Known gaps and backlog

The intent here is honesty, not apology. CompStack is a living product - this page captures the things we know are imperfect so testers don't file duplicate bugs and customers know what to expect.

For testers. Read this page before running the Tester checklist. Items listed here are known and don't need new bug reports.

Currently shipped fixes

These were the bugs found and fixed during the most recent QA pass. They are already deployed, listed here for context only.

Document workflow

• Doc-with-no-version dead end (Edit hidden when no version) → fixed.
• update_document_versions_updated_at trigger referenced a column that doesn't exist → trigger dropped.
• submitForReview didn't materialize the approval chain → now does.
• Approve/Reject buttons hidden on doc detail → fixed by resolving approver from current state.
• Approval Step display off-by-one (showed Step 2 for first step) → fixed.
• Approval decision didn't auto-advance version to Approved → now sweeps approvals on each decision.
• Publish button hidden because allApproved read empty version.approvals → now derives from page-level _approvals.

CAPA workflow

• Board didn't auto-refresh after Save → wired RealtimeAutoReload mixin + added capa table to publication.
• No Assign action button on Draft CAPAs → added.
• Assign confirm dialog navigated away without persisting (root cause: page context's Navigator popped the route, not the dialog) → showCarbonModal callsites + helper now use rootNavigator: true.

Audit workflow

• Runner overwrote item 1 every Next click (race in _saveCurrentItem writeback after _currentIndex advanced) → fixed by re-locating by id and awaiting save before advancing.
• Audit complete didn't auto-raise findings → now sweeps NC/OBS/OFI items in AuditService.completeAudit, idempotent.

Risk workflow

• Schema missing cause, consequence columns → added.
• Schema missing created_by → added.
• Model sent generated inherent_risk_score / residual_risk_score on insert (DB error 428C9) → removed from insert payload.
• risks.category was NOT NULL but the editor sends null → constraint dropped.

Realtime

• Wired RealtimeAutoReload mixin to Finding, CAPA, Audit detail pages.
• Added audit_checklist_items, findings, capa, audits, risks, controls to the supabase_realtime publication.

AI / Misc

• AI Approval Center default Pending filter showed empty due to org-race on initial load → fixed with addPostFrameCallback and _lastOrgId guard.
• Onboarding Apply error path didn't surface to UI (button stuck on "Applying…" if exception thrown) → wrapped in try/catch with success
  • error snackbars.
• Org list page had no Member CRUD → added "Manage members" menu entry that opens a _OrgMembersDialog for invite / role change / deactivate.
• Management review detail had no finalize transition → added Schedule / Start / Finalize / Reopen action buttons in the app bar.

Remaining known issues

Performance

• Onboarding large-sample apply takes 30-60 s. The service inserts 472 processes serially. Acceptable for now; batched insert is on the roadmap.

UX gaps

• No manual create-finding form. Findings only appear via the audit auto-raise sweep. Manual create is on the roadmap.
• No org-level invite-by-email-with-signup-link flow. The current Manage members dialog only invites users that already exist in the system. We need a Supabase auth invite path (admin sends an email with a magic link, recipient signs up + auto-joins the org).
• Realtime not wired on every list page. CAPA board, Workspace, Documents/Processes/Findings detail pages have realtime. Some list pages (Findings list, Risk list, Audit list, Onboarding result) still need a manual Refresh button click after save.
• AI Copilot drawer shows raw text input on Flutter web. First character of a typed message can drop on Flutter web's a11y shim. If you see "rterly internal audit…" instead of "Quarterly internal audit…", that's why.
• Assignment target picker is a static dropdown (not a typeahead). Lots of options can be hard to scroll. Adding fuzzy search is on the roadmap.

Security TODO (carried forward)

• #74 - Enable Supabase leaked-password protection. Has to be toggled by an org owner in the Supabase dashboard. One click, but flagged here so it doesn't get forgotten.

Videos roadmap

Shipped (programmatic Remotion, in /videos)

Total: ~2.5 minutes of finished video, ~10 MB at 1080p30. Source code (TSX compositions, shared theme, reusable Stepper / Slide / MockBrowser components) lives in videos/src/. Re-render any time with cd videos && bun run build:all.

Planned (next batch)

Future improvements

• Voiceover. Add ElevenLabs audio + @remotion/captions overlay so videos work even when muted-by-default in the help center.
• Hybrid screen-capture. Mix in real Playwright recordings of the app via <OffthreadVideo> for higher fidelity than pure animation.
• Localization. Move strings into i18n.ts and render per-locale.

See videos/README.md for the full project layout and how to add new compositions.

Where to look next

If you find a new bug, add it to this page under the right heading. Once it's fixed, move it up to "Currently shipped fixes" with a one-liner. The page should always reflect the truth.