docs: add backlog tasks, add security.md, update agents.md

pythoninthegrass · pythoninthegrass · commit dc3d54933604 · 2026-02-26T11:17:28.000-06:00
diff --git a/AGENTS.md b/AGENTS.md
@@ -10,6 +10,17 @@
 - If the token limit is close or it's over 50 LOC, print the line numbers and avoid comments altogether
 - Explain as much as possible in the chat unless asked to annotate (i.e., docstrings, newline comments, etc.)
 
+## Context7
+
+Always use Context7 MCP when I need library/API documentation, code generation, setup or configuration steps without me having to explicitly ask.
+
+### Libraries
+
+- fastapi/fastapi
+- roborev-dev/roborev
+- websites/deno
+- websites/taskfile_dev_usage
+
 ## Build, Lint, and Test Commands
 
 - Full test suite: `uv run pytest` or `task test`
@@ -35,11 +46,13 @@
 When debugging GraphQL API issues (particularly for Meetup API):
 
 ### 1. Direct GraphQL Testing
+
 - Test queries directly against the GraphQL endpoint using curl before debugging application code
 - Example: `curl -X POST "https://api.meetup.com/gql-ext" -H "Authorization: Bearer <token>" -H "Content-Type: application/json" -d '{"query": "query { self { id name } }"}'`
 - Start with simple queries (like `self { id name }`) then gradually add complexity
 
 ### 2. API Migration Validation
+
 - Check API documentation for migration guides when encountering field errors
 - Common Meetup API changes:
   - `count` → `totalCount`
@@ -48,6 +61,7 @@ When debugging GraphQL API issues (particularly for Meetup API):
   - Syntax changes: `field(input: {first: N})` → `field(first: N)`
 
