e of Array.from(n))e.addEventListener("error",()=>{r.reject()});else{let e=document.createElement("script");e.src=t,e.onerror=()=>{r.reject()},document.head.appendChild(e)}}else throw Error(`can't infer type of chunk from URL ${t}`)}return r.loadingStarted=!0,r.promise})(e,t),async loadWebAssembly(e,t,r,n,o){let l=fetch(q(r)),{instance:i}=await WebAssembly.instantiateStreaming(l,o);return i.exports},async loadWebAssemblyModule(e,t,r,n){let o=fetch(q(r));return await WebAssembly.compileStreaming(o)}};let H=globalThis.TURBOPACK;globalThis.TURBOPACK={push:F},H.forEach(F)})();

package/board-dist/.next/static/jxv0GcmWplyzie2rdOiIo/_buildManifest.js

@@ -0,0 +1,11 @@
+self.__BUILD_MANIFEST = {
+  "__rewrites": {
+    "afterFiles": [],
+    "beforeFiles": [],
+    "fallback": []
+  },
+  "sortedPages": [
+    "/_app",
+    "/_error"
+  ]
+};self.__BUILD_MANIFEST_CB && self.__BUILD_MANIFEST_CB()

package/board-dist/.next/static/jxv0GcmWplyzie2rdOiIo/_clientMiddlewareManifest.js

@@ -0,0 +1 @@
+self.__MIDDLEWARE_MATCHERS = [];self.__MIDDLEWARE_MATCHERS_CB && self.__MIDDLEWARE_MATCHERS_CB()

package/board-dist/.next/static/jxv0GcmWplyzie2rdOiIo/_ssgManifest.js

@@ -0,0 +1 @@
+self.__SSG_MANIFEST=new Set([]);self.__SSG_MANIFEST_CB&&self.__SSG_MANIFEST_CB()

