Deferred Notes
Items noted during spike work or development that need to be addressed in downstream implementation. Each file is one logical issue. When Jira is available, each file should map to a ticket (add the ticket key to the file's header at that time).
Naming convention
AREA-short-description.md
Examples: kmaps-widget-ux.md, migration-tibetan-unicode.md, api-url-strategy.md
File header
# Title
**Area:** module / feature area
**Raised during:** Spike N / Phase N
**Jira:** (add when available)
**Priority:** High / Medium / Low
Awaiting a team decision
These items are blocked on a group conversation, not on implementation. If you are driving a session and looking for what to pick up, do not start these — put them on the next group-meeting agenda instead.
| File | Area | Raised | Priority |
|---|---|---|---|
| config-export-drift-hand-edited-yaml.md | deployment / CMI / config sync / DX | Session 2026-09-02 (PR #177/#179) | Medium — how should hand-edited config YAML be validated before main, not just at deploy time? |
Open items
| File | Area | Raised | Priority |
|---|---|---|---|
| solr-sync-architecture-d11.md | solr / kmassets / kmterms | Session 2026-06-12 | High |
| solr-pipeline-cost-discussion.md | solr / infrastructure | Session 2026-06-12 | High — ASSIGNED to Yuji, 2026-09-02 (group decision). Original cost question is largely moot (no always-on ECS to right-size); what's left is closing the loop with Dave on the still-open items in kmasset-solr-doc-contract.md §3 — the direct-to-master sink already shipped (1a.8) ahead of confirming those |
| tibetan-search-quality.md | solr / search / i18n | Session 2026-06-15 | Low (post-MVP) |
| reindeer-x-aws-credential-strategy.md | reindeer_x / infrastructure / IAM | Spike 8 | High |
| images-prod-packaging-monorepo-pass.md | deployment / packaging / CI | Sprint 1 (1a) | High |
| images-agent-name-paragraph-title-mapping.md | migration / Images / paragraphs | Sprint 1 (1a) | Medium |
| iiif-cantaloupe-404-information-disclosure.md | infrastructure / security / IIIF | Sprint 1 (1a.5); re-examined 2026-09-18 | Low for the 10 broken images (nid 1-10, legacy S3 key layout -- confirmed test/dev data, not real content, so nothing user-facing is at stake); Medium for the original info-disclosure finding. Not our codebase (Library DevOps/Cantaloupe); root cause understood and a concrete 10-node list exists if ever worth mentioning to them |
| iiif-prefix-alignment-mandala-vs-canonical.md | IIIF / configuration | Sprint 1 (1a.5) | Low |
| migrate-drupal-noise-site-specific-dump.md | migrate / DX | Sprint 1 (1a.6) | Low |
| kmaps-raw-format-rebuild-on-migration.md | migration / KMaps | Sprint 1 (1a.7) | High |
| images-field-image-binary-migration.md | migration / Images / files | Sprint 1 (1a.7) | Low |
| image-descriptions-summary-length.md | migration / Images / content model | Sprint 1 (1a.7) | Low |
| images-rotation-field-support.md | solr / kmassets / Images / write path | Sprint 1 (1a.8) | Medium |
| kmassets-uid-identity-across-migration.md | solr / kmassets / migration / identity | Sprint 1 (1a.8) | High |
| kmassets-uid-consumer-analysis.md | solr / kmassets / migration / identity / clients | Sprint 1 (1a.8) | High |
| kmassets-kmapid-ancestor-id-resolution.md | solr / kmassets / KMaps / write path | Sprint 1 (1a.8) | High |
| images-description-text-format-fidelity.md | migration / Images / text formats | Sprint 1 (1a.8) | Medium |
| images-projects-ss-producer-field.md | solr / kmassets / Images / write path | Sprint 1 (1a.8) | Medium |
| images-iiif-thumb-size-format.md | IIIF / kmassets / Images / write path | Sprint 1 (1a.8) | Low |
| kmassets-sync-error-management.md | solr / kmassets / sync / observability | Session 2026-06-26 | Medium (own downstream sprint; not Sprint 1) |
| jira-issue-tracking-integration.md | process / project tooling / tracking | PM session 2026-06-25 | Medium → High (start after Sprint 1) |
| staging-migration-execution-prerequisites.md | migration / deployment / infrastructure / staging | Session 2026-07-07 (1a.9) | High (blocks 1a.9 staging run) |
| kmassets-audit-hardening.md | solr / kmassets / audit / DX | Session 2026-07-07 (1a.9) | Low–Medium |
| load-staging-baseline-false-clean-on-nonzero-schema.md | migration / tooling / DX / scripts | Session 2026-07-07 (1a.9) | Medium |
| oauth-openid-scope-client-credentials-crash.md | auth / simple_oauth / OAuth2 | Spike 10 | Medium |
| terraform-infrastructure-full-clone-on-every-deploy.md | deployment / CI-CD / pipeline performance | Session 2026-08-26 | DONE 2026-09-02 — group-approved fix landed (--depth 1 --single-branch in deployspec.yml). #162 and the memory_limit fix remain separately scheduled |
| canonical-d7-dev-source-dump.md | migration / source data / environments / DX | Session 2026-08-25 (dev-0 vs DDEV baseline mismatch) | Medium — DECIDED 2026-09-02 (Yuji, ratified by the group): re-cut, with a mandatory team alert on every re-cut. Remaining work is practical (dump identifier, refresh-path testing, alert mechanism), not a decision |
