crank/TASKS.md

TASKS

Current

feat/frontend-xss-hardening

Status: in_progress

DoD:

• API-derived data is not inserted into innerHTML without escaping
• shared DOM-safe helpers are introduced for frontend rendering paths that still need markup
• known unsafe rendering paths from __REVIEW_FRONT.md are removed or hardened
• the current UI behavior remains intact after the hardening pass
• targeted frontend smoke checks cover the touched pages

Next

• feat/frontend-shell-unification

Backlog

• feat/frontend-xss-hardening
• feat/frontend-login-simplification
• feat/frontend-settings-honesty-pass
• feat/frontend-command-palette-decision
• feat/frontend-plural-rules
• feat/frontend-template-safety-cleanup
• feat/frontend-shell-unification
• feat/frontend-wizard-modularization
• feat/frontend-build-pipeline
• feat/frontend-css-state-cleanup
• feat/frontend-performance-polish
• feat/frontend-observability-and-testability
• feat/id-display-support
• feat/postgres-pool-config
• feat/postgres-registry-modularization
• feat/sqlx-compile-time-verification
• feat/secret-crypto-hkdf
• feat/typed-timestamps
• feat/error-structure-normalization
• feat/correlation-id-propagation
• feat/runtime-rate-limiting-and-backpressure
• feat/distributed-mcp-session-store
• feat/websocket-test-run-polish
• feat/live-authenticated-staging-entry