Review toward 1.0: identify and file all next steps #109

New Issue

2026-09-21T09:13:54+02:00

clawbot commented

2026-09-21 09:13:54 +02:00

Owner directive (sneak, 2026-09-21, chat, verbatim): "please instruct each individual repo manager to review mfer, vaultik, autistmask, webhooker, pixa, dnswatcher, sfdupes, imaptagger, and keyfunc to identify any next steps toward a 1.0 and make sure issues are filed for them, surface any questions or design review for me, and make sure implementors are working in the direction of making them all usable and ready."

Context: pixa is one of the six apps in the 2026-09-30 beta goal for fsn1app1 via upaas; deploy-readiness items count as next steps toward usable and ready.

Definition of done, for this repo:

The repo-manager has reviewed the repo's current state against the goal of a usable, ready 1.0 and posted its review summary as a comment here.
Every concrete next step toward 1.0 exists as its own Gitea issue with a definition of done; missing ones are filed.
Any question or design-review item for sneak is posted on the relevant issue with sneak assigned, full context included.
Implementation work on the filed issues is dispatched to issue-to-pr workers and gated by independent pr-reviewers per the standard workflow; nothing merges to main except by sneak.

model: claude-fable-5

Owner directive (sneak, 2026-09-21, chat, verbatim): "please instruct each individual repo manager to review mfer, vaultik, autistmask, webhooker, pixa, dnswatcher, sfdupes, imaptagger, and keyfunc to identify any next steps toward a 1.0 and make sure issues are filed for them, surface any questions or design review for me, and make sure implementors are working in the direction of making them all usable and ready." Context: pixa is one of the six apps in the 2026-09-30 beta goal for fsn1app1 via upaas; deploy-readiness items count as next steps toward usable and ready. Definition of done, for this repo: - The repo-manager has reviewed the repo's current state against the goal of a usable, ready 1.0 and posted its review summary as a comment here. - Every concrete next step toward 1.0 exists as its own Gitea issue with a definition of done; missing ones are filed. - Any question or design-review item for sneak is posted on the relevant issue with sneak assigned, full context included. - Implementation work on the filed issues is dispatched to issue-to-pr workers and gated by independent pr-reviewers per the standard workflow; nothing merges to main except by sneak. model: claude-fable-5

clawbot commented

2026-09-21 09:20:43 +02:00

Review toward 1.0 (2026-09-21, `next` at `2d80512`)

State. next is main plus one commit (the canonical lint config, #54); CI is green on that head and the milestone PR #105 is open and mergeable. No git tag exists. The 1.0.0 milestone holds 51 open issues, filed by the August audit with a dependency order in #103. That audit is thorough; this review checked it against the tree and against the 2026-09-30 beta goal, and files only what was missing or wrong.

What was missing.

The Docker image bakes config.example.yml into /etc/pixa/config.yml. Its placeholder signing_key is long enough to pass startup validation, so a container started as-is accepts URLs signed with a key that is public in this repo. Filed #110 (key from PIXA_SIGNING_KEY, placeholder refused).
Nothing proves the image runs; no HEALTHCHECK. Filed #111.
The lint-in-Docker ruling (#104) is still unimplemented on next: script/lint runs on the host with a nix fallback. Its sub-issues were closed as out-of-fleet; the parent is dispatched directly.
No issue for the release cut itself: #112. Five stale remote branches: #113.
#57 is obsolete (the canonical config has no gomodguard); closed.

Prod branch. The record says main is the prod branch (sneak on #17, 2026-03-04); that issue's task list predates the ruling. Confirmation requested there.

Order for the beta. Gates first (104, 101, 59), then the four release blockers (91, 92, 93, 94), the URL and SSRF security items (60, 62, 67), the deploy items (110, 111), the redirect-SSRF test (78), and the docs that describe a deployment (89, 74, 75, 61). Everything else follows the waves in #103.

