c3be7potc4gi3641b69a58oeepvjqk0i · 5 rows
| id | content_hash | title | description | design | acceptance_criteria | notes | status | priority | issue_type | assignee | estimated_minutes | created_at | created_by | owner | updated_at | closed_at | closed_by_session | external_ref | spec_id | compaction_level | compacted_at | compacted_at_commit | original_size | sender | ephemeral | wisp_type | pinned | is_template | mol_type | work_type | source_system | metadata | source_repo | close_reason | event_kind | actor | target | payload | await_type | await_id | timeout_ns | waiters | hook_bead | role_bead | agent_state | last_activity | role_type | rig | due_at | defer_until | no_history | started_at | is_blocked |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| sr-ht-compare-11d | d93cb90c612f995ac19f371322ae99fc738ba4348621e8b6f91e81348d776ffa | Give compare's CSRF guard a rendered deny handler instead of nil | What is wrong: sourcehut-compare/web/router.go installs 'r.Use(csrf.Require(s.chromeSvc.SelfOrigin(), nil))'. Passing nil selects csrf.denyPlain, a bare text/plain http.Error. Every sibling — sourcehut-{tokens,bench,coverage,curator,specs,artifacts,dolt}/web/router.go — passes a renderer, e.g. 'func(w, r) { s.renderError(w, r, http.StatusForbidden, csrf.Message) }'. Status and message already agree with the siblings; only the presentation differs. Why it matters: compare has no POST routes today, so nothing is refused yet — but the first form added gets a naked text/plain 403 on a surface whose every other refusal is a rendered page with nav. The router's own comment explains the guard exists 'because the day somebody adds the first POST is exactly the day nobody remembers to add the check'; the same argument applies to the renderer. csrf.Require's doc calls the nil default 'a usable default rather than an invitation to skip the middleware', and compare already has an error renderer (s.renderError) it simply isn't wiring in. Correct variant: the seven siblings that pass a renderer, e.g. repo/path sourcehut-tokens/web/router.go::csrf.Require call site. Fix: sourcehut-compare/web/router.go — replace the nil argument with 'func(w, r) { s.renderError(w, r, http.StatusForbidden, csrf.Message) }'. Note: the register rates this consistency after two source reports disagreed (one called it cosmetic, one correctness-risk); both agree there are currently no POST routes so nothing is refused today. Audit: D34 (cross-repo audit, 2026-08-17) | open | 3 | chore | NULL | NULL | 2026-08-17T21:37:43Z | bigbes | bigbes@gmail.com | 2026-08-17T21:37:43Z | NULL | NULL | 0 | NULL | NULL | NULL | 0 | 0 | 0 | �{} | 0 | NULL | NULL | NULL | 0 | NULL | 0 | ||||||||||||||||||||||||
| sr-ht-compare-4yv | 3a6f90aef7850f81dba8c5e2c73048f090739410fbe0de7bed713ed762731d1d | Make sourcehut-compare/Makefile's css recipe portable off GNU sha256sum | What is wrong: the css recipe in sourcehut-compare/Makefile ends with 'mv web/static/main.min.css web/static/main.min.$$(sha256sum ... | cut -c1-8).css'. On a machine without GNU coreutils, sha256sum does not exist, the command substitution yields empty, and mv produces web/static/main.min..css. This affects six Makefiles: sourcehut-{artifacts,compare,coverage,dolt,specs,tokens}/Makefile. Why it matters: that filename does not match main.min.*.css, so assets.Resolve answers "" and every page renders unstyled, with no error anywhere (set -e does not catch a failure inside $$( )). Compounded by D09 (compare tracks the old build artefact) and the compare/dolt/specs/artifacts gap in check-version/check-embedded-css (D12). Correct variant: repo/path sourcehut-bench/Makefile and sourcehut-curator/Makefile, which define 'SHA256SUM ?= sha256sum' and use $(SHA256SUM), with a comment naming 'make SHA256SUM="shasum -a 256" css' as the macOS invocation. Fix: add 'SHA256SUM ?= sha256sum' to sourcehut-compare/Makefile and substitute $(SHA256SUM) for the raw sha256sum call in the css recipe. Audit: D08 (cross-repo audit, 2026-08-17) | open | 1 | bug | NULL | NULL | 2026-08-17T21:36:10Z | bigbes | bigbes@gmail.com | 2026-08-17T21:36:10Z | NULL | NULL | 0 | NULL | NULL | NULL | 0 | 0 | 0 | �{} | 0 | NULL | NULL | NULL | 0 | NULL | 0 | ||||||||||||||||||||||||