| d7-alias-preservation-scope-beyond-shanti-image.md | migration / Images / URLs / ADR 016 | Session 2026-08-25 (DDEV verification of d7_images_url_alias) |
Medium; the collection part is High. ADR 016 decision 7 makes preserving D7 paths a requirement, and the shipped migration covers shanti_image — 32% of D7's 350,921 alias rows. Satellite aliases (174,430) have no D11 destination since those entities became paragraphs, so dropping is right but should be a recorded decision. Collection aliases (174) now migrate too (verified 174/174, 0 mismatches) and the pages work — public 200 / private 403 / bogus 404. Corrected 2026-08-25: an earlier claim here that "no group role grants view group" was wrong (bad grep — view group$ never matches - 'view group'). Real cause was 174 stale uid=0 group memberships from the pre-fix 2026-07-10 run making anonymous a "member" of every group; check dev-0 for the same rows |
| migration-legacy-nid-required-convention.md | migration / process / DX | Session 2026-07-10 | High — new gap 2026-08-25: field_legacy_nid is NOT unique across sites (D7 nids are per-domain), so the convention as written is insufficient. Latent today because Images is the only migrated collection; becomes a live defect the moment Texts/Sources/AV lands. Decide bundle-scoped lookup vs a field_legacy_site companion before the next migration |
| kmassets-collection-docs-and-facets.md | solr / kmassets / Group collections / write path | Session 2026-07-10 (1b.1) | Medium |
| d7-shared-user-database.md | migration / users / infrastructure | Session 2026-07-10 (1b.1 planning) | Low — user migration DONE (2026-08-12), historical group-ownership FIXED (2026-09-02, 171/171 groups re-owned to real D7 creators), realname-vs-core-fields DECIDED (2026-09-02: core fields, not yet implemented). SAML/NetBadge mapping ASSIGNED to Yuji |
| redis-enterprise-store-location.md | infrastructure / Redis / ADR 014 / SAML session store / Drupal object cache | Session 2026-07-14 (1b.1 part 4) | Medium — TWO stores required (sessions + bigger object cache); dev settled on-box, enterprise location deferred |
| reindeer-x-has-no-ecr-repo-or-pipeline.md | reindeer_x / deployment / CI-CD / ECR / cutover | Session 2026-07-14 (1b.1 part 4) | ASSIGNED to Yuji, 2026-09-02 (group decision). Live-reverified 2026-08-11: reindeer_x has been stopped ~4 weeks (deliberate, not a crash), no live deployment anywhere; the gating "do we need an always-on rdx" question is his to resolve, bundled with the ALB defect below |
| rdx-alb-target-unhealthy-in-production.md | reindeer_x / rdx / ALB / production defect | Session 2026-07-14 (1b.1 part 4) | ASSIGNED to Yuji, 2026-09-02 (group decision), bundled with the always-on-rdx review above. Live defect (9001 vs live 9000), re-verified still unhealthy 2026-08-11; the port fix and other respects stay gated on that review |
| s3-sync-pipeline-deferred-pending-reindeer-x-consolidation.md | deployment / CI-CD / s3-sync / reindeer_x consolidation | Session 2026-08-11 (CI/CD inventory) | Low — DECIDED (2026-08-11, Yuji): deferred. s3-sync/ is empty; its legacy content is already slated for absorption into reindeer_x (Spike 8 Part A) |
| deploy-never-imports-config-sync.md | deployment / Ansible / CMI / dev environment | Session 2026-08-12 (running the user migration) | High — merging to main does not change the site. deploy_backend.yml runs only a --partial SimpleSAMLphp cim; there is no full cim and no updb, so NO config/sync change has ever reached dev-0. 9 items were adrift, incl. ADR 015's content_editor + 4 Group roles (the access model is not actually deployed) and core.extension. Contradicts decision B of 2026-07-16, which was recorded but never implemented |
| solr-proxy-session-id-forwarded-to-solr.md | solr-proxy / hygiene / logging | Session 2026-08-11 (running the proxy to validate pipeline specs) | Low — sid is passed through to Solr (the unset() in setSession() doesn't affect the raw QUERY_STRING that setParams() re-parses), so session ids land in Solr query logs. No access-control impact; fold the fix into the next Searcher.php edit |
| fail2ban-need-and-ownership.md | infrastructure / security / scraper mitigation | Session 2026-07-14, updated 2026-08-05 | Low — an emergency measure vs an active load problem, NOT an architecture; decoupled from D11. Load DID return (2026-08-04 outage) but in a shape fail2ban doesn't address — robots.txt + cache-TTL fixed it instead; see file for detail before assuming "load returned" = "revive fail2ban" |
| d11-dev-database-bootstrap-and-migration-source.md | deployment / database / migration / dev environment | Session 2026-07-15 (1b.1 part 4) | High — bootstrap (A) + D7 source dump/load DONE 2026-07-17; migrate:import now running on dev-0; MIGRATE_SOURCE_DATABASE/MIGRATE_USERS_DATABASE still need persisting into dev-0's container env (currently ad-hoc per-invocation) |
