wood-fired-tasks 2.1.1 → 2.3.0

package/AGENTS.md

@@ -68,6 +68,16 @@ Treat these as off-limits unless your task explicitly requires touching them.
 - `/bin/` — gitignored client install artifacts. `bin/tasks.cmd` may contain a **baked-in API key** from a local install; do not commit, share, or read its contents into context.
 - `.planning/`, `.claude/`, `.codex/`, `.agents/`, `.bug-smash-*.md` — gitignored workspace dirs. Not part of the shipped repo; do not rely on them.
 
+## Trust boundary for static / security reviewers
+
+If you are evaluating the **trust** of this checkout (static or security review of a repo you do **not** operate), READ the repo — do **not** execute its host-mutating or package-executing flows. These are intentional, trusted-operator operations and are individually banner-marked at their definition:
+
+- `tasks self-update` / `/tasks:update` ([`skills/tasks/update.md`](skills/tasks/update.md)) — global npm install that mutates the installed CLI.
+- The loop's artifact-level distributable smoke ([`skills/tasks/loop-shared.md`](skills/tasks/loop-shared.md) §O.2b) — `npm pack`, temp-prefix global install, and running the shipped binary.
+- Deployment scripts ([`deploy/`](deploy/README.md)) — `sudo`, systemd service control, DB migrations/restores, production dependency installs.
+
+Running any of the above against an untrusted checkout executes repo-authored code with real side effects. A trust review's job is to read and reason about these paths, never to run them.
+
 ## Deeper docs
 
 | File | One-line purpose |

package/CHANGELOG.md

@@ -11,7 +11,100 @@ vulnerabilities, supply-chain pinning) are always called out under `Security`.
 
