Repos

Private preview

You're viewing a read-only demo. Access opens one team at a time.

Join the waitlist Back to the site

rafinery

Read-only demoLive view of gallirohik/research-canvas at 1ebb712, scanned 19 September 2026 — nothing here can be edited.

Join the waitlist

gallirohik/research-canvasat 1ebb712, scanned 19 September 2026

research-canvas

github.com/gallirohik/research-canvas0 runs · 5 P0·P1 open

Brain notes

18

cited rules + playbooks

Rules / playbooks

14/4

the brain's two note kinds

Open improvements

14

P0 0 · P1 5 · P2 6 · P3 3

Health

44/100ITERATE

citation freshness vs code trunk · prism verdict

Brain healthingested from brain reposynced 5h ago

44/100ITERATE

Improvementsdebt score 3514 open

P1_download_resource writes the literal string "ERROR" into _RESOURCE_CACHE on any failure, but download_node's re-download test is `if not get_resource(url)` — "ERROR" is a non-empty (truthy) string, so one transient network blip permanently poisons that resource for the life of the process while the UI reports the download as donedownload-error-sentinel-blocks-retry
P1The exact-pinned direct dependency next@15.5.15 has 21 OSV advisories against it (10 high / 9 moderate / 2 low), spanning middleware-bypass, SSRF in Server Actions and rewrites, cache poisoning, XSS and DoS; every one is cleared by upgrading to >= 16.2.11next-dependency-cves
P1Two packages resolved transitively through next@15.5.15 are vulnerable — postcss 8.4.31 (arbitrary file read, path traversal in source-map auto-loading, XSS in stringify output) and sharp 0.34.5 (inherited libvips CVEs); both are fixable now with a pnpm override, without waiting on the next 15 -> 16 majornext-transitive-postcss-sharp-cves