u3uq5um7fm7f8a0scmuee9iu6j2n6kni · 9 rows
| id | content_hash | title | description | design | acceptance_criteria | notes | status | priority | issue_type | assignee | estimated_minutes | created_at | created_by | owner | updated_at | closed_at | closed_by_session | external_ref | spec_id | compaction_level | compacted_at | compacted_at_commit | original_size | sender | ephemeral | wisp_type | pinned | is_template | mol_type | work_type | source_system | metadata | source_repo | close_reason | event_kind | actor | target | payload | await_type | await_id | timeout_ns | waiters | hook_bead | role_bead | agent_state | last_activity | role_type | rig | due_at | defer_until | no_history | started_at | is_blocked |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| sr-ht-ecore-1aj | c4c2ac5328e8bff0f19885800e9d66e8ee4425f78a823059b40864a4b17cec0d | chrome: remove the deprecated ExtraNav seam | chrome.Service.ExtraNav has no users left across the six services: bench and cov dropped it when the instance deployed a tokens.sr.ht and 'tokens' appeared in the navbar twice, and artifacts moved its three sections to Sections (ecore 514838a, artifacts 7584106). Both historical uses were the same mistake - a page of one service in the row that lists the instance's services - so there is no correct use to preserve. Removing it touches Service, Page and the srht-nav partial's second range block. | open | 3 | task | NULL | NULL | 2026-08-15T19:37:00Z | Eugene Blikh | bigbes@gmail.com | 2026-08-15T19:37:00Z | NULL | NULL | 0 | NULL | NULL | NULL | 0 | 0 | 0 | �{} | 0 | NULL | NULL | NULL | 0 | NULL | 0 | ||||||||||||||||||||||||
| sr-ht-ecore-3sa | 215f333df6ff16c8b5689438a7ddeb225dd529efd8e3f1b66d3f3de31a9bc980 | Bump gqlparser to v2.5.36 and gqlgen to v0.17.94 in go.mod | What is wrong: sr-ht-ecore/go.mod pins github.com/vektah/gqlparser/v2 v2.5.8 and github.com/99designs/gqlgen v0.17.36, below the GO-2024-2920 security floor (a DoS in gqlparser's parseDirectives, fixed in v2.5.14). gqlgen v0.17.36 also pins golang.org/x/tools v0.9.3, which does not compile under the current toolchain, breaking 'go generate ./graph' in downstream consumers (observed in sourcehut-specs). Why it matters: sr-ht-ecore is a shared library, so its floor becomes every consumer's floor. sourcehut-specs, sourcehut-compare and sourcehut-tokens all inherit this pin transitively via sr-ht-ecore/sr-ht-core. This must land before those consumers can be bumped (sr-ht-core needs the same bump first). Correct variant, already in use by: sourcehut-artifacts, sourcehut-bench, sourcehut-coverage, sourcehut-curator, sourcehut-dolt, sourcehut-federation, sr-ht-api and thistle, all on gqlparser v2.5.36 + gqlgen v0.17.94. Fix: go get github.com/vektah/gqlparser/v2@v2.5.36 github.com/99designs/gqlgen@v0.17.94 in sr-ht-ecore/go.mod. Confidence: verified (version strings read directly out of all nine services' go.mod plus sr-ht-core and sr-ht-ecore; split is exactly 5/5). Audit: D06 (cross-repo audit, 2026-08-17) | open | 0 | bug | NULL | NULL | 2026-08-17T20:35:28Z | Eugene Blikh | bigbes@gmail.com | 2026-08-17T20:35:28Z | NULL | NULL | 0 | NULL | NULL | NULL | 0 | 0 | 0 | �{} | 0 | NULL | NULL | NULL | 0 | NULL | 0 | ||||||||||||||||||||||||