package/board-dist/lib/tickets/board.ts

@@ -0,0 +1,154 @@
+// Board model assembler — the READ path (KODI-009).
+//
+// Given the tickets root (KODI_TICKETS_DIR), reads `status.yaml` for placement
+// (index-wins, data-model §4), resolves each `entry.file` with containment
+// (SR-1/SR-2), reads + projects each ticket file's frontmatter to §7 (SR-5), and
+// returns the four-column board. Every consumed value is index-authoritative for
+// placement/status; frontmatter contributes content only.
+//
+// Robustness (SR-3): each entry is resolved/read/projected in its OWN try/catch —
+// one bad entry (rejected pointer, missing file, ELOOP, EACCES, oversize,
+// malformed frontmatter) degrades that ONE card while the rest render, and never
+// unwinds getBoard(). Absent/empty status.yaml, a missing dir, or an
+// absent/whitespace root all yield an EMPTY board, never an error (ADR-0002 §2.5,
+// SR-7). READ-ONLY (R-014/SR-6): only statSync/readFileSync/realpathSync.
+
+import { readFileSync, realpathSync, statSync } from 'node:fs';
+import { resolve } from 'node:path';
+import {
+  MAX_FILE_BYTES,
+  resolveContainedFile,
+  safeParseStatusIndex,
+  type StatusIndexEntry,
+} from './status-index';
+import { extractFrontmatterBlock, projectFrontmatter } from './frontmatter';
+import {
+  TICKET_STATUSES,
+  type BoardColumn,
+  type BoardModel,
+  type BoardTicket,
+  type TicketStatus,
+} from './types';
+
+/** The four columns in fixed enum order, all empty (ADR-0002 §2.5, R-012). */
+function emptyColumns(): { model: BoardModel; byStatus: Map<TicketStatus, BoardColumn> } {
+  const byStatus = new Map<TicketStatus, BoardColumn>();
+  const columns: BoardColumn[] = TICKET_STATUSES.map((status) => {
+    const column: BoardColumn = { status, tickets: [] };
+    byStatus.set(status, column);
+    return column;
+  });
+  return { model: { columns }, byStatus };
+}
+
+/**
+ * A minimal, fully-trusted placeholder for a degraded card (SR-3). It carries
+ * ONLY index-derived data — `key` (already validated by KEY_RE in the parse) and
+ * the authoritative `status`/column — built by explicit pick. It is never a
+ * partial unprojected frontmatter object.
+ */
+function placeholderCard(key: string, status: TicketStatus): BoardTicket {
+  return {
+    key,
+    title: key,
+    status,
+    dependencies: [],
+    drivers: { adr: [] },
+    summary: '',
+    acceptanceCriteria: [],
+  };
+}
+
+/**
+ * Resolve + read + project one index entry into a §7 card. Throws on any failure
+ * so the caller can degrade this single card (SR-3). `status` is set from the
+ * index column (index-wins, §4), never from the file's frontmatter.
+ */
+function buildCard(
+  root: string,
+  realRoot: string,
+  key: string,
+  entry: StatusIndexEntry,
+): BoardTicket {
+  // SR-1/SR-2: contained real path, or throw.
+  const filePath = resolveContainedFile(root, realRoot, key, entry);
+
+  // SR-8: bound the read via stat before touching the bytes.
+  const stat = statSync(filePath);
+  if (!stat.isFile() || stat.size > MAX_FILE_BYTES) {
+    throw new Error('ticket file is not a regular file or exceeds the size cap');
+  }
+
+  const source = readFileSync(filePath, 'utf-8');
+  const block = extractFrontmatterBlock(source);
+  if (block === null) {
+    throw new Error('ticket file has no frontmatter block');
+  }
+  const fm = projectFrontmatter(block); // §7 explicit pick (SR-5)
+
+  // Explicit field construction (SR-5) — the parsed object is never spread.
+  const card: BoardTicket = {
+    key,
+    title: fm.title !== undefined && fm.title.length > 0 ? fm.title : key,
+    status: entry.column, // index-wins (§4)
+    dependencies: fm.dependencies,
+    drivers: fm.drivers,
+    summary: fm.summary ?? '',
+    acceptanceCriteria: fm.acceptanceCriteria,
+  };
+  if (fm.prUrl !== undefined) card.prUrl = fm.prUrl;
+  if (fm.notes !== undefined) card.notes = fm.notes;
+  return card;
+}
+
+/**
+ * Assemble the board model from the tickets root. Never throws: any failure
+ * short-circuits to an empty (or partially-degraded) board.
+ *
+ * @param dir the tickets root (KODI_TICKETS_DIR). Absent/empty/whitespace, a
+ *            missing dir, or an absent/oversize/malformed status.yaml all yield
+ *            the four empty columns (SR-7, ADR-0002 §2.5).
+ */
+export function buildBoard(dir: string | undefined | null): BoardModel {
+  const { model, byStatus } = emptyColumns();
+
+  if (dir === undefined || dir === null || dir.trim() === '') {
+    return model; // SR-7: no target dir → empty board.
+  }
+  const root = dir;
+
+  let statusText: string;
+  let realRoot: string;
+  try {
+    // Absent status.yaml (or missing dir) → empty board (ADR-0002 §2.5).
+    const statusPath = resolve(root, 'status.yaml');
+    const stat = statSync(statusPath); // throws if absent → caught → empty board
+    if (!stat.isFile() || stat.size > MAX_FILE_BYTES) {
+      return model; // SR-8: oversize/non-file status.yaml → empty board
+    }
+    statusText = readFileSync(statusPath, 'utf-8');
+    realRoot = realpathSync(root); // pre-realpath the root once for SR-2
+  } catch {
+    return model; // absent/unreadable → empty board, never a crash (SR-3/SR-7)
+  }
+
+  let index: ReturnType<typeof safeParseStatusIndex>;
+  try {
+    index = safeParseStatusIndex(statusText); // SR-4: safe YAML + null-proto
+  } catch {
+    return model; // unparseable status.yaml → empty board
+  }
+
+  for (const [key, entry] of Object.entries(index.tickets)) {
+    const column = byStatus.get(entry.column); // always present (parse filtered)
+    if (column === undefined) continue;
+    try {
+      column.tickets.push(buildCard(root, realRoot, key, entry));
+    } catch {
+      // SR-3: degrade this ONE card with trusted index-only data; keep going.
+      column.tickets.push(placeholderCard(key, entry.column));
+    }
+  }
+
+  return model;
+}