 ### 3. Response Structure Analysis
+
 - Add temporary debug logging to inspect actual GraphQL responses
 - Check for `errors` array in GraphQL responses, not just HTTP status codes
 - Verify field existence with introspection or simple field queries
@@ -59,12 +73,85 @@ When debugging GraphQL API issues (particularly for Meetup API):
   ```
 
 ### 4. Field Validation Process
+
 - Use GraphQL validation errors to identify undefined fields
 - Test field names individually: `{ self { fieldName } }`
 - Check if field requires parameters (e.g., `memberEvents` requires `first`)
 - Validate nested field access patterns
 
 ### 5. Token and Authentication Debugging
+
 - Verify token generation is working: `uv run python -c "from app.sign_jwt import main; print(main())"`
 - Test tokens directly against GraphQL endpoint outside of application
 - Check token expiration and refresh token logic
+
+## Code Review (roborev)
+
+Every commit is automatically reviewed by [roborev](https://www.roborev.io/) via git hooks. Reviews run in the background and findings must be addressed before merging.
+
+Config: `.roborev.toml` (project), `~/.roborev/config.toml` (global)
+
+### CLI Commands
+
+```bash
+roborev show                          # List recent reviews
+roborev show --job <id>               # View a specific review
+roborev show --job <id> --json        # Machine-readable review output
+roborev fix                           # Fix all unaddressed reviews
+roborev fix <job_id>                  # Fix a specific review
+roborev fix --unaddressed --list      # List unaddressed reviews without fixing
+roborev refine                        # Fix, re-review, repeat until passing
+roborev comment --job <id> "<msg>"    # Add a comment to a review
+roborev address <job_id>              # Mark a review as addressed
+```
+
+### Agent Skills
+
+| Skill | Purpose |
+| ----- | ------- |
+| `/roborev-review` | Request a code review for a specific commit |
+| `/roborev-review-branch` | Review all commits on the current branch |
+| `/roborev-fix` | Discover and fix all unaddressed review findings |
+| `/roborev-address` | Fetch a review and make code changes to address findings |
+| `/roborev-respond` | Comment on a review and mark it as addressed |
+| `/roborev-design-review` | Request a design review for a commit |
+| `/roborev-design-review-branch` | Design review for all commits on current branch |
+
+### Workflow
+
+1. **Commit** — roborev automatically reviews in the background
+2. **Check** — `roborev show` or `roborev fix --unaddressed --list` to see findings
+3. **Fix** — `/roborev-fix` addresses findings, runs tests, comments, and marks addressed
+4. **Refine** — `roborev refine` loops fix-and-review in an isolated worktree until passing
+
+When `roborev fix` cannot automatically resolve a finding, create a backlog task with the `roborev` label and reference the job ID.
+
+<!-- BACKLOG.MD MCP GUIDELINES START -->
+
+<CRITICAL_INSTRUCTION>
+
+## BACKLOG WORKFLOW INSTRUCTIONS
+
+This project uses Backlog.md MCP for all task and project management activities.
+
+**CRITICAL GUIDANCE**
+
+- If your client supports MCP resources, read `backlog://workflow/overview` to understand when and how to use Backlog for this project.
+- If your client only supports tools or the above request fails, call `backlog.get_workflow_overview()` tool to load the tool-oriented overview (it lists the matching guide tools).
+
+- **First time working here?** Read the overview resource IMMEDIATELY to learn the workflow
+- **Already familiar?** You should have the overview cached ("## Backlog.md Overview (MCP)")
+- **When to read it**: BEFORE creating tasks, or when you're unsure whether to track work
+
+These guides cover:
+
+- Decision framework for when to create tasks
+- Search-first workflow to avoid duplicates
+- Links to detailed guides for task creation, execution, and finalization
+- MCP tools reference
+
+You MUST read the overview resource to understand the complete workflow. The information is NOT summarized here.
+
+</CRITICAL_INSTRUCTION>
+
+<!-- BACKLOG.MD MCP GUIDELINES END -->
diff --git a/SECURITY.md b/SECURITY.md
@@ -0,0 +1,54 @@
+# Security Policy
+
+* [Security Policy](#security-policy)
+  * [Reporting Security Problems](#reporting-security-problems)
+  * [Security Point of Contact](#security-point-of-contact)
+  * [Incident Response Process](#incident-response-process)
+    * [1. Containment](#1-containment)
+    * [2. Response](#2-response)
+    * [3. Remediation](#3-remediation)
+
+<a name="reporting"></a>
+
+## Reporting Security Problems
+
+**DO NOT CREATE AN ISSUE** to report a security problem. Instead, please
+send an email to <burrows_remix6p@icloud.com>.
+
+<a name="contact"></a>
+
+## Security Point of Contact
+
+The security point of contact is Lance Stephens. Lance responds to security incident reports as fast as possible, within one business day 
+at the latest.
+
+If they don't respond within two days, please try emailing again.
+
+<a name="process"></a>
+
+## Incident Response Process
+
+In case an incident is discovered or reported, I will follow the following
+process to contain, respond and remediate:
+
+### 1. Containment
+
+The first step is to find out the root cause, nature and scope of the incident.
+
+* Is still ongoing? If yes, first priority is to stop it.
+* Is the incident outside of my influence? If yes, first priority is to contain it.
+* Find out knows about the incident and who is affected.
+* Find out what data was potentially exposed.
+
+### 2. Response
+
+After the initial assessment and containment to my best abilities, I will
+document all actions taken in a response plan.
+
+I will create a comment in [the issues](https://github.com/pythoninthegrass/meetup_bot/issues) to inform users about
+the incident and what I actions I took to contain it.
+
+### 3. Remediation
+
+Once the incident is confirmed to be resolved, I will summarize the lessons learned from the incident and create a list of actions I will
+take to prevent it from happening again.