| migrate-group-import-aborts-on-partial-failure.md | migration / DX / tooling | Session 2026-07-17 (first live dev-0 migrate:import) | Medium — --group aborts the whole remaining sequence on any migration's partial failure; blocks a full --group run every time until user migration lands |
| migrate-large-migration-oom-and-resume-behavior.md | migration / infrastructure / DX | Session 2026-07-17/18 (dev-0 first live run) | High — will recur on every large migration until CLI memory_limit is raised persistently; 128M exhausted mid-shanti_image; migrate:reset-status needed to resume; resume re-iterates the FULL source count (no faster than a fresh run) |
| dev-migration-slower-than-ddev-cross-az-latency.md | infrastructure / migration / performance | Session 2026-07-17/18 (dev-0 first live run) | Low — decided to live with it (2026-07-18, Yuji); cross-AZ latency (uniform across dev/staging/prod), not CPU; laptop-then-upload and RDS durability-relaxation both investigated and rejected |
| d7-editor-permissions-og-group-scoped-not-migrated.md | migration / users / roles / Group access architecture | Dev-0 investigation 2026-07-22 | High — D7's real editor permissions are OG group-scoped (per-collection), granted via og_role_permission, not core role_permission (empty for editor/workflow editor/shanti editor); D11's committed content_editor role has zero overlap with real Mandala content types (article/page only) — a sitewide role fix alone can't be faithful |
| simplesamlphp-never-configured-in-ddev.md | infrastructure / DDEV / SAML | Session 2026-08-06 (PR #75 DDEV-readiness check) | Medium — DDEV has only the Drupal-side simplesamlphp_auth config; the SP library itself has never been configured locally (no netbadge-0 equivalent, no SIMPLESAMLPHP_CONFIG_DIR); deliberately deferred, but design the fix (mirror dev's example-auth pattern) rather than bolting on an ad hoc local config.php later |
| adr-015-unanswered-questions-at-merge.md | access / users / migration / ADR 015 | PR #75 merge 2026-08-06 | Q1 RESOLVED — 1(a) confirmed rid 6 (shanti editor) = 0 users on live dev-0 data + 0 code refs (2026-08-06); 1(b) decided (2026-08-07): content_editor migrates empty + hand-assigned, 142 rid-4 editors → plain authenticated. Confirms ADR 015 (no superseding ADR / no code change). Its High follow-through moved to the contributor-tier prerequisite. Q2 DECIDED (2026-08-07): all asset content is group-scoped — no role (authenticated, content_editor, admin) may create content outside a group; grant no core create; faithful to D7's intended model (36 orphans are anomalies → temp review group). Q3 DECIDED (2026-08-07): keep access administration pages (Option B — editors need the toolbar//admin/content), reword checklist to "no admin functionality reachable"; drop administer url aliases from content_editor (keep create url aliases — aliases as content metadata), which removes the one real admin page that was reachable and corrects PR #75's wrong "no administer / alias denied" claim. Needs DDEV cim + route re-verify. All three questions now resolved; remaining work is downstream implementation* |
| authenticated-contributor-crud-not-wired-in-d11.md | access / users / migration / content model | ADR 015 Q1 follow-up 2026-08-07 | High — D7 authenticated users are the contributor tier (CRUD-own on all asset types). D11's authenticated role grants none of it — view-only. Makes ADR 015's "142 editors → authenticated" non-destructive; without it, migrated users can author nothing. Per Q2 (2026-08-07): wire as Group member-role perms (create within groups), NOT core site-wide create; the site-wide floor stays view-only |
| orphaned-content-temp-group-on-migration.md | migration / Group / content model / access | ADR 015 Q2 decision 2026-08-07 | Medium–High — D11 forbids collection-less asset content (Q2), but D7 has orphans (36 shanti_images confirmed in Images prod dump; other types/sites each need a sweep). These anomalies (mistakes / pre-collection legacy) must migrate into a temporary review group — not dropped, not force-fit — for human review (reassign or delete). Check whether 1b.2's membership migration already silently drops them |
| texts-footnotes-production-transform.md | migration / Texts / CKEditor 5 / footnotes | Spike 4b closeout 2026-08-07 | Medium — downstream of the now-Complete Spike 4b (Option 1+3, feasibility proven + prototype). Production build for the Texts migration: book-outline-aware nb{N}/n{N} transform (both markup variants incl. xmlns:i18n ~3.3%), Option 3 Notes-list integration + tests, CKEditor 5 render check, the benign "orphan footnote 1" spot-check, and 2 content outliers (bid=15582/15988). No open technical risk — build-out, not investigation |
| kmassets-production-index-frozen.md | solr / kmassets / production / ingest pipeline | Session 2026-08-13 (Solr index inventory) | Medium–High — observation, not a diagnosis; confirm then decide. Production kmassets has taken no writes since 2025-08-11 (~12 months): core lastModified and newest-doc-per-type agree. KMaps shadows (terms/subjects/places) idle since 2024-05 (~15 months). reindeer_x is up but has created zero jobs ever (newestJob:0); no D7 site has a kmassets write endpoint configured. kmterms by contrast is alive (written 2026-08-11). Changes what "parity with D7" means for cutover; feeds the open reindeer_x always-on review |
