archipelagoandClaude Opus 5
7f40fa1e93
Verified live on archi-dev-box, code fix committed in f6b5245b but not
deployed. Deliberately logged as open rather than fixed: the defect that
matters to an operator is the running node, not the source tree.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
205 lines
13 KiB
Markdown
205 lines
13 KiB
Markdown
---
|
|
schema_version: 1
|
|
open_count: 13
|
|
waived_count: 0
|
|
fixed_count: 1
|
|
total_count: 14
|
|
last_updated: 2026-08-02T22:44:15.215Z
|
|
---
|
|
|
|
# Broken Windows Ledger
|
|
|
|
> Cross-phase defect register. `/gsd-ship` blocks while `open_count > 0`.
|
|
> Waive with `gsd-tools windows waive <id> "<reason>"` (reason required).
|
|
> Mark fixed with `gsd-tools windows fixed <id>`.
|
|
|
|
| id | phase | kind | file | line | description | status | reason | recorded_at | resolved_at |
|
|
|----|-------|------|------|------|-------------|--------|--------|-------------|-------------|
|
|
| 1 | 02 | deviation | neode-ui/src/stores/cloud.ts | | CloudFolder.vue's file listing cache lacks a TTL gate in cloudStore.navigate() — always re-issues the RPC on revisit (paints from cache instantly first, but still refetches unconditionally). Needs a TTL check added to navigate() to fully satisfy 'no new RPC within TTL'. | open | | 2026-07-30T12:25:22.301Z | |
|
|
| 2 | 02 | deviation | neode-ui/src/views/Home.vue | | Wallet/send flow (SendBitcoinModal.vue via Home.vue) named by 02-FINDINGS.md as owned by 02-03 (worst-ranked revisit, 2607ms) but not in 02-03-PLAN.md's files_modified — reported as an unplanned-item gap, not converted. Cause is pure client-side remount cost (0 RPC), not a caching problem. | open | | 2026-07-30T12:25:22.450Z | |
|
|
| 3 | 02 | deviation | neode-ui/src/views/PeerFiles.vue | | 02-03-PLAN.md assumed PeerFiles.vue already used useCachedResource; it actually uses the raw resources store directly (correctly per-item-keyed) with no TTL gate and the same loading/refreshing conflation bug fixed in OpenWrtGateway.vue this plan. Left untouched (out of files_modified scope) — candidate for the same fix in a future plan. | open | | 2026-07-30T12:25:22.605Z | |
|
|
| 4 | 02 | deviation | neode-ui/src/views/Chat.vue | | AIUI-side D-14 commit (900c0b9, branch feat/d14-embed-defaults in local clone /home/archipelago/Projects/AIUI, based on development) is NOT pushed upstream to git.tx1138.com/lfg2025/AIUI — anonymous push returned 403 Forbidden. neode-ui's two new query params (chatExpanded, mobileChat) are inert no-ops against any currently-deployed AIUI build until a maintainer with push rights merges and it is rebuilt/redeployed. 02-08 (deploy) or the user must resolve push access. | fixed | | 2026-07-30T22:37:25.565Z | 2026-07-30T22:37:44.642Z |
|
|
| 5 | 09 | unrun-verify | botfight/e2e/signup-bot.spec.ts | | pnpm test:e2e -- e2e/signup-bot.spec.ts not run: local backend dev port 9100 is occupied by the live archi-dev-box botfights container (podman, 42h uptime) needed for tomorrow's demo — could not free it to run a local dev server. Task-level automated verify (vue-tsc + grep sweep) passed; vitest server suite passed with only pre-existing unrelated flaky failures. | open | | 2026-07-31T02:35:00.391Z | |
|
|
| 6 | 02 | deviation | neode-ui/src/views/Discover.vue | | Discover revisit-ms regression (1083->1257->1453ms across 3 runs), confirmed phase-2-caused split-signal client-side render cost, not fixed (deploy blocked this session) | open | | 2026-07-31T10:56:26.089Z | |
|
|