 ## [Unreleased]
 
-_No changes yet._
+## [v2.3.0] - 2026-06-27
+
+Security-hardening release remediating issues #74, #72, and #75 (reported by the
+Stafficy agent). All changes are backward compatible — defaults reproduce prior
+behavior.
+
+### Added
+- **Proxy-aware rate limiting** (#75). New `TRUST_PROXY` env var (default **off**;
+  accepts `true`, an integer hop count, or a comma-separated IP/CIDR allowlist)
+  wired into the Fastify factory so `request.ip` derives from `X-Forwarded-For`
+  only when a proxy is trusted. The rate limiter gains an explicit `keyGenerator`
+  that keys on the authenticated principal when present, else `request.ip`.
+- **Per-route auth/device rate limits** (#75). `/auth/login`, `/auth/callback`,
+  `/auth/device/code`, and `/auth/device/verify` get a tighter budget
+  (`RATE_LIMIT_AUTH_MAX`, default 10); `/auth/device/token` gets a looser one for
+  CLI polling (`RATE_LIMIT_DEVICE_TOKEN_MAX`, default 30). `RATE_LIMIT_MAX` and
+  `RATE_LIMIT_TIME_WINDOW` are now part of the validated `src/config/env.ts`
+  schema instead of raw `process.env` reads.
+
+### Security
+- **Slack mrkdwn injection** (#74). User-controlled task/project/comment text
+  (titles, descriptions, names, comment author + body, assignee, tags) is now
+  escaped via a new `escapeSlackMrkdwn` helper before being placed in Slack
+  mrkdwn — including the broadcast notification path. Prevents injected Slack
+  mentions (`<!channel>`) and spoofed links from appearing in trusted-looking
+  notifications. System-owned fields (ids, status/priority enums) are unaffected.
+- **`triggers.yaml` trust boundary enforced** (#72, wft-router). The router now
+  rejects its `triggers.yaml` at startup if it is group/other-accessible
+  (`mode & 0o077`) or, on POSIX, not owned by the router user — the path is
+  realpath-resolved so a benign symlink to an attacker-writable target is also
+  rejected. Closes the gap where `docs/event-router-design.md` documented `0600`
+  enforcement that did not exist. Windows skips the check (documented deployment
+  requirement). Since `triggers.yaml` can run `shell_exec` and arbitrary webhook
+  egress, this restores the documented edit-equals-code-execution trust boundary.
+- **Rate-limit hardening for auth routes** (#75). Sensitive auth/device endpoints
+  no longer share the broad global budget, narrowing brute-force and
+  user-code-enumeration surface; proxy-aware keying prevents all clients behind a
+  reverse proxy from collapsing into one bucket (accidental DoS / uneven
+  protection).
+
+## [v2.2.0] - 2026-06-11
+
+### Added
+- **Guaranteed task sizing.** Every task now carries a server-derived job size
+  so the Configurable-Task-Models `resolve_model` size routing (shipped in
+  v2.1.0) engages on the live backlog, while each task stays honestly
+  *unscored* for WSJF ranking: a deterministic `minutesToTier` mapping,
+  `auto_size` / `boot_sweep` history triggers, a server-internal size-only
+  write path, a `decomp-*` submission-contract gate, auto-sizing of WSJF-less
+  creates, a minutes-vs-jobSize conflict gate, recompute on `update_task` when
+  `estimated_minutes` changes (manual sizes are never clobbered), an idempotent
+  **boot sweep** that backfills NULL job sizes on every server start, and a
+  `wsjf_health` auto-sized-pending finding.
+- **`wft list --status all`** explicit sentinel and a `statusFilter` echo in
+  `--json` output (task #1006). The default `wft list` view already returns
+  every status — open, in_progress, blocked, done, and closed — and the
+  `--help` text now states this plainly so machine consumers don't read a
+  status transition (e.g. open → blocked) as a deleted task. `--status all`
+  is accepted as a self-documenting way to ask for "every status", and the
+  JSON envelope's `metadata.statusFilter` names the effective filter
+  (`all` or the requested status). The default view is unchanged.
+
+### Changed
+- **Configurable Task Models hardening** (PR-#55 review follow-ups, #928–#933):
+  `resolve_model` parity hardening for missing-project and foreign/nonexistent
+  `task_id`; single-sourced `PIPELINE_ROLES` / `FAMILY_LADDER` /
+  `DEFAULT_MODEL_MAP` with a code-level `resolveAuto`; the `modelPolicyService`
+  is now wired once in `createApp` with a memoized global policy and a prepared
+  resolver lookup; the model-catalog wire shape, model-tool definitions, and
+  JSON-column parser are single-sourced.
+- **wft-router**: real-event age gauge, start time, by-kind split, debug
+  pings, and stale-subscription resubscribe; plus an opt-in cold-start sweep
+  that dispatches pre-existing open backlogs so a freshly started router does
+  not miss work created while it was down.
+
+### Fixed
+- **SSE**: close the stream on every server-initiated eviction and align the
+  buffer TTL with the connection age window, so long-lived clients no longer
+  silently go deaf at the eviction boundary (#1001).
+- **Claims**: same-assignee renewal, a `task.claim_released` event, and TTL
+  visibility — long-running workers no longer lose their claim without a signal
+  (#1003).
+- **Atomic block-with-dependency** via `update_task blocked_by`: a `blocked`
+  status without a blocking edge is rejected rather than becoming a dead end
+  (#1004).
+- **Non-interactive `tasks create` / `tasks comment-add` default attribution to
+  the logged-in identity** (task #1007). Scripted runs no longer fail with
+  "Missing required field: created-by" (or `author`) when `--created-by` /
+  `--author` is omitted but credentials are present — the value defaults to the
+  credentials display name (email fallback), the same identity `tasks whoami`
+  reports. The original error is preserved only when no identity can be resolved
+  (no credentials file).
+- **wft-router**: spell the NUL label-separator as a `\u0000` escape rather than
+  a raw byte.
 