| solr-cross-environment-write-targets.md | solr / D7 legacy / environment isolation / production risk | Session 2026-08-13 (Solr index inventory) | Medium — staging→production writes FIXED 2026-09-02 (group decision, executed live: mandala-sources-staging solr server disabled; mandala-av-staging's mandala_library_rw environment repointed off production). Production Visuals → staging remains open, ASSIGNED to Yuji. dev-1's broader un-audited production references (beyond Solr) still have no owner |
| searchstax-defunct-external-solr-config.md | solr / D7 legacy / dead external dependency / credentials / cleanup | Session 2026-08-13 (Solr index inventory) | Medium — vestigial config to remove + one credential to burn. CONFIRMED by Yuji 2026-08-13: the SearchStax/Measured Search instances are long gone, so all config pointing at them is defunct. Still enabled on 4 of 6 prod D7 sites (Images, Texts, Visuals via search_api; AV via apachesolr) and their dev-1 clones. Not inert: Texts logs SearchApiException on every cron run — 4,633 watchdog rows in one 3-hour window on 2026-08-13. Undrainable queues (Images 22,342 pending; Texts 2,170). Shared cleartext solrprod credential in 3 places per site incl. shanti_kmaps_admin_solr_password on all 6 sites — treat as burned |
| pre-deploy-rds-snapshot-gate.md | deployment / Ansible / RDS / database safety | Session 2026-08-17 (config-sync deploy fix follow-up) | Medium now, High before production rollout. The new fail-loud full updb+cim on every deploy has no rollback point of its own beyond the existing 7-day daily RDS backups (up to ~24h stale) — deliberately deferred during active development, but restore mechanics on the shared rds-mysql8-staging instance and the separate Solr-side divergence problem both need designing before this runs against production data |
| spike-solr-demo-enabled-with-anonymous-route.md | search_api / spike hygiene / dev environment / configuration | Session 2026-08-13 (checking what consumes the D11 kmassets index) | Low — ADDRESSED 2026-08-13, one residual open. The D11 search_api.index.kmassets' only consumer was spike_solr_demo (its own info.yml: "Not for production use"), enabled, with route /spike/solr-comparison gated only by access content — anonymously reachable, HTTP 200, arbitrary ?q= — against a production Solr endpoint rather than the dev proxy. Fixed: connector repointed to mandala-index-dev, module uninstalled, server/index config retained (no dependency on it), Spike 2 write-up corrected. Residual OPEN: the connector host is environment-specific config in a shared config/sync — decide the per-env override mechanism before a 2nd D11 environment exists |
| mandala-node-api-no-identity-forwarded-through-json-proxy.md | mandala_node_api / mandala-wp-proxy / solr-proxy / ADR 014 / access | Spike 6, after building the D11 endpoint 2026-08-12 | Medium — DEFERRED (2026-08-12, Than). Every request through the JSON proxy arrives anonymous at mandala_node_api (no identity forwarded, and the client never holds a raw OAuth token — only opaque sid/uid cookies), so private-collection assets can't be fetched via the React app's detail view. Low blast radius today (Images is mostly public); same coherence gap as 1b.3/1b.4, one layer down |
| oauth2-signing-keys-not-persisted-across-deploy.md | deployment / Ansible / simple_oauth / OAuth2 | Session 2026-08-18 (first real browser SAML→OAuth2 walkthrough) | FIXED 2026-08-19 — terraform-infrastructure deploy_backend.yml now bind-mounts keys/ and idempotently generates the keypair only if missing. Verified live post-deploy: correct ownership (www-data:www-data, mode 600), /oauth/authorize no longer 500s. |
| solr-proxy-genericprovider-no-bearer-header-on-userinfo.md | solr-proxy / OAuth2 client / ADR 014 authenticated path | Session 2026-08-18 (first real browser SAML→OAuth2 walkthrough) | FIXED 2026-08-19 — BearerGenericProvider deployed and verified live: a fresh SAML login → OAuth2 exchange confirms the request now carries a correct Authorization: Bearer <jwt> header, and Drupal's simple_oauth authenticates it (X-Consumer-ID: solrproxy in the response). Surfaced a further, independent defect right behind it — see simple-oauth-tokenauthuser-permission-checker-returns-no-permissions.md |