package/board-dist/lib/tickets/frontmatter.ts

@@ -0,0 +1,114 @@
+// Ticket frontmatter extractor + §7 projector.
+//
+// Reads ONLY the leading `---`…`---` fenced block (SR-4: the markdown body is
+// NEVER parsed as data), safe-parses it with the `yaml` default schema, and
+// projects to the §7 allow-list by EXPLICIT field pick (SR-5: never spread the
+// parsed object). No fs here — the caller hands in the already-read source.
+//
+// Anchors: PRD 0001 §7 (the exact, only fields), R-013 (do not surface
+// slug/nonGoals), NG-1 (never read the phantom fields).
+
+import { parse as parseYaml } from 'yaml';
+import type { BoardDrivers } from './types';
+
+/** SR-4: prototype-pollution keys never survive the rebuild. */
+const DANGEROUS_KEYS = new Set(['__proto__', 'constructor', 'prototype']);
+
+/**
+ * The §7 fields we can derive from frontmatter. `status` is intentionally NOT
+ * here — placement/status is index-wins and comes from `status.yaml`, not the
+ * file (data-model §4). `title`/`summary` are optional at this layer because a
+ * malformed file may omit them; the assembler applies safe defaults.
+ */
+export interface ProjectedFrontmatter {
+  title?: string;
+  dependencies: string[];
+  drivers: BoardDrivers;
+  summary?: string;
+  acceptanceCriteria: string[];
+  prUrl?: string;
+  notes?: string;
+}
+
+/**
+ * Extract the leading YAML frontmatter block from a ticket markdown source.
+ * Returns the inner YAML text (WITHOUT the fences), or `null` when the source
+ * does not begin with a `---` fence or the fence is never closed. Only the
+ * leading block is considered — the body is ignored entirely (SR-4).
+ */
+export function extractFrontmatterBlock(source: string): string | null {
+  // Tolerate a leading UTF-8 BOM, then require a `---` fence as the very first line.
+  const text = source.charCodeAt(0) === 0xfeff ? source.slice(1) : source;
+  const match = /^---[ \t]*\r?\n([\s\S]*?)\r?\n---[ \t]*(?:\r?\n|$)/.exec(text);
+  return match ? match[1] : null;
+}
+
+/** Rebuild a parsed value into a null-proto record, or `null` if not a map. */
+function toNullProtoRecord(raw: unknown): Record<string, unknown> | null {
+  if (raw === null || typeof raw !== 'object' || Array.isArray(raw)) return null;
+  const out: Record<string, unknown> = Object.create(null) as Record<string, unknown>;
+  for (const [key, value] of Object.entries(raw as Record<string, unknown>)) {
+    if (DANGEROUS_KEYS.has(key)) continue;
+    out[key] = value;
+  }
+  return out;
+}
+
+/** Coerce a value to a `string[]`, keeping only string members (default `[]`). */
+function asStringArray(value: unknown): string[] {
+  if (!Array.isArray(value)) return [];
+  return value.filter((item): item is string => typeof item === 'string');
+}
+
+/** Coerce a value to a non-empty string, or `undefined`. */
+function asOptionalString(value: unknown): string | undefined {
+  return typeof value === 'string' ? value : undefined;
+}
+
+/**
+ * Rebuild `drivers` by picking ONLY its three known sub-keys (SR-5). Default is
+ * `{ adr: [] }` (§7). `prd`/`security` present only when a string.
+ */
+function projectDrivers(value: unknown): BoardDrivers {
+  const src = toNullProtoRecord(value);
+  const drivers: BoardDrivers = { adr: src ? asStringArray(src.adr) : [] };
+  if (src) {
+    const prd = asOptionalString(src.prd);
+    if (prd !== undefined) drivers.prd = prd;
+    const security = asOptionalString(src.security);
+    if (security !== undefined) drivers.security = security;
+  }
+  return drivers;
+}
+
+/**
+ * Project a frontmatter YAML block to the §7 allow-list. Parses with the `yaml`
+ * default/core schema (no custom tags, no reviver, merge off) then picks each
+ * field EXPLICITLY — the parsed object is never spread, so keys outside the
+ * allow-list (slug, nonGoals, status, and the NG-1 phantoms) cannot leak (SR-5).
+ * Throws on a malformed block (→ caller degrades the card, SR-3).
+ */
+export function projectFrontmatter(block: string): ProjectedFrontmatter {
+  const raw: unknown = parseYaml(block);
+  const src = toNullProtoRecord(raw);
+  if (src === null) {
+    throw new Error('frontmatter is not a YAML mapping');
+  }
+
+  const projected: ProjectedFrontmatter = {
+    dependencies: asStringArray(src.dependencies),
+    drivers: projectDrivers(src.drivers),
+    acceptanceCriteria: asStringArray(src.acceptanceCriteria),
+  };
+
+  const title = asOptionalString(src.title);
+  if (title !== undefined) projected.title = title;
+  const summary = asOptionalString(src.summary);
+  if (summary !== undefined) projected.summary = summary;
+  const prUrl = asOptionalString(src.prUrl);
+  if (prUrl !== undefined) projected.prUrl = prUrl;
+  const notes = asOptionalString(src.notes);
+  if (notes !== undefined) projected.notes = notes;
+
+  return projected;
+}

