Digital Employee System Audit Issue List (2026-06-14)

? CRITICAL (3)

P1: Premature Module-Level Call to ensureTables() in boss-scheduler/index.js

• File: server/boss-scheduler/index.js Lines 13-16
• Code calls staffManager.ensureTables() at module scope before sqlite-compat.init() completes
• First call to getDb() throws "sql.js not initialized" → _db remains permanently null
• Even if loadSqliteRoutes() later calls ensureTables() successfully and sets _db,

if an old zombie process or asynchronous re-entry grabs it first, the API will always return empty

• Fix: Move the module-level ensureTables() call inside _loadProfile() or _ensureInit(),

or delete it entirely (since loadSqliteRoutes() in server.js already calls it once).

P2: Hardcoded 1-Minute Timeout in procurement.js Phase 2

• File: server/boss-scheduler/workers/procurement.js Line 159
• waitTimeout: 1, confirmTimeout: 1 are hardcoded test values
• Should read from staff.params.waitTimeout (waitTimeout: 30 in local.yaml, unit: seconds)
• Causes procurement to timeout before the user can confirm
• Fix: Use { ...(staff.params || {}), ...(parameters || {}) } to get the full merged config, ensure overrides are passed correctly.

P3: cost-optimizer.js Uses Hardcoded Mock Data

• File: server/boss-scheduler/workers/cost-optimizer.js
• The entire worker does not connect to real SCSAI/BOM data
• mockComponents and recommendations are entirely hardcoded
• Contradicts the earlier decision to "prohibit mock data"
• Fix: At minimum add a TODO comment; on API call failure, use a logging fallback instead of mock, or directly throw an error

? ARCHITECTURE (3)

P4: Inconsistent database states between staff-manager and lite-scheduler

• staff-manager uses the digital_staff table from sciot_import.db
• lite-scheduler loads from local.yaml and writes to DB via syncStaffToDb()
• YAML overwrites DB changes: User edits to staff configuration via frontend are overwritten by syncStaffToDb()
• Fix: Use a merge strategy in syncStaffToDb(), preserving fields already modified in the DB

P5: procurement.js creates a new SCSAIClient on every request

• File: server/boss-scheduler/workers/procurement.js lines 107-113
• Phase 1 creates a new SCSAIClient on each execution, no connection pool reuse
• Reads the same parameters from environment variables and repeatedly creates new instances
• Fix: Create a single SCSAIClient instance at the top of the module

P6: Double hardcoding of default parameters in procurement.js

• params.waitTimeout: 30 is already defined in local.yaml
• procurement.js line 159 hardcodes waitTimeout: 1 again
• Data flow: staff.params → merged (overwrites params) → runProcurementWorkflowV3({ waitTimeout: 1, ... })
• The value of params is manually overwritten to 1 in merged

? BUGS (6)

P7: cost-optimizer.js HTTP API calls use 'http' instead of require('http'), which may not exist

• File: server/boss-scheduler/workers/cost-optimizer.js Line 62
• API call timeout not handled (default is infinite wait)
• If the server calls itself (ylxt.chat/api/demo/bom-cost-optimize),

deadlock may occur when the worker holds the mutex

P8: execution-context.js logs use JSON file for high concurrency

• 1-second debounce, multiple async operations write to the same file simultaneously
• Although tmp+rename is used, JSON.stringify may cause OOM with 500 log entries (~2MB)
• Fix: Consider limiting line size or throttling

P9: data-caretaker.js poDir duplicate declaration

• File: server/boss-scheduler/workers/data-caretaker.js Line 80
• const poDir declared twice (Line 68 and 80), runtime throws SyntaxError
• Fix: Remove duplicate declaration

P10: staff-registry.js and lite-scheduler.js capability fields inconsistent

• toRuntimeStaff() sets capabilities array for staff
• _resolveStaff() does not set capabilities when loading staff from DB
• Frontend-edited staff lacks capabilities, plugins cannot use capabilities

P11: staff-manager.js queryLogs uses ISO string, execution-context.js uses timestamp

• staff-manager.queryLogs since parameter uses ISO date string for comparison
• execution-context.getStaffLogs since parameter uses timestampUnix (number)
• Two sets of query APIs have inconsistent formats

P12: Hardcoded configuration when building SCSAIClient in lite-scheduler.js

• File: lite-scheduler.js lines 87-93
• SCSAI configuration is obtained from process.env.SCSAI_* or falls back to hardcoded values
• This and the SCSAIClient loaded by server.js are two different paths; configurations may differ

⚪ CODE QUALITY (5)

P13: 95KB of legacy code in digital-staff/index.js

• Still referenced by execution-context.js (pushLogToSSEClients)
• But has been replaced by the lite-scheduler system
• Recommend cleaning up unused exports

P14: Numerous empty-line debug logs in server.js routing

• [DEBUG] and [router] dispatch entries create noise

P15: Missing result parameter in staffLog call for procurement.js Phase 1

• File line 155: staffLog(staff.id, 'Procurement assistant started', ...) only passes 3 parameters
• But the ctx.staffLog signature is (staffId, action, detail, result, meta)

P16: Excessive empty lines in system-health.js

• Lines 84-88 contain many empty lines

P17: getSciotDb in consistency-check.js may not be exported correctly

• system-health.js line 10: const { runConsistencyCheck, getSciotDb } = require('../lib/consistency-check');
• If getSciotDb is not exported, it will return undefined