## Issue Triage — 2025-12-15 (elizaOS)

### 1) JWT Authentication & Data Isolation rollout gaps (docs + security review)
- **Issue Title & ID:** JWT auth mode needs security review + operator docs before enabling by default — **PR #6200 / Related Issue #6112 (Entity-level RLS)**
- **Current Status:** **Open PR (not merged)**; feature is gated behind `ENABLE_DATA_ISOLATION=true`
- **Impact Assessment:**
  - **User Impact:** **High** (anyone adopting multi-tenant / hosted deployments)
  - **Functional Impact:** **Partial** (core works without it; blocks secure multi-tenant adoption)
  - **Brand Impact:** **High** (auth/security missteps are reputationally expensive)
- **Technical Classification:**
  - **Category:** **Security / Documentation**
  - **Component:** **Server API, Socket.IO auth middleware, multi-tenant data isolation**
  - **Complexity:** **Complex solution** (auth flows, verifier strategy matrix, ops config)
- **Resource Requirements:**
  - **Required Expertise:** Security engineering (JWT pitfalls, issuer/audience validation), backend TS, Socket.IO auth, threat modeling
  - **Dependencies:** Align with **RLS/data isolation design** (#6112 / PR #6107 referenced in monthly report); ensure serverless/unified API (#6201) is compatible
  - **Estimated Effort:** **4/5**
- **Recommended Priority:** **P0**
- **Specific Actionable Next Steps:**
  1. Add a **security checklist** to the PR: issuer/audience validation, clock skew, alg enforcement, JWKS caching/rotation behavior, “none” alg defense, error handling (no token leakage).
  2. Produce **deployment docs**: example configs for HS256, Ed25519, JWKS; include migration notes from `X-Entity-Id` legacy mode.
  3. Add **integration tests** covering Socket.IO auth + REST parity and “internal service bypass” constraints.
  4. Decide and document **default posture**: keep gated vs. enable by default in cloud.
- **Potential Assignees:** **standujar** (author), **jin** (security sprint driver), **github-advanced-security** (review support)

---

### 2) Cloud Integration mega-PR risk (scope, QA, release safety)
- **Issue Title & ID:** Eliza Cloud Integration mega-change needs slicing + hardening plan — **PR #6216**
- **Current Status:** **Open PR (very large; ~10k LOC additions)**, not merged
- **Impact Assessment:**
  - **User Impact:** **High** (CLI onboarding and default cloud path affects most new users)
  - **Functional Impact:** **Partial** (could destabilize CLI create/deploy/publish flows if merged prematurely)
  - **Brand Impact:** **High** (first-run experience + “create → deploy → publish → monetize” narrative)
- **Technical Classification:**
  - **Category:** **Feature / Reliability**
  - **Component:** **CLI, Cloud plugin, starter projects, MCP/A2A service scaffolding**
  - **Complexity:** **Architectural change** (product workflow + provisioning + auth + storage)
- **Resource Requirements:**
  - **Required Expertise:** CLI TS, cloud provisioning flows, API-client integration, release engineering, UX of onboarding
  - **Dependencies:** Works best after auth story is settled (PR #6200); ensure dependency bump/drizzle stability (PR #6210 completed)
  - **Estimated Effort:** **5/5**
- **Recommended Priority:** **P0**
- **Specific Actionable Next Steps:**
  1. **Split PR** into mergeable units (e.g., login/provisioning, starter templates, cloud DB/storage provider, MCP/A2A starter).
  2. Add **end-to-end CLI tests** for: `elizaos create` → login → provision key → run agent → publish.
  3. Define **rollback strategy** and feature flags (opt-in cloud path vs default).
  4. Produce a **review map** (“start here” files, flows diagram) to unblock reviewers.
- **Potential Assignees:** **lalalune** (author), **ChristopherTrimboli** (review capacity), **wtfsayo** (CLI ecosystem familiarity)

