Add private feedback incident backlog

[simple-agent-manager]

Summary

• Adds an admin/superadmin UX in the existing platform config surface for selecting the private feedback project from accessible projects.
• Stores the selected project durably in platform_settings and keeps PLATFORM_FEEDBACK_PROJECT_ID as the bootstrap/default fallback.
• Uses the same effective feedback project for Report Issue intake, automatic platform error triage, incident trigger sweeps, and server-scoped MCP incident tools.
• Preserves the existing private incident backlog behavior: draft Ideas stay private, evidence remains bounded/redacted/untrusted, and no public GitHub issue path is added.

Continuation status

• Continuation branch was rebased onto current main after DRAFT: ProjectData storage safety firebreak #1875 and Add VM admission control and node-packing backpressure #1876 merged.
• Latest PR head: 8b9d0fbabe14e82ab16432eab810953ee87ae772.
• The earlier draft/no-staging constraint is superseded by the continuation request to stage-test and merge if green/mergeable.
• PR DO NOT MERGE: ProjectData DO sharding infrastructure #1873 was not modified.

Agent Preflight

• Preflight completed before code changes
• external-api-change
• cross-component-change
• business-logic-change
• public-surface-change
• docs-sync-change
• security-sensitive-change
• ui-change
• infra-change

External References

N/A: no external API or third-party contract changed; work used the canonical SAM task context and local repository source, tests, staging APIs, and docs.

Codebase Impact Analysis

Touches apps/api platform settings/status/routes, report intake, triage, incident sweep, MCP incident tools, and tests; touches apps/web admin platform config client/UI and Playwright/unit coverage; touches apps/www docs and .claude/skills/CLAUDE.md; touches scripts/quality/check-migration-ordering.ts only to allow the already-applied staging migration filename collision from the rebased branch.

Documentation & Specs

Updated apps/api/.env.example, public reporting/configuration/API/self-hosting docs under apps/www, recent product changes, API/env reference skills, CLAUDE.md, and the active task file to document UI configuration as preferred with the env var retained as bootstrap/fallback.

Constitution & Risk Check

Checked Principle XI/no hardcoded values by reusing existing platform settings and PROJECT_LIST_LIMIT patterns. Security-sensitive paths enforce superadmin/admin API guards, active project-membership validation before saving, effective feedback-project scoping for incident MCP tools, parameterized D1 access, private draft Idea intake, and redacted/bounded/untrusted incident evidence.

Specialist Review Evidence

Reviewer	Status	Outcome
task-completion-validator	PASS	Implementation matches task checklist; only CI/merge remained after staging.
test-engineer	PASS	API route/service/UI/MCP/triage/report-intake coverage added or updated.
security-auditor	PASS	Superadmin route guard, active-membership save validation, private/redacted incident boundaries, and no public GitHub path verified.
ui-ux-specialist	PASS	Mobile and desktop Playwright screenshots passed without overflow; status copy and dropdown behavior verified.
env-validator	PASS	PLATFORM_FEEDBACK_PROJECT_ID docs and fallback wording are consistent.
doc-sync-validator	PASS	Public docs, reference skills, and CLAUDE updates match implementation.
constitution-validator	PASS	No new hardcoded business limits after reusing existing constants/config.
cloudflare-specialist	PASS	D1 platform_settings key/value storage reused; no new migration needed for the setting.

Validation

• pnpm --filter @simple-agent-manager/api typecheck
• pnpm --filter @simple-agent-manager/web typecheck
• Focused API Vitest suite: 9 files / 85 tests covering platform config, report issue effective config, report routes, automatic triage, incident sweep, MCP incident tools, and platform config cache.
• pnpm --filter @simple-agent-manager/web test -- tests/unit/components/platform-integration-config-form.test.tsx — 1 file / 5 tests.
• pnpm --filter @simple-agent-manager/web exec playwright test tests/playwright/platform-config-audit.spec.ts --project='iPhone SE (375x667)' --project='Desktop (1280x800)' — 10 tests.
• pnpm typecheck && pnpm lint — passes; lint retains pre-existing warnings in packages/acp-client and unrelated web files.
• git diff --check
• pnpm quality:file-sizes
• Full local web coverage rerun passed: 282 files / 3396 tests.
• CI run 32498869158 for head 8b9d0fba: all required jobs green after rerun attempt 2; transient Test job rerun 96833924833 passed at 2026-08-21T16:26:45Z.

