Workspace
Operations
Governance
Asset Inventory
Network Infrastructure
Licenses & Software
Administration
??
Endpoint is referenced in the client but never implemented. Any call to this route returns 404, completely breaking exam workstation flows.
The document API returns a shape that conflicts with lib/api-response.ts. Client-side parsing fails silently or throws a runtime error.
Deleting a parent record leaves orphaned ExamSession rows, causing referential integrity violations and broken downstream queries.
The notifications schema and SSE stream exist but no domain event (incident created, task assigned, finding raised, license expiring, etc.) ever calls the trigger function. In-app alerts and emails are completely silent.
/api/cron tick endpoint exists but the automation engine never registers or dispatches jobs. Recurring tasks, scheduled reports, and automated alerts are all no-ops.
The finance schema has budget and spending models but no aggregation logic ever runs against them. The finance admin dashboard shows empty or permanently stale data.
The reports UI and schema exist but there is no logic to produce a report. Clicking "generate" is a dead action — no PDF, CSV, or data output is produced.
Incidents can be logged but there is no SLA timer, breach detection, or automatic escalation when a ticket ages past its target resolution time.
Projects, tasks, and assignees exist but there is no workload or available-hours model. Managers have no visibility into who is over-allocated.
License records store expiry dates but notifications are never triggered. Licenses expire silently with no warning.
Audit frameworks and findings are tracked manually. There is no logic to compute a compliance score or trend, and no scheduled check runs.
Assets can be catalogued but there is no lifecycle state machine (ordered → received → deployed → retired → disposed) and no financial depreciation calculation.
There is no CSV or Excel import to onboard large asset batches, and no export to produce an inventory register for audits or insurance.
K2 manages IT operations internally but staff outside the IT team have no mechanism to submit requests, track their tickets, or receive updates.
Projects have a calendar and task list but no Gantt-style timeline. Phase overlap, critical path, and schedule drift are invisible.
On exam day the IT manager needs a single aggregate view: PCs ready vs. not-ready per lab row, active sessions, current scan status, and checklist completion per room. No such consolidated view exists — the operator must cross-reference three separate modules.
Pearson VUE audits require a packaged evidence bundle (scan logs, configuration screenshots, checklist sign-offs, hardware audit results). There is no export function; evidence must be assembled manually for every audit cycle.
The README lists vendor management as a core IT responsibility, but K2 has no vendor-contract model, contract expiry reminders, or per-vendor SLA monitoring. Vendor relationships are managed entirely outside the system.
ExamSession moves through states (scheduled → in-progress → completed) but transitions are not server-side guarded. A session can be marked completed without ever being started, or re-opened after completion.
Two exam sessions can be assigned to the same physical seat at the same time. There is no overlap check in the booking logic.
Tasks can be assigned to phases that belong to a different project, silently corrupting project data.
The confidence-scored cascade (serial → MAC → hostname) logs mismatches but never surfaces them for human review. Unresolved conflicts accumulate silently and may cause wrong assets to receive scan data.
Credential logins (email/password) have no second factor. ZITADEL federates SSO with its own MFA, but local accounts are unprotected beyond a single password.
Sign-in, reset-password, and change-password endpoints have no brute-force protection — no throttle, no lockout, no CAPTCHA.
Hardware audits live in their own submodule but findings raised there are not aggregated into the main governance/audits view or compliance scoring.
nautobot.prisma is present, implying network-device sync, but there are no actual sync jobs, webhooks, or UI flows connecting K2 to a live Nautobot instance.
The backups module records backup metadata but there is no automated restore-test job and no UI to verify a backup's integrity.
Asset records do not have a vendorEolDate field or automated EOL alerts. Gear can silently pass its support-end date.
Tasks can have due dates but there are no formal milestones and no task-dependency graph (task B cannot start until task A is done).
Tasks have no time-logged field. There is no way to record how long work actually took, compare to estimates, or feed into capacity planning.
The /api/agent/ endpoints receive PowerShell scan uploads from up to 240 PCs. There is no evidence of per-agent API keys, mutual TLS, or payload signing. A rogue or misconfigured machine could inject false scan data, corrupting the asset-confidence matching pipeline.