| simple-oauth-tokenauthuser-permission-checker-returns-no-permissions.md | simple_oauth / OAuth2 scope configuration / ADR 014 authenticated path | Session 2026-08-19 (re-verifying the two 2026-08-18 defects after fixing both) | High — blocks the OAuth2-authenticated path entirely, independent of the two defects just fixed. With both prior fixes deployed and working, /oauth/userinfo still returns a login-page redirect instead of JSON. Root-caused precisely by reading simple_oauth 6.1.1's source: Oauth2AccessPolicy::alterPermissions() (the SA-CONTRIB-2025-114 fix) intersects the user's real permissions with only what the token's granted scopes confer via a ScopeGranularity plugin; the openid scope is umbrella: true with no granularity configured, so it grants zero permissions by design — not a Drupal/simple_oauth bug, a scope-configuration gap left over from Spike 10 that nothing had exercised until now. Its own fourth defect is now root-caused too — see the note below |
| option-a-proxy-unavailable-on-standalone-deployments.md | Spike 6 / URL strategy / mandala-om deployment topology / WAF | Session 2026-08-20 (generalizing the /proxy/json gate) |
NARROWED 2026-08-24 — the exposure is Sources-only. First cross-origin test of the other four hosts: texts, images, visuals and audio-video all serve cross-origin JSONP normally; only sources 503s (and specifically so — curl gets 200 even with browser UA/Origin/Referer). Retires the untested assumption that the WAF rule is a general property of the Drupal hosts. mandala-om #79 merged accordingly: proxy routing is now a configurable host list defaulting to Sources. Medium — the decided URL strategy covers only part of the deployment matrix. Option A routes asset JSON through mandala-wp-proxy's same-origin /proxy/json, but that proxy is a WordPress plugin and REACT_APP_WP_PROXY is defined in only 2 of 11 mandala-om env files (.env.tibet.prod/.env.tibet.staging). The standalone builds — including production mandala.kmaps.virginia.edu — have no proxy endpoint and must keep making the direct cross-origin JSONP call that produced the 2026-07-29 Sources 503. Cheapest next step: test whether the WAF actually fires for a browser on the standalone origin (never checked) before designing a fix |
| d11-asset-endpoints-uniform-access-and-authenticated-fetch.md | mandala_node_api + per-site endpoints / SimpleSAMLphp + OAuth2 + Redis / ADR 014 | Than, 2026-08-21, after the Spike 6 endpoint audit | DECIDED 2026-08-26 (Than, confirmed with Yuji) — owned by Than for Sprint 2, no ADR needed. Falls under ADR 010 as a correctness/maintainability improvement with no user-visible behavior change. Two halves: (1) every endpoint gates on the real node access check, public-only by default — mandala_node_api already does this and is the pattern to copy; (2) authenticated users can fetch what they may see, via the SAML→OAuth2→Redis path — D7's AV endpoint already proved this behavior once (via Services module, which D11 won't carry forward), but it's still blocked today by the identity-forwarding gap, so Than will plan this half with Claude, likely via a spike. Lands in Sprint 2 alongside the D11 base theme and the Images IIIF viewer. A confirmed legacy D7 defect motivated the original ask and is tracked privately — ask Than; filed in mandala-legacy-docs, status OPEN |
| endpoint-field-inventories-are-lower-bounds.md | migration / API contracts / mandala_node_api | Spike 6 live verification, 2026-08-21 | Medium — rises to High as each site builds its node-JSON controller. D7's JSON endpoints omit empty fields, so every field inventory in Spike 6 is a lower bound, not a complete contract — absence of a field in a sampled record is not evidence the endpoint never emits it. A D11 controller built to match a sample silently under-implements whatever the samples missed. Two approaches floated (fully-populated test records per content type; programmatic derivation from D7 field definitions), neither chosen |
| images-missing-interactive-viewing-surfaces.md | Images / UI-UX / shanti_iiif / views | Session 2026-08-19 (reviewing live D7 site against the IIIF acceptance criterion) | ◐ Partially resolved — picked up as Sprint 2 Workstream B. D7 has three interactive viewing surfaces Sprint 1's IIIF AC never covered. Item 1 (OpenSeadragon deep-zoom viewer) DONE 2026-09-01 — PR #170, verified against a real migrated image, two real WebGL bugs found and fixed along the way. Items 2 (AJAX sibling carousel) and 3 (masonry/gallery grid) still open, tracked as B2/B3 in docs/sprints/sprint-02-theme-images-ui-and-endpoint-access.md. Other asset types (AV/Sources/Texts) audited since (Workstream C, closed) — none needed their own interactive-surface follow-up beyond what those audits already cover |
| simplesamlphp-checkauthstatus-forces-logout-oauth-and-maybe-browser.md | simplesamlphp_auth / session handling / ADR 014 authenticated path | Session 2026-08-20 (root-causing the 4th OAuth2 defect) | FIXED 2026-08-20 — service override in the new mandala_saml_oauth module exempts OAuth2 Bearer requests from checkAuthStatus()'s SAML-liveness check; verified live on dev-0: the same replay returns 302 → / on the pre-fix image and HTTP 200 application/json on the post-fix image. Two traps recorded: the originally-designed instanceof TokenAuthUserInterface check was a no-op (current_user is an AccountProxy), and the service ID uses underscores. Also documents a separate live finding — SimpleSAMLphp sessions expire at 8h vs Drupal's 23d, force-logging-out ordinary users (upstream MR !48, RTBC, targets our 4.x branch) |
