What are the serious holes?

The main hole is that ATProto's data model is a bit awkward for a code forge.

Issues/PRs/comments are records owned by their authors, not by the repo. So an issue can span N users' PDSes. That's a neat model for social media, but a forge wants the repo to be the durable owner/context of its issues and history because that's where the comment/issue/etc. logically belongs.

The solution? tangled.org acts as a super advanced cache/aggregator for that. What can possibly go wrong?