| 7 | 02 | deviation | neode-ui/src/views/Server.vue | | Server revisit-ms regression (738->849->1239ms across 3 runs) despite confirmed instance survival and improved RPC count; confirmed phase-2-caused split-signal cost, not fixed (deploy blocked this session) | open | | 2026-07-31T10:56:26.305Z | |
|
|
| 8 | 02 | deviation | neode-ui/src/views/web5/Web5.vue | | Web5 revisit-ms regression (566->709->1329ms, zero overlap across 3 runs) despite confirmed instance survival; confirmed phase-2-caused split-signal cost, not fixed (deploy blocked this session) | open | | 2026-07-31T10:56:26.570Z | |
|
|
| 9 | 02 | deviation | neode-ui/src/views/AppDetails.vue | | AppDetails revisit-ms regression (1204->1510->2668ms across 3 runs); confirmed phase-2-caused split-signal cost, not fixed (deploy blocked this session) | open | | 2026-07-31T10:56:26.751Z | |
|
|
| 10 | 02 | deviation | neode-ui/src/views/server/OpenWrtGateway.vue | | OpenWrtGateway revisit-ms regression (663.5->1148->1460ms across 3 runs); confirmed phase-2-caused split-signal cost, not fixed (deploy blocked this session) | open | | 2026-07-31T10:56:26.933Z | |
|
|
| 11 | 10 | unrun-verify | docs/security/KEY-02-FLEET-ROTATION.md | | C-3 FAILED: archipelago-1, archy-x250-beta and archipelago share all three SSH host keys; the first two also share their TLS private key. Not rotated — needs an operator-driven --apply --yes per node. | open | | 2026-08-02T19:07:39.861Z | |
|
|
| 12 | 10 | unrun-verify | scripts/security/host-secrets-audit.sh | | Rotation never exercised on real hardware: that 'systemctl reload ssh' keeps the operator's own forked session alive is proven only by design, not by observation. Needs --apply --yes on one disposable node from a session the operator is willing to lose. | open | | 2026-08-02T19:07:40.217Z | |
|
|
| 13 | 10 | unrun-verify | core/archipelago/src/api/rpc/system/handlers.rs | | system.stats host_secrets never observed on a real node — proven against the file contract in unit tests only. Needs a build carrying 10-04 deployed to the dev pair, then a system.stats call. | open | | 2026-08-02T19:07:40.522Z | |
|
|
| 14 | 10 | unrun-verify | core/archipelago/src/container/prod_orchestrator.rs | | LIVE EXPOSURE on archi-dev-box: archy-bitcoin-ui (systemd/Quadlet-owned, user-uninstalled marker set) still serves unauthenticated POST /bitcoin-rpc/ on 0.0.0.0:8334 with Access-Control-Allow-Origin *, reaching Bitcoin Core RPC through a credential-injecting proxy. Verified live 2026-08-02 (returned a real block height with no cookies). Code fix committed f6b5245b but NOT deployed: closing it needs the new binary on the node plus an archy-bitcoin-ui restart. archy-electrs-ui is in the same uninstalled-but-running state (static UI only, no credential proxy). Operator-gated; no node touched. | open | | 2026-08-02T22:44:15.215Z | |
|
|
|
|
````json
|
|
[
|
|
{
|
|
"id": 1,
|
|
"kind": "deviation",
|
|
"phase": "02",
|
|
"file": "neode-ui/src/stores/cloud.ts",
|
|
"line": null,
|
|
"description": "CloudFolder.vue's file listing cache lacks a TTL gate in cloudStore.navigate() — always re-issues the RPC on revisit (paints from cache instantly first, but still refetches unconditionally). Needs a TTL check added to navigate() to fully satisfy 'no new RPC within TTL'.",
|
|
"status": "open",
|
|
"reason": "",
|
|
"recorded_at": "2026-07-30T12:25:22.301Z",
|
|
"resolved_at": null
|
|
},
|
|
{
|
|
"id": 2,
|
|
"kind": "deviation",
|
|
"phase": "02",
|
|
"file": "neode-ui/src/views/Home.vue",
|
|
"line": null,
|
|
