chore: audit and improve TODO.md and PLANS.md quality #355
Conversation
- Fix git merge conflict in TOON block (renumber t109-t111 to t121-t123) - Resolve t104 ID collision (Tirith renumbered to t124) - Update stale research briefs (t024 Dexter, t029 Weave, t030 progressive-memory, t031 company orchestration) - Decline t099 Neural-Chromium (4 stars, Windows-only) and remove subagent - Remove Neural-Chromium from browser-automation.md decision tree - Add t125 browser-use (77.8k stars) and t126 Skyvern (20.3k stars) as replacements - Update t074 DocStrange brief (1.3k stars, built-in MCP server) - Update t080 voice brief (GPU reality, MiniCPM-o + GPT-4o-Realtime) - Confirm t103 Pi agent review as done - Add Voice Integration Pipeline plan (p019) to PLANS.md - Add SEO Tool Subagents Sprint plan (p020) to PLANS.md - Update TOON summary counts (183 total, 97 pending, 84 done, 2 declined)
WalkthroughThe pull request removes experimental Neural-Chromium browser automation references from documentation and quick-reference tables, resolves merge conflicts in the TODO backlog with task reconciliation, and adds a new SEO Tool Subagents Sprint plan entry to the active planning roster. Changes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Summary of ChangesHello @marcusquinn, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request represents a significant audit and improvement of the project's TODO.md and PLANS.md files. The primary goal was to enhance the quality, accuracy, and clarity of task and plan documentation. This involved resolving merge conflicts, updating detailed briefs for various AI agent and tool evaluations, declining outdated or unviable tasks, and introducing new strategic tasks and plans to guide future development. The changes ensure that the project's roadmap is current and well-defined. Highlights
Changelog
Activity
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
🔍 Code Quality Report�[0;35m[MONITOR]�[0m Code Review Monitoring Report �[0;34m[INFO]�[0m Latest Quality Status: �[0;34m[INFO]�[0m Recent monitoring activity: 📈 Current Quality Metrics
Generated on: Thu Feb 5 23:55:23 UTC 2026 Generated by AI DevOps Framework Code Review Monitoring |
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (2)
todo/PLANS.md (1)
1974-1982:⚠️ Potential issue | 🟠 MajorFix duplicate plan ID and align active_plans index.
p016is already used for “Install Script Integrity Hardening”; reusing it for “Parallel Agents & Headless Dispatch” will break TOON uniqueness. Also ensure this plan is listed in theactive_plansTOON block if it’s meant to be active.TODO.md (1)
76-77:⚠️ Potential issue | 🟠 MajorSync human vs TOON status for t004.
t004is marked done in the human list but stillpendingin the TOON backlog block, which will desync automation and tooling. Please update the TOON entry to match.Also applies to: 347-348
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request provides a comprehensive audit and update of the TODO.md and PLANS.md files. The changes are well-documented in the PR description and align with the project's goals of improving task tracking and planning. I've identified a few minor inconsistencies and redundancies in the markdown files that could be addressed to improve clarity. Overall, this is a great housekeeping effort that improves the quality of the project's documentation.
| - Notes: Review complete. See todo/research/pi-agent-review.md. Key findings: Pi's minimal 4-tool core validates aidevops's on-demand MCP loading. Session trees (branching/rewinding) are interesting but require agent-level support. Recommended: document "remix" skill pattern, add desktop notification pattern for long tasks. | ||
| - Notes: Review complete. See todo/research/pi-agent-review.md. Key findings: Pi's minimal 4-tool core validates aidevops's on-demand MCP loading. Session trees (branching/rewinding) are the most interesting feature aidevops lacks but can't implement without agent-level support. Extension hot-reload is powerful but different architecture from aidevops's markdown subagents. Recommended: document "remix" skill pattern in build-agent.md, add desktop notification pattern for long tasks. Skip: removing MCP, rewriting in TypeScript. |
There was a problem hiding this comment.
