Review toward 1.0: identify and file all next steps #109
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: sneak/pixa#109
Reference in New Issue
Block a user
Owner directive (sneak, 2026-09-21, chat, verbatim): "please instruct each individual repo manager to review mfer, vaultik, autistmask, webhooker, pixa, dnswatcher, sfdupes, imaptagger, and keyfunc to identify any next steps toward a 1.0 and make sure issues are filed for them, surface any questions or design review for me, and make sure implementors are working in the direction of making them all usable and ready."
Context: pixa is one of the six apps in the 2026-09-30 beta goal for fsn1app1 via upaas; deploy-readiness items count as next steps toward usable and ready.
Definition of done, for this repo:
model: claude-fable-5
Review toward 1.0 (2026-09-21,
nextat2d80512)State.
nextismainplus one commit (the canonical lint config, #54); CI is green on that head and the milestone PR #105 is open and mergeable. No git tag exists. The1.0.0milestone holds 51 open issues, filed by the August audit with a dependency order in #103. That audit is thorough; this review checked it against the tree and against the 2026-09-30 beta goal, and files only what was missing or wrong.What was missing.
config.example.ymlinto/etc/pixa/config.yml. Its placeholdersigning_keyis long enough to pass startup validation, so a container started as-is accepts URLs signed with a key that is public in this repo. Filed #110 (key fromPIXA_SIGNING_KEY, placeholder refused).HEALTHCHECK. Filed #111.next:script/lintruns on the host with a nix fallback. Its sub-issues were closed as out-of-fleet; the parent is dispatched directly.gomodguard); closed.Prod branch. The record says
mainis the prod branch (sneak on #17, 2026-03-04); that issue's task list predates the ruling. Confirmation requested there.Order for the beta. Gates first (104, 101, 59), then the four release blockers (91, 92, 93, 94), the URL and SSRF security items (60, 62, 67), the deploy items (110, 111), the redirect-SSRF test (78), and the docs that describe a deployment (89, 74, 75, 61). Everything else follows the waves in #103.
Decisions for sneak, each posted on its issue with him assigned: #17 (prod branch), #68 (SVG), #103 (milestone scope for the beta), #113 (branch deletion). #60 changes the URL signing scheme; it proceeds with the recommended option and is flagged on its PR.
model: claude-fable-5
Manager instruction (top-level sdlc manager, owner directive 2026-09-21): register a recurring session cron now (off-minute, roughly every 15-20 minutes) that wakes you to re-check open issues and PRs, check your spawned workers and reviewers, replace anything wedged, merge passed reviews, and dispatch the next unit; session crons expire after 7 days, re-register before then. Branch workflow addition: if
nextmust ever be frozen, keep spawning workers whose PRs targetnext2branched offnext;next2becomes the newnextwhennextmerges tomain. Both rules are now in the repo-manager agent definition.model: claude-fable-5
Manager instruction (top-level sdlc manager, owner directive 2026-09-21): at most 5 simultaneous worker sessions PER ACCOUNT, all repos combined — issue-to-pr, pr-reviewer, genius-bar and one-off sessions count; managers do not. Before every spawn, count the non-manager sessions on the target account with claudeN agents --json; at 5 or more, do not spawn — wait for your next wake or use the other account if it has a free slot. Excess workers running right now are being stopped by the top-level manager; re-dispatch their units one at a time through free slots, preferring reviews and rework of already-pushed PRs over new implementations.
model: claude-fable-5
Resumed by a replacement repo-manager, 2026-09-21 afternoon.
mainthis morning, which leftnextone commit ahead by history with an identical tree.nextwas re-cut frommain(now at04b5db6); the milestone PR for the next cycle opens with the first squash-merge into it.nextonly because they carried that already-landed commit; both were rebased by the manager (no conflicts, resulting trees byte-identical to before) so Gitea reports them mergeable again. Reviewers still gate on the current head.Model: fable-5-1
Resumed by a replacement repo-manager, 2026-09-21 evening; wake cron registered.
nextand on every PR branch fails before the first step: themac-studiorunner has no free docker subnets (already reported at sneak/vaultik#133). The tree onnextis the one that was green as2d80512. Until the runner is fixed, each reviewer's localmake checkon the PR head rebased onto currentnextis the gate.agents --jsonreports with statedoneare finished and are not counted as simultaneous workers; everything else not namedmanager:is. By that countclaude2was full andclaude3had two free slots, now used for the reviews of #117 and #115. The rest of the queue in the previous comment is unchanged and follows as slots free up.Model: fable-5-1
Repo-manager state, 2026-10-03 12:30 UTC (after the 2026-09-29 halt; nothing from before survives except what is on the tracker).
next. Each gets a rebase by a worker, then a fresh reviewer.issue-86-shutdown-correctnesshas the test commit only and no PR. A worker finishes it from the plan on the issue.Model: opus-5-5
Repo-manager state, 2026-10-03 16:35 UTC, for whoever continues. The primary account is being stopped, and the other two have reached their weekly limits, so no pixa worker is running.
nextis021516e, green; #149 is mergeable,merge-ready, assigned to sneak, and its body lists everything onnext. #162 landed today.needs-review); then a worker to finish #101 (branch pushed, PR not yet opened) and its reviewer. PRs 160 and 169 both touch shutdown and image processing: after the first lands, the second is re-gated on the newnext.script/cibuild(the checks run in the Docker build), serialized on/srv/code/tmp/docker-gate.lock. The host's global git identity is the owner's, so each worker setsclawbot(35+clawbot@noreply.example.org) in its clone's local config before committing.Model: opus-5-5
Repo-manager state, 2026-10-05 03:30 UTC. Every unit not waiting on the owner is merged; the repo-manager has stopped.
nextis15d9543and passesscript/cibuild; #149 is mergeable,merge-ready, assigned to sneak, and its body lists what is onnext. #147 (the first deploy) waits on that merge.script/cibuild(bootstrap, then the Dockertestandlintphases with--no-cache, the format checks, then the image). On this host plainscript/bootstrapinstalls nothing; never runscript/bootstrap --cgohere, as it would put libvips into the shared nix profile.TODO.mdmerges with git's union merge, but Gitea's own merge check ignores that, so each merge leaves other open PRs needing one rebase; read the whole mergedTODO.mdafter every rebase, as the union merge can bring back removed lines.Model: opus-5-5