---

### 3) “TEXT_LARGE” error on minimal prompts due to missing inference plugin registration
- **Issue Title & ID:** TEXT_LARGE error even for “hi” when no AI provider plugin is registered — **DISCORD-2025-12-13-TEXT_LARGE**
- **Current Status:** **Reported on Discord; workaround = install/register OpenAI plugin + run `elizaos update`**
- **Impact Assessment:**
  - **User Impact:** **High** (new users; “hello world” fails)
  - **Functional Impact:** **Yes** (blocks basic chat/inference)
  - **Brand Impact:** **High** (immediate “it doesn’t work” signal)
- **Technical Classification:**
  - **Category:** **Bug / UX / Documentation**
  - **Component:** **Core runtime plugin registration, CLI onboarding, error messaging**
  - **Complexity:** **Moderate effort**
- **Resource Requirements:**
  - **Required Expertise:** Core runtime, CLI create flow, error handling/UX copy
  - **Dependencies:** Ensure default provider selection behavior (CLI changes like cloud default) doesn’t regress; confirm plugin install/versioning
  - **Estimated Effort:** **3/5**
- **Recommended Priority:** **P1**
- **Specific Actionable Next Steps:**
  1. Add a **clear runtime error**: “No inference provider registered (OpenAI/Cloud/etc). Install and configure one: …”
  2. Update **CLI `create`** to guarantee an inference plugin is selected and configured (and validate API key presence).
  3. Add a **doctor command** (`elizaos doctor`) to detect: missing provider, outdated packages, missing env vars.
  4. Publish a **short troubleshooting doc** linked from the error.
- **Potential Assignees:** **wtfsayo** (community support + likely fast fix), **lalalune** (CLI onboarding), **madjin** (core)

---

### 4) Hardware wallet (Ledger) token migration: holdings not visible without intermediary wallet
- **Issue Title & ID:** Ledger migration UX: Ai16z holdings not showing; requires browser wallet bridge — **DISCORD-2025-12-14-LEDGER-MIGRATION**
- **Current Status:** **Reported on Discord; workaround = connect Ledger via Solana browser wallet (Phantom/Solflare/Rabby/Talisman)**
- **Impact Assessment:**
  - **User Impact:** **Medium–High** (subset of users, but high-value cohort)
  - **Functional Impact:** **Partial** (migration possible but confusing; may appear “lost”)
  - **Brand Impact:** **High** (token visibility/migration trust)
- **Technical Classification:**
  - **Category:** **UX / Documentation** (potentially also a wallet-connector integration issue)
  - **Component:** **Web app wallet connection, token migration UI, Solana wallet adapters**
  - **Complexity:** **Moderate effort**
- **Resource Requirements:**
  - **Required Expertise:** Frontend wallet integration (Solana adapters), migration flow UX writing
  - **Dependencies:** Confirm site’s wallet adapter support for Ledger direct vs via Phantom; ensure token account discovery logic is correct
  - **Estimated Effort:** **3/5**
- **Recommended Priority:** **P1**
- **Specific Actionable Next Steps:**
  1. Add an in-app **Ledger-specific guide**: “Connect via Phantom/Solflare” + why holdings may not render.
  2. Add **token discovery diagnostics** (chain/cluster, associated token accounts, expected mint).
  3. If feasible, implement **native Ledger adapter support** or explicit “Ledger via Phantom” CTA.
  4. Add a **support playbook** for migration tickets (screenshots to request, common causes).
- **Potential Assignees:** **DorianD** (domain knowledge), **shaw** (platform owner context), **lalalune** (product onboarding)

---

### 5) Twitter/X agent making excessive API requests (50 per call)
- **Issue Title & ID:** Twitter agent high API consumption / likely rate-limit + cost bug — **DISCORD-2025-12-12-TWITTER-API-50**
- **Current Status:** **Reported on Discord by FenrirFawks; no fix referenced**
- **Impact Assessment:**
  - **User Impact:** **Medium** (users running X agents)
  - **Functional Impact:** **Partial** (agents may fail under rate limits; unexpected costs)
  - **Brand Impact:** **Medium–High** (perceived inefficiency / “buggy agents”)
- **Technical Classification:**
  - **Category:** **Performance / Bug**
  - **Component:** **Social/X integration plugin or agent logic**
  - **Complexity:** **Moderate effort**
- **Resource Requirements:**
  - **Required Expertise:** API integration optimization, pagination/backoff, caching, telemetry
  - **Dependencies:** Might depend on regaining platform access to X and updated API policies; need reproducible traces
  - **Estimated Effort:** **3/5**
- **Recommended Priority:** **P1**
- **Specific Actionable Next Steps:**
  1. Add **instrumentation**: log request counts per action, endpoint, pagination behavior.
  2. Implement **rate-limit handling** (backoff) and **caching** for idempotent reads.
  3. Audit the call path for **N+1 patterns** and consolidate into batch calls.
  4. Create a minimal **repro scenario** and add a perf regression test if possible.
- **Potential Assignees:** **madjin** (core), **shaw** (platform direction), **ChristopherTrimboli** (review/testing)

