#376 Follow-ups from #371 CodeRabbit review (prod promotion)

[Anonymous]

Originally created by: Akarsh-Hegde

Tracking issue for the CodeRabbit / code-quality findings raised on #371 (the pre-main → main prod promotion).

Why these weren't fixed in [#371]: [#371] promotes code that already shipped to staging through individual feature PRs. CodeRabbit re-reviewed the full ~8.2k-line cumulative diff, so the findings below are pre-existing, not introduced by the promotion. To avoid destabilizing staging-tested code inside the merge that was urgently needed to fix broken prod worklogs (runtime-latest was stuck on a runtime missing the WORKLOG_SYSTEM re-export), they're tracked here as follow-ups instead.

A few are worth prioritising — the 🔴 idempotent ticket creation and the IST-hardcoded observability dashboards (which render wrong hours for any non-IST deployment after the local-time refactor).

Excluded (handled in [#371]): the pyproject.toml version (resolved to 1.67.0) and the worklog.py:11 "WORKLOG_SYSTEM unused" false positive (it's a re-export used by pipeline.py).

---

🔴 Critical

• [ ] Make ticket creation idempotent before retrying approved proposals. — src/pm_worklog/post.rs:420 (comment)

🟠 Major

• [ ] Keep proposal provider selection aligned with the poster. — meridian-core/src/readers/proposed.rs:161 (comment)
• [ ] --exclude-coding doesn't match the server contract. — scripts/run-distill.sh:29 (comment)
• [ ] Don't silently discard spans that fail Agno conversion. — services/agents/observability.py:526 (comment)
• [ ] Use the shared local-hour conversion here. — services/agents/routes/activity.py:60 (comment)
• [ ] Instrument the coding-summary lookup inside the request trace. — services/agents/routes/activity.py:77 (comment)
• [ ] Keep the extracted traceparent as the span parent. — services/agents/routes/activity.py:182 (comment)
• [ ] Don't cache the local timezone as a fixed offset. — services/agents/time_utils.py:20 (comment)
• [ ] Don’t erase an existing proposed-task draft when the rerun has no new worklog payload. — services/agents/worklog_pipeline/db.py:315 (comment)
• [ ] These filters make failed activity_report calls disappear. — services/observability/dashboards/activity-summary.json:23 (comment)
• [ ] Don't hard-code IST in a local-time dashboard. — services/observability/dashboards/activity-summary.json:350 (comment)
• [ ] This table is still rendering hours as if the pipeline were IST/UTC-based. — services/observability/dashboards/pm-worklog-hour.json:161 (comment)
• [ ] Use a relative trace URL here. — services/observability/dashboards/session-distiller.json:344 (comment)
• [ ] This table still hard-codes IST after the local-time refactor. — services/observability/dashboards/session-distiller.json:357 (comment)
• [ ] Keep the CLI-installed /session-summary prompt in sync with this new contract. — services/skills/coding-agent/session-summary/SKILL.md:15 (comment)
• [ ] Don’t let the limited batch hide processable sources behind backed-off rows. — src/coding_agent_session_ingest/summariser/mod.rs:513 (comment)
• [ ] Filter session_text with the same coding-agent predicate. — src/etl/extractor.rs:82 (comment)
• [ ] Don't silently treat pause-gap lookup failures as “uncovered.” — src/etl/runner.rs:115 (comment)
• [ ] The new semver-suppression rule is not implemented. — src/etl/session_builder.rs:226 (comment)
• [ ] Normalize Azure DevOps keys before building browse URLs. — src/intelligence/ticket_update/mod.rs:335 (comment)
• [ ] Add a bounded timeout to provider ticket-creation requests. — src/pm_worklog/create.rs:127 (comment)
• [ ] Do not infer GitHub’s target repo from an arbitrary row. — src/pm_worklog/db.rs:329 (comment)
• [ ] Group proposal worklog insert parameters into a struct. — src/pm_worklog/db.rs:348 (comment)
• [ ] Add context to proposal-sweep database calls. — src/pm_worklog/post.rs:342 (comment)
• [ ] The 24-hour local loop breaks on DST transition days. — src/worklog_pipeline.rs:130 (comment)
• [ ] Guard auto-resume against active work-hours schedule. — tray/src-tauri/src/commands/daemon.rs:196 (comment)
• [ ] Store cancellation handles before spawning capture tasks. — tray/src-tauri/src/lib.rs:845 (comment)
• [ ] Fail open when work-hours config is disabled or invalid. — tray/src-tauri/src/poll/mod.rs:290 (comment)
• [ ] Reject invalid work-hours values before saving. — ui/components/views/SettingsView.tsx:520 (comment)
• [ ] Use proposed_id for proposal mutations. — ui/components/views/WorklogsView.tsx:171 (comment)
• [ ] Don’t allow approving a proposal with an empty worklog. — ui/components/views/WorklogsView.tsx:515 (comment)
• [ ] Scope contents: write to the publish jobs only. — .github/workflows/build-mlx-runtime.yml:64 (comment)
• [ ] Pin all GitHub Actions refs in this workflow to immutable SHAs. — .github/workflows/build-mlx-runtime.yml:79 (comment)

🟡 Minor

• [ ] Preserve local-time semantics in the legacy proposal fallback. — meridian-core/src/readers/worklogs.rs:306 (comment)
• [ ] Pick the ambiguous DST instant that actually contains now. — meridian-core/src/util/date.rs:40 (comment)
• [ ] Add languages to the fenced output examples. — scripts/README.md:47 (comment)
• [ ] Split the two statements on Line 412. — services/agents/session_distiller.py:412 (comment)
• [ ] Make reasoning truly required. — services/agents/worklog_pipeline/models.py:49 (comment)
• [ ] Replace the Utc::now() fallback in local_hour_to_utc. — src/pm_worklog/post.rs:98 (comment)
• [ ] Add explicit button types and an accessible input label. — tray/src/index.html:101 (comment)
• [ ] Pin actions/checkout and disable credential persistence. — .github/workflows/runtime-gate-selftest.yml:32 (comment)
• [ ] Pin actions/checkout and disable credential persistence. — .github/workflows/services-version-bump.yml:26 (comment)
• [ ] Reject partial numeric and fractional custom durations. — tray/src/pause-utils.js:26 (comment)

🔵 Trivial

• [ ] ' --glob '! — .cargo/config.toml:6 (comment)

—

• [ ] Unused import — services/agents/observability.py:49 (comment)
• [ ] File: — services/agents/observability.py:52 (comment)
• [ ] General approach: — services/agents/worklog_pipeline/worklog.py:11 (comment)
• [ ] Unused global variable — services/agents/observability.py:592 (comment)