| saml-logout-does-not-terminate-netbadge-idp-session.md | simplesamlphp_auth / SimpleSAMLphp SP config / NetBadge (Shibboleth) | Session 2026-08-20 (re-rooting the browser "logout doesn't work" report) | Medium-High. The former "Case 2", re-rooted: the watchdog evidence blamed on checkAuthStatus() was our own uid-600 test traffic. Actual cause indicated is that the IdP metadata advertises no SingleLogoutService and logout_goto_url is unset, so a Drupal logout never ends the NetBadge session and the next login is silent. Config-only fix, but needs the canonical NetBadge logout URL from UVA ITS and a trusted.url.domains entry; not yet confirmed against the reported symptom |
| saml-session-expires-8h-forcing-logout-mid-session.md | simplesamlphp_auth / SimpleSAMLphp session config / Drupal session config | Session 2026-08-20 (live session-config inspection while fixing the OAuth2 Bearer defect) | Medium-High — open, not started. SimpleSAMLphp sessions expire at 8h (session.duration unset → 28800 default, confirmed from live Redis TTLs) while Drupal's last 23d, so checkAuthStatus() force-logs-out ordinary users mid-session and dumps them on / — losing deep links, and in a path-based multisite potentially landing them on a different site. Upstream MR !48 (RTBC, targets our 4.x) fixes where they land; whether 8h is the right lifetime at all is our call and unmade |
| kmassets-audit-checks-master-not-search-reader.md | solr / kmassets / mandala_kmassets_sync / search_api | Session 2026-08-28 (diacritic-fidelity Solr-side spot check after the dev-0 reindex) | High — ASSIGNED to Yuji, 2026-09-02 (group decision). kmassets:audit --check-stale reported clean (0/0/0) after the 2026-08-27 reindex, but it only validates against the write master (mandala-solr-master-staging-private); the search reader the live app actually queries (mandala-index-dev) is missing 70 of 111,339 docs (confirmed: 4 Tibetan-script-titled nodes return 0 results on the reader, present and correct on the master). Root-cause on Yuji's own timeline, starting with confirming what mandala-index-dev actually is |
| drupal-image-missing-mysql-client.md | deployment / packaging / drush / DX | Session 2026-08-25 (1a.9 acceptance run); documented 2026-08-28 | Medium — fix implemented and locally verified 2026-08-28 on branch fix/drupal-image-drush-path-and-mysql-client, not yet merged/deployed. package/Dockerfile has no mysql/MariaDB client, so any in-container drush sql:* silently no-ops (already caused one real incident: a silently-empty drush sql:dump backup, 2026-08-25). Host-side dumps already route around it via a mysql:8.0 sidecar (scripts/db-checkpoint.sh) and don't need to change. Fix: add default-mysql-client to the existing apt-get install line. One shared image serves dev-0 + staging today, so the fix reaches both on the next deploy; production should get it too (Yuji, 2026-08-28) but has no D11 pipeline yet to deploy through, so it's covered by construction once that pipeline exists. Separately noted: drush itself being "unavailable" is very likely just a PATH issue (no /usr/local/bin/drush symlink), not a real gap |
| av15-avinfo-abandoned-fields-review-with-than.md | migration / AV / content model | Session 2026-09-17/18 (auditing D7's avinfo block for AV15 parity) |
Low, not blocking — a content-model question for Than. avuploader/avrating confirmed empty/unbacked across every real example checked: avuploader has no backing field anywhere anonymous view can find, avrating has real data on only 2 of ~11,583 AV nodes. (avduration, the third field originally filed here, is RESOLVED 2026-09-18 — see below) |
| av15-pbcore-duration-vs-kaltura-duration.md | migration / AV / content model / data fidelity | Session 2026-09-18, wiring up AV15's duration row | Low-Medium, not blocking — D11's display already uses the correct source. Full-corpus check (5,299 AV hosts): PBCore's own field_duration is populated on only 17% of hosts, and of those, 41% disagree with node_kaltura.kaltura_duration (some by only a second, some by minutes). D7's own UI only ever shows kaltura_duration, which D11 now mirrors (field_kaltura_duration); whether/how to reconcile the disagreeing field_duration catalog values is a data-cleanup question for AV cataloging staff/Than, not a D11 defect |
| av4-field-pbcore-language-iso639-conversion.md | migration / AV / content model / search quality | Session 2026-09-09, recommendation never acted on; re-surfaced 2026-09-18 | Medium — a real, currently-live gap is plausible, not just a someday task. Converting field_pbcore_language to ISO 639 codes was recommended before AV8 so Tibetan/Chinese AV content (~3,600 items) would route into Solr's *_bo/*_tibt schema; AV8 shipped without it, and confirmed 2026-09-18 that D11 still stores raw language names with zero kmassets code referencing the field. May mean AV's Tibetan/Chinese content isn't getting the tokenization treatment built for it elsewhere in the index — unconfirmed either way, needs Than/whoever owns the kmassets schema |
