Generated by the improve skill on 2026-06-11 against commit 635fc3c (branch feat/dashboard-mvp). Execute in the order below unless dependencies say otherwise. Each executor: read the plan fully before starting, honor its STOP conditions, and update your row when done.

Status values: TODO | IN PROGRESS | DONE | BLOCKED (with one-line reason) | REJECTED (with one-line rationale)

• 001 first, always — it's the verification baseline; every other plan gates on bun run typecheck, which fails today.
• 002 before 011 (hard dependency) — consolidating the services before the pagination fix lands would re-spread the >300-users truncation bug.
• 003 before 009 — both edit packages/bff/src/routes/sync.ts and packages/worker/src/services/sync-job-repo.ts; 003 changes logic, 009 then swaps literals for constants.
• 005 before 006 — 006's 401s flow through the rewritten error handler and its tests reuse it.
• 003/004 before 008 — route tests should lock in the fixed behavior, not the bugs.
• 007 and 008 before 011 — they are the safety net that makes the consolidation refactor verifiable.
• 006 before 010 if possible — 010's .env.example should include 006's new auth variables (010 is written to pick up whatever the live config schemas contain).

Recorded so future audits don't re-litigate them:

• "Jobs double-completed after failure" (sync-engine catchAll) — false positive: the catchAll path returns empty invited/removed, making the completion condition false. The real defect is the stuck-running job, covered by plan 003.
• "status as 400 hardcodes all error responses to 400" — false positive: a TypeScript cast doesn't change runtime values. The cast is removed incidentally by plan 005.
• "Audit-log inserts not awaited (silent failures)" — false positive: every db.insert(auditLog) in routes/{users,teams,repos}.ts is awaited.
• "Atlassian delete URL malformed" (api-client.ts:234) — https://api.atlassian.com/users/{account_id}/manage/lifecycle/delete is the documented Atlassian user-management lifecycle endpoint; not a bug.
• Sync-endpoint DoS via unbounded job creation — mostly mitigated: the 409 dedupe check caps the queue at one pending/running job per type. Auth (plan 006) closes the rest.
• Stale Google auth singleton in BFF routes — google.auth.GoogleAuth refreshes tokens automatically; not a real defect.
• PII (emails/usernames) in logs and Slack notifications — intentional product behavior for an internal admin/audit tool; not worth doing.
• "Invite race when a user is deleted mid-sync" — already handled gracefully (error accumulated, sync continues); noise.

• No actor identity in audit_log (no performed_by column; activity feed hardcodes trigger: 'dashboard') — blocked on per-user auth; revisit after plan 006 ships and if/when OIDC replaces Basic Auth. Noted in plan 006's maintenance notes.
• No runtime validation of API request bodies (c.req.json<T>() casts; Zod available but unused at boundaries) — moderate value; natural to add per-route once route tests (008) exist.
• repos.ts route tests — deferred from plan 008 to keep it a day-ish; mirror teams.test.ts.
• Direction options surfaced to the maintainer (not planned): GitHub-sync dry-run/preview endpoint (the diff logic already computes lists before acting); surfacing sync_history.details in the dashboard; Atlassian visibility in the dashboard.