North star: Every real problem, security weakness and worthwhile improvement on our sites is found, proven, ranked and waiting in one list any AI can pick up and finish, so the owner never has to find bugs himself. Hard gates (never bend): read-only on the sites under review (no real leads, orders, sign-ups, payments, load tests or exploit attempts); every finding reproduced live in this run with evidence; no secrets, personal or customer data in a finding; never propose rewriting owner-approved copy; user, customer or subscription counts are never a finding; gated-lane fixes ship through a PR and owner approval; security checks stay passive (headers, TLS, public responses, shipped code) and a security finding never contains a secret value or working exploit steps. Everything else is a default. Try a better or unusual way when it serves the north star; record what you changed and why in the change log. Change log: bottom of this page (who, when, why).
The list: https://projects.jbnx.io/#/backlog (sortable; click any row for full detail and a copy-ready block for agents) Write path: agent_ops.backlog_report(handle, item) on the JBNX Supabase project (ngjmqdzpnhwpybtssykz) Jev labels: POST https://ngjmqdzpnhwpybtssykz.supabase.co/functions/v1/jev-triage with header x-actor: 1099:<your handle>
Paste into any agent's scheduler (Claude scheduled task, Cowork, Cursor background agent, Viktor). Fill the three blanks.
Daily bug & feature scan. Follow https://projects.jbnx.io/framework/bug-feature-scan exactly.
SITES: <https://site-one.com>, <https://site-two.com>
HANDLE (fixed, never mint another): <1099:your-handle>
Directive: fetch https://hi.jbnx.io/core once and follow it. Supabase project ngjmqdzpnhwpybtssykz.
Credentials by name only (Supabase Edge secrets, Railway variables); never read or print a value.
Run the Scanner loop (section 3) for every site, write each finding with agent_ops.backlog_report,
then end with the final message from section 3 step 8. No hard stops: one failing page or tool never stops the run.Bug — something that exists is broken, wrong, misleading, inaccessible, insecure, slow, or contradicts what the page promises. Security — a weakness someone could use to read, change or take data, accounts, money or systems (weak headers, insecure transport, secrets or internal endpoints in shipped code, auth or access gaps, risky dependencies). Security beats bug when both fit. Feature — nothing is broken; something missing would help visitors or the business (a clearer path to buy, a missing trust signal, an answer people look for and can't find).
Look for, on desktop (1366px) and phone (390px):
| Area | Checks |
|---|---|
| Works | HTTP status, redirect loops, dead links and images, console errors, forms that never submit or never confirm (watch validation and the request, never send a real lead), buttons that do nothing |
| Looks right | layout breaks at 390px, overlapping or cut-off text, unreadable contrast, missing images |
| Says the right thing | wrong prices or dates, contradictions between pages, stale claims, typos in headlines and buttons |
| Fast | slow first paint or heavy pages (PageSpeed or a timed load), layout shift |
| Findable | title, meta description, canonical, robots, sitemap, Open Graph, structured data |
| Security | HTTPS and redirects, mixed content, security headers (HSTS, CSP, X-Frame-Options, Referrer-Policy), cookies without Secure/HttpOnly, keys or internal URLs in shipped JS, open admin or debug paths (look, never log in or force), outdated libraries with known advisories |
| Accessible | labels on inputs, alt text, keyboard focus, headings in order |
| Missing | the next thing a visitor needs and can't do (feature ideas: say who benefits and how we'd measure it) |
Default limit: up to 10 new findings per site per run, best first. Raise it when a site is new or badly broken, and log why.
/insights if present.jev-triage with {findings:[{title, summary, url, steps, expected, actual, evidence}]}. It returns kind (bug, feature or security), severity, impact (1–5) each with a confidence and distribution."fallback": "low confidence, picked by hand" in jev."fallback": "picked by hand, Jev down", say it once, continue. select agent_ops.backlog_report('<handle>', '<item json, section 4>'::jsonb);
created = new item, seen_again = already open (seen count goes up), regression = it was closed and came back.
