Issues

• [SEC] ops: rotate the production secrets exposed in a dev session (2026-08-06)

  agora-fed/core#43 · Filter by author marcos-mendez opened on Aug 6, 2026

• [SEC] db: decide how a request scopes its connection, so RLS becomes possible (#14 phase 2)

  agora-fed/core#42 · Filter by author marcos-mendez opened on Aug 6, 2026

• [PERF] reports: first request after a deploy takes 59s — the 6h gasto-parlamentar cache is in-memory and per-process

  agora-fed/core#41 · Filter by author marcos-mendez opened on Aug 6, 2026
  1

• [ADD] web: Playwright coverage for the registration UF→municipality selector

  ADD
  agora-fed/core#40 · Filter by author marcos-mendez opened on Aug 5, 2026

• [FIX] l10n-br: municipality ordering is collation-dependent — accented names sort last in production

  FIX
  agora-fed/core#39 · Filter by author marcos-mendez opened on Aug 5, 2026

• [CI] playwright: replace networkidle waits with explicit assertions in the smoke suite

  CI
  agora-fed/core#37 · Filter by author marcos-mendez opened on Aug 5, 2026
  2

• [IMP] onboarding: don't publish/federate citizens as 'cidadao-<id>' — gate public identity on a completed handle + name

  IMP
  agora-fed/core#36 · Filter by author marcos-mendez opened on Aug 5, 2026

• [ADD] governance: DCO, TRADEMARK/NOTICE, GOVERNANCE, single legal identity, framework security channel, issue/PR templates

  ADD
  agora-fed/core#35 · Filter by author marcos-mendez opened on Aug 5, 2026

• [DOC] decisions+docs: write the 4 pending ADRs, mark ADR-0005/0011 Implemented, fix ROADMAP/PLAN/version drift, add FEDERATION.md

  DOC
  agora-fed/core#34 · Filter by author marcos-mendez opened on Aug 5, 2026

• [REF] web: generate TypeScript DTOs from the served OpenAPI and unify the dual error envelope

  REF
  agora-fed/core#33 · Filter by author marcos-mendez opened on Aug 5, 2026

• [IMP] web+ci: island components are untestable, Playwright never runs in CI, coverage ratchet has no per-crate floor

  IMP
  agora-fed/core#32 · Filter by author marcos-mendez opened on Aug 5, 2026

• [IMP] web: SSG single-build cannot serve per-tenant branding/SEO; resolve the tenant server-side

  IMP
  agora-fed/core#31 · Filter by author marcos-mendez opened on Aug 5, 2026

• [I18N] gateway: pt-BR error payloads and route segments violate ADR-0013; add a localization seam

  I18N
  agora-fed/core#29 · Filter by author marcos-mendez opened on Aug 5, 2026

• [PERF] federation: per-process unbounded caches, inbox_seen without cleanup, unlocked announce sweep break multi-replica

  PERF
  agora-fed/core#28 · Filter by author marcos-mendez opened on Aug 5, 2026
  1

• [PERF] federation: no remote actor/key cache, new client per fetch, per-follower fan-out, non-Create delivery dropped

  PERF
  agora-fed/core#27 · Filter by author marcos-mendez opened on Aug 5, 2026

• [ADD] deploy: third-party install guide + generic values + Helm migration Job + migration hygiene

  ADD
  agora-fed/core#26 · Filter by author marcos-mendez opened on Aug 5, 2026

• [REF] localization: move Brazilian seed out of migrations, fix the dead AGORA_LOCALIZATION/INSTALL_L10N knob, decouple CPF from Tier-0

  REF
  agora-fed/core#25 · Filter by author marcos-mendez opened on Aug 5, 2026

• [REF] core: dyn-compatible AgoraModule trait — fix Space RPITIT, retire the dead Component trait, unblock plugin repos

  REF
  agora-fed/core#24 · Filter by author marcos-mendez opened on Aug 5, 2026

• [REF] gateway: stop reading/writing component-owned tables directly (scorecard, consequence, consultations)

  REF
  agora-fed/core#23 · Filter by author marcos-mendez opened on Aug 5, 2026

• [REF] gateway: extract domain modules (participatory budget, campaign, commitments) into Tier-2 crates with outbox

  REF
  agora-fed/core#22 · Filter by author marcos-mendez opened on Aug 5, 2026

• [PERF] consensus: CPU model inference blocks the tokio runtime; shared 16-conn pool for HTTP + background

  PERF
  agora-fed/core#21 · Filter by author marcos-mendez opened on Aug 5, 2026

• [IMP] worker: no leader election with 2+ replicas — duplicate emails/notifications; adopt claim-first sweeps

  IMP
  agora-fed/core#20 · Filter by author marcos-mendez opened on Aug 5, 2026

• [IMP] events: per-subscriber dispatch drops events (processed_at is row-global) and has no dead-letter

  IMP
  agora-fed/core#19 · Filter by author marcos-mendez opened on Aug 5, 2026

• [SEC] rate-limit: shared durable store, per-credential OTP/TOTP throttling, trusted client-origin

  SEC
  agora-fed/core#17 · Filter by author marcos-mendez opened on Aug 5, 2026
  1

• [SEC] lgpd: allowlist the data-subject export and complete erasure via a declarative PII registry

  SEC
  agora-fed/core#16 · Filter by author marcos-mendez opened on Aug 5, 2026
  1