| sr-ht-ecore-g3r | 7bc634f8ff5276c0d7ed0606d98065dcab336835eeeb84293e5d62817317aa68 | Unify the GraphQL bearer plane: meta PAT beside the working token | Four services (cov, bench, spec, artifacts) accept only a tokens.sr.ht working token on /query, and publish an empty scope list in api-meta.json, so meta.sr.ht cannot mint a PAT for them at all. dolt already accepts both and publishes a scope. api.sr.ht forwards ONE client Authorization header to every service a federated query touches, so a GraphQL plane that refuses meta PATs cannot federate. Bring the four to dolt's shape: /query accepts meta PAT + working token; MCP and REST stay on tokens.sr.ht alone. | Shared half lands in a new sr-ht-ecore package, metapat, beside bearer: ClientID routing, the meta PAT resolve path (decode, username check, LookupUser, LookupTokenRevocation, positive cache) and the OAuth scope check. Each service keeps its own Principal, MetaBackend and error classification. dolt is not migrated in this epic: its PAT plane is entangled with the Basic clone path. Scopes are spelled upstream-style, upper case: cov.sr.ht/REPORTS, bench.sr.ht/RESULTS, spec.sr.ht/SPECS, artifacts.sr.ht/REPOS. | open | 1 | epic | NULL | NULL | 2026-08-16T18:27:30Z | Eugene Blikh | bigbes@gmail.com | 2026-08-16T18:27:30Z | NULL | NULL | 0 | NULL | NULL | NULL | 0 | 0 | 0 | �{} | 0 | NULL | NULL | NULL | 0 | NULL | 0 | |||||||||||||||||||||||
| sr-ht-ecore-g3r.1 | 6690b3b79f16709676dae3a6f0b93b38828402c0c8cd1e1e8ecca20c54419d2b | ecore/metapat: the shared meta.sr.ht PAT plane | A validator for meta.sr.ht personal access tokens beside bearer's working-token one: PlaneOf routing, decode/lookup/revocation with a bounded positive cache, and Allows for the OAuth scope gate. | closed | 1 | feature | NULL | NULL | 2026-08-16T18:37:37Z | Eugene Blikh | bigbes@gmail.com | 2026-08-16T18:59:50Z | 2026-08-16T18:59:50Z | NULL | 0 | NULL | NULL | NULL | 0 | 0 | 0 | �{} | Closed | 0 | NULL | NULL | NULL | 0 | NULL | 0 | |||||||||||||||||||||||
| sr-ht-ecore-g3r.2 | 5997c4e1476c5bf13968d86af31e1de96d4d785cd472868cf297aa31d77a69ec | cov.sr.ht accepts a meta PAT on /query (scope REPORTS) | Adopt ecore/metapat on the GraphQL endpoint: route by PlaneOf, keep the working-token arm, gate the meta PAT arm on the service's OAuth scope, and publish that scope in api-meta.json so meta.sr.ht can mint a token for it. MCP and REST stay on tokens.sr.ht alone. Rewrite the doc comments that currently state the opposite. | closed | 1 | task | Eugene Blikh | NULL | 2026-08-16T18:37:49Z | Eugene Blikh | bigbes@gmail.com | 2026-08-16T19:13:39Z | 2026-08-16T19:13:39Z | NULL | 0 | NULL | NULL | NULL | 0 | 0 | 0 | �{} | Deployed as cov.sr.ht 0.9.1_git30 and verified end-to-end: api-meta.json publishes REPORTS, and hut reads /query with the ordinary meta PAT already in its config. | 0 | NULL | NULL | NULL | 0 | 2026-08-16T18:59:58Z | 0 | |||||||||||||||||||||||