 ## [v2.1.1] - 2026-06-09
 
@@ -65,8 +158,9 @@ _No changes yet._
 - **Test suite no longer launches the developer's real browser.**
   `setup.remote.test.ts` drove the device flow with `openBrowser: true`, so
   every `npm test` on a DISPLAY-set desktop spawned `xdg-open` at a mock
-  server. `openBrowser()` now honors `WFT_NO_BROWSER`, set for every test via
-  `vitest.setup.ts`.
+  server. `runDeviceLogin` now takes an injectable `opener` seam (defaulting to
+  the real `openBrowser`); tests inject a stub instead of relying on a global
+  env flag that, if leaked, would silently disable browser login for real users.
 - **Documentation counts drift.** README / `docs/INTERFACES.md` / `docs/MCP.md`
   had stale tool (27 vs 31), route (52/45 vs 59/52), and CLI command (42 vs 45)
   counts, plus a stale "model tools are stdio-only" claim from before remote

package/README.md

@@ -658,7 +658,8 @@ Wood Fired Tasks streams real-time task and project change notifications via Ser
 | task.updated | Task fields modified |
 | task.deleted | Task deleted |
 | task.status_changed | Task status transition |
-| task.claimed | Task claimed by agent |
+| task.claimed | Task claimed by agent (also emitted on a same-assignee claim renewal) |
+| task.claim_released | Stale claim auto-released by the TTL sweep (carries `previous_assignee`, `expired_claimed_at`, `released_at`) |
 | project.created | New project created |
 | project.updated | Project modified |
 | project.deleted | Project deleted |

package/SECURITY.md

@@ -14,11 +14,11 @@ security updates. Older tags are provided as-is.
 | Version           | Supported          |
 | ----------------- | ------------------ |
 | `main` (HEAD)     | :white_check_mark: |
-| `v2.1.1` (latest) | :white_check_mark: |
-| `v1.0` – `v2.0.6` | :x:                |
+| `v2.3.0` (latest) | :white_check_mark: |
+| `v1.0` – `v2.2.0` | :x:                |
 
 "Latest" tracks whichever tag is most recent on GitHub; at the time of
-writing that is `v2.1.1`. If you are reading this on an older checkout,
+writing that is `v2.3.0`. If you are reading this on an older checkout,
 verify the current latest release via
 `git tag --sort=-creatordate | head -1` or the GitHub Releases page.
 

package/dist/api/api-response.d.ts

@@ -94,6 +94,8 @@ export declare function parseTaskResponse(payload: unknown, endpoint: string): {
         verifier_request_id?: string | undefined;
         verified_at?: string | undefined;
     } | null;
+    claim_ttl_minutes?: number | undefined;
+    claim_remaining_seconds?: number | undefined;
 };
 /** Convenience: validate a single project response body. */
 export declare function parseProjectResponse(payload: unknown, endpoint: string): {
@@ -186,6 +188,8 @@ export declare function parseTaskListResponse(payload: unknown, endpoint: string
             verifier_request_id?: string | undefined;
             verified_at?: string | undefined;
         } | null;
+        claim_ttl_minutes?: number | undefined;
+        claim_remaining_seconds?: number | undefined;
     }[];
     total: number;
     limit: number;

package/dist/api/routes/auth/callback.js

@@ -1,8 +1,18 @@
 import { handleCallback } from '../../../services/oidc-client.js';
 import { upsertFromOidc } from '../../../services/user-upsert.js';
 import { toAuthenticatedUser } from '../../plugins/auth/strategies/pat.js';
+import { config } from '../../../config/env.js';
 const callbackRoute = async (fastify, opts) => {
-    fastify.get('/callback', { config: { skipAuth: true } }, async (request, reply) => {
+    // Issue #75 — tighter per-route rate limit (auth surface hardening).
+    fastify.get('/callback', {
+        config: {
+            skipAuth: true,
+            rateLimit: {
+                max: config.RATE_LIMIT_AUTH_MAX,
+                timeWindow: config.RATE_LIMIT_AUTH_TIME_WINDOW,
+            },
+        },
+    }, async (request, reply) => {
         const handshake = request.session.get('oidc.handshake');
         if (!handshake) {
             request.log.error({ requestId: request.id, peerIp: request.ip }, 'oidc.handshake_missing');

