Issues

• refactor(backend): centralize the dual Lambda/test import fallback (~2 dozen blocks)

  enhancement
  dmeiser/kernelworx#774 · Filter by author dmeiser opened on Oct 17, 2026

• refactor(backend): split admin_operations.py (1838 lines, multiple concerns)

  enhancement
  dmeiser/kernelworx#773 · Filter by author dmeiser opened on Oct 17, 2026

• fix(backend): _parse_product_price accepts non-finite Decimal values (Infinity/inf)

  bug
  dmeiser/kernelworx#771 · Filter by author dmeiser opened on Oct 17, 2026

• Unresolved TODOs remain in the e2e page objects

  dmeiser/kernelworx#766 · Filter by author dmeiser opened on Oct 16, 2026

• _scan_accounts_matches bounds scanned_count by returned items, not evaluated items

  dmeiser/kernelworx#757 · Filter by author dmeiser opened on Oct 16, 2026

• Dependency advisories are unmanaged (23 frontend + werkzeug; no Dependabot/audit gate)

  dmeiser/kernelworx#756 · Filter by author dmeiser opened on Oct 16, 2026

• Disable-MFA re-authentication is client-side only, not a real control (#664)

  dmeiser/kernelworx#754 · Filter by author dmeiser opened on Oct 16, 2026

• Adopt Cognito step-up authentication (ACR/AMR claims) for sensitive operations

  enhancement
  dmeiser/kernelworx#753 · Filter by author dmeiser opened on Oct 16, 2026

• @types/qrcode in production dependencies, unused passkeyCount/mfaEnabled props, and dead reportFormat variable

  dmeiser/kernelworx#751 · Filter by author dmeiser opened on Oct 16, 2026

• Sequential DynamoDB/Cognito queries in loops in list_unit_catalogs.py and admin_operations.py, and 7 sequential tofu output calls in ephemeral-env.sh

  dmeiser/kernelworx#747 · Filter by author dmeiser opened on Oct 16, 2026

• Unpaginated VTL field resolvers for Campaign.totalOrders and Campaign.totalRevenue incur 2*N queries and IEEE-754 float drift

  dmeiser/kernelworx#746 · Filter by author dmeiser opened on Oct 16, 2026

• CatalogsPage and OrdersPage use blocking native window.confirm() for deletions instead of ConfirmDialog

  dmeiser/kernelworx#745 · Filter by author dmeiser opened on Oct 16, 2026

• Duplicated frontend UI sections (UnitInfoSection, CatalogSection), UNIT_TYPES constants, error/phone helpers, and hardcoded version strings

  dmeiser/kernelworx#744 · Filter by author dmeiser opened on Oct 16, 2026

• Duplicated Lambda layer build sequence across 3 files, duplicated export blocks in ephemeral-env.sh, and duplicated jobs in recover-environment.yml

  dmeiser/kernelworx#743 · Filter by author dmeiser opened on Oct 16, 2026

• Account.unitNumber is typed as string instead of number across 4 duplicate Account interfaces

  dmeiser/kernelworx#742 · Filter by author dmeiser opened on Oct 16, 2026

• Duplicate concurrent checkAuthSession() executions on every password login in AuthContext

  dmeiser/kernelworx#741 · Filter by author dmeiser opened on Oct 16, 2026

• useCreateCampaignPageSetup runs duplicate GET_SHARED_CAMPAIGN queries, unused FIND_SHARED_CAMPAIGNS network requests, and a no-op useMemo

  dmeiser/kernelworx#740 · Filter by author dmeiser opened on Oct 16, 2026

• SellerProfile.permissions field resolver issues up to 100 NOOP DynamoDB GetItems per listMyProfiles page instead of runtime.earlyReturn

  dmeiser/kernelworx#739 · Filter by author dmeiser opened on Oct 16, 2026

• ProtectedRoute writes to sessionStorage during render and drops location.search on login redirect

  dmeiser/kernelworx#738 · Filter by author dmeiser opened on Oct 16, 2026

• Inconsistent ACCOUNT# prefix stripping on SharedCampaign.createdBy across resolvers and admin_operations

  dmeiser/kernelworx#737 · Filter by author dmeiser opened on Oct 16, 2026

• RouteErrorBoundary sits inside ErrorBoundary, intercepting all page runtime errors with a chunk-load message and raw error.message

  dmeiser/kernelworx#736 · Filter by author dmeiser opened on Oct 16, 2026

• Inconsistent Cognito transient-error retries, RESOURCE_BUSY error mapping, and AWS client construction across Python handlers

  dmeiser/kernelworx#735 · Filter by author dmeiser opened on Oct 16, 2026

• usePasswordChange only checks length >= 15 instead of enforcing PASSWORD_REGEX character classes

  dmeiser/kernelworx#734 · Filter by author dmeiser opened on Oct 16, 2026

• scripts/ephemeral-env.sh duplicates CloudWatch log-group cleanup without pagination instead of calling cleanup_cloudwatch_log_groups_for_run

  dmeiser/kernelworx#733 · Filter by author dmeiser opened on Oct 16, 2026

• Hand-rolled ID prefixing in Python handlers/utils and lib/prefs_optimistic_lock.js bypasses src/utils/ids.py and lib/ids.js

  dmeiser/kernelworx#732 · Filter by author dmeiser opened on Oct 16, 2026