package/board-dist/lib/tickets/status-index.ts

@@ -0,0 +1,184 @@
+// Board-local `status.yaml` reader + containment resolver (Alternative B).
+//
+// This RE-IMPLEMENTS the CLI's `src/providers/status-index.ts` posture
+// (`parse` + `resolveFile`) independently — the board is a separate project with
+// its own deps and MUST NOT import across packages (ADR-0002 §2.6). It is
+// READ-ONLY (R-014/SR-6): only `readFileSync`/`statSync`/`realpathSync` here.
+//
+// Anchors: data-model §1 (Alternative-B shape), §2 (path base = dir containing
+// status.yaml = KODI_TICKETS_DIR), §3 (folder slugs), §4 (index-wins),
+// invariants I2/I4. Security: SR-1 (path containment), SR-2 (symlink-out escape),
+// SR-4 (safe YAML + null-proto), SR-8 (size cap).
+
+import { isAbsolute, relative, resolve, sep } from 'node:path';
+import { realpathSync } from 'node:fs';
+import { parse as parseYaml } from 'yaml';
+import { TICKET_STATUSES, type TicketStatus } from './types';
+
+/** SR-8: cap any single read (status.yaml or a ticket file) to a sane size. */
+export const MAX_FILE_BYTES = 1024 * 1024; // 1 MiB
+
+/** Frontmatter/index `key` shape (SR-1/SR-4 key filter). */
+export const KEY_RE = /^[A-Z][A-Z0-9]*-\d+$/;
+
+/** A composed filename: `<KEY>-<slug>.md` (data-model §2; I4). */
+const FILE_RE = /^([A-Z][A-Z0-9]*-\d+)-[a-z0-9]+(?:-[a-z0-9]+)*\.md$/;
+
+/** SR-4: prototype-pollution keys never survive the rebuild. */
+const DANGEROUS_KEYS = new Set(['__proto__', 'constructor', 'prototype']);
+
+/** Frozen status → on-disk folder slug map (data-model §3). Board's own copy. */
+const STATUS_TO_SLUG: Readonly<Record<TicketStatus, string>> = {
+  Pending: 'pending',
+  'In progress': 'in-progress',
+  'To review': 'to-review',
+  Done: 'done',
+};
+
+/** One placement record — column + relative pointer, nothing else (§1). */
+export interface StatusIndexEntry {
+  column: TicketStatus;
+  file: string;
+}
+
+/** The parsed index: only the flat `tickets` map is consumed by the board. */
+export interface StatusIndex {
+  tickets: Record<string, StatusIndexEntry>;
+}
+
+function slugForStatus(status: TicketStatus): string {
+  return STATUS_TO_SLUG[status];
+}
+
+function isTicketStatus(value: string): value is TicketStatus {
+  return (TICKET_STATUSES as readonly string[]).includes(value);
+}
+
+/** A fresh null-prototype map (SR-4: no prototype pollution). */
+function freshTickets(): Record<string, StatusIndexEntry> {
+  return Object.create(null) as Record<string, StatusIndexEntry>;
+}
+
+/**
+ * Safe-parse a `status.yaml` string (SR-4). Uses the `yaml` DEFAULT/core schema
+ * — no custom tags, no reviver, no merge keys (`merge` is off by default in
+ * yaml v2). The `tickets` map is rebuilt into a null-prototype object; keys are
+ * filtered against {@link KEY_RE} (which also drops `__proto__`/`constructor`/
+ * `prototype`), and each entry is kept ONLY when it has a string `file` and a
+ * `column` that is one of the four canonical statuses (data-model §4: a card is
+ * only placeable when its index column is valid). Malformed entries are dropped,
+ * never trusted. Absent/empty/non-object input → an empty index (ADR-0002 §2.5).
+ */
+export function safeParseStatusIndex(text: string): StatusIndex {
+  const tickets = freshTickets();
+  const raw: unknown = parseYaml(text);
+  if (raw === null || typeof raw !== 'object' || Array.isArray(raw)) {
+    return { tickets };
+  }
+
+  const rawTickets = (raw as Record<string, unknown>).tickets;
+  if (rawTickets === null || typeof rawTickets !== 'object' || Array.isArray(rawTickets)) {
+    return { tickets };
+  }
+
+  for (const [key, value] of Object.entries(rawTickets as Record<string, unknown>)) {
+    if (DANGEROUS_KEYS.has(key)) continue; // SR-4
+    if (!KEY_RE.test(key)) continue; // SR-4: only real ticket keys survive