| sr-ht-ecore-g3r.3 | 66c7751f414cf0b90abe4ea13425406b477a790ecbe973c19d832d94e54f2f00 | bench.sr.ht accepts a meta PAT on /query (scope RESULTS) | Adopt ecore/metapat on the GraphQL endpoint: route by PlaneOf, keep the working-token arm, gate the meta PAT arm on the service's OAuth scope, and publish that scope in api-meta.json so meta.sr.ht can mint a token for it. MCP and REST stay on tokens.sr.ht alone. Rewrite the doc comments that currently state the opposite. | closed | 1 | task | Eugene Blikh | NULL | 2026-08-16T18:37:49Z | Eugene Blikh | bigbes@gmail.com | 2026-08-16T19:34:12Z | 2026-08-16T19:34:12Z | NULL | 0 | NULL | NULL | NULL | 0 | 0 | 0 | �{} | Implemented, green, pushed; awaiting CI and deploy. | 0 | NULL | NULL | NULL | 0 | 2026-08-16T19:13:46Z | 0 | |||||||||||||||||||||||
| sr-ht-ecore-g3r.4 | dbd2c9916707cdf650d8a40a3ef2bd558062d3ea79934d7f3a7ea10b1e556b60 | spec.sr.ht accepts a meta PAT on /query (scope SPECS) | Adopt ecore/metapat on the GraphQL endpoint: route by PlaneOf, keep the working-token arm, gate the meta PAT arm on the service's OAuth scope, and publish that scope in api-meta.json so meta.sr.ht can mint a token for it. MCP and REST stay on tokens.sr.ht alone. Rewrite the doc comments that currently state the opposite. | closed | 1 | task | NULL | NULL | 2026-08-16T18:37:50Z | Eugene Blikh | bigbes@gmail.com | 2026-08-17T06:03:09Z | 2026-08-17T06:03:09Z | NULL | 0 | NULL | NULL | NULL | 0 | 0 | 0 | �{} | Implemented by parallel agents, verified independently (gates re-run + mutation tests), pushed and deployed; all four services answer a meta PAT on /query. | 0 | NULL | NULL | NULL | 0 | NULL | 0 | |||||||||||||||||||||||
| sr-ht-ecore-g3r.5 | 2903cfd195123a383a6bcea6a4232f6eb4439e1ae5b45dd2b4549ae2d5056838 | artifacts.sr.ht accepts a meta PAT on /query (scope REPOS) | Adopt ecore/metapat on the GraphQL endpoint: route by PlaneOf, keep the working-token arm, gate the meta PAT arm on the service's OAuth scope, and publish that scope in api-meta.json so meta.sr.ht can mint a token for it. MCP and REST stay on tokens.sr.ht alone. Rewrite the doc comments that currently state the opposite. | closed | 1 | task | NULL | NULL | 2026-08-16T18:37:51Z | Eugene Blikh | bigbes@gmail.com | 2026-08-17T06:03:10Z | 2026-08-17T06:03:10Z | NULL | 0 | NULL | NULL | NULL | 0 | 0 | 0 | �{} | Implemented by parallel agents, verified independently (gates re-run + mutation tests), pushed and deployed; all four services answer a meta PAT on /query. | 0 | NULL | NULL | NULL | 0 | NULL | 0 | |||||||||||||||||||||||
| sr-ht-ecore-g3r.6 | 99ae2263684e417f3db49e4563c52d5d011ad36811f4692b4bd5604d8a2672ec | api.sr.ht is not deployed on the instance, so nothing is federated yet | The stack on phoebe runs 23 srht-* containers and api.sr.ht is not among them: POST https://api.srht.bigb.es/query does not resolve. So the federation the meta-PAT work unblocks is potential, not current — what it buys today is that hut and any other meta-PAT client can read /query directly. Deploying the gateway means a Dockerfile.api in phoebe-lab/srht, an [api.sr.ht] section, and api-origin= lines for the services to federate. Upstream builds the service list from every config section whose name ends in .sr.ht, so our six custom services would be picked up automatically once they are in its config. | open | 2 | task | NULL | NULL | 2026-08-16T19:35:26Z | Eugene Blikh | bigbes@gmail.com | 2026-08-16T19:35:26Z | NULL | NULL | 0 | NULL | NULL | NULL | 0 | 0 | 0 | �{} | 0 | NULL | NULL | NULL | 0 | NULL | 0 |