q5r08pmvd6shij7rn16rajcub2t8cmtf · 55 rows
| id | content_hash | title | description | design | acceptance_criteria | notes | status | priority | issue_type | assignee | estimated_minutes | created_at | created_by | owner | updated_at | closed_at | closed_by_session | external_ref | spec_id | compaction_level | compacted_at | compacted_at_commit | original_size | sender | ephemeral | wisp_type | pinned | is_template | mol_type | work_type | source_system | metadata | source_repo | close_reason | event_kind | actor | target | payload | await_type | await_id | timeout_ns | waiters | hook_bead | role_bead | agent_state | last_activity | role_type | rig | due_at | defer_until | no_history | started_at | is_blocked |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| sr-ht-dolt-tmz.4 | 27890cf801b4c4286fd767224977561eeeb70f932e5f450f1d63fd40345d3d50 | Wire /query into the daemon, api-meta.json scopes and docs | Mount the schema on core-go's authenticated router, serve /query/api-meta.json with a NON-NULL scopes list (a null there 500s meta.sr.ht's personal-token page for the whole instance), add api-origin to config.example.ini and README, and document federating into api.sr.ht. | closed | 2 | task | NULL | NULL | 2026-08-15T09:43:03Z | Eugene Blikh | bigbes@gmail.com | 2026-08-15T10:19:36Z | 2026-08-15T10:19:36Z | NULL | 0 | NULL | NULL | NULL | 0 | 0 | 0 | �{} | Closed | 0 | NULL | NULL | NULL | 0 | NULL | 0 | |||||||||||||||||||||||
| sr-ht-dolt-u2b | f5120a5915edd32830478ece9e2fbc0dbf8f91c85460d25f3737aaec0ae44ac5 | Add bind-address config key and replace static-dir with go:embed | What is wrong, in two parts. (a) `sourcehut-dolt/config.example.ini` has `remotesapi-listen=127.0.0.1:5306`, `credsapi-listen=127.0.0.1:5308`, and `static-dir=/usr/share/sourcehut/dolt.sr.ht/static`, but no `bind-address` key — the web listener's bind address is settable only through the `-b` command-line flag (`cmd/doltsrht/main.go` calls `server.New(serviceName, defaultWebAddr, conf, os.Args)`), not through the shared `bind-address` config key every sibling service uses. (b) dolt is the one service in the family that serves its stylesheet from an on-disk `static-dir` rather than compiling it into the binary with `go:embed` — every sibling's `config.example.ini` carries the sentence "There is no static-dir key: CSS and JS are compiled into the binary with go:embed", and dolt is the reason that sentence has to be written at all. Why it matters: (a) the containerized deployment relies on the config key to set `0.0.0.0:<port>` in exactly one place — every entrypoint's comment says repeating the port on the command line "is how a unit and its config drift apart", and dolt is one of only two services (with specs) where this can happen. (b) an on-disk static tree means a version-skewed package can serve a stylesheet from a different build than the binary running — exactly what `check-embedded-css` prevents everywhere else, and dolt is separately missing that gate (see D12) and does not clean up old hashed files either (see D22), compounding the risk. Sibling that already does it correctly: every other sibling service, on both halves — they read `bind-address` from config and `go:embed` their static assets. Fix: add a `bind-address` key to dolt's `[dolt.sr.ht]` config section and read it in `validateConfig`; convert dolt's `static/` tree to `go:embed` and drop the `static-dir` config key entirely. Status: verified — confirmed directly by reading dolt's `config.example.ini` and `cmd/doltsrht/main.go` (this was one of two contradictory claims across the source reports and was settled by reading the code). Audit: D20 (cross-repo audit, 2026-08-17) | open | 2 | task | NULL | NULL | 2026-08-17T20:39:26Z | Eugene Blikh | bigbes@gmail.com | 2026-08-17T20:39:26Z | NULL | NULL | 0 | NULL | NULL | NULL | 0 | 0 | 0 | �{} | 0 | NULL | NULL | NULL | 0 | NULL | 0 | ||||||||||||||||||||||||