Docker healthchecks cover service restarts but there is no documented DR runbook, no tested failover scenario, and no defined RTO/RPO for the PostgreSQL database. A disk failure or container host crash has no defined recovery path.
Tasks have status fields but allowed transitions are not enforced server-side. Any status can be set from any other, bypassing review or approval steps.
@dnd-kit is wired for reordering but the new order is never written back to the database. Reloading resets the order.
A global search module exists but there is no PostgreSQL full-text index (tsvector/tsquery) or external search engine. Searches likely run ILIKE scans which degrade badly at scale.
FOG is listed as a scaffolded integration but there are no actual API calls, job triggers, or status callbacks connecting K2 to a FOG server.
AD is listed as an integration but no sync logic exists. User provisioning, group → role mapping, and PC hostname resolution from AD are all absent.
Switching between ESAA and ACCA-VTS modes is orchestrated across 240 PCs but there is no defined rollback path if a transition fails mid-way.
ACCA-VTS checklists are filled manually. Scan data collected by PowerShell already contains OS version, software inventory, disk space, and more that could auto-verify many items.
Redis is in docker-compose but there is no evidence of a cache-invalidation strategy, cache-warming on startup, or documented TTL policy for any resource.
The win11-upgrade module exists to track the Windows 11 rollout project, but it does not cross-reference asset records for TPM 2.0, RAM ≥ 8 GB, or storage ≥ 64 GB eligibility before scheduling rollout batches. Incompatible machines could be queued silently.
Before committing a switch from ESAA to ACCA-VTS mode (or vice versa) across all 240 PCs, there is no way to simulate the transition and preview which machines will pass or fail readiness checks without actually applying changes.
The calendar schema stores recurrence rule data but there is no engine that materialises recurring event instances. Users see a single occurrence; future instances are never generated or displayed.
Exam functionality is split between /api/acca-vts/* (top-level) and /api/v1/operations/* (versioned). This dual surface complicates auth middleware and confuses API consumers.
Some routes outside /api/v1/* return raw JSON without the standard envelope, breaking client-side error handling and pagination assumptions.
Some critical operations (auth failures, RBAC denials, bulk data changes) do not emit systemLog entries, leaving audit trails incomplete.
The i18n loader and RTL layout are ready but German, Spanish, and Chinese are not shipped despite being mentioned as candidates.
E2E coverage exists for auth, assets, projects, locations, and network only. Governance, licenses, operations, admin, and finance modules are entirely untested.
Under exam-day load (240 concurrent scan uploads) the system behaviour is completely unknown. There is no k6, Locust, or Playwright performance test.
RBAC and CSP headers are configured but there are no automated OWASP ZAP scans, npm dependency vulnerability checks in CI, or documented pen-test results.
Docker healthchecks are defined but there is no Prometheus, Grafana, or equivalent. CPU, memory, error rate, and DB connection-pool saturation are completely invisible.
The app runs as a single standalone container. Redis supports scaling but there is no documented approach for running multiple replicas behind a load balancer.
Next.js serves all assets from the Node container. There is no CDN layer, no image optimisation pipeline, and no long-lived cache headers for JS/CSS bundles.
JWT sessions expire after 24 hours with no silent refresh. Users working a long exam day (logged in more than 24h earlier) are logged out mid-session.
Assets have labels but there is no camera-based QR or barcode scanning in the web UI to quickly look up an asset record on the lab floor.
The network designer UI appears scoped to the get-started onboarding flow. There is no persistent diagram, VLAN management, or live topology sync.
The app is likely responsive via Tailwind but there is no PWA manifest, no offline fallback, and no touch-optimised UX for lab-floor work.
The finance module tracks budgets but there is no purchase-request → approval → purchase-order → receipt flow. Procurement happens entirely outside the system.
Credentials for MinIO, SMTP, FOG, Nautobot, and Active Directory are environment variables. There is no runtime key rotation, secret expiry tracking, or secrets-management integration. A single leaked .env file exposes all service credentials.