The first backlog
Import a codebase and the first backlog holds only the work a one-click fix on the Maintaining tab cannot cover: the missing capabilities behind its findings and policy gaps, checked against the code before they are proposed.
The first backlog Taiga plans for an imported codebase is where you judge whether it understood the code. One that bundles every finding into a single security item, or suggests a feature while a serious vulnerability sits open, has not.
It now holds only the work no single fix covers: a missing capability, such as central audit logging or a shared way to manage secrets, that explains several findings or closes a gap against your policies; the foundation for building and testing changes safely, where the repository has none; or replacing a dependency whose vulnerability has no fixed version. Findings the Maintaining tab can fix in one click stay there. Before naming a capability as missing, the planner reads the repository, so a gap the code has already closed is not proposed.
There is no target length: a repository in good shape gets a short list. An empty request for the next initiative starts from the most urgent open finding or policy gap nothing covers yet, before anything your documents describe.