Issues

• Python auth layer assumes unprefixed caller ids, so the authoritative prefixed form is denied

  dmeiser/kernelworx#660 · Filter by author dmeiser opened on Sep 30, 2026

• _update_shares_after_transfer swallows every failure, so a transfer can report success while leaving all collaborators locked out

  dmeiser/kernelworx#549 · Filter by author dmeiser opened on Sep 27, 2026

• ID-prefix normalization is hand-rolled in 45 resolvers; lib/ids.js is used by one, and three owner verifiers already disagree

  dmeiser/kernelworx#534 · Filter by author dmeiser opened on Sep 27, 2026

• Four fully-deployed GraphQL operations (requestCampaignReport, shareProfileDirect, listUnitCatalogs, listUnitCampaignCatalogs) have no frontend caller

  dmeiser/kernelworx#528 · Filter by author dmeiser opened on Sep 27, 2026

• validation.py, responses.py and appsync_types.py are ~1075 lines of production-dead Python held at 100% coverage by their own test files

  dmeiser/kernelworx#527 · Filter by author dmeiser opened on Sep 27, 2026

• SellerProfile.unitType whitelist is unreachable on every path, and a test asserts the unreachable code works

  dmeiser/kernelworx#520 · Filter by author dmeiser opened on Sep 27, 2026

• updateMyPreferences overwrites the whole preferences blob with no lock, silently deleting the user's paymentMethods

  dmeiser/kernelworx#510 · Filter by author dmeiser opened on Sep 27, 2026

• auto_verified_attributes=["email"] defeats the pre-signup account-linking fail-closed guard

  dmeiser/kernelworx#503 · Filter by author dmeiser opened on Sep 27, 2026