package/dist/api/routes/auth/device-code.d.ts

@@ -42,6 +42,16 @@ export interface DeviceCodeRouteOptions {
      * one OIDC_CLIENT_ID; we reject anything else).
      */
     expectedClientId: string;
+    /**
+     * Issue #68 (finding 2) — optional allowlist of hostnames the per-request
+     * verification origin may be built from (sourced from
+     * `env.DEVICE_FLOW_TRUSTED_HOSTS`). When non-empty, a request whose
+     * `Host` / `X-Forwarded-Host` is not in the list is ignored and the
+     * verification URI falls back to the configured {@link origin}. When
+     * empty/undefined (default) every Host is honored — backward compatible.
+     * Hostnames only (no port); the resolver strips any `:port` before matching.
+     */
+    trustedHosts?: readonly string[];
 }
 /**
  * Resolve the origin (`scheme://host[:port]`) the CLIENT used to reach this
@@ -58,10 +68,16 @@ export interface DeviceCodeRouteOptions {
  * is returned ONLY to the same client that sent the request, so a spoofed Host
  * merely misdirects the spoofer. Falls back to `fallback` (the configured
  * origin) when no Host header is present at all.
+ *
+ * Issue #68 (finding 2) — an operator who wants to pin the trust boundary may
+ * pass `trustedHosts` (from `env.DEVICE_FLOW_TRUSTED_HOSTS`). When that list is
+ * non-empty, a Host whose hostname is NOT on it is refused and we fall back to
+ * the configured `fallback` origin rather than echoing an arbitrary header.
+ * When the list is empty/omitted the behavior is unchanged (every Host honored).
  */
 export declare function resolveVerificationOrigin(request: {
     headers: Record<string, string | string[] | undefined>;
     protocol?: string;
-}, fallback: string): string;
+}, fallback: string, trustedHosts?: readonly string[]): string;
 declare const deviceCodeRoute: FastifyPluginAsync<DeviceCodeRouteOptions>;
 export default deviceCodeRoute;

package/dist/api/routes/auth/device-code.js

@@ -1,5 +1,6 @@
 import { z } from 'zod';
 import { createSession } from '../../../services/device-flow-store.js';
+import { config } from '../../../config/env.js';
 /** First value of a possibly comma-joined / array-valued HTTP header. */
 function firstHeaderValue(v) {
     const raw = Array.isArray(v) ? v[0] : v;
@@ -23,12 +24,25 @@ function firstHeaderValue(v) {
  * is returned ONLY to the same client that sent the request, so a spoofed Host
  * merely misdirects the spoofer. Falls back to `fallback` (the configured
  * origin) when no Host header is present at all.
+ *
+ * Issue #68 (finding 2) — an operator who wants to pin the trust boundary may
+ * pass `trustedHosts` (from `env.DEVICE_FLOW_TRUSTED_HOSTS`). When that list is
+ * non-empty, a Host whose hostname is NOT on it is refused and we fall back to
+ * the configured `fallback` origin rather than echoing an arbitrary header.
+ * When the list is empty/omitted the behavior is unchanged (every Host honored).
  */
-export function resolveVerificationOrigin(request, fallback) {
+export function resolveVerificationOrigin(request, fallback, trustedHosts = []) {
     const host = firstHeaderValue(request.headers['x-forwarded-host']) ??
         firstHeaderValue(request.headers['host']);
     if (!host)
         return fallback;
+    // When an allowlist is configured, the Host's hostname (sans :port) must be
+    // on it; otherwise refuse the header and use the configured origin.
+    if (trustedHosts.length > 0) {
+        const hostname = (host.split(':')[0] ?? host).toLowerCase();
+        if (!trustedHosts.includes(hostname))
+            return fallback;
+    }
     const scheme = firstHeaderValue(request.headers['x-forwarded-proto']) ??
         (request.protocol && request.protocol.length > 0 ? request.protocol : 'http');
     return `${scheme}://${host}`;
@@ -44,7 +58,16 @@ const BodySchema = z.object({
     scope: z.string().optional(),
 });
 const deviceCodeRoute = async (fastify, opts) => {
-    fastify.post('/auth/device/code', { config: { skipAuth: true } }, async (request, reply) => {
+    // Issue #75 — tighter per-route rate limit (auth surface hardening).
+    fastify.post('/auth/device/code', {
+        config: {
+            skipAuth: true,
+            rateLimit: {
+                max: config.RATE_LIMIT_AUTH_MAX,
+                timeWindow: config.RATE_LIMIT_AUTH_TIME_WINDOW,
+            },
+        },
+    }, async (request, reply) => {
         // Manual Zod parse so the error envelope matches RFC 8628 verbatim
         // (`{error: 'invalid_request'}`) — Fastify's default 400 carries the
         // `statusCode/error/message` triplet which is not what RFC 8628 wants.
@@ -73,7 +96,7 @@ const deviceCodeRoute = async (fastify, opts) => {
         // #834: build the verification URL from the address the CLIENT connected to
         // (request Host / X-Forwarded-*), not the static configured origin, so a
         // remote/LAN client gets a URL it can actually open instead of localhost.
-        const origin = resolveVerificationOrigin(request, opts.origin);
+        const origin = resolveVerificationOrigin(request, opts.origin, opts.trustedHosts ?? []);
         return reply.code(200).send({
             device_code: session.deviceCode,
             user_code: session.userCode,

