Epic: 2026-08-10 Full Platform Audit Remediation

[b-at-neu]

Tracking issue for the 2026-08-10 full platform audit. 56 issues, grouped into the recommended build sequence.

Method: eight parallel static audits (permissions, business logic, design, links, DRY, GitHub history, workflows, build/CI) plus a live click-through — local Postgres, migrations, seed, and hand-built fixtures covering every PositionStatus and ApplicationStatus, walked as anonymous, applicant, manager and admin. Findings are tagged verified-live, verified-in-code, or plausible in each issue.

Headline: the codebase is in good shape — CI passes hard-clean, zero any, no Prisma in client components, and reviewer-side authorization held up under attack. The defects cluster in one place: the applicant write path checks ownership everywhere and status almost nowhere.

---

Wave 1 — Critical correctness (claude + ready)

All five reproduced live against a running instance.

• Gate Application Answer Writes and Submission on Application Status #345 Gate Application Answer Writes and Submission on Application Status
• Block Withdrawing Accepted or Rejected Applications #346 Block Withdrawing Accepted or Rejected Applications
• Validate Position Status, Window, and Deletion in Reopen #347 Validate Position Status, Window, and Deletion in Reopen
• Exclude Soft-Deleted and Draft Positions From Application Queries and Counts #348 Exclude Soft-Deleted and Draft Positions From Application Queries and Counts
• Hide Unsubmitted Draft Applications From Reviewers #349 Hide Unsubmitted Draft Applications From Reviewers

Wave 2 — Foundations for everything after

• Extend the Seed to Cover Every Position and Application State #383 Extend the Seed to Cover Every Position and Application State — highest leverage in the backlog; every Wave 1 defect lives in a state the seed cannot currently produce
• Introduce a Test Runner and Cover Authorization, Transitions, and Dates #384 Introduce a Test Runner and Cover Authorization, Transitions, and Dates
• Add Shared Authorization Helpers and Standardize Denial Handling #356 Add Shared Authorization Helpers and Standardize Denial Handling — land before new authorization code is written
• Add Missing Database Indexes #385 Add Missing Database Indexes
• Upgrade Next.js and Plan the Neon Auth Upgrade #386 Upgrade Next.js and Plan the Neon Auth Upgrade

Wave 3 — Data integrity and trust

• Standardize Dev-Bypass Environment Checks on isBypassAllowed #350 Standardize Dev-Bypass Environment Checks on isBypassAllowed
• Derive Answer Question Labels Server-Side and Verify Question Ownership #351 Derive Answer Question Labels Server-Side and Verify Question Ownership
• Validate Answer Values Against Question Options and Add Length Limits #352 Validate Answer Values Against Question Options and Add Length Limits
• Move Draft Application Creation Out of the Apply Page Render #353 Move Draft Application Creation Out of the Apply Page Render
• Preserve Stored Answers When a Question Type or Options Change #354 Preserve Stored Answers When a Question Type or Options Change
• Keep In-Progress Drafts Submittable After a Global Question Is Added #355 Keep In-Progress Drafts Submittable After a Global Question Is Added
• Restrict searchUsers to Managers and Admins #357 Restrict searchUsers to Managers and Admins
• Prevent Managers From Removing Themselves as Position Manager #358 Prevent Managers From Removing Themselves as Position Manager
• Revoke Access Immediately When a User Is Deactivated #388 Revoke Access Immediately When a User Is Deactivated

Wave 4 — The position policy epic

• Design the Position Edit Policy #398 Design the Position Edit Policy — the design that governs the rest of this wave
• Managers cannot see Draft positions #340 Managers cannot see Draft positions (existing issue; audit scope added as a comment)
• Build the Position Detail View for Draft and Closed Positions #359 Build the Position Detail View for Draft and Closed Positions
• Make Archived Positions Read-Only for Managers #360 Make Archived Positions Read-Only for Managers
• Let Managers Create Positions From the UI #361 Let Managers Create Positions From the UI
• Remove or Wire Up deletePosition #362 Remove or Wire Up deletePosition

Wave 5 — Application lifecycle experience

• Make Withdrawn Applications Editable and Replace Reopen With Resubmit #363 Make Withdrawn Applications Editable and Replace Reopen With Resubmit
• Add an Application Status Transition Graph With Next-Step Quick Actions #364 Add an Application Status Transition Graph With Next-Step Quick Actions
• Warn Before Bulk Status Changes and Report Skipped Rows #365 Warn Before Bulk Status Changes and Report Skipped Rows
• Disable the Status Control for Withdrawn Applications #366 Disable the Status Control for Withdrawn Applications
• Add a Read-Only Application View for Applicants #367 Add a Read-Only Application View for Applicants
• Redirect Applicants to My Applications After Submitting #368 Redirect Applicants to My Applications After Submitting
• Make Draft Deletion Recoverable, Preserving Historical Answers #369 Soft-Delete Draft Applications via Resurrect and Re-Snapshot