There appear to be duplicate notes for task t103. The first note on line 219 is a subset of the more detailed note on line 220. To improve clarity and avoid redundancy, consider keeping only the more comprehensive note.
| - Notes: Review complete. See todo/research/pi-agent-review.md. Key findings: Pi's minimal 4-tool core validates aidevops's on-demand MCP loading. Session trees (branching/rewinding) are interesting but require agent-level support. Recommended: document "remix" skill pattern, add desktop notification pattern for long tasks. | |
| - Notes: Review complete. See todo/research/pi-agent-review.md. Key findings: Pi's minimal 4-tool core validates aidevops's on-demand MCP loading. Session trees (branching/rewinding) are the most interesting feature aidevops lacks but can't implement without agent-level support. Extension hot-reload is powerful but different architecture from aidevops's markdown subagents. Recommended: document "remix" skill pattern in build-agent.md, add desktop notification pattern for long tasks. Skip: removing MCP, rewriting in TypeScript. | |
| - Notes: Review complete. See todo/research/pi-agent-review.md. Key findings: Pi's minimal 4-tool core validates aidevops's on-demand MCP loading. Session trees (branching/rewinding) are the most interesting feature aidevops lacks but can't implement without agent-level support. Extension hot-reload is powerful but different architecture from aidevops's markdown subagents. Recommended: document "remix" skill pattern in build-agent.md, add desktop notification pattern for long tasks. Skip: removing MCP, rewriting in TypeScript. |
| - [ ] t104 Add Tirith terminal security guard for homograph/injection attacks #security #tools #terminal ~2h (ai:1.5h test:20m read:10m) logged:2026-02-03 ref:https://github.com/sheeki03/tirith | ||
| - Notes: Tirith (740 stars, Rust, AGPL-3.0) - terminal security tool that catches attacks browsers block but terminals don't. **30 rules across 7 categories:** 1) Homograph attacks (Cyrillic/Greek lookalikes, punycode, mixed-script). 2) Terminal injection (ANSI escapes, bidi overrides, zero-width chars). 3) Pipe-to-shell (`curl|bash`, `wget|sh`, `eval $(wget ...)`). 4) Dotfile attacks (downloads targeting ~/.bashrc, ~/.ssh/authorized_keys). 5) Insecure transport (HTTP piped to shell, `curl -k`). 6) Ecosystem threats (git clone typosquats, untrusted Docker registries, pip/npm URL installs). 7) Credential exposure (userinfo tricks, shortened URLs). **Integration options:** 1) Add to aidevops setup/onboarding as recommended install. 2) Create tirith.md subagent at tools/security/. 3) Document shell hook setup (`eval "$(tirith init)"`). 4) Consider MCP wrapper for `tirith check` command validation. **Key features:** Sub-millisecond overhead, local-only (no network calls), YAML policy config, bypass with `TIRITH=0` prefix. Install: `brew install sheeki03/tap/tirith` or `npm install -g tirith` or `cargo install tirith`. | ||
| - [ ] t124 Add Tirith terminal security guard for homograph/injection attacks #security #tools #terminal ~2h (ai:1.5h test:20m read:10m) logged:2026-02-03 ref:https://github.com/sheeki03/tirith | ||
| - Notes: Tirith (1,300 stars, Rust, AGPL-3.0) - also see t104 plan: Tirith's `tirith run` command provides verified download-then-execute as the implementation vehicle for curl|sh hardening. - terminal security tool that catches attacks browsers block but terminals don't. **30 rules across 7 categories:** 1) Homograph attacks (Cyrillic/Greek lookalikes, punycode, mixed-script). 2) Terminal injection (ANSI escapes, bidi overrides, zero-width chars). 3) Pipe-to-shell (`curl|bash`, `wget|sh`, `eval $(wget ...)`). 4) Dotfile attacks (downloads targeting ~/.bashrc, ~/.ssh/authorized_keys). 5) Insecure transport (HTTP piped to shell, `curl -k`). 6) Ecosystem threats (git clone typosquats, untrusted Docker registries, pip/npm URL installs). 7) Credential exposure (userinfo tricks, shortened URLs). **Integration options:** 1) Add to aidevops setup/onboarding as recommended install. 2) Create tirith.md subagent at tools/security/. 3) Document shell hook setup (`eval "$(tirith init)"`). 4) Consider MCP wrapper for `tirith check` command validation. **Key features:** Sub-millisecond overhead, local-only (no network calls), YAML policy config, bypass with `TIRITH=0` prefix. Install: `brew install sheeki03/tap/tirith` or `npm install -g tirith` or `cargo install tirith`. |
There was a problem hiding this comment.