select * from agent_ops.v_backlog where project_slug in (...) and task_status in ('todo','blocked'). If one no longer reproduces, say so in the final message with evidence. Do not close it yourself; the worker or verifier closes with proof.POST https://projects.jbnx.io/api/1099/record-usage), release the claims. Final message, 2–5 lines: new / seen again / regressions per site, the top 3 by rank with their links (https://projects.jbnx.io/#/backlog/<id>), and any gaps. Nothing new: one line saying so.| Field | Required | Notes |
|---|---|---|
project | yes | project slug (section 6) |
kind | yes | bug, feature or security (Jev) |
title | yes | 8–200 chars, says what is wrong or wanted: "Contact form Send does nothing on iPhone" |
severity | yes | critical high medium low (Jev) |
impact | yes | 1–5 (Jev) |
url | yes for bugs | exact page |
summary | yes | 1–3 plain sentences a person understands cold |
details.steps | bugs, security | numbered steps that reproduce it (security: the passive check only) |
details.expected / details.actual | bugs | one line each |
details.acceptance | yes | the checks that prove it is done, testable on the live site |
details.evidence | yes | list of strings or {label, url, note} |
details.user_impact / details.business_impact | yes | who it hurts or helps, and how |
details.suggested_fix | if known | the likely fix in one or two lines |
details.area / details.files | if known | page, component, repo path |
details.effort | if known | S, M or L |
details.environment | for bugs | browser, device, viewport |
details.related | optional | links to related items or docs |
details.exposure | security | what could be read, changed or taken, and by whom |
details.category | security | e.g. transport, headers, secrets exposure, access control, dependency |
details.verification | security | the safe one-line re-check that proves it fixed |
details.references | security, optional | advisory or guidance links (OWASP, CVE) |
jev | yes | {kind, severity, impact, model, latency_ms, request_id, fallback?} as returned |
fingerprint | optional | supply one only to merge findings the default would split |
Example:
{"project":"lp-jbnx","kind":"bug","title":"Contact form Send does nothing on iPhone","severity":"high","impact":4,
"url":"https://jbnx.io/contact","summary":"On iPhone Safari, tapping Send on the contact form does nothing and no request is sent.",
"details":{"steps":["Open https://jbnx.io/contact on an iPhone (390px)","Fill every field","Tap Send"],
"expected":"A thank-you message and the lead recorded","actual":"Nothing happens; no network request",
"acceptance":["Form submits on iPhone Safari","Thank-you message shows","Lead appears in the CRM"],
"evidence":["Console: TypeError at contact.js:41"],"user_impact":"Phone visitors cannot reach us",
"business_impact":"Lost leads from most traffic","suggested_fix":"Bind the handler to the form submit event",
"environment":"iOS Safari, 390px","effort":"S"},
"jev":{"kind":{"label":"bug","confidence":0.93},"severity":{"label":"high","confidence":0.71},"impact":{"label":4,"confidence":0.62},"model":"jev-latest"}}rank = severity weight × impact × (0.5 + 0.5 × Jev kind confidence) × type factor severity weight: critical 10, high 6, medium 3, low 1 · type factor: security 1.2, bug 1.0, feature 0.8 · highest possible 60. Task priority from rank: 30+ → P1, 15+ → P2, 6+ → P3, 2+ → P4, else P5. Same fingerprint while open = one item with a rising seen count.
| Host | Project slug |
|---|---|
| fedm8.com, www.fedm8.com | fedm8-net |
| ai.fedm8.com, scan.fedm8.com | fedm8 |
| jbnx.io, www.jbnx.io | lp-jbnx |
| anything else | look it up in portfolio.projects (name, repo) or the estate map (R12) |
select * from agent_ops.v_backlog where task_status = 'todo' and (claimed_by is null or claim_expires_at < now()) order by rank_score desc nulls last limit 5;BF-n).Every change to this framework: who, when, why. Source: agent_ops.catalog_changelog.
| When (UTC) | Who | Version | What | Why |
|---|---|---|---|---|
| 2026-11-08 19:39 | 1099:claude-chat-c1d3 | v3 | Worker pick-up query: rank_score desc nulls last | Postgres sorts nulls first on desc, so the worker query handed agents the 14 older unranked reports before Jev-ranked ones |
| 2026-11-08 19:23 | 1099:claude-chat-c1d3 | v2 | v2: security type (definition, passive checks, item fields exposure/category/verification/references, rank factor 1.2, worker rule) | Owner asked (2026-11-08) to add security to the list alongside bugs and features |
| 2026-11-08 19:23 | 1099:claude-chat-c1d3 | changed: description | Owner asked (2026-11-08) to add security to the list alongside bugs and features | |
| 2026-11-08 17:24 | 1099:claude-chat-c1d3 | v1 | new document version: Bug & feature scan — daily review framework | Owner asked (2026-11-08) for a reusable daily bug/feature scan framework that any AI can run; Jev must be able to route to it |
| 2026-11-08 17:24 | 1099:claude-chat-c1d3 | added to catalog | Owner asked (2026-11-08) for a reusable daily bug/feature scan framework that any AI can run; Jev must be able to route to it |