+    if (value === null || typeof value !== 'object' || Array.isArray(value)) continue;
+    const entry = value as Record<string, unknown>;
+    const column = entry.column;
+    const file = entry.file;
+    if (typeof column !== 'string' || typeof file !== 'string') continue;
+    if (!isTicketStatus(column)) continue; // drop unknown-column entries
+    // Explicit two-field pick — the index carries ONLY column + file (§1).
+    tickets[key] = { column, file };
+  }
+
+  return { tickets };
+}
+
+/**
+ * Resolve an index entry's `file` pointer to a REAL absolute path, contained
+ * inside the tickets root. Throws (→ caller degrades the card, SR-3) on any
+ * violation — pointers are REJECTED, never sanitised.
+ *
+ * SR-1 (lexical containment): rejects an empty pointer, an absolute path, a
+ * Windows drive letter (`X:`), any backslash/UNC, any `..`/empty split segment,
+ * and anything that is not exactly the two-segment `<folder-slug>/<KEY>-<slug>.md`
+ * shape. Enforces I2 (folder segment === slug(column)) and I4 (`<KEY>` segment ===
+ * map key). Then resolves against `root` and asserts containment BOUNDARY-SAFELY
+ * (`path.relative` non-`..` check AND `=== root || startsWith(root + sep)` — never
+ * a bare `startsWith(root)`).
+ *
+ * SR-2 (symlink-out escape): after lexical containment passes, `realpathSync` the
+ * resolved file and re-assert the REAL path is inside `realRoot` (the caller's
+ * pre-realpathed root). Done BEFORE the file's bytes are read. If `realpathSync`
+ * throws (missing target / ELOOP) the error propagates — the card degrades and we
+ * NEVER fall back to the lexical path.
+ *
+ * @param root     the tickets root as given (KODI_TICKETS_DIR).
+ * @param realRoot `realpathSync(root)`, computed once by the caller.
+ */
+export function resolveContainedFile(
+  root: string,
+  realRoot: string,
+  key: string,
+  entry: StatusIndexEntry,
+): string {
+  if (!KEY_RE.test(key)) {
+    throw new Error('invalid ticket key');
+  }
+
+  const file = entry.file;
+  if (
+    file.length === 0 ||
+    isAbsolute(file) ||
+    file.includes('\\') || // backslash / UNC
+    /^[A-Za-z]:/.test(file) // Windows drive letter
+  ) {
+    throw new Error('unsafe index file pointer');
+  }
+
+  const segments = file.split('/');
+  if (segments.some((segment) => segment === '..' || segment === '')) {
+    throw new Error('unsafe index file pointer');
+  }
+  if (segments.length !== 2) {
+    throw new Error('malformed index file pointer: expected <slug>/<file>');
+  }
+
+  const [folder, filename] = segments;
+
+  // I2 — folder segment must equal slug(entry.column).
+  if (folder !== slugForStatus(entry.column)) {
+    throw new Error('index/folder disagreement');
+  }
+
+  // I4 — filename must be `<KEY>-<slug>.md` with <KEY> === the map key.
+  const match = FILE_RE.exec(filename);
+  if (!match || match[1] !== key) {
+    throw new Error('index key mismatch');
+  }
+
+  // SR-1 lexical containment (boundary-safe, not a bare startsWith).
+  const resolved = resolve(root, file);
+  const rel = relative(root, resolved);
+  const lexicallyContained =
+    (resolved === root ||
+      (rel !== '' && rel !== '..' && !rel.startsWith(`..${sep}`) && !isAbsolute(rel))) &&
+    (resolved === root || resolved.startsWith(root + sep));
+  if (!lexicallyContained) {
+    throw new Error('index file pointer escapes tickets root');
+  }
+
+  // SR-2 symlink-out containment. Throws (→ degrade) if the target is missing or
+  // an ELOOP; we deliberately do NOT catch here so no lexical fallback happens.
+  const realResolved = realpathSync(resolved);
+  const realContained =
+    realResolved === realRoot || realResolved.startsWith(realRoot + sep);
+  if (!realContained) {
+    throw new Error('index file pointer escapes tickets root via symlink');
+  }
+
+  return realResolved;
+}

