[AUDIT] [EPIC] Audit 2026-04-23 follow-ups

[imagodata]

Context

Tracker for the FilterMate deep audit conducted on 2026-04-23 (v4.6.6). Three parallel subagent audits surfaced architecture, security and stability findings. Two CRITICAL + one HIGH were already patched in-session and pushed to main:

Finding	Commit	Status
C1 — broken _execute_direct template	dbcbc040	✅ Fixed + regression test
C2 — PushWorker signal race	—	✅ Debunked (Qt AutoConnection handles it)
H1 — raw expression → WHERE via TaskBridge	e360fd4a	✅ Fixed at 3 call sites
H2 — favorites re-sanitization on reload	1ef9d29c	✅ Fixed at universal setSubsetString chokepoint + 5 tests

This epic tracks the remaining follow-ups.

Child issues

HIGH priority (real bugs / blocking refactors)

• [AUDIT] [H5] Cache keys missing schema_version — stale-hit risk on field changes #36 — [H5] Cache keys missing schema_version — closed 2026-04-27, commit 9696f629 + 7 regression tests
• [AUDIT] [H3] Refactor filter_mate_dockwidget.py god-class (6889 LOC → panels) #37 — [H3] Refactor filter_mate_dockwidget.py god-class (6889 LOC → panels)
• [AUDIT] [H4] Split core/tasks/filter_task.py (3003 LOC) #38 — [H4] Split core/tasks/filter_task.py (3003 LOC) — partial: 6 handlers extracted, file still 3003 LOC
• [AUDIT] [DUPE] Triage 5 duplicate-service pairs (consolidation-revert fallout) #39 — [DUPE] Triage duplicate-service pairs — closed 2026-04-27, no real duplicates confirmed
• [AUDIT] [C3] EPIC — Reconcile hexagonal arch: remove PyQt/QGIS from core/ (52 files) #40 — [C3] EPIC — Reconcile hexagonal arch: remove PyQt/QGIS from core/ (54 files — was 52)

MEDIUM priority (tech debt)

• [AUDIT] [TECH-DEBT] Batch fixes from audit 2026-04-23 (M1-M7) #41 — [TECH-DEBT] Batch fixes M1-M7 — closed 2026-04-27, all 7 items shipped (M2/M3/M4/M5/M6/M7 in commits 344f930c + 81e620ca + e6bf4286 + 43446ba5)

Operational

• [AUDIT] [TESTS] Pre-existing test-order pollution in test_handlers.py #42 — [TESTS] Pre-existing test-order pollution in test_handlers.py — re-opened 2026-04-27: pollution still reproducible (passes in isolation, 2 tests fail in full suite)
• [AUDIT] [TESTS] Missing TaskBridge test coverage #43 — [TESTS] Missing TaskBridge test coverage — closed 2026-04-27, commit 228b0d36 (18 tests covering value-object contract, gating, metrics, singleton, and H1 security regression)

Re-audit 2026-04-27 — implementation pass

• ✅ [AUDIT] [H5] Cache keys missing schema_version — stale-hit risk on field changes #36 + [AUDIT] [TECH-DEBT] Batch fixes from audit 2026-04-23 (M1-M7) #41 + [AUDIT] [TESTS] Missing TaskBridge test coverage #43 fully shipped + tests
• ✅ [AUDIT] [DUPE] Triage 5 duplicate-service pairs (consolidation-revert fallout) #39 confirmed closeable
• 🔄 [AUDIT] [TESTS] Pre-existing test-order pollution in test_handlers.py #42 re-opened (false positive on first close)
• 🟡 [AUDIT] [H4] Split core/tasks/filter_task.py (3003 LOC) #38 partial — handlers extracted, main file unchanged
• 🔴 [AUDIT] [H3] Refactor filter_mate_dockwidget.py god-class (6889 LOC → panels) #37, [AUDIT] [C3] EPIC — Reconcile hexagonal arch: remove PyQt/QGIS from core/ (52 files) #40 untouched

Sprint recommendation (updated 2026-04-27)

Sprint 1 (remaining): #42 root-cause + fix the test_handlers.py order pollution.

Sprint 2: #37 or #38 (pick one god-class; #37 dockwidget panel extraction recommended). One PR per extracted panel.

Sprint 3+: #40 (hex-arch) phases 1-2 — enumeration + port extension. Multi-sprint.

Audit reference

Full audit report + memory note lives at ~/.claude/projects/*/memory/project_deep_audit_2026_04_23.md (agent-local; summarized in the linked commits).

Scorecard baseline (2026-04-23 post-patches)

• Architecture: 5.5/10 (broken hexagonal claim)
• Security: 7.5/10 (after H1/H2 patches)
• Stability: 6.8/10
• Test coverage: 6/10
• Overall: 6.5/10 — up from 6.2 pre-patches

Target after closing this epic's children: ≥8.0/10.

[imagodata]

Cross-epic update — Favorites consolidation audit (2026-04-27)

A second audit pass landed today, scope-disjoint from this epic (which covers security/bugs from 2026-04-23). The new audit targets favorites-stack design debt (harmonisation + consolidation) — see #46 for the full breakdown.

14/19 findings shipped as 11 incremental commits (2c33d4bc..4bfcdd38):

• Phase 0 quick wins (dead code, schema constants, log spam)
• Phase 1 (UI styles + ICONS registry)
• Phase 2 (RemoteLayersNormalizer 4→1 paths, strip_owner absorbed, bump_updated_at rename)
• Phase 2-bis (dialog leak fix, git worker factor, refresh filters fix)
• Phase 3 step 1+2 — god-class controller decomposition: 2394→2024 lines (-15%) via FavoritesMenuBuilder + FavoritesExtensionBridge + F5-minimal MenuActionSpec registry seam.

1105/1105 tests pass at each commit, zero regressions.

Updated sprint recommendation (combined for #44 + #46):

• Sprint 1 (in progress): [AUDIT] [TESTS] Pre-existing test-order pollution in test_handlers.py #42 root-cause test_handlers.py order pollution.
• Sprint 2 (option A — light): [AUDIT] [EPIC] Favorites consolidation 2026-04-27 #46 F5 stage 2 (S effort) — extension auto-registers actions via the registry seam landed today.
• Sprint 2 (option B — heavy): [AUDIT] [H3] Refactor filter_mate_dockwidget.py god-class (6889 LOC → panels) #37 dockwidget panel extraction (god-class Error at launch of Filter_mate 1.5 #1) OR [AUDIT] [EPIC] Favorites consolidation 2026-04-27 #46 F4 step 3 SpatialConfigRestorer (god-class error at launch - unable to open database file #2 last slice). Pick one per sprint.
• Sprint 3+: [AUDIT] [H4] Split core/tasks/filter_task.py (3003 LOC) #38 filter_task split, [AUDIT] [EPIC] Favorites consolidation 2026-04-27 #46 F15 (FavoriteImportHandler), [AUDIT] [EPIC] Favorites consolidation 2026-04-27 #46 F16 (FavoritesError family — needs contract-change discussion first).