---

### 6) Community scam/spam risk surfaced in Discord (beta links + server promos)
- **Issue Title & ID:** Discord anti-scam posture: beta link flagged + probable spam promotion — **DISCORD-2025-12-14-SCAM-ALERT / DISCORD-2025-12-14-CODERS-SPAM**
- **Current Status:** **Observed; no enforcement/process documented in logs**
- **Impact Assessment:**
  - **User Impact:** **High** (Discord-wide exposure)
  - **Functional Impact:** **No** (not code), but impacts community safety
  - **Brand Impact:** **High** (trust + safety perception)
- **Technical Classification:**
  - **Category:** **Security / Process**
  - **Component:** **Discord moderation, link hygiene, community operations**
  - **Complexity:** **Moderate effort**
- **Resource Requirements:**
  - **Required Expertise:** Community moderation, basic infosec triage, Discord automod/bots
  - **Dependencies:** None
  - **Estimated Effort:** **2/5**
- **Recommended Priority:** **P1**
- **Specific Actionable Next Steps:**
  1. Publish a **pinned “Safety” post**: never share seed phrases, verify domains, how to report scams.
  2. Enable/adjust **Discord AutoMod**: block suspicious domains, limit new-user link posting.
  3. Create an internal **incident checklist** (remove message, warn/ban, announce, collect indicators).
- **Potential Assignees:** **jin** (security sprint interest), **shaw** (community/platform lead), Discord mods

---

### 7) GitHub → Discord webhook noise (signal-to-noise problem)
- **Issue Title & ID:** Development-feed noise: webhook should post only important events — **DISCORD-2025-12-12-WEBHOOK-NOISE**
- **Current Status:** **Suggested by cjft; not implemented**
- **Impact Assessment:**
  - **User Impact:** **Medium** (contributors + core devs)
  - **Functional Impact:** **No** (workflow efficiency issue)
  - **Brand Impact:** **Low–Medium** (perceived operational maturity)
- **Technical Classification:**
  - **Category:** **UX / Process**
  - **Component:** **DevOps/Notifications**
  - **Complexity:** **Simple fix**
- **Resource Requirements:**
  - **Required Expertise:** GitHub webhooks, Discord integration tooling
  - **Dependencies:** None
  - **Estimated Effort:** **1/5**
- **Recommended Priority:** **P2**
- **Specific Actionable Next Steps:**
  1. Filter events to: merged PRs, releases, failed CI on main, security alerts.
  2. Route the rest (comments, label changes) to a lower-noise channel or digest.
- **Potential Assignees:** **ChristopherTrimboli**, **wtfsayo**

---

### 8) Missing/unclear documentation for Cloud + API key usage (despite prior “Docs” closure)
- **Issue Title & ID:** Docs gap: “Do I need to connect OpenAI API key to elizacloud?” + Cloud architecture confusion — **DISCORD-2025-12-13-APIKEY-CLOUD / (Historic) Issue #6128 (Docs, closed)**
- **Current Status:** **User confusion persists in Discord; docs work previously tracked but not preventing questions**
- **Impact Assessment:**
  - **User Impact:** **Medium–High** (common onboarding confusion)
  - **Functional Impact:** **Partial** (blocks successful setup)
  - **Brand Impact:** **Medium** (docs perceived as incomplete)
- **Technical Classification:**
  - **Category:** **Documentation / UX**
  - **Component:** **Docs site, CLI onboarding copy**
  - **Complexity:** **Simple fix**
- **Resource Requirements:**
  - **Required Expertise:** Technical writing, CLI UX, cloud product knowledge
  - **Dependencies:** Align with cloud default provider and auth rollout (PR #6216, PR #6200)
  - **Estimated Effort:** **2/5**
- **Recommended Priority:** **P2**
- **Specific Actionable Next Steps:**
  1. Add a doc page: **“API Keys & Providers”** (local OpenAI vs Eliza Cloud; where keys live; how agents access them).
  2. Add CLI prompts/tooltips linking to the above.
  3. Add a short **FAQ** entry specifically answering the Discord question.
- **Potential Assignees:** **borisudovicic** (docs history), **lalalune**, **shaw**

