# qip-ask-qien Backlog

## Issues

### [ISSUE] SEV-1 — Auth privilege escalation in user-management routes
- **Severity:** SEV-1 (Security)
- **Summary:** Expert (non-admin) users can create and promote other users to `admin` because user-management routes guard with `requireExpertApiUser` instead of `requireAdminApiUser`.
- **Source:** Fable model code review — 2026-07-06
- **Status:** open
- **Fix hint:** Swap `requireExpertApiUser` → `requireAdminApiUser` on all user-management API routes; add an integration test asserting a non-admin expert receives 403.

### [ISSUE] SEV-2 — Reliability cluster: no transactions, non-idempotent Inngest agents, dead LLM timeout config
- **Severity:** SEV-2 (Reliability)
- **Summary:** Three related gaps: (1) zero `db.transaction` usage — multi-step writes are not atomic; (2) Inngest agents are non-idempotent on retry — duplicate emails and messages can be sent; (3) `ai_job_timeout_seconds` config key is dead — LLM calls have no enforced timeout.
- **Source:** Fable model code review — 2026-07-06
- **Status:** open
- **Fix hint:** Wrap multi-step DB writes in `db.transaction()`; add Inngest idempotency keys or step-level deduplication; wire `ai_job_timeout_seconds` (or equivalent) into LLM call options.

### [ISSUE] SEV-2 — No test gate on main; highest-risk routes bypass real handlers in tests
- **Severity:** SEV-2 (Testing / CI)
- **Summary:** CI runs no tests — a push to `main` migrates prod and deploys with no gate. The highest-risk routes (`respond`, `status`) are "tested" via inline re-implementations that bypass the real handlers' auth and side effects.
- **Source:** Fable model code review — 2026-07-06
- **Status:** open
- **Fix hint:** Add a GitHub Actions test step before the deploy job; replace inline test re-implementations with real integration tests that call the actual route handlers.


## [CORTEX] https://www.quality-intelligence.co/
- **Source:** www.quality-intelligence.co
- **URL:** https://www.quality-intelligence.co/
- **Added:** 2026-05-23
- **Confidence:** 97%
- **Why:** This is the live production website for Ask QIEN — the exact product being built in qip-ask-qien. The content describes the same ticket lifecycle (submit → AI completeness check → triage/summarize → KB-backed draft → expert review → KB update), same target verticals (medical device, pharmaceutical, food manufacturing), and same core value propositions.
- **Status:** unreviewed## [CORTEX] https://www.reddit.com/r/AiForSmallBusiness/s/vAZIURqu4Q
- **Source:** www.reddit.com
- **URL:** https://www.reddit.com/r/AiForSmallBusiness/s/vAZIURqu4Q
- **Added:** 2026-01-20
- **Confidence:** 85%
- **Why:** The content describes using AI to analyze support feedback (pain clusters) to improve product, operations, and messaging. This directly maps to qip-ask-qien's lifecycle of transforming support tickets into product/knowledge base improvements.
- **Status:** unreviewed## [CORTEX] https://github.com/jamesjlopez/qip-qien/blob/main/docs/feature_ai_observability_and_resilience.md
- **Source:** github.com
- **URL:** https://github.com/jamesjlopez/qip-qien/blob/main/docs/feature_ai_observability_and_resilience.md
- **Added:** 2026-05-12
- **Confidence:** 95%
- **Why:** The URL explicitly references 'qip-qien', which is the underlying project name for 'qip-ask-qien'. The document title focuses on AI observability and resilience, which is critical for a multi-tenant support ticket system.
- **Status:** unreviewed## [CORTEX] https://github.com/jamesjlopez/qip-qien/blob/main/docs/go-to-market.md
- **Source:** github.com
- **URL:** https://github.com/jamesjlopez/qip-qien/blob/main/docs/go-to-market.md
- **Added:** 2026-05-14
- **Confidence:** 100%
- **Why:** The content is the Go-To-Market documentation for the specific repository underlying the qip-ask-qien project.
- **Status:** unreviewed## [CORTEX] https://github.com/jamesjlopez/qip-qien/commit/02f764a8181855d033b438e0a9fd9e3c653a5a87
- **Source:** github.com
- **URL:** https://github.com/jamesjlopez/qip-qien/commit/02f764a8181855d033b438e0a9fd9e3c653a5a87
- **Added:** 2026-05-15
- **Confidence:** 100%
- **Why:** The URL points directly to a commit within the repository for qip-qien (the target project).
- **Status:** unreviewed## [CORTEX] https://github.com/jamesjlopez/qip-qien/commit/33a640cf703ee565ab9be100e9ae29fa846935ee
- **Source:** github.com
- **URL:** https://github.com/jamesjlopez/qip-qien/commit/33a640cf703ee565ab9be100e9ae29fa846935ee
- **Added:** 2026-05-15
- **Confidence:** 100%
- **Why:** The URL points directly to a commit in the repository explicitly associated with the 'qip-ask-qien' project.
- **Status:** unreviewed## [CORTEX] https://podcasts.apple.com/us/podcast/authority-hacker-podcast-ai-automation-for-small-biz/id1073349789?i=1000765510112
- **Source:** podcasts.apple.com
- **URL:** https://podcasts.apple.com/us/podcast/authority-hacker-podcast-ai-automation-for-small-biz/id1073349789?i=1000765510112
- **Added:** 2026-05-12
- **Confidence:** 60%
- **Why:** The podcast topic 'AI Automation for Small Biz' aligns with the goals of qip-ask-qien, specifically in terms of workflows for handling support tickets and business process automation.
- **Status:** unreviewed