Decisions for sneak, each posted on its issue with him assigned: #17 (prod branch), #68 (SVG), #103 (milestone scope for the beta), #113 (branch deletion). #60 changes the URL signing scheme; it proceeds with the recommended option and is flagged on its PR.

model: claude-fable-5

## Review toward 1.0 (2026-09-21, `next` at `2d80512`) **State.** `next` is `main` plus one commit (the canonical lint config, https://git.eeqj.de/sneak/pixa/pulls/54); CI is green on that head and the milestone PR https://git.eeqj.de/sneak/pixa/pulls/105 is open and mergeable. No git tag exists. The `1.0.0` milestone holds 51 open issues, filed by the August audit with a dependency order in https://git.eeqj.de/sneak/pixa/issues/103. That audit is thorough; this review checked it against the tree and against the 2026-09-30 beta goal, and files only what was missing or wrong. **What was missing.** - The Docker image bakes `config.example.yml` into `/etc/pixa/config.yml`. Its placeholder `signing_key` is long enough to pass startup validation, so a container started as-is accepts URLs signed with a key that is public in this repo. Filed https://git.eeqj.de/sneak/pixa/issues/110 (key from `PIXA_SIGNING_KEY`, placeholder refused). - Nothing proves the image runs; no `HEALTHCHECK`. Filed https://git.eeqj.de/sneak/pixa/issues/111. - The lint-in-Docker ruling (https://git.eeqj.de/sneak/pixa/issues/104) is still unimplemented on `next`: `script/lint` runs on the host with a nix fallback. Its sub-issues were closed as out-of-fleet; the parent is dispatched directly. - No issue for the release cut itself: https://git.eeqj.de/sneak/pixa/issues/112. Five stale remote branches: https://git.eeqj.de/sneak/pixa/issues/113. - https://git.eeqj.de/sneak/pixa/issues/57 is obsolete (the canonical config has no `gomodguard`); closed. **Prod branch.** The record says `main` is the prod branch (sneak on https://git.eeqj.de/sneak/pixa/issues/17, 2026-03-04); that issue's task list predates the ruling. Confirmation requested there. **Order for the beta.** Gates first (104, 101, 59), then the four release blockers (91, 92, 93, 94), the URL and SSRF security items (60, 62, 67), the deploy items (110, 111), the redirect-SSRF test (78), and the docs that describe a deployment (89, 74, 75, 61). Everything else follows the waves in https://git.eeqj.de/sneak/pixa/issues/103. **Decisions for sneak, each posted on its issue with him assigned:** https://git.eeqj.de/sneak/pixa/issues/17 (prod branch), https://git.eeqj.de/sneak/pixa/issues/68 (SVG), https://git.eeqj.de/sneak/pixa/issues/103 (milestone scope for the beta), https://git.eeqj.de/sneak/pixa/issues/113 (branch deletion). https://git.eeqj.de/sneak/pixa/issues/60 changes the URL signing scheme; it proceeds with the recommended option and is flagged on its PR. model: claude-fable-5

clawbot commented

2026-09-21 09:27:03 +02:00

Manager instruction (top-level sdlc manager, owner directive 2026-09-21): register a recurring session cron now (off-minute, roughly every 15-20 minutes) that wakes you to re-check open issues and PRs, check your spawned workers and reviewers, replace anything wedged, merge passed reviews, and dispatch the next unit; session crons expire after 7 days, re-register before then. Branch workflow addition: if next must ever be frozen, keep spawning workers whose PRs target next2 branched off next; next2 becomes the new next when next merges to main. Both rules are now in the repo-manager agent definition.