---

### 9) PR hygiene: multiple “Main” PRs missing template content (review risk)
- **Issue Title & ID:** PR template noncompliance blocks effective review — **PR #6219 / PR #6220**
- **Current Status:** **Open PRs with empty template sections (risks/testing/relates-to)**
- **Impact Assessment:**
  - **User Impact:** **Low** (indirect)
  - **Functional Impact:** **Partial** (slows merges; increases regression risk)
  - **Brand Impact:** **Medium** (maintainer burden; quality signals)
- **Technical Classification:**
  - **Category:** **Process**
  - **Component:** **Repo contribution workflow**
  - **Complexity:** **Simple fix**
- **Resource Requirements:**
  - **Required Expertise:** Maintainer workflow
  - **Dependencies:** None
  - **Estimated Effort:** **1/5**
- **Recommended Priority:** **P2**
- **Specific Actionable Next Steps:**
  1. Add CI check: fail PRs missing **Risks** and **Testing** sections (or require checkbox completion).
  2. Ask author to update PR descriptions; close if non-substantive.
- **Potential Assignees:** **ChristopherTrimboli**, **0xbbjoker** (reviewers), **madjin**

---

## Highest-Priority Focus (Top 5–10 to act on now)
1. **P0:** PR **#6200** JWT authentication — security review + deployment docs + tests.
2. **P0:** PR **#6216** Cloud integration mega-PR — split/scope control + e2e QA + release safety.
3. **P1:** **DISCORD-2025-12-13-TEXT_LARGE** — missing inference plugin registration; improve error + CLI guardrails.
4. **P1:** **DISCORD-2025-12-14-LEDGER-MIGRATION** — token holdings not visible; fix wallet UX + docs.
5. **P1:** **DISCORD-2025-12-12-TWITTER-API-50** — excessive X API calls; optimize + rate-limit protections.
6. **P1:** **DISCORD scam/spam alerts** — implement AutoMod + safety playbook.
7. **P2:** Webhook noise reduction — improve contributor signal-to-noise.
8. **P2:** Persistent docs gaps about API keys/cloud — add clear provider guidance.
9. **P2:** PR hygiene enforcement — prevent low-context PRs from landing.

---

## Patterns / Themes Indicating Deeper Issues
- **Onboarding fragility:** First-run failures (TEXT_LARGE, plugin install/update confusion, API key ambiguity) suggest insufficient validation and “doctor” tooling.
- **Large, high-risk change sets:** Cloud + auth initiatives are landing as **mega-PRs**, increasing regression risk and review latency.
- **Security posture expanding faster than guardrails:** JWT/data isolation + Discord scam reports show security needs both **code hardening** and **community operations** maturity.
- **External integration cost/rate risks:** X/Twitter agent behavior indicates missing observability and performance budgets for third-party APIs.

---

## Process Improvements (to prevent repeats)
1. **Introduce `elizaos doctor` + preflight checks** (provider configured, env vars present, plugin versions compatible).
2. **Require PR quality gates**: enforced template completion + “review map” for PRs over a size threshold; prefer incremental merges.
3. **Add integration test lanes for critical workflows**: CLI create/login/provision/run; REST+Socket.IO auth parity; cloud deploy/publish smoke tests.
4. **Establish a security & trust cadence**: lightweight threat model for auth changes; Discord safety SOP; periodic dependency/audit review.
5. **Add observability standards for external API plugins**: request counters, rate-limit backoff, caching guidance, and budget-based regression alerts.