"description": "Wallet/send flow (SendBitcoinModal.vue via Home.vue) named by 02-FINDINGS.md as owned by 02-03 (worst-ranked revisit, 2607ms) but not in 02-03-PLAN.md's files_modified — reported as an unplanned-item gap, not converted. Cause is pure client-side remount cost (0 RPC), not a caching problem.",
|
|
"status": "open",
|
|
"reason": "",
|
|
"recorded_at": "2026-07-30T12:25:22.450Z",
|
|
"resolved_at": null
|
|
},
|
|
{
|
|
"id": 3,
|
|
"kind": "deviation",
|
|
"phase": "02",
|
|
"file": "neode-ui/src/views/PeerFiles.vue",
|
|
"line": null,
|
|
"description": "02-03-PLAN.md assumed PeerFiles.vue already used useCachedResource; it actually uses the raw resources store directly (correctly per-item-keyed) with no TTL gate and the same loading/refreshing conflation bug fixed in OpenWrtGateway.vue this plan. Left untouched (out of files_modified scope) — candidate for the same fix in a future plan.",
|
|
"status": "open",
|
|
"reason": "",
|
|
"recorded_at": "2026-07-30T12:25:22.605Z",
|
|
"resolved_at": null
|
|
},
|
|
{
|
|
"id": 4,
|
|
"kind": "deviation",
|
|
"phase": "02",
|
|
"file": "neode-ui/src/views/Chat.vue",
|
|
"line": null,
|
|
"description": "AIUI-side D-14 commit (900c0b9, branch feat/d14-embed-defaults in local clone /home/archipelago/Projects/AIUI, based on development) is NOT pushed upstream to git.tx1138.com/lfg2025/AIUI — anonymous push returned 403 Forbidden. neode-ui's two new query params (chatExpanded, mobileChat) are inert no-ops against any currently-deployed AIUI build until a maintainer with push rights merges and it is rebuilt/redeployed. 02-08 (deploy) or the user must resolve push access.",
|
|
"status": "fixed",
|
|
"reason": "",
|
|
"recorded_at": "2026-07-30T22:37:25.565Z",
|
|
"resolved_at": "2026-07-30T22:37:44.642Z"
|
|
},
|
|
{
|
|
"id": 5,
|
|
"kind": "unrun-verify",
|
|
"phase": "09",
|
|
"file": "botfight/e2e/signup-bot.spec.ts",
|
|
"line": null,
|
|
"description": "pnpm test:e2e -- e2e/signup-bot.spec.ts not run: local backend dev port 9100 is occupied by the live archi-dev-box botfights container (podman, 42h uptime) needed for tomorrow's demo — could not free it to run a local dev server. Task-level automated verify (vue-tsc + grep sweep) passed; vitest server suite passed with only pre-existing unrelated flaky failures.",
|
|
"status": "open",
|
|
"reason": "",
|
|
"recorded_at": "2026-07-31T02:35:00.391Z",
|
|
"resolved_at": null
|
|
},
|
|
{
|
|
"id": 6,
|
|
"kind": "deviation",
|
|
"phase": "02",
|
|
"file": "neode-ui/src/views/Discover.vue",
|
|
"line": null,
|
|
"description": "Discover revisit-ms regression (1083->1257->1453ms across 3 runs), confirmed phase-2-caused split-signal client-side render cost, not fixed (deploy blocked this session)",
|
|
"status": "open",
|
|
"reason": "",
|
|
"recorded_at": "2026-07-31T10:56:26.089Z",
|
|
"resolved_at": null
|
|
},
|
|
{
|
|
"id": 7,
|
|
"kind": "deviation",
|
|
"phase": "02",
|
|
"file": "neode-ui/src/views/Server.vue",
|
|
"line": null,
|
|
"description": "Server revisit-ms regression (738->849->1239ms across 3 runs) despite confirmed instance survival and improved RPC count; confirmed phase-2-caused split-signal cost, not fixed (deploy blocked this session)",
|
|
"status": "open",
|
|
"reason": "",
|
|
"recorded_at": "2026-07-31T10:56:26.305Z",
|
|
"resolved_at": null
|
|
},
|
|
{
|
|
"id": 8,
|
|
"kind": "deviation",
|
|
"phase": "02",
|
|
"file": "neode-ui/src/views/web5/Web5.vue",
|
|
"line": null,
|
|