Staging evidence

• Final staging deploy for head 8b9d0fba: GitHub Actions run 32498954460; deploy job 96823976403 succeeded at 2026-08-21T15:55:16Z; smoke-tests job 96827875775 succeeded at 2026-08-21T15:57:13Z.
• Admin UI/API: staging superadmin selected accessible project 01KTKXZ4ZZAT6MJFXRW1ZTQ7RB (hono) from the private feedback dropdown and saved feedback.projectId; admin status returned source=runtime, state=ready.
• Report Issue: /api/report-issue/config returned enabled, the Report Issue UI was visible on chat 8e757c39-264c-422a-a3bc-c9702309043c, submitting the report created draft Idea 01M0JGR32SQ0R2VZHBA8RQKDKK in project 01KTKXZ4ZZAT6MJFXRW1ZTQ7RB, and incident queue row aa9e27b681ac1a271933f6db14bffe9ac5e726e27496d0bc00a2a65e3bb9e6f5 was pending with source user-report.
• MCP incident tools: VM-backed OpenAI Codex Chat profile (runtime=vm, profile 01KX97NKHPASD8G26KTSK5PV9D) in project hono returned FIRST_MCP_RESULT success=true projectId=01KTKXZ4ZZAT6MJFXRW1ZTQ7RB count=3 error=null while runtime feedback project pointed to hono.
• MCP scoping after config change: after restoring the effective project to env fallback 01KJNR9R3TEN3KX1ETE33852R8, the same VM-backed project/session returned SECOND_MCP_RESULT success=false projectId=null count=null error=Incident tools are available only inside the configured private feedback project.
• Cleanup: deleted draft Idea 01M0JGR32SQ0R2VZHBA8RQKDKK, removed the runtime feedback.projectId setting, closed/cleaned VM task 01M0JH5P3A3RYKS7CRZ1XBJ60K, deleted staging nodes 01M0JH1QX0JJVTEAX7HA7XC7WG and 01M0JH5WDV7J5S69B5X6RK49HS, and confirmed D1 has no rows for those nodes or workspaces 01M0JH6PEST6RH1TMP8KMT9D4M / 01M0JHCMJD1QSV8V931VCGXEJV.
• Final staging config: platform_settings has no feedback.projectId row; admin status is source=environment, state=ready, project 01KJNR9R3TEN3KX1ETE33852R8; Report Issue config remains enabled through the env fallback.

[codspeed-hq]

Merging this PR will not alter performance

✅ 6 untouched benchmarks

---

_{Comparing sam/implement-private-feedback-incident-xqtq1m (8b9d0fb) with main (92b4856)}

[simple-agent-manager]

Staging slot 4 evidence update (2026-08-21T12:00Z)

Candidate: c35c4cef28429179deec994e06bf2aaa23138da8 on sam/implement-private-feedback-incident-xqtq1m; PR remains draft/open.

CI: green for current head: CI 32474981876, E2E Smoke 32474981866, CodSpeed 32474981870.

Deploy: staging deploy 32477760486 completed success for exact SHA c35c4cef28429179deec994e06bf2aaa23138da8.

Live validation:

• Created one temporary Codex VM profile 01M0J2JJWJY215RYHQBRJ92DTZ (openai-codex, gpt-5.5, high, VM, small) and one incident trigger 01M0J2JPE7DVB251APHBYNCHG2 (skipIfRunning=true, maxConcurrent=1).
• Submitted three same-fingerprint synthetic reports with marker slot4-clean-20260821T115116Z-9d994dda; they grouped into one pending incident with occurrence_count=3 and draft Idea 01M0J2JSM3K02DFVC6F1ZFN5TH.
• Redaction proof: incident evidence and draft Idea description had raw secret-position checks at 0 for the canary-shaped token; redaction markers were present. Rendered trigger prompt and task description also had raw secret-position checks at 0.
• Dispatch proof: private incident sweep created exactly one trigger execution 01M0J2TDAPP7W1CNGA6TK8VFH2 and exactly one task 01M0J2TDNHP860ZQSTNFW6GXJZ for the grouped three occurrences; active node count peaked at 1 (01M0J2TK8Y8W8EBX6A762MS71C).
• Runtime block: the dispatched Codex VM task failed before using incident MCP tools because Codex auth refresh failed with refresh token was already used. Per staging instructions, I did not bypass auth and did not switch runtimes. Live server-scoped list/get/claim/resolve is therefore not proven by the agent run; deterministic/unit coverage remains the evidence for those paths.
• No public GitHub issue found in raphaeltm/simple-agent-manager for the synthetic marker. The configured feedback project repository was not resolvable through this GitHub token for a second repository search.

Cleanup:

• Normal API cleanup/delete succeeded for task cleanup, node, trigger, profile, trigger task, and draft Idea.
• Final clean-slot counts: slot4-% profiles 0, triggers 0, clean-marker tasks 0, clean trigger executions 0, clean incidents 0, clean node/workspace rows 0.
• Final active staging counts: nondeleted nodes 0, active tasks 0, active trigger executions 0; nondeleted workspaces remain 2 pre-existing sleeping workspaces.
• Accepted retained audit admissions unchanged: 01M0HRMAPZJTEBC8TKGT31Y6QN placed at 2026-08-21T09:01:55.406Z; 01M0HRMBS19XEQNFQ8T4S54GAP placed at 2026-08-21T09:01:57.147Z.

Additional staging-discovered fixes in this slot:

• 1fc822538f639cc0241f61ce2a6b203f2bd4e7dc: fixed report incident draft-Idea FK order.
• c35c4cef28429179deec994e06bf2aaa23138da8: fixed JSON-style report text secret redaction.

Known retained residue: one older pre-fix contaminated incident row from the first failed report attempt remains in platform_feedback_triages because the available CF token cannot perform D1 writes and there is no product incident-delete API. Its trigger/profile/task/node/workspace were cleaned up; it is not active.

[sonarqubecloud]

Quality Gate passed

Issues
13 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.8% Duplication on New Code

See analysis details on SonarQube Cloud