tohnjcmahdoobco6r9g5rauc84ofm150 · 10 rows
| id | content_hash | title | description | design | acceptance_criteria | notes | status | priority | issue_type | assignee | estimated_minutes | created_at | created_by | owner | updated_at | closed_at | closed_by_session | external_ref | spec_id | compaction_level | compacted_at | compacted_at_commit | original_size | sender | ephemeral | wisp_type | pinned | is_template | mol_type | work_type | source_system | metadata | source_repo | close_reason | event_kind | actor | target | payload | await_type | await_id | timeout_ns | waiters | hook_bead | role_bead | agent_state | last_activity | role_type | rig | due_at | defer_until | no_history | started_at | is_blocked |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| sr-ht-ecore-1aj | c4c2ac5328e8bff0f19885800e9d66e8ee4425f78a823059b40864a4b17cec0d | chrome: remove the deprecated ExtraNav seam | chrome.Service.ExtraNav has no users left across the six services: bench and cov dropped it when the instance deployed a tokens.sr.ht and 'tokens' appeared in the navbar twice, and artifacts moved its three sections to Sections (ecore 514838a, artifacts 7584106). Both historical uses were the same mistake - a page of one service in the row that lists the instance's services - so there is no correct use to preserve. Removing it touches Service, Page and the srht-nav partial's second range block. | open | 3 | task | NULL | NULL | 2026-08-15T19:37:00Z | Eugene Blikh | bigbes@gmail.com | 2026-08-15T19:37:00Z | NULL | NULL | 0 | NULL | NULL | NULL | 0 | 0 | 0 | �{} | 0 | NULL | NULL | NULL | 0 | NULL | 0 | ||||||||||||||||||||||||
| sr-ht-ecore-3sa | 215f333df6ff16c8b5689438a7ddeb225dd529efd8e3f1b66d3f3de31a9bc980 | Bump gqlparser to v2.5.36 and gqlgen to v0.17.94 in go.mod | What is wrong: sr-ht-ecore/go.mod pins github.com/vektah/gqlparser/v2 v2.5.8 and github.com/99designs/gqlgen v0.17.36, below the GO-2024-2920 security floor (a DoS in gqlparser's parseDirectives, fixed in v2.5.14). gqlgen v0.17.36 also pins golang.org/x/tools v0.9.3, which does not compile under the current toolchain, breaking 'go generate ./graph' in downstream consumers (observed in sourcehut-specs). Why it matters: sr-ht-ecore is a shared library, so its floor becomes every consumer's floor. sourcehut-specs, sourcehut-compare and sourcehut-tokens all inherit this pin transitively via sr-ht-ecore/sr-ht-core. This must land before those consumers can be bumped (sr-ht-core needs the same bump first). Correct variant, already in use by: sourcehut-artifacts, sourcehut-bench, sourcehut-coverage, sourcehut-curator, sourcehut-dolt, sourcehut-federation, sr-ht-api and thistle, all on gqlparser v2.5.36 + gqlgen v0.17.94. Fix: go get github.com/vektah/gqlparser/v2@v2.5.36 github.com/99designs/gqlgen@v0.17.94 in sr-ht-ecore/go.mod. Confidence: verified (version strings read directly out of all nine services' go.mod plus sr-ht-core and sr-ht-ecore; split is exactly 5/5). Audit: D06 (cross-repo audit, 2026-08-17) | open | 0 | bug | NULL | NULL | 2026-08-17T20:35:28Z | Eugene Blikh | bigbes@gmail.com | 2026-08-17T20:35:28Z | NULL | NULL | 0 | NULL | NULL | NULL | 0 | 0 | 0 | �{} | 0 | NULL | NULL | NULL | 0 | NULL | 0 | ||||||||||||||||||||||||
| sr-ht-ecore-6r2 | 5a67ac288a1f220cf4ef8e7674c6a12e4b32044d52cf9db6af99a2055527cab6 | Parameterize the hardcoded Vary header in mcphttp.PrivateCache so dolt can adopt mcphttp | What is wrong: sr-ht-ecore/mcphttp/cache.go's PrivateCache hardcodes vary = "Cookie, Authorization". This is the one stated blocker preventing sourcehut-dolt from importing mcphttp instead of carrying its own private copy, since dolt deliberately uses Vary: Authorization alone. Why it matters: mcphttp was extracted precisely because the Host guard, the commit-time cache wrapper and the two transport options are byte-identical across six services (artifacts, bench, coverage, curator, dolt, specs) — yet nothing imports it (grep across all nine service trees returns zero real