Live production audit completed 18 Oct 2026, desktop 1440×900 and mobile 390×844. Canonical URL: https://app.taskl.ie. The supplied apps.taskl.ie address failed to load. Findings were filed during the audit.
14 active QA issues: 8 High, 6 Normal. Focus: whether a community member can join, submit feedback, have it reviewed, plan it and understand delivery—not just alignment.
Grouping: Subtasks are now enabled in the production Paradaux workspace, as requested. All 14 active findings are native children of PAR-457 and carry Production Design QA · 2026-10-18.
| Priority | Issue | User impact |
|---|---|---|
| High | PAR-468 | Anonymous invitation preview crashes with a server exception |
| High | PAR-469 | Signed-in invitation acceptance is rejected by the proxy |
| High | PAR-464 | Mobile drops page actions; cannot create another project or access issue actions |
| High | PAR-467 | Accepting triage removes the request from the queue but leaves Triage status and no decision history |
| High | PAR-459 | First-time GitHub connection has no installation path, only a manual installation ID |
| High | PAR-470 | Sub-issue creation succeeds but parent tree/count stay stale until reload |
| High | PAR-458 | Onboarding invites default to Admin, including shareable links |
| High | PAR-465 | Project reports 158 live issues while Delivery says no production deployment exists |
| Normal | PAR-466 | Full-page and quick-create route new issues into different default statuses |
| Normal | PAR-472 | Public CTA promises commenting after sign-in, but signed-in visitors cannot comment |
| Normal | PAR-462 | Project empty state sends users elsewhere instead of offering Add/Create issue |
| Normal | PAR-463 | Upcoming sprint is called Active, while its burndown says no active sprint with dates |
| Normal | PAR-471 | Already signed-in users get Sign in as the recovery action on a permission denial |
| Normal | PAR-460 | Analytics exposes unreadable raw fractional days for status age |
PAR-461 was withdrawn/canceled: native Playwright accessibility checks disproved an apparent unnamed-navigation defect in the MCP snapshot tool. No app fix requested.
Both viewport sizes were used for:
Confirmed persistence after fresh navigation/reload for issue creation, status changes, comments, voting, project/milestone/sprint assignment, project and milestone creation, sprint creation, a saved filter view, label creation, archive/restore and sub-issue creation. Desktop quick-create, keyboard issue peek, filter/display controls, mobile menu, triage duplicate suggestions and snooze picker were exercised. Board menu movement persisted. Sub-issue persistence passed but immediate UI feedback failed (PAR-470).
Viewer creation/edit/comment controls are restricted as expected and direct creation/settings routes deny access. Invite acceptance blocked the normal join journey; the second test account was added through the existing member-management API in the isolated workspace to complete Viewer checks.
.context/design-qa-20261018/. They are local artifacts, not uploaded attachments. Each finding includes reproduction and expected behavior.This is responsive Chromium browser QA, not physical iOS/Android/Safari testing. Virtual-keyboard and touch-gesture behavior remain unverified. Drag gestures were attempted without a conclusive persisted result; board menu movement was verified instead. External Discord/GitHub authorization, live bot posting, deployment ingestion, email delivery/recovery completion and billing transactions were not executed. Their screens/setup paths were inspected; missing access/configuration is not counted as a pass. Registration was inspected, while test users were created through Keycloak as authorized. Destructive workspace/team deletion was not executed.
Existing broader work (PAR-390 feedback, PAR-450 notifications, PAR-451 core-screen gaps, PAR-452 settings/sharing gaps) was not duplicated merely because those features are unfinished.
The audit is complete and all 14 active findings are Done. GitHub confirms their fixes merged into main: PRs #86, #87–#93, #95–#98, #100 and #101. PAR-461 remains canceled as a disproved finding. Closing this parent to match completed audit/remediation work. The original coverage limits remain; this reconciliation is not a fresh production browser retest and does not independently verify the GitHub App rollout configuration.
Findings filed so far: PAR-458 invite roles default to Admin; PAR-459 GitHub setup continuity; PAR-460 unreadable status age; PAR-461 unnamed mobile navigation. Passed: mobile issue creation, status update, comment submission, and persistence after reload. Initial desktop and mobile screen captures cover core screens and all 17 settings sections. Continuing dialog and populated-state testing.
Confirmed 14 active findings filed: PAR-458–PAR-460 and PAR-462–PAR-472. PAR-461 was canceled after native accessibility-tree verification disproved the initial tool snapshot observation. High-impact discoveries: anonymous invite crash (468), signed-in acceptance proxy rejection (469), mobile page actions missing (464), triage decisions/status/history disagree (467), GitHub installation path missing (459), stale sub-issue creation feedback (470). Viewer testing was unblocked via the existing member-management API in the disposable QA workspace: issue creation/edit/comment are correctly restricted. Temporary invite links and API key are being verified revoked. Coverage and evidence index will be added to the description.
Implementing all 14 confirmed findings as a dependent PR stack, one ticket per PR per repository guidance. Will enable production Sub-issues and attach findings to this parent. Verification will cover Java tests, web lint/types/unit/story suites, plus the affected desktop/mobile journeys. No merges or production deployment are included.
Subtasks are now enabled in production Paradaux. All 14 active QA findings are attached as native children of PAR-457. Other feature flags retain their defaults. The available service REST credential is intentionally read-only across workspaces, so the flag was enabled as a single scoped configuration-row update and child assignment was verified through MCP.
All 14 active QA children now have focused implementation branches in a dependent PR stack. Subtasks are enabled in the production Paradaux workspace and every QA issue is attached natively to this parent. Combined stack checks passed: lint, TypeScript, 1,211 unit tests (one pre-existing skip), 483 Chromium story checks, and the production Next.js/CSS build. Full API verification is still running against isolated local PostgreSQL; invitation/authentication regression tests previously passed. Preparing PRs with diagrams and real desktop/mobile component captures. GitHub installation rollout configuration is documented on PAR-459.
Published all 14 QA fixes as a dependent PR stack. Merge in this order:
Each PR targets the previous branch; the first targets main. All were read back to verify their dependency base and attachment URLs. Local required checks passed: 1,306 API tests, 1,211 active unit tests, 483 Chromium story checks, lint, TypeScript and the production Next.js/CSS build. Final focused story checks also passed after rerunning a test-runner module-fetch failure.
Subtasks are already enabled in production and all 14 issues are attached to this parent. Application fixes await review/merge/deployment. GitHub rollout must configure the App slug and setup URL described on PAR-459. Analytics and access-denied authenticated after-screenshots remain uncaptured; their server behavior has unit coverage. GitHub PR rendering could not be inspected in the browser because its session is signed out of the private repository; bodies and uploaded URLs were verified through the authenticated CLI.
Merged all 14 QA PRs into main in stack order, retargeting each PR after its predecessor landed: #86, #87, #88, #89, #90, #91, #92, #93, #95, #96, #97, #98, #100 and #101. All PR checks passed before the corresponding merges; no protection bypasses were used. Each merged state and destination was verified through GitHub.
The normal production pipelines have been triggered. Superseded queued builds from earlier stack merges were canceled, retaining the latest run per pipeline. Production rollout completion has not been verified. The GitHub App slug/setup URL prerequisite on PAR-459 remains a rollout configuration requirement.
Audit started. Canonical production is https://app.taskl.ie (supplied apps.taskl.ie fails). Disposable account tasklie-qa-20261018 and isolated workspace design-qa-20261018 created. Paradaux rejects parent relations because subtasks are disabled; findings are linked here and reference PAR-457 in their descriptions. Findings so far: PAR-458 (Admin default for invitations).