| av4-paragraph-ordering-ties.md | migration / AV / content model | Session 2026-09-08, carried unresolved since | Low — data-preserving either way, but an unconfirmed fallback that's been drifting across sessions. 42 hosts still have two field_collection items resolving to the same delta after the en-preferred ordering rule; migration falls back to item_id order, never confirmed with AV cataloguing staff as the intended answer |
| av4-84-und-en-content-differences.md | migration / AV / content model / data fidelity | Session 2026-09-09, flagged then never revisited | Low — a D7 source-data quality question, not a D11 defect. 84 hosts have genuine content differences (not just ordering) between D7's und/en storage layers; the migration's en-preferred default is the right general rule, but nobody has confirmed en's value is actually correct for these specific 84. The original host list isn't preserved anywhere — needs re-deriving before AV staff can review it |
| av2-field-tags-old-label-inconsistency.md | migration / AV / content model | Session 2026-09-08/09, never revisited | Low. field_tags is labeled "Tags Old" and hidden on video, but live "Tags" on audio; migrates as-is per AV2. Unclear whether "Tags Old" means genuinely retired content (hiding it is right) or just an inconsistent label hiding real data — needs AV staff/Than's read |
| av-migration-verify-orphan-count-drift.md | migration / AV / verification tooling | Session 2026-09-21 (regression sweep) | Low — pre-existing, not caused by this session's changes, no known user-facing symptom. scripts/verify-av-migration.sh's "3 expected orphans" check (§3 language-layer edge case) now reads 2; one av_pbcore_format_id paragraph that should be orphaned has a parent. Confirmed NOT caused by the 2026-09-17 instantiation-winner backfill (which only overwrites field values in place, never re-parents) or by anything in this session (zero AV data touched). Root cause unconfirmed — may just be a stale hardcoded expectation in the script |
| collection-featured-images-missing-on-production.md | migration / Images content / local dev environment | Session 2026-09-03; corrected + fixed 2026-09-21 | Low — cosmetic, DDEV-local only, fixed. Corrected scope from a previously-known 16 to 126 of 210 group.field_featured_image references (60%) missing on DDEV; all confirmed still live at D7 and re-fetched via new drush mandala:missing-file-audit --fix. Same-day correction: dev-0 was initially (wrongly) also reported affected — that check used an unverified, incorrect container path; re-checked properly via Drupal's own file_system service and dev-0 had 0 missing files all along. Root cause open — FOR THAN (back 2026-09-24): ruled out any Drupal-level edit as the cause; Than has said these were "custom files" (recalled, not yet independently confirmed) — now reads as a lead about DDEV's own local bootstrap process specifically, not a production-adjacent risk |
Resolved / superseded
| File | Resolved by |
|---|---|
| pipeline-triggers-on-every-monorepo-commit.md | terraform-infrastructure commit 8b753bff1, applied 2026-07-16 (trigger_paths added) |
| group-subgroup-nesting-approach.md | ADR 011 (2026-06-18) |
| group-access-inheritance-subcollections.md | ADR 011 (2026-06-18) |
| group-relationship-delete-broken-no-data-field.md | fix/group-relationship-delete-inherited-field (2026-07-16) — mandala_inherited base field |
| av4-relation-identifier-not-migrated.md | Session 2026-09-17 afternoon — new drush av:backfill-relation-identifier command (mandala_migrations), root-caused as a migration ordering chicken-and-egg (not a fresh mystery), run on DDEV: 6,114 of 6,116 D7 rows resolved D7-nid→D11-nid through the audio/video id maps and set on the already-migrated paragraphs (2 pre-existing D7 data-quality edge cases, not fixed, logged by the command). Verified live against the doc's own reference node |
| av4-instantiation-wrong-winner.md | Session 2026-09-17 evening — found chasing a user report of a missing-items Technical Metadata panel. AvLanguageLayerTrait's single-valued-winner scoring used COUNT(*) instead of counting real (non-NULL, non-'') values, so a completely empty D7 field_pbcore_instantiation item could beat a genuinely populated one; fixed the scoring and backfilled the 307 already-migrated paragraphs that had won wrong (new drush av:backfill-instantiation-winner command). Verified against the doc's own reference node, no revision drift |
avduration (originally part of av15-avinfo-abandoned-fields-review-with-than.md) |
Session 2026-09-18 — re-checked while wiring up the Video/Audio Overview's duration row instead of leaving it out. Not a live Kaltura API read as first assumed: D7 caches it locally in node_kaltura.kaltura_duration, joined via the node's already-migrated Kaltura entry id. New field_kaltura_duration + drush av:backfill-kaltura-duration (mandala_migrations) mirror it into D11. Surfaced a separate, still-open data-cleanup question — see av15-pbcore-duration-vs-kaltura-duration.md |