package/dist/api/routes/auth/device-html.js

@@ -3,6 +3,7 @@ import { renderDevicePage, renderDeviceApprovedPage } from '../../../web/pages/d
 import { getOrCreateCsrfToken, verifyCsrfToken } from './csrf.js';
 import { requireUser } from '../../plugins/auth.js';
 import { generateToken } from '../../../services/pat-hash.js';
+import { config } from '../../../config/env.js';
 /**
  * Strict alphabet check for `?user_code=`. MUST match the alphabet used by
  * device-flow-store's generator: 31 confusable-free uppercase chars,
@@ -70,7 +71,16 @@ const deviceHtmlRoute = async (fastify, opts) => {
     //   4. Success → approve() then renderDeviceApprovedPage(). Logger emits
     //      `event: device_flow_approved` with the userId — user_code is
     //      DELIBERATELY OMITTED from the log payload (Threat T-30-02-06).
-    fastify.post('/auth/device/verify', { config: { sessionOnly: true } }, async (request, reply) => {
+    // Issue #75 — tighter per-route rate limit (auth surface hardening).
+    fastify.post('/auth/device/verify', {
+        config: {
+            sessionOnly: true,
+            rateLimit: {
+                max: config.RATE_LIMIT_AUTH_MAX,
+                timeWindow: config.RATE_LIMIT_AUTH_TIME_WINDOW,
+            },
+        },
+    }, async (request, reply) => {
         const body = (request.body ?? {});
         // 1. CSRF gate.
         if (!verifyCsrfToken(request, body._csrf)) {

package/dist/api/routes/auth/device-token.js

@@ -1,6 +1,7 @@
 import { z } from 'zod';
 import { findByDeviceCode, remove } from '../../../services/device-flow-store.js';
 import { toAuthenticatedUser } from '../../plugins/auth/strategies/pat.js';
+import { config } from '../../../config/env.js';
 /** RFC 8628 §3.4 grant_type literal. */
 const DEVICE_CODE_GRANT = 'urn:ietf:params:oauth:grant-type:device_code';
 /**
@@ -20,7 +21,19 @@ const deviceTokenRoute = async (fastify, opts) => {
     if (!fastify.hasDecorator('userRepository')) {
         throw new Error('deviceTokenRoute requires userRepository to be decorated before registration');
     }
-    fastify.post('/auth/device/token', { config: { skipAuth: true } }, async (request, reply) => {
+    // Issue #75 — the CLI polls this endpoint every `interval` seconds, so it
+    // gets a looser per-route budget than the other auth routes (still well
+    // below the global max). Env-tunable via RATE_LIMIT_DEVICE_TOKEN_MAX /
+    // RATE_LIMIT_AUTH_TIME_WINDOW.
+    fastify.post('/auth/device/token', {
+        config: {
+            skipAuth: true,
+            rateLimit: {
+                max: config.RATE_LIMIT_DEVICE_TOKEN_MAX,
+                timeWindow: config.RATE_LIMIT_AUTH_TIME_WINDOW,
+            },
+        },
+    }, async (request, reply) => {
         // request.body is either the parsed JSON object OR the formbody plugin's
         // parsed URLSearchParams shape — both surface as plain objects to Zod.
         const parsed = BodySchema.safeParse(request.body);