| sr-ht-compare-cz1 | d4ed69b8f83cc9d16ac512119174c4e0e047f5c5a5a0d6f22e4e3b9ff078f32c | Add check-version and check-embedded-css targets to sourcehut-compare/Makefile | What is wrong: sourcehut-compare/Makefile defines no check-version: target (nor check-embedded-css); its APKBUILD build() runs only 'make check-css' and package() re-verifies nothing. This gap exists in four repos: sourcehut-{artifacts,compare,dolt,specs}/Makefile. Why it matters: check-version inspects the compiled binary (go version -m $(CHECK_BIN)) for vcs.revision/vcs.modified and fails the build if the tree was dirty; check-embedded-css greps the binary for the embedded stylesheet name and diffs it against what is on disk, catching 'compiled before make css ran'. compare's own D09 (tracked build artefact that make css deletes) makes compare hit exactly the dirty-tree failure mode this gate exists to catch, on every local make css, and nothing enforces it. Correct variant: repo/path sourcehut-tokens/Makefile — bench, coverage, curator, tokens (both targets) and federation (check-version only) all call these from both build() and package(), so the gate runs against the artefact that actually ships. Fix: port check-version/check-embedded-css plus their CHECK_BIN/CHECK_BINS staged-artefact invocations from sourcehut-tokens/Makefile into sourcehut-compare/Makefile and its APKBUILD build()/package(). Audit: D12 (cross-repo audit, 2026-08-17) | open | 2 | bug | NULL | NULL | 2026-08-17T21:36:11Z | bigbes | bigbes@gmail.com | 2026-08-17T21:36:11Z | NULL | NULL | 0 | NULL | NULL | NULL | 0 | 0 | 0 | �{} | 0 | NULL | NULL | NULL | 0 | NULL | 0 | ||||||||||||||||||||||||
| sr-ht-compare-g77 | 9de449836d2118c925ba7fecbe77c2b5528f3b24fcc0d83cbc879606e52a930e | Bump gqlparser/gqlgen off the GO-2024-2920 floor in compare/go.mod | What is wrong: sourcehut-compare/go.mod pins github.com/vektah/gqlparser/v2 v2.5.8 and github.com/99designs/gqlgen v0.17.36. gqlparser v2.5.8 is below the fix for GO-2024-2920 (a DoS in parseDirectives), which landed in v2.5.14. Five modules share this stale pin: sourcehut-specs/go.mod, sourcehut-compare/go.mod, sourcehut-tokens/go.mod, sr-ht-core/go.mod, sr-ht-ecore/go.mod. Why it matters: sr-ht-core and sr-ht-ecore are libraries that compare depends on, so their floor becomes compare's floor regardless of whether compare's own /query path requires a credential first. Correct variant: gqlparser/v2 v2.5.36 + gqlgen v0.17.94, already in use by sourcehut-{artifacts,bench,coverage,curator,dolt}, thistle, sr-ht-api and sourcehut-federation (repo/path: sourcehut-bench/go.mod as a reference). Fix: bump sr-ht-core and sr-ht-ecore to gqlparser/v2@v2.5.36 + gqlgen@v0.17.94 first, then run 'go get github.com/vektah/gqlparser/v2@v2.5.36 github.com/99designs/gqlgen@v0.17.94' in sourcehut-compare/go.mod and re-run go mod tidy. Audit: D06 (cross-repo audit, 2026-08-17) | open | 0 | bug | NULL | NULL | 2026-08-17T21:36:09Z | bigbes | bigbes@gmail.com | 2026-08-17T21:36:09Z | NULL | NULL | 0 | NULL | NULL | NULL | 0 | 0 | 0 | �{} | 0 | NULL | NULL | NULL | 0 | NULL | 0 | ||||||||||||||||||||||||
| sr-ht-compare-jdq | cea9b707c3ee54120545e344272afc44380b8c68685835f8c7aba5ec03e59276 | Untrack the compiled CSS/JS bundle that make css deletes in sourcehut-compare | What is wrong: sourcehut-compare/web/static/main.min.79713f25.css (142 KB) and web/static/bundle.a62c2e63.js (10 MB) are both tracked in git, while sourcehut-compare/.gitignore already has the patterns /web/static/main.css and /web/static/main.min.*.css (with a NOTE that removal from the index 'waits on the first CI run'). A tracked file is unaffected by a later-added ignore pattern, and 'make css' opens with 'rm -f web/static/main.css $(CSS)' — it deletes a tracked file. Why it matters: every developer who runs 'make css' gets a dirty working tree, and Go stamps every binary built afterwards vcs.modified=true, which is exactly what check-version exists to catch — and compare is one of the four repos that has no check-version target (see D12/sr-ht-compare issue for that). Separately, install-files copies web/static/*, so a stale tracked CSS would be staged if make css is skipped. Correct variant: the seven sibling services, all of which gitignore the compiled stylesheet and cannot hit this class of bug. Fix: git rm --cached web/static/main.min.79713f25.css (the ignore entry already exists). Separately decide whether the 10 MB esbuild bundle from frontend/ (web/static/bundle.a62c2e63.js) should be built in CI like the CSS rather than committed, and gitignore it too if so. Audit: D09 (cross-repo audit, 2026-08-17) | open | 1 | bug | NULL | NULL | 2026-08-17T21:36:10Z | bigbes | bigbes@gmail.com | 2026-08-17T21:36:10Z | NULL | NULL | 0 | NULL | NULL | NULL | 0 | 0 | 0 | �{} | 0 | NULL | NULL | NULL | 0 | NULL | 0 |