pinwise
Sign in

Docs · Tickets

A ticket is a complete brief

An agent with zero other context should be able to execute it. That is the bar every pinwise ticket is written to.

01Anatomy of a ticket

  1. Target and whyInstalled → target, both release dates, and why this version clears your safe window.
  2. AdvisoriesEvery advisory on the installed version, with severity and the first fixed release.
  3. Breaking changesOnly the ones that touch this repo, researched from changelogs and migration guides.
  4. Files touchedWhere the package is imported or configured, so the agent starts in the right place.
  5. Work planOrdered steps, codemods first, then the hand edits.
  6. Test rulesWhat the agent may and may not do to your tests. Non-negotiable.
  7. Acceptance criteriaWhat the rescan checks. Green only when every line holds.
  8. How to reportcomplete_ticket with the evidence block below. Claims without evidence stay open.
  9. SourcesLinks to every changelog and advisory used, so you can check the research.
get_ticket TDB-0001
# TDB-0001 · Close the Next.js middleware auth bypass

next 14.2.3 → 14.2.33  (P0 · cve · lane L1 web)
Target released 2026-09-12; past the 14-day safe window.

## Advisories
- GHSA-f82v-jwr5-mffw / CVE-2025-29927 (critical): middleware
  auth bypass via x-middleware-subrequest. Fixed in 14.2.25.

## Breaking changes for this repo
None on the 14.2 line.

## Files touched
middleware.ts · next.config.mjs · app/layout.tsx

## Work plan
1. Pin next@14.2.33 in package.json.
2. pnpm install; commit the regenerated lockfile.
3. Add a test for a spoofed x-middleware-subrequest header.

## Test rules
Never delete, skip or loosen a test. Justify every change.

## Acceptance
- [ ] lockfile resolves next@14.2.33
- [ ] no advisories for next on rescan
- [ ] middleware tests pass unchanged

## Report
complete_ticket(id, evidence)  → see /docs/tickets#evidence

02Test rules

  1. 01

    Never delete a test.

    A test that fails after an upgrade is evidence, not an obstacle.

  2. 02

    Never skip, xfail or loosen one.

    No .skip, no wider tolerances, no weaker assertions to go green.

  3. 03

    Change a test only for a documented behaviour change.

    Each change is listed in changed_tests with a one-line reason that matches the sources.

  4. 04

    Run everything before reporting.

    Tests, lint, typecheck and build, with the real output tail.

03Evidence

complete_ticket(id, evidence) takes exactly these fields; unknown keys are rejected. We then fetch your manifests and lockfile at ref and scan them. The scan, not the claim, decides.

Evidence fields
FieldTypeNotes
refstringBranch or commit we rescan. Must be pushed.
versions{ before, after }What the agent believes changed. The rescan decides.
tests.commandsstring[]Every command run, at least one.
tests.result"pass" | "fail"Report failures honestly; a fail is not a verified close.
tests.output_tailstringThe last lines of real output (≤ 20 000 chars).
files_changedstring[]Paths touched by the change.
changed_tests{ path, why }[]Each edited test with its justification.
evidence.json
{
  "ref": "pinwise/TDB-0001-next-14.2.33",
  "versions": {
    "before": "14.2.3",
    "after": "14.2.33"
  },
  "tests": {
    "commands": [
      "pnpm test",
      "pnpm lint",
      "pnpm typecheck",
      "pnpm build"
    ],
    "result": "pass",
    "output_tail": "Test Files  42 passed (42)\n     Tests  318 passed (318)"
  },
  "files_changed": [
    "package.json",
    "pnpm-lock.yaml",
    "middleware.ts"
  ],
  "changed_tests": [
    {
      "path": "middleware.test.ts",
      "why": "Added a case for a spoofed x-middleware-subrequest header (CVE-2025-29927)."
    }
  ]
}

04Lifecycle

  1. openGenerated from a scan

    Red rows always become tickets; amber rows when they carry breaking notes or are 90+ days behind.

  2. in_progressAn agent takes a lease

    start_ticket holds it for 30 minutes; add_note renews.

  3. verifyingEvidence submitted

    complete_ticket queues a rescan of the reported ref.

  4. closed_verifiedThe lockfile proves it

    Installed ≥ target and no advisories. Green tick, verified ref recorded.

  5. reopenedOr the rescan disagrees

    Back to in_progress with what the scan actually saw.

Open1

TDB-0004
Next.js 14 → 15 (hop 1 of 2)
P2L1 webmajor
blocked byTDB-0003

In progress1

TDB-0003
Upgrade React and React DOM to 19
P2L1 webmajor
agent claude-code

Verified1

TDB-0001
Close the Next.js middleware auth bypass
P0L1 webcve

Feature tickets cannot be proven by a scan; they close as closed_claimed with a distinct icon. The green tick is reserved for scan-verified closures.

05Priority

  • P0CVE critical/high
  • P1CVE moderate/low or deprecated
  • P2major behind
  • P3minor with breaking notes
  • P4routine