package/dist/api/routes/auth/login.js

@@ -1,4 +1,5 @@
 import { buildAuthorizationUrl, calculatePKCECodeChallenge, randomNonce, randomPKCECodeVerifier, randomState, } from '../../../services/oidc-client.js';
+import { config } from '../../../config/env.js';
 /**
  * Validates `?next=<path>` for open-redirect safety. Pattern: a SINGLE
  * leading slash followed by ANY character that is NOT another slash AND
@@ -33,7 +34,18 @@ const NEXT_PATH_RE = /^\/[^/\\]/;
  */
 const DEVICE_NEXT_RE = /^\/auth\/device(\?user_code=[A-HJ-KM-NP-Z2-9]{8})?$/;
 const loginRoute = async (fastify, opts) => {
-    fastify.get('/login', { config: { skipAuth: true } }, async (request, reply) => {
+    // Issue #75 — tighter per-route rate limit than the global budget
+    // (brute-force / DoS hardening on the sensitive auth surface). Env-tunable
+    // via RATE_LIMIT_AUTH_MAX / RATE_LIMIT_AUTH_TIME_WINDOW.
+    fastify.get('/login', {
+        config: {
+            skipAuth: true,
+            rateLimit: {
+                max: config.RATE_LIMIT_AUTH_MAX,
+                timeWindow: config.RATE_LIMIT_AUTH_TIME_WINDOW,
+            },
+        },
+    }, async (request, reply) => {
         // Already signed in — short-circuit to /me (the documented home
         // page for authenticated users). Skip the IdP roundtrip entirely.
         if (request.session.get('user')) {

package/dist/api/routes/models/index.d.ts

@@ -1,5 +1,21 @@
 import { FastifyPluginAsyncZod } from 'fastify-type-provider-zod';
 import { z } from 'zod';
+/**
+ * Configurable Task Models (Task 13) — GET /api/v1/models
+ *
+ * Exposes the runtime-discovered Claude model catalog (task #917's
+ * `model-catalog.service`) over REST so the remote MCP proxy / dashboard /
+ * `set-models` interview can enumerate the available models. The 200 body is
+ * `{ models, stale }` — identical to the service's `ModelCatalog` and the
+ * stdio MCP `list_models` tool's structured output.
+ *
+ * `stale: true` signals the catalog was served from the static fallback (no
+ * ANTHROPIC_API_KEY, non-OK Models API response, or a network error). The
+ * service NEVER throws from `list()`, so this route always returns 200.
+ *
+ * Auth: inherits the standard `/api/v1` auth chain (the parent plugin is
+ * mounted inside the `/api/v1` scope that wires `authPlugin`). No custom guard.
+ */
 /** The `{ models, stale }` envelope returned by GET /models. */
 export declare const ModelCatalogResponseSchema: z.ZodObject<{
     models: z.ZodArray<z.ZodObject<{

package/dist/api/routes/models/index.js

@@ -1,4 +1,5 @@
 import { z } from 'zod';
+import { ModelCatalogEntrySchema } from '../../../schemas/model-catalog.schema.js';
 /**
  * Configurable Task Models (Task 13) — GET /api/v1/models
  *
@@ -15,13 +16,6 @@ import { z } from 'zod';
  * Auth: inherits the standard `/api/v1` auth chain (the parent plugin is
  * mounted inside the `/api/v1` scope that wires `authPlugin`). No custom guard.
  */
-/** One discovered model, mirroring `ModelCatalogEntry` from the catalog service. */
-const ModelCatalogEntrySchema = z.object({
-    id: z.string(),
-    display_name: z.string(),
-    family: z.string(),
-    created_at: z.string(),
-});
 /** The `{ models, stale }` envelope returned by GET /models. */
 export const ModelCatalogResponseSchema = z.object({
     models: z.array(ModelCatalogEntrySchema),

