roadmap(phase 0): stabilize while shipping

[JSONbored]

Parent roadmap: #127

Goal

Keep the v1 roadmap moving while clearing deterministic blockers that make the current queue hard to trust: merge conflicts, stale generated artifacts, lockfile drift, typecheck failures, pagination/accounting bugs, and PRs that need land/replace/close decisions.

Live PR cleanup queue

• PR feat(extension): add private maintainer PR sidebar context #224: extension PR sidebar context panel; UI evidence still matters.
• PR fix(auth): trim bearer tokens in rate-limit keys #65: bearer-token rate-limit fix.
• PR fix(docs): clarify MCP metadata upload boundary #231: MCP metadata upload boundary docs.
• PR feat: add agent action explanation cards #232: agent action explanation cards.
• PR feat(agent): add recommendation outcome feedback #229: recommendation outcome feedback.
• PR feat(agent): add risk-adjusted action portfolio #219: risk-adjusted action portfolio.

Deterministic blocker issues

• [Bug]: ensurePullRequestLabel misses labels beyond first page #160 / PR fix(labels): ensurePullRequestLabel misses labels beyond first page #161: label pagination/accounting.
• [Bug]: openIssuesTotal under-counts when open PRs are subtracted from GraphQL issues #159 / PR fix(backfill): openIssuesTotal under-counts when open PRs are subtracted from GraphQL issues #162: open issue under-count.
• [Bug]: Monolithic backfill stores PR-inclusive count as openIssuesCount #176 / PR fix(backfill): Monolithic backfill stores PR-inclusive count as openIssuesCount #177: PR-inclusive open issue count.
• [Bug]: Maintainer-authored issues can be scored ready for outside contributors #186 / PR fix(engine): Maintainer-authored issues can be scored ready for outside contributors #187: maintainer-authored issue scoring.
• PR feat(bounties): classify lifecycle advisory states #157: stale bounty lifecycle branch.

Done when

• The stale v1 PR queue is sorted into land, replace, or close buckets.
• Mechanical blockers are fixed or superseded by cleaner replacement PRs.
• Generated artifacts, OpenAPI/schema output, package locks, and route trees are current wherever touched.

Cross-cutting acceptance criteria

• Preserve the repo quality gate: npm run test:ci, 97%+ global coverage, and the local branch coverage target for touched code.
• Keep public/private boundaries explicit. Public GitHub output must not expose wallets, hotkeys, reward estimates, raw trust scores, public score predictions, private reviewability, private scoreability context, or farming language.
• Add/update focused tests for the changed behavior instead of relying on green checks alone.

UI evidence gate

Any visible web, browser-extension, or GitHub-overlay change must include maintainer-reviewable screenshots or a short recording covering the changed states. A checked template box without actual visual evidence is not enough.