The note for task t124 seems to have a fragment from another plan inserted mid-sentence, which makes it difficult to read. Consider rephrasing for clarity.
| - Notes: Tirith (1,300 stars, Rust, AGPL-3.0) - also see t104 plan: Tirith's `tirith run` command provides verified download-then-execute as the implementation vehicle for curl|sh hardening. - terminal security tool that catches attacks browsers block but terminals don't. **30 rules across 7 categories:** 1) Homograph attacks (Cyrillic/Greek lookalikes, punycode, mixed-script). 2) Terminal injection (ANSI escapes, bidi overrides, zero-width chars). 3) Pipe-to-shell (`curl|bash`, `wget|sh`, `eval $(wget ...)`). 4) Dotfile attacks (downloads targeting ~/.bashrc, ~/.ssh/authorized_keys). 5) Insecure transport (HTTP piped to shell, `curl -k`). 6) Ecosystem threats (git clone typosquats, untrusted Docker registries, pip/npm URL installs). 7) Credential exposure (userinfo tricks, shortened URLs). **Integration options:** 1) Add to aidevops setup/onboarding as recommended install. 2) Create tirith.md subagent at tools/security/. 3) Document shell hook setup (`eval "$(tirith init)"`). 4) Consider MCP wrapper for `tirith check` command validation. **Key features:** Sub-millisecond overhead, local-only (no network calls), YAML policy config, bypass with `TIRITH=0` prefix. Install: `brew install sheeki03/tap/tirith` or `npm install -g tirith` or `cargo install tirith`. | |
| - Notes: Tirith (1,300 stars, Rust, AGPL-3.0) is a terminal security tool that catches attacks browsers block but terminals don't. Also see the t104 plan: Tirith's `tirith run` command provides verified download-then-execute as the implementation vehicle for curl|sh hardening. **30 rules across 7 categories:** 1) Homograph attacks (Cyrillic/Greek lookalikes, punycode, mixed-script). 2) Terminal injection (ANSI escapes, bidi overrides, zero-width chars). 3) Pipe-to-shell (`curl|bash`, `wget|sh`, `eval $(wget ...)`). 4) Dotfile attacks (downloads targeting ~/.bashrc, ~/.ssh/authorized_keys). 5) Insecure transport (HTTP piped to shell, `curl -k`). 6) Ecosystem threats (git clone typosquats, untrusted Docker registries, pip/npm URL installs). 7) Credential exposure (userinfo tricks, shortened URLs). **Integration options:** 1) Add to aidevops setup/onboarding as recommended install. 2) Create tirith.md subagent at tools/security/. 3) Document shell hook setup (`eval "$(tirith init)"`). 4) Consider MCP wrapper for `tirith check` command validation. **Key features:** Sub-millisecond overhead, local-only (no network calls), YAML policy config, bypass with `TIRITH=0` prefix. Install: `brew install sheeki03/tap/tirith` or `npm install -g tirith` or `cargo install tirith`. |
| | 1 | t072 Transcription | None | Foundation - most broadly useful | | ||
| | 2 | t071 TTS/STT Models | None (parallel with Phase 1) | Model catalog for other phases | | ||
| | 3 | t081 Local Pipecat | t071, t072 | Local voice agent pipeline | | ||
| | 4 | t080 NVIDIA Nemotron | t081 | Cloud voice agent with open models | |
There was a problem hiding this comment.
The description for task t080 in this table (NVIDIA Nemotron) is inconsistent with its updated title and scope elsewhere in the PR (Set up cloud voice agents and S2S models (GPT-4o-Realtime, MiniCPM-o, Nemotron)). To maintain consistency, please update this entry to reflect the broader scope of the task.
| | 4 | t080 NVIDIA Nemotron | t081 | Cloud voice agent with open models | | |
| | 4 | t080 Cloud voice agents and S2S models | t081 | Cloud voice agent setup | |
1 participant
Summary
Comprehensive audit of TODO.md and PLANS.md to fix conflicts, update stale briefs, and add new plans.
Changes
Bug Fixes
Task Brief Updates
Declined
.agent/tools/browser/neural-chromium.mdsubagent (266 lines)browser-automation.mddecision tree and quick referenceNew Tasks
New Plans (PLANS.md)
Housekeeping
Summary by CodeRabbit
Release Notes
Documentation
Chores