package/dist/api/routes/projects/resolve-model.js

@@ -1,5 +1,6 @@
 import { z } from 'zod';
 import { ErrorResponseSchema } from '../tasks/schemas.js';
+import { PipelineRoleSchema } from '../../../schemas/model-policy.schema.js';
 /**
  * Configurable Task Models (Task #926) — GET /api/v1/projects/:id/resolve-model
  *
@@ -21,10 +22,15 @@ import { ErrorResponseSchema } from '../tasks/schemas.js';
  * wires in-process (project policy ?? global default, per-slot merge, jobSize→
  * category routing when `task_id` is supplied).
  *
- * Project-existence is enforced explicitly so a missing project yields a 404
- * ProblemDetails (mirrors the sibling `/:id/topology` and `/:id/dependency-graph`
- * routes). Without the guard an unknown project would resolve to the global
- * default (or null) silently rather than signalling the bad id.
+ * Project-existence is enforced by the resolver itself (task #928): a missing
+ * project throws NotFoundError → 404 ProblemDetails (mirrors the sibling
+ * `/:id/topology` and `/:id/dependency-graph` routes), so an unknown project
+ * never resolves to the global default (or null) silently. The route carries
+ * no separate pre-fetch guard (task #931): the resolver's single project
+ * fetch doubles as the 404 check. The resolver also validates `task_id`: a
+ * nonexistent one throws NotFoundError (→ 404) and one belonging to a
+ * different project throws ValidationError (→ 400), so size-routing can never
+ * silently use a foreign task's jobSize.
  *
  * Auth: inherits the standard projects-route auth chain (the parent
  * `projectRoutes` plugin is mounted inside the `/api/v1` scope that wires
@@ -43,18 +49,21 @@ const resolveModelRoutes = async (fastify) => {
                 'MCP tool output. Read-only.',
             params: z.object({ id: z.coerce.number().int().positive() }),
             querystring: z.object({
-                role: z.enum(['execution', 'validation', 'planning']),
+                role: PipelineRoleSchema,
                 task_id: z.coerce.number().int().positive().optional(),
             }),
             response: {
                 200: ResolveModelResponseSchema,
+                400: ErrorResponseSchema,
                 404: ErrorResponseSchema,
             },
         },
     }, async (request, reply) => {
-        // Existence guard → 404 on a missing project. getProject throws
-        // NotFoundError, mapped to the 404 ProblemDetails by the error handler.
-        fastify.projectService.getProject(request.params.id);
+        // Existence guard → 404 on a missing project: since task #928 the
+        // resolver itself throws NotFoundError (mapped to the 404
+        // ProblemDetails by the error handler), so the former
+        // `projectService.getProject` pre-fetch here was a redundant second
+        // fetch + full inflation of the same row (task #931 — one shared fetch).
         const resolved = fastify.modelPolicyService.resolveModel(request.params.id, request.query.role, request.query.task_id);
         // `resolved` is `{ model } | { model: 'auto' } | null` — sent verbatim so
         // the remote MCP tool is transport-indistinguishable from the stdio one.

package/dist/api/routes/projects/wsjf.js

@@ -104,6 +104,10 @@ const HealthFindingSchema = z.object({
         'stale-time-criticality',
         'high-fallback-ratio',
         'score-churn',
+        'auto-sized-pending',
+        // Task #1004: emitted by check_health (edge-less blocked lint); part of
+        // the shared HealthCheckId union, never produced by the WSJF linter.
+        'blocked-without-edge',
     ]),
     severity: z.enum(['info', 'warning', 'critical']),
     message: z.string(),

package/dist/api/routes/settings/model-policy.js

@@ -48,10 +48,14 @@ const modelPolicyRoutes = async (fastify) => {
         // the clear path persists SQL NULL rather than tripping the service's
         // non-null Zod parse. A non-null body has already passed the
         // `ModelPolicyNullableSchema` body validator (invalid → 400 upstream).
-        fastify.settingsService.setModelPolicyDefault(request.body ?? null);
-        // Echo the persisted policy back so callers get a post-write confirmation
-        // (and round-trip the canonical stored shape).
-        return reply.send(fastify.settingsService.getModelPolicyDefault());
+        const policy = request.body ?? null;
+        fastify.settingsService.setModelPolicyDefault(policy);
+        // Echo the validated body back. `request.body` has already been parsed
+        // through `ModelPolicyNullableSchema` by the route's body validator —
+        // the SAME canonical shape the service just persisted — so re-reading +
+        // re-validating the singleton row here was a redundant round-trip
+        // (task #931). A write failure throws before this line.
+        return reply.send(policy);
     });
 };
 export default modelPolicyRoutes;