Wave 6 — Navigation and routing

• Preserve the Return Destination Through Every Auth Redirect #370 Preserve the Return Destination Through Every Auth Redirect
• Show Applicants the Profile Blocker in Place Instead of Redirecting #371 Explain the Profile Completeness Redirect Instead of Silently Bouncing
• Render the Not Found Page Inside the App Shell #372 Render the Not Found Page Inside the App Shell
• Stop Rendering Managed Positions Twice on the Positions Page #373 Stop Rendering Managed Positions Twice on the Positions Page
• Split the Sidebar Into Apply and Manage Sections #374 Split the Sidebar Into Apply and Manage Sections
• Give Position Managers a Manager Dashboard #375 Give Position Managers a Manager Dashboard
• Fix date/timezone model for positions and applications #339 Resolve issue with time selection display (existing issue; agreed date/timezone model added as a comment)

Wave 7 — Design, accessibility, polish

• Fix Status Badge Contrast to Meet WCAG AA #376 Fix Status Badge Contrast to Meet WCAG AA
• Give Every Form Input an Accessible Label #377 Give Every Form Input an Accessible Label
• Mobile Layout Pass — Users Page, Dashboard, Tables and Filters #378 Fix Touch Targets and Mobile Layout on the Users Page
• Add a Global Error Boundary and Remove the Duplicate Route-Group One #379 Add a Global Error Boundary and Remove the Duplicate Route-Group One
• Add Confirmation to Admin Promotion and Question Deletion #380 Add Confirmation to Admin Promotion and Question Deletion
• Reduce Extra Spacing in the Edit Question Dialog #381 Reduce Extra Spacing in the Edit Question Dialog
• Support Markdown in Position Descriptions #382 Support Markdown in Position Descriptions

Wave 8 — Architecture and hygiene

• Remove Dead Code and Unused Dependencies #390 Remove Dead Code and Unused Dependencies
• Strengthen ESLint, TypeScript, and CI Configuration #391 Strengthen ESLint, TypeScript, and CI Configuration
• Extract a Shared DataTable and Section Card #392 Extract a Shared DataTable and Section Card
• Share the Remaining Authorization Scope Copies in Application Actions #393 Extract Shared Authorization Scopes for Application Queries
• Unify the Two Answer Editors #394 Unify the Two Answer Editors
• Add Pagination to the Applications Hub #389 Add Pagination to the Applications Hub
• Add an Account Deactivated Screen and Admin Reactivation #387 Add an Account Deactivated Screen and Admin Reactivation

Wave 9 — Documentation and process

Written against the decided target state, not current behaviour.

• Document the Permissions Model #395 Document the Permissions Model
• Document the Official User Workflows #396 Document the Official User Workflows
• Add a Full Review Claude Command #397 Add a Full Review Claude Command

Deferred by decision

Recorded for visibility; not current scope.

• Add Application Status Event Tracking #399 Add Application Status Event Tracking
• Add Email Notifications for Application Events #400 Add Email Notifications for Application Events

---

Decisions taken during the audit

Topic	Decision
Hosting	Vercel always — the dev-bypass gap is not exploitable in production, but Preview remains an exposure surface
Submitted applications	Not editable by the applicant; withdraw first, edit, resubmit
Editable statuses	draft and withdrawn — withdrawn stays visible to reviewers, draft never is
Terminal states	accepted/rejected cannot be withdrawn by the applicant, but are reversible by a reviewer
Question editing	Fully editable; submitted snapshots preserved permanently; drafts and withdrawn must answer new questions
Dates	Authored as Eastern calendar days, displayed in the viewer's timezone
Manager rights	May appoint peers; may not remove themselves
Archived positions	Read-only for managers; admins exempt
Bulk updates	Exempt from the transition graph, but must warn and report skipped rows
Last admin	No invariant — self-demotion is already blocked, the mutual-demotion race is accepted
Scale	Pagination ticketed, not prioritized; indexes go in early regardless
Testing	Test runner introduced, authorization scopes covered first

Disproven during the audit

Four reported "criticals" were tested and found false — recorded so they are not re-raised:

1. text-destructive-foreground does resolve; measured 5.11:1, passes AA
2. <SelectItem value=""> does not crash the applications toolbar on the installed Radix version
3. Managers do not lose Edit/Applications links on managed position cards
4. app/(main)/error.tsx is the legitimate route-group boundary — only the nested (auth) copy is redundant