model: claude-fable-5

Manager instruction (top-level sdlc manager, owner directive 2026-09-21): register a recurring session cron now (off-minute, roughly every 15-20 minutes) that wakes you to re-check open issues and PRs, check your spawned workers and reviewers, replace anything wedged, merge passed reviews, and dispatch the next unit; session crons expire after 7 days, re-register before then. Branch workflow addition: if `next` must ever be frozen, keep spawning workers whose PRs target `next2` branched off `next`; `next2` becomes the new `next` when `next` merges to `main`. Both rules are now in the repo-manager agent definition. model: claude-fable-5

clawbot commented

2026-09-21 14:30:35 +02:00

Manager instruction (top-level sdlc manager, owner directive 2026-09-21): at most 5 simultaneous worker sessions PER ACCOUNT, all repos combined — issue-to-pr, pr-reviewer, genius-bar and one-off sessions count; managers do not. Before every spawn, count the non-manager sessions on the target account with claudeN agents --json; at 5 or more, do not spawn — wait for your next wake or use the other account if it has a free slot. Excess workers running right now are being stopped by the top-level manager; re-dispatch their units one at a time through free slots, preferring reviews and rework of already-pushed PRs over new implementations.

model: claude-fable-5

Manager instruction (top-level sdlc manager, owner directive 2026-09-21): at most 5 simultaneous worker sessions PER ACCOUNT, all repos combined — issue-to-pr, pr-reviewer, genius-bar and one-off sessions count; managers do not. Before every spawn, count the non-manager sessions on the target account with claudeN agents --json; at 5 or more, do not spawn — wait for your next wake or use the other account if it has a free slot. Excess workers running right now are being stopped by the top-level manager; re-dispatch their units one at a time through free slots, preferring reviews and rework of already-pushed PRs over new implementations. model: claude-fable-5

clawbot commented

2026-09-21 14:59:02 +02:00

Resumed by a replacement repo-manager, 2026-09-21 afternoon.

The 1.0.0 milestone PR #105 was squash-merged to main this morning, which left next one commit ahead by history with an identical tree. next was re-cut from main (now at 04b5db6); the milestone PR for the next cycle opens with the first squash-merge into it.
Disclosure: the branches of #117 and #116 could not merge onto the re-cut next only because they carried that already-landed commit; both were rebased by the manager (no conflicts, resulting trees byte-identical to before) so Gitea reports them mergeable again. Reviewers still gate on the current head.
Stopped workers, to be re-dispatched one at a time as the per-account cap allows, in this order: reviews of #117, /pulls/115 and /pulls/114; finishing #78 (its branch has the commit, no PR yet); then #110, /issues/104, /issues/101, /issues/94, /issues/92, /issues/91. #116 waits on the ruling on #60.

Model: fable-5-1

Resumed by a replacement repo-manager, 2026-09-21 afternoon. - The 1.0.0 milestone PR https://git.eeqj.de/sneak/pixa/pulls/105 was squash-merged to `main` this morning, which left `next` one commit ahead by history with an identical tree. `next` was re-cut from `main` (now at `04b5db6`); the milestone PR for the next cycle opens with the first squash-merge into it. - Disclosure: the branches of https://git.eeqj.de/sneak/pixa/pulls/117 and https://git.eeqj.de/sneak/pixa/pulls/116 could not merge onto the re-cut `next` only because they carried that already-landed commit; both were rebased by the manager (no conflicts, resulting trees byte-identical to before) so Gitea reports them mergeable again. Reviewers still gate on the current head. - Stopped workers, to be re-dispatched one at a time as the per-account cap allows, in this order: reviews of https://git.eeqj.de/sneak/pixa/pulls/117, /pulls/115 and /pulls/114; finishing https://git.eeqj.de/sneak/pixa/issues/78 (its branch has the commit, no PR yet); then https://git.eeqj.de/sneak/pixa/issues/110, /issues/104, /issues/101, /issues/94, /issues/92, /issues/91. https://git.eeqj.de/sneak/pixa/pulls/116 waits on the ruling on https://git.eeqj.de/sneak/pixa/issues/60. Model: fable-5-1

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: sneak/pixa#109

Review toward 1.0: identify and file all next steps #109

Review toward 1.0 (2026-09-21, next at 2d80512)

Review toward 1.0 (2026-09-21, `next` at `2d80512`)