Loading issues
Code-quality audit finding 4. PlatformAuthConfig falls back to unsigned X-Actor headers when issuer is unset or verifier initialization fails. This weakens acting identity for callers holding the service key. Acceptance: only explicit tasklie.role=dev permits legacy unsigned actor headers; production/all/api/worker startup rejects missing/invalid issuer or client id; startup/network failure cannot silently downgrade identity; tests exercise valid, absent and malformed configuration and preserve explicit dev startup. Update setup examples and tests. Rules 7, 18.
Implemented in https://github.com/ParadauxIO/taskl.ie/pull/108 as part of the ordered quality stack #107 → #108 → #109 → #110 → #111 → #112 → #113 → #114. Each layer targets its predecessor; #107 targets main. Local final-stack verification: 1,312 backend tests against disposable PostgreSQL 17/pgvector, 1,218 web unit tests, 486 Chromium stories, lint, TypeScript, production build/CSS gate and standalone HTTP smoke all pass. A focused listener cleanup regression also passes after the final lifecycle change. CI results are tracked on the PRs; no merges or deployments performed.
Implementing as one layer of the user-requested code-quality fix stack. Base is current main (rebuild has merged and its remote branch is gone). Plan: add focused behavioral regression coverage, implement this issue without weakening architecture rules, run affected checks and full applicable suites, then publish a stacked PR with validation and dependency links. Stack order: PAR-489 → PAR-492 → PAR-490 → PAR-494 → PAR-491 → PAR-454 → PAR-478 → PAR-493.