| sr-ht-dolt-ux7 | 4b1926735da5ca79103be3182a885d250e69d467de48e359793621e66cb29728 | browse.Log reports an unparseable start hash as an internal failure | browse.Log classifies a from-hash that is not a parseable dolt hash with a plain fmt.Errorf and has no sentinel for it, so a caller that hands over a mistyped cursor is told the service broke rather than that the ref does not exist. Found while building the MCP get_commit_log cursor (7a77409): mcpsrv cannot classify it without parsing a hash format that browse/ owns, so the fix belongs in browse/. | Wrap the MaybeParse arm of Log in ErrRefNotFound, the sentinel the package already uses for "this ref names nothing". mcpsrv then answers it as the ordinary miss it is, through the refMiss classifier that already exists. | browse test: a garbage from-hash returns an error satisfying errors.Is(err, ErrRefNotFound); the MCP tool answers it as a miss rather than an internal error. | closed | 3 | bug | NULL | NULL | 2026-08-13T05:46:20Z | Eugene Blikh | bigbes@gmail.com | 2026-08-13T06:35:00Z | 2026-08-13T06:35:00Z | NULL | 0 | NULL | NULL | NULL | 0 | 0 | 0 | �{} | Landed in 2c8903f: the MaybeParse arm plus two more the agent found by testing rather than inspection — a well-formed but nonexistent from-hash reaching the topological iterator, and the same shape in resolveCommit — all wrapped in ErrRefNotFound via datas.ErrCommitNotFound. Genuine failures stay unwrapped, so 'not there' and 'could not answer' remain distinguishable. | 0 | NULL | NULL | NULL | 0 | 2026-08-13T06:27:39Z | 0 | |||||||||||||||||||||
| sr-ht-dolt-w9p | 9dda36b62370ee29df3aecaf80b94cc108302d1c9c2493aeedd3a8a64016ac54 | Mount middleware.PrivateCache on the /query GraphQL route | What is wrong: the chi Group mounting `/query` in `sourcehut-dolt/cmd/doltsrht/main.go` carries RealIP/log/config/database middleware but never `middleware.PrivateCache`. dolt's GraphQL schema answers per-credential and also answers anonymous callers, so the same URL can yield different response bodies to different viewers with nothing marking that in the response headers. Why it matters: ranked as a lower-severity correctness risk than the REST equivalent (D03) because POST bodies are not normally cached by intermediaries — but it becomes live risk the moment GET-query support or a GraphQL-aware cache sits in front of the service. Sibling that already does it correctly: `sourcehut-curator/graph/graph.go::Mount` and `sourcehut-artifacts/graph/graph.go::privateCache`, both of which set `no-store` + `Vary: Authorization, Cookie` on the `/query` route. Fix: add `r.Use(middleware.PrivateCache)` to the chi Group mounting `/query` in `cmd/doltsrht/main.go`. Status: verified by the underlying report. Audit: D14 (cross-repo audit, 2026-08-17) | open | 2 | bug | NULL | NULL | 2026-08-17T20:39:10Z | Eugene Blikh | bigbes@gmail.com | 2026-08-17T20:39:10Z | NULL | NULL | 0 | NULL | NULL | NULL | 0 | 0 | 0 | �{} | 0 | NULL | NULL | NULL | 0 | NULL | 0 | ||||||||||||||||||||||||
| sr-ht-dolt-xsc | 434e870e68beb866ff78324b80edf5e757977794d577a8b7851b7eeca021da92 | A clipped labels table degrades the board silently | The board raises Truncated for a clipped issues or dependencies table, but a clipped labels table degrades every card and the label filter with nothing said. Noticed while making the other projections honest (ebbd30f), which deliberately left the board rule byte-for-byte unchanged and pinned it with a test. | closed | 3 | bug | NULL | NULL | 2026-08-13T07:17:46Z | Eugene Blikh | bigbes@gmail.com | 2026-08-13T08:12:10Z | 2026-08-13T08:12:10Z | NULL | 0 | NULL | NULL | NULL | 0 | 0 | 0 | �{} | Landed in 96b5e53: Data.Clipped []ClippedTable (table, shown, total, and the effect written at the read), board mode only. Truncated/ShownOf keep their exact meaning, so mcpsrv's table_truncated is untouched. The board now names each clipped table it draws from and what that costs; comments never appears because the board does not read it. One behaviour change beyond addition: the count line is gated on IssuesClipped, so a deps-only clip no longer prints 'the first 4 of 4 issues'. | 0 | NULL | NULL | NULL | 0 | 2026-08-13T07:57:56Z | 0 |