"description": "Web5 revisit-ms regression (566->709->1329ms, zero overlap across 3 runs) despite confirmed instance survival; confirmed phase-2-caused split-signal cost, not fixed (deploy blocked this session)",
|
|
"status": "open",
|
|
"reason": "",
|
|
"recorded_at": "2026-07-31T10:56:26.570Z",
|
|
"resolved_at": null
|
|
},
|
|
{
|
|
"id": 9,
|
|
"kind": "deviation",
|
|
"phase": "02",
|
|
"file": "neode-ui/src/views/AppDetails.vue",
|
|
"line": null,
|
|
"description": "AppDetails revisit-ms regression (1204->1510->2668ms across 3 runs); confirmed phase-2-caused split-signal cost, not fixed (deploy blocked this session)",
|
|
"status": "open",
|
|
"reason": "",
|
|
"recorded_at": "2026-07-31T10:56:26.751Z",
|
|
"resolved_at": null
|
|
},
|
|
{
|
|
"id": 10,
|
|
"kind": "deviation",
|
|
"phase": "02",
|
|
"file": "neode-ui/src/views/server/OpenWrtGateway.vue",
|
|
"line": null,
|
|
"description": "OpenWrtGateway revisit-ms regression (663.5->1148->1460ms across 3 runs); confirmed phase-2-caused split-signal cost, not fixed (deploy blocked this session)",
|
|
"status": "open",
|
|
"reason": "",
|
|
"recorded_at": "2026-07-31T10:56:26.933Z",
|
|
"resolved_at": null
|
|
},
|
|
{
|
|
"id": 11,
|
|
"kind": "unrun-verify",
|
|
"phase": "10",
|
|
"file": "docs/security/KEY-02-FLEET-ROTATION.md",
|
|
"line": null,
|
|
"description": "C-3 FAILED: archipelago-1, archy-x250-beta and archipelago share all three SSH host keys; the first two also share their TLS private key. Not rotated — needs an operator-driven --apply --yes per node.",
|
|
"status": "open",
|
|
"reason": "",
|
|
"recorded_at": "2026-08-02T19:07:39.861Z",
|
|
"resolved_at": null
|
|
},
|
|
{
|
|
"id": 12,
|
|
"kind": "unrun-verify",
|
|
"phase": "10",
|
|
"file": "scripts/security/host-secrets-audit.sh",
|
|
"line": null,
|
|
"description": "Rotation never exercised on real hardware: that 'systemctl reload ssh' keeps the operator's own forked session alive is proven only by design, not by observation. Needs --apply --yes on one disposable node from a session the operator is willing to lose.",
|
|
"status": "open",
|
|
"reason": "",
|
|
"recorded_at": "2026-08-02T19:07:40.217Z",
|
|
"resolved_at": null
|
|
},
|
|
{
|
|
"id": 13,
|
|
"kind": "unrun-verify",
|
|
"phase": "10",
|
|
"file": "core/archipelago/src/api/rpc/system/handlers.rs",
|
|
"line": null,
|
|
"description": "system.stats host_secrets never observed on a real node — proven against the file contract in unit tests only. Needs a build carrying 10-04 deployed to the dev pair, then a system.stats call.",
|
|
"status": "open",
|
|
"reason": "",
|
|
"recorded_at": "2026-08-02T19:07:40.522Z",
|
|
"resolved_at": null
|
|
},
|
|
{
|
|
"id": 14,
|
|
"kind": "unrun-verify",
|
|
"phase": "10",
|
|
"file": "core/archipelago/src/container/prod_orchestrator.rs",
|
|
"line": null,
|
|
"description": "LIVE EXPOSURE on archi-dev-box: archy-bitcoin-ui (systemd/Quadlet-owned, user-uninstalled marker set) still serves unauthenticated POST /bitcoin-rpc/ on 0.0.0.0:8334 with Access-Control-Allow-Origin *, reaching Bitcoin Core RPC through a credential-injecting proxy. Verified live 2026-08-02 (returned a real block height with no cookies). Code fix committed f6b5245b but NOT deployed: closing it needs the new binary on the node plus an archy-bitcoin-ui restart. archy-electrs-ui is in the same uninstalled-but-running state (static UI only, no credential proxy). Operator-gated; no node touched.",
|
|
"status": "open",
|
|
"reason": "",
|
|
"recorded_at": "2026-08-02T22:44:15.215Z",
|
|
"resolved_at": null
|
|
}
|
|
]
|
|
````
|