imports, only two doc-comment mentions in bench and specs falsely claiming the swap is blocked because the ecore commit adding mcphttp is unpublished/unpinned — verifiably false, both pinned ecore revisions already contain the package). Because each service kept its own private copy, the identical cacheWriter.Flush bug was independently discovered and fixed twice (ecore 3bd158f/00d7582, artifacts 6c44e03), and two other defects in this same audit (a service missing Stateless: true, two services missing Flush on their cacheWriter) are direct consequences of copy-don't-import continuing instead of the package being adopted. Correct variant: mcphttp itself, once this one blocker is removed. Fix: make vary a parameter/field on mcphttp.PrivateCache (or on StreamableOptions), defaulting to "Cookie, Authorization" but overridable so dolt can pass "Authorization" alone. This unblocks each of the six services deleting their private privateCache/cacheWriter/allowHosts/hostAllowed copies and importing mcphttp directly — that consumer-side work is separate follow-up work per repo, not part of this issue. Confidence: verified (two doc-comment mentions found, zero real imports; both services' pinned sr-ht-ecore revisions confirmed to already contain mcphttp). Audit: D10 (cross-repo audit, 2026-08-17) | open | 2 | bug | NULL | NULL | 2026-08-17T20:36:07Z | Eugene Blikh | bigbes@gmail.com | 2026-08-17T20:36:07Z | NULL | NULL | 0 | NULL | NULL | NULL | 0 | 0 | 0 | �{} | 0 | NULL | NULL | NULL | 0 | NULL | 0 | ||||||||||||||||||||||||
| sr-ht-ecore-g3r | 7bc634f8ff5276c0d7ed0606d98065dcab336835eeeb84293e5d62817317aa68 | Unify the GraphQL bearer plane: meta PAT beside the working token | Four services (cov, bench, spec, artifacts) accept only a tokens.sr.ht working token on /query, and publish an empty scope list in api-meta.json, so meta.sr.ht cannot mint a PAT for them at all. dolt already accepts both and publishes a scope. api.sr.ht forwards ONE client Authorization header to every service a federated query touches, so a GraphQL plane that refuses meta PATs cannot federate. Bring the four to dolt's shape: /query accepts meta PAT + working token; MCP and REST stay on tokens.sr.ht alone. | Shared half lands in a new sr-ht-ecore package, metapat, beside bearer: ClientID routing, the meta PAT resolve path (decode, username check, LookupUser, LookupTokenRevocation, positive cache) and the OAuth scope check. Each service keeps its own Principal, MetaBackend and error classification. dolt is not migrated in this epic: its PAT plane is entangled with the Basic clone path. Scopes are spelled upstream-style, upper case: cov.sr.ht/REPORTS, bench.sr.ht/RESULTS, spec.sr.ht/SPECS, artifacts.sr.ht/REPOS. | open | 1 | epic | NULL | NULL | 2026-08-16T18:27:30Z | Eugene Blikh | bigbes@gmail.com | 2026-08-16T18:27:30Z | NULL | NULL | 0 | NULL | NULL | NULL | 0 | 0 | 0 | �{} | 0 | NULL | NULL | NULL | 0 | NULL | 0 | |||||||||||||||||||||||
| sr-ht-ecore-g3r.1 | 6690b3b79f16709676dae3a6f0b93b38828402c0c8cd1e1e8ecca20c54419d2b | ecore/metapat: the shared meta.sr.ht PAT plane | A validator for meta.sr.ht personal access tokens beside bearer's working-token one: PlaneOf routing, decode/lookup/revocation with a bounded positive cache, and Allows for the OAuth scope gate. | closed | 1 | feature | NULL | NULL | 2026-08-16T18:37:37Z | Eugene Blikh | bigbes@gmail.com | 2026-08-16T18:59:50Z | 2026-08-16T18:59:50Z | NULL | 0 | NULL | NULL | NULL | 0 | 0 | 0 | �{} | Closed | 0 | NULL | NULL | NULL | 0 | NULL | 0 | |||||||||||||||||||||||