diff --git a/backlog/config.yml b/backlog/config.yml
@@ -0,0 +1,16 @@
+project_name: "meetup_bot"
+default_status: "To Do"
+statuses: ["To Do", "In Progress", "Done"]
+labels: []
+milestones: []
+date_format: yyyy-mm-dd
+max_column_width: 20
+auto_open_browser: true
+default_port: 6425
+remote_operations: false
+auto_commit: false
+zero_padded_ids: 3
+bypass_git_hooks: true
+check_active_branches: false
+active_branch_days: 30
+task_prefix: "task"
diff --git a/backlog/tasks/task-001 - Bump-FastAPI-from-0.115.6-to-0.133.1.md b/backlog/tasks/task-001 - Bump-FastAPI-from-0.115.6-to-0.133.1.md
@@ -0,0 +1,28 @@
+---
+id: TASK-001
+title: Bump FastAPI from >=0.115.6 to >=0.133.1
+status: To Do
+assignee: []
+created_date: '2026-02-26 16:25'
+labels:
+  - dependencies
+dependencies: []
+references:
+  - 'https://github.com/fastapi/fastapi/pull/14964'
+  - pyproject.toml
+priority: low
+---
+
+## Description
+
+<!-- SECTION:DESCRIPTION:BEGIN -->
+Update FastAPI dependency in pyproject.toml from >=0.115.6 to >=0.133.1. This is a routine dependency bump covering ~18 minor versions. Notable changes include Rust-powered JSON serialization via Pydantic (0.131.0) and deprecation of ORJSONResponse/UJSONResponse. Test suite should be reviewed and updated before upgrading to ensure compatibility.
+<!-- SECTION:DESCRIPTION:END -->
+
+## Acceptance Criteria
+<!-- AC:BEGIN -->
+- [ ] #1 Review and update test suite for compatibility with FastAPI 0.133.1 before upgrading
+- [ ] #2 Bump fastapi dependency to >=0.133.1 in pyproject.toml
+- [ ] #3 All existing tests pass after upgrade
+- [ ] #4 Verify /token, /healthz, /, and /auth/login endpoints work correctly
+<!-- AC:END -->
diff --git a/backlog/tasks/task-002 - Replace-pre-commit-with-prek.md b/backlog/tasks/task-002 - Replace-pre-commit-with-prek.md
@@ -0,0 +1,54 @@
+---
+id: TASK-002
+title: Replace pre-commit with prek
+status: In Progress
+assignee: []
+created_date: '2026-02-26 16:56'
+updated_date: '2026-02-26 17:16'
+labels:
+  - tooling
+  - dx
+dependencies: []
+references:
+  - 'https://github.com/j178/prek'
+  - .pre-commit-config.yaml
+  - CLAUDE.md
+documentation:
+  - 'https://prek.j178.dev'
+priority: medium
+ordinal: 1000
+---
+
+## Description
+
+<!-- SECTION:DESCRIPTION:BEGIN -->
+Replace the Python-based `pre-commit` tool with `prek` (j178/prek), a Rust-based reimplementation that is faster, dependency-free, and compatible with existing `.pre-commit-config.yaml` configuration.
+
+## Current Setup
+
+The project uses pre-commit with these hooks (`.pre-commit-config.yaml`):
+
+- **gitleaks** (`zricethezav/gitleaks` v8.30.0) - secret detection
+- **ruff** (`astral-sh/ruff-pre-commit` v0.15.3) - Python linting with `--fix --exit-non-zero-on-fix`
+- **pre-commit-hooks** (`pre-commit/pre-commit-hooks` v6.0.0) - check-added-large-files, check-executables-have-shebangs, check-merge-conflict, check-shebang-scripts-are-executable, check-symlinks, debug-statements, destroyed-symlinks, detect-private-key, end-of-file-fixer, fix-byte-order-marker, mixed-line-ending, requirements-txt-fixer, check-toml, check-yaml, pretty-format-json
+
+## Migration Notes
+
+- prek is a drop-in replacement that reads `.pre-commit-config.yaml` natively
+- prek has built-in Rust implementations for `pre-commit-hooks` repo hooks (faster)
+- Install via `mise` (preferred): add `prek` to `.tool-versions` or `mise.toml`
+- Run `prek install` to set up git hooks
+- Run `prek run --all-files` to verify all hooks pass
+- Update Taskfile, CLAUDE.md, and CI workflows to reference `prek` instead of `pre-commit`
+<!-- SECTION:DESCRIPTION:END -->
+
+## Acceptance Criteria
+<!-- AC:BEGIN -->
+- [ ] #1 prek is installed via mise and configured as the git hook runner
+- [ ] #2 All existing hooks (gitleaks, ruff, pre-commit-hooks) pass with prek
+- [ ] #3 pre-commit Python package is removed from dev dependencies
+- [ ] #4 Taskfile `pre-commit` task updated to use prek
+- [ ] #5 CLAUDE.md references updated from pre-commit to prek
+- [ ] #6 CI workflows updated if applicable
+- [ ] #7 `prek run --all-files` passes cleanly
+<!-- AC:END -->
diff --git a/backlog/tasks/task-003 - Replace-Node.js-with-Deno-via-mise.md b/backlog/tasks/task-003 - Replace-Node.js-with-Deno-via-mise.md
@@ -0,0 +1,48 @@
+---
+id: TASK-003
+title: Replace Node.js with Deno via mise
+status: In Progress
+assignee: []
+created_date: '2026-02-26 17:10'
+updated_date: '2026-02-26 17:16'
+labels:
+  - infra
+  - deno
+  - mise
+dependencies: []
+priority: medium
+ordinal: 2000
+---
+
+## Description
+
+<!-- SECTION:DESCRIPTION:BEGIN -->
+Replace the Node.js runtime with Deno for all JS/TS tooling in the project.
+
+**Current state:**
+- `.tool-versions` declares `nodejs 24.5.0`
+- `package.json` has commitlint and cz-conventional-changelog dependencies
+- `package-lock.json` exists with Node.js dependency tree
+- `taskfiles/deno.yml` already exists with Deno-based task definitions (vite, playwright, etc.)
+- `devbox.json` references `nodejs`
+
+**Work required:**
+1. Install Deno via mise (`mise use deno@latest`) and remove Node.js from `.tool-versions`
+2. Migrate commitlint and commitizen (cz-conventional-changelog) to Deno-compatible alternatives or run via `deno run -A npm:`
+3. Remove `package.json`, `package-lock.json`, and `node_modules/` once all deps are migrated
+4. Update `devbox.json` to replace `nodejs` with `deno`
+5. Update `.pre-commit-config.yaml` if any hooks depend on Node.js
+6. Wire up `taskfiles/deno.yml` into `taskfile.yml` (replace `taskfiles/poetry.yml` or Node-based includes)
+7. Verify all task commands work with Deno runtime
+<!-- SECTION:DESCRIPTION:END -->
+
+## Acceptance Criteria
+<!-- AC:BEGIN -->
+- [ ] #1 Node.js removed from .tool-versions
+- [ ] #2 Deno installed via mise and declared in .tool-versions
+- [ ] #3 package.json and package-lock.json removed
+- [ ] #4 commitlint and commitizen work under Deno
+- [ ] #5 All task commands in taskfile.yml pass
+- [ ] #6 devbox.json updated to reference deno instead of nodejs
+- [ ] #7 Pre-commit hooks function without Node.js
+<!-- AC:END -->