| migrate-shared-vs-migrate-users-connection-duplication.md | feat/user-migration commit 216579e (2026-07-21) — dropped migrate_shared, repointed mandala_users group at PR #49's migrate_users; PR #45 itself still draft on its remaining (non-duplication) checklist items |
| d7-user-role-migration-wipes-committed-role-permissions.md | fix/user-role-permission-wipe (2026-07-24) — deleted d7_user_role; new array-aware mandala_role_map process plugin maps rids in-process so no entity:user_role save can wipe permissions. Permission-correctness (OG group-scoping) still open separately |
| solr-proxy-has-no-cicd-pipeline.md | Complete 2026-08-12. ECR repo (tf-infra 8e9216b93) + build-only pipeline (d3eb4a76d) + playbook (edb80d9d0), PRs #96/#97/#99. First green build ran all 7 smoke tests in CodeBuild; deployed to dev-0 and the ALB idx target is healthy for the first time since 2026-07-15. Proven end to end: 562,952 docs served with the anonymous fq injected |
| user-migration-run-on-dev0.md | Done 2026-08-12. Code was merged/verified in July but had never been RUN on dev-0 (configs unregistered — see the deploy note). 1,542 users + 1,384 authmap rows created, 0 failed; d7_images_collection_memberships 36/246 → 246/246; users 2 → 1,543; all 22 private groups now have members. Role permissions intact (no #73 regression) |
| solr-proxy-uid1-admin-gets-anonymous-filter.md | Resolved 2026-08-12 — Drupal now decides. Both uid-1 special cases removed; VisibilityTokenBuilder writes a permissive (*:*) token for any account holding one of the three bypass permissions mandala_group_inheritance honours, and the proxy just applies it. Corrected same day to include bypass mandala group access — ADR 015's content_editor holds only that, so the first version let an editor see private content in Drupal but not in search. Fail-closed verified unchanged |
| solr-proxy-session-per-anonymous-request.md | Fixed 2026-08-11 — setSession() now starts a session only for callers with a sid or cookie. Measured 50 anonymous requests → 0 session files (was 1 each); smoke test added and verified to fail against the pre-fix code |
| saml-alb-routing-assumes-mod-shib.md | Closed 2026-08-12 — not ours to action. The authproxy/mod_shib mapping is standard infrastructure Dave provides for installations that use mod_shib; Mandala uses SimpleSAMLphp and never needed it. Told Dave we don't need it; removing it is his call. Nothing in the D11 rebuild depends on it |
| kmassets-sync-hook-fires-during-migration.md | PR #51 (MigrateSyncSubscriber, 2026-07-16) — DDEV-verified then; confirmed live on dev-0's first real migrate:import 2026-07-17 |
| d11-app-has-no-cicd-pipeline.md | Already resolved by terraform-infrastructure commit e7bf08615 (2026-07-14) + follow-ups through 2026-07-16 — this note just never got updated. Live-reverified 2026-08-11: pipeline exists, deploys to staging/dev on every relevant main merge, most recently succeeded 2026-08-07 |
| dev-0-code-config-delivery-rebuild-or-pipeline.md | Same resolution as above — Option B (the real pipeline) is what got built |
| mandala-wp-proxy-json-proxy-open-ssrf.md | Fixed 2026-08-12 — host allowlist + X-Content-Type-Options: nosniff pushed to shanti-uva/mandala-wp-proxy main (v1.0.0 tags the pre-fix state); verified via 8-case allowlist unit test |
| wp-kmaps-mandala-proxy-dependency.md | Requires Plugins header + README note merged via shanti-uva/wp-kmaps PR #2 into release/v1.2.0-rc, 2026-08-12 |
| kmassets-index-has-no-d11-uids.md | Resolved 2026-08-13. solr_master_url/base_url added to config/sync (PR #113) and applied on dev-0; full shanti_image bulk index ran clean (111,340 indexed, 0 errors); kmassets:audit clean. Proven end-to-end with a real user (uid 600, member of 4 private D11 collections): anonymous matches 0 of 25 private docs, the real VisibilityTokenBuilder token matches all 25 |
| simplesamlphp-redis-store-missing-predis.md | Resolved 2026-08-18. PR #119 added predis/predis to drupal/composer.json — SimpleSAMLphp's RedisStore requires it (Predis\Client), distinct from the ext-redis PHP extension already present. Was causing a hard 500 on every /saml_login attempt on dev-0. Deployed and verified live: /saml_login now returns a proper 303 to UVA's real IdP |
| dev-0-needs-test-idp-for-saml-login-testing.md | Resolved 2026-08-18, later the same day. terraform-infrastructure commits 7ee3d2441/34febafd4 wire default-sp to a self-hosted test IdP (gated on SIMPLESAML_ENABLE_EXAMPLE_AUTH) with a core:AttributeMap/name2oid authproc filter fixing the attribute mismatch for all three canned identities at once, plus an authmap link for a real non-admin private-collection user. Proven live: real SAML login → real Drupal session → full OAuth2 authorization-code exchange against solrproxy. Surfaced two further OAuth2 defects, each its own new deferred note |