| sr-ht-ecore-g3r.2 | 5997c4e1476c5bf13968d86af31e1de96d4d785cd472868cf297aa31d77a69ec | cov.sr.ht accepts a meta PAT on /query (scope REPORTS) | Adopt ecore/metapat on the GraphQL endpoint: route by PlaneOf, keep the working-token arm, gate the meta PAT arm on the service's OAuth scope, and publish that scope in api-meta.json so meta.sr.ht can mint a token for it. MCP and REST stay on tokens.sr.ht alone. Rewrite the doc comments that currently state the opposite. | closed | 1 | task | Eugene Blikh | NULL | 2026-08-16T18:37:49Z | Eugene Blikh | bigbes@gmail.com | 2026-08-16T19:13:39Z | 2026-08-16T19:13:39Z | NULL | 0 | NULL | NULL | NULL | 0 | 0 | 0 | �{} | Deployed as cov.sr.ht 0.9.1_git30 and verified end-to-end: api-meta.json publishes REPORTS, and hut reads /query with the ordinary meta PAT already in its config. | 0 | NULL | NULL | NULL | 0 | 2026-08-16T18:59:58Z | 0 | |||||||||||||||||||||||
| sr-ht-ecore-g3r.3 | 66c7751f414cf0b90abe4ea13425406b477a790ecbe973c19d832d94e54f2f00 | bench.sr.ht accepts a meta PAT on /query (scope RESULTS) | Adopt ecore/metapat on the GraphQL endpoint: route by PlaneOf, keep the working-token arm, gate the meta PAT arm on the service's OAuth scope, and publish that scope in api-meta.json so meta.sr.ht can mint a token for it. MCP and REST stay on tokens.sr.ht alone. Rewrite the doc comments that currently state the opposite. | closed | 1 | task | Eugene Blikh | NULL | 2026-08-16T18:37:49Z | Eugene Blikh | bigbes@gmail.com | 2026-08-16T19:34:12Z | 2026-08-16T19:34:12Z | NULL | 0 | NULL | NULL | NULL | 0 | 0 | 0 | �{} | Implemented, green, pushed; awaiting CI and deploy. | 0 | NULL | NULL | NULL | 0 | 2026-08-16T19:13:46Z | 0 | |||||||||||||||||||||||
| sr-ht-ecore-g3r.4 | dbd2c9916707cdf650d8a40a3ef2bd558062d3ea79934d7f3a7ea10b1e556b60 | spec.sr.ht accepts a meta PAT on /query (scope SPECS) | Adopt ecore/metapat on the GraphQL endpoint: route by PlaneOf, keep the working-token arm, gate the meta PAT arm on the service's OAuth scope, and publish that scope in api-meta.json so meta.sr.ht can mint a token for it. MCP and REST stay on tokens.sr.ht alone. Rewrite the doc comments that currently state the opposite. | closed | 1 | task | NULL | NULL | 2026-08-16T18:37:50Z | Eugene Blikh | bigbes@gmail.com | 2026-08-17T06:03:09Z | 2026-08-17T06:03:09Z | NULL | 0 | NULL | NULL | NULL | 0 | 0 | 0 | �{} | Implemented by parallel agents, verified independently (gates re-run + mutation tests), pushed and deployed; all four services answer a meta PAT on /query. | 0 | NULL | NULL | NULL | 0 | NULL | 0 | |||||||||||||||||||||||
| sr-ht-ecore-g3r.5 | 2903cfd195123a383a6bcea6a4232f6eb4439e1ae5b45dd2b4549ae2d5056838 | artifacts.sr.ht accepts a meta PAT on /query (scope REPOS) | Adopt ecore/metapat on the GraphQL endpoint: route by PlaneOf, keep the working-token arm, gate the meta PAT arm on the service's OAuth scope, and publish that scope in api-meta.json so meta.sr.ht can mint a token for it. MCP and REST stay on tokens.sr.ht alone. Rewrite the doc comments that currently state the opposite. | closed | 1 | task | NULL | NULL | 2026-08-16T18:37:51Z | Eugene Blikh | bigbes@gmail.com | 2026-08-17T06:03:10Z | 2026-08-17T06:03:10Z | NULL | 0 | NULL | NULL | NULL | 0 | 0 | 0 | �{} | Implemented by parallel agents, verified independently (gates re-run + mutation tests), pushed and deployed; all four services answer a meta PAT on /query. | 0 | NULL | NULL | NULL | 0 | NULL | 0 | |||||||||||||||||||||||
| sr-ht-ecore-g3r.6 | 99ae2263684e417f3db49e4563c52d5d011ad36811f4692b4bd5604d8a2672ec | api.sr.ht is not deployed on the instance, so nothing is federated yet | The stack on phoebe runs 23 srht-* containers and api.sr.ht is not among them: POST https://api.srht.bigb.es/query does not resolve. So the federation the meta-PAT work unblocks is potential, not current — what it buys today is that hut and any other meta-PAT client can read /query directly. Deploying the gateway means a Dockerfile.api in phoebe-lab/srht, an [api.sr.ht] section, and api-origin= lines for the services to federate. Upstream builds the service list from every config section whose name ends in .sr.ht, so our six custom services would be picked up automatically once they are in its config. | open | 2 | task | NULL | NULL | 2026-08-16T19:35:26Z | Eugene Blikh | bigbes@gmail.com | 2026-08-16T19:35:26Z | NULL | NULL | 0 | NULL | NULL | NULL | 0 | 0 | 0 | �{} | 0 | NULL | NULL | NULL | 0 | NULL | 0 |