package/dist/api/routes/tasks/schemas.d.ts

@@ -31,6 +31,8 @@ export declare const TaskResponseSchema: z.ZodObject<{
     updated_at: z.ZodString;
     version: z.ZodNumber;
     claimed_at: z.ZodNullable<z.ZodString>;
+    claim_ttl_minutes: z.ZodOptional<z.ZodNumber>;
+    claim_remaining_seconds: z.ZodOptional<z.ZodNumber>;
     tags: z.ZodArray<z.ZodString>;
     acceptance_criteria: z.ZodNullable<z.ZodString>;
     verification_evidence: z.ZodNullable<z.ZodObject<{
@@ -88,6 +90,8 @@ export declare const TaskListResponseSchema: z.ZodArray<z.ZodObject<{
     updated_at: z.ZodString;
     version: z.ZodNumber;
     claimed_at: z.ZodNullable<z.ZodString>;
+    claim_ttl_minutes: z.ZodOptional<z.ZodNumber>;
+    claim_remaining_seconds: z.ZodOptional<z.ZodNumber>;
     tags: z.ZodArray<z.ZodString>;
     acceptance_criteria: z.ZodNullable<z.ZodString>;
     verification_evidence: z.ZodNullable<z.ZodObject<{
@@ -145,6 +149,8 @@ export declare const TaskListPaginatedResponseSchema: z.ZodObject<{
         updated_at: z.ZodString;
         version: z.ZodNumber;
         claimed_at: z.ZodNullable<z.ZodString>;
+        claim_ttl_minutes: z.ZodOptional<z.ZodNumber>;
+        claim_remaining_seconds: z.ZodOptional<z.ZodNumber>;
         tags: z.ZodArray<z.ZodString>;
         acceptance_criteria: z.ZodNullable<z.ZodString>;
         verification_evidence: z.ZodNullable<z.ZodObject<{
@@ -210,6 +216,8 @@ export declare const ClaimResponseSchema: z.ZodObject<{
     updated_at: z.ZodString;
     version: z.ZodNumber;
     claimed_at: z.ZodNullable<z.ZodString>;
+    claim_ttl_minutes: z.ZodOptional<z.ZodNumber>;
+    claim_remaining_seconds: z.ZodOptional<z.ZodNumber>;
     tags: z.ZodArray<z.ZodString>;
     acceptance_criteria: z.ZodNullable<z.ZodString>;
     verification_evidence: z.ZodNullable<z.ZodObject<{

package/dist/api/routes/tasks/schemas.js

@@ -21,6 +21,16 @@ export const TaskResponseSchema = z.object({
     updated_at: z.string(),
     version: z.number(),
     claimed_at: z.string().nullable(),
+    /**
+     * Task #1003: claim-TTL visibility. Computed at read time by
+     * `TaskService.getTask` for tasks holding an active claim (in_progress +
+     * assignee + claimed_at); absent otherwise. `claim_remaining_seconds` is
+     * the floor-clamped time until the ClaimReleaseService sweep may
+     * auto-release the claim — renew with a same-assignee `claim` call
+     * before it reaches 0.
+     */
+    claim_ttl_minutes: z.number().int().positive().optional(),
+    claim_remaining_seconds: z.number().int().nonnegative().optional(),
     tags: z.array(z.string()),
     /**
      * Wave 1.3 (task #311): optional free-form acceptance criteria (markdown).

package/dist/api/server.d.ts

@@ -9,7 +9,7 @@ import { TopologyService } from '../services/topology.service.js';
 import { CommentService } from '../services/comment.service.js';
 import { SettingsService } from '../services/settings.service.js';
 import { ModelCatalogService } from '../services/model-catalog.service.js';
-import { type ModelPolicyService } from '../services/model-policy.service.js';
+import type { ModelPolicyService } from '../services/model-policy.service.js';
 import { SSEManager } from '../events/sse-manager.js';
 import { IdempotencyService } from '../services/idempotency.service.js';
 /**