package/board-dist/lib/tickets/types.ts

@@ -0,0 +1,69 @@
+// Board read-path TS types — the §7 projection surface and the board model.
+//
+// Anchors:
+//  - PRD 0001 §7 "Corrected data contract" — the ONLY ticket fields the board
+//    may read/expose (allow-list, SR-5).
+//  - data-model §1/§3 — the four canonical statuses (Alternative B) and their
+//    fixed order. These mirror the columns a remote (github/azure) board is
+//    configured with (to-do/pending, in progress, in review, done) — there is
+//    no "Blocked" status.
+//
+// This module is a leaf (no fs, no yaml) so both the reader and the (future)
+// UI can depend on it without pulling node-only code into the client bundle.
+
+/**
+ * The four canonical ticket statuses, in FIXED render order (data-model §1/§3,
+ * PRD §7 exact spelling). This is the board's own hardcoded copy of the CLI's
+ * `TICKET_STATUSES` — the board is a self-contained project and MUST NOT import
+ * across packages (ADR-0002 §2.6). Column order is derived from THIS enum, never
+ * from `status.yaml`'s `columns` list (which may be absent — ADR-0002 §2.5).
+ */
+export const TICKET_STATUSES = ['Pending', 'In progress', 'To review', 'Done'] as const;
+
+export type TicketStatus = (typeof TICKET_STATUSES)[number];
+
+/**
+ * The §7 `drivers` object. `adr` always present (default `[]`); `prd`/`security`
+ * optional strings, present only when set. Rebuilt by explicit sub-key pick —
+ * never by spreading parsed frontmatter (SR-5).
+ */
+export interface BoardDrivers {
+  adr: string[];
+  prd?: string;
+  security?: string;
+}
+
+/**
+ * The §7 projection of a ticket as the board exposes it (SR-5 allow-list).
+ *
+ * `status` is the AUTHORITATIVE index column (data-model §4 index-wins): it comes
+ * from `status.yaml`'s `tickets[KEY].column`, NOT from the file's frontmatter
+ * `status`. A card in the "Blocked" column shows status "Blocked" even if its
+ * frontmatter still says "Pending".
+ *
+ * The phantom NG-1 fields (priority/phase/created/implementedAt/branch/lastCommit)
+ * and the non-surfaced `slug`/`nonGoals` (R-013) are DELIBERATELY absent — they
+ * are never read and never exposed.
+ */
+export interface BoardTicket {
+  key: string;
+  title: string;
+  status: TicketStatus;
+  dependencies: string[];
+  drivers: BoardDrivers;
+  summary: string;
+  acceptanceCriteria: string[];
+  prUrl?: string;
+  notes?: string;
+}
+
+/** One board column: a status header + the cards placed in it (may be empty). */
+export interface BoardColumn {
+  status: TicketStatus;
+  tickets: BoardTicket[];
+}
+
+/** The whole board model: always the four columns, in the fixed enum order. */
+export interface BoardModel {
+  columns: BoardColumn[];
+}