feat(platformctl): harden sacred path safety #157

Merged

pdurlej merged 1 commit from codex/issues/142-phase3-safety into main 2026-05-10 23:06:54 +02:00

Conversation 1 Commits 1 Files changed 2 +725 -37

codex commented 2026-05-10 01:30:17 +02:00

Collaborator

Copy link

Canary status: missing — fire canary 3+3 manually before merge

Canary Context Pack

Product story

Phase 3 needs platformctl to be allowed to inspect and eventually apply platform state without risking sacred runtime data. This PR hardens the deterministic safety layer before transport/apply work builds on it.

What changed

• Split sacred path rules into exact, prefix, path-glob, name-glob, and allow-glob lists.
• Added is_sacred_path() and check_command() for command-level mutation refusal.
• Added coverage for charter §11 categories including env files, postgres/minio/vault/forgejo data, OpenClaw workspace/persona paths, backups, ssh/sudoers, and Mac baseline/session paths.
• Added parser coverage for no-space redirects, fd append redirects, clobber redirects, >&, -t/--target-directory, sed --in-place, -- option terminators, shell flags before -c, shell positional arguments after -c, fail-closed command substitution/parse failure, common mutating file utilities, curl/wget output targets, scp remote-path targets, inherited cd/initial cwd context, semicolon separators, nested shells after cd, $HOME/tilde/$OPENCLAW_HOME expansion, shell-glob overlap, sacred-exact directory targets, and &&/|| mutation sequences.

Why it changed

Phase 3 Packet 3.5 requires a central sacred-path enforcer before any SSH transport or apply command can be trusted.

Files touched

• control-plane/platformctl/safety.py
• control-plane/platformctl/tests/test_safety_phase3.py

Relevant context

• prompts/codex-cutover-flight/phase-3-operational.md Packet 3.5
• PLATFORM_CHARTER.md §11 sacred paths
• docs/forgejo-agent-operations.md
• AGENTS.md security-sensitive class of service

Runtime evidence

No runtime mutation. Code-only PR.

Known constraints

policies/sacred-paths.yaml is referenced by the charter but does not exist on origin/main; this PR keeps enforcement in existing safety.py and tests the charter categories directly.

Explicit out-of-scope

• No SSH transport implementation.
• No platformctl apply implementation.
• No production mutation.
• No edit to sacred runtime paths.

Requested decision

Review as security-sensitive Phase 3 foundation. Merge only after full canary / operator process.

Merge blockers

• Any sacred path category from charter §11 not blocked by tests.
• Any normal platform repo path blocked as a false positive.
• Any command parser behavior that would allow common sacred-path mutation patterns.

Spec sources read

• prompts/codex-cutover-flight/dispatch.md — phase sequencing and gates
• prompts/codex-cutover-flight/phase-3-operational.md — Packet 3.5 acceptance criteria
• PLATFORM_CHARTER.md §11 — sacred path categories
• docs/forgejo-agent-operations.md — Forgejo/identity protocol
• AGENTS.md — security-sensitive class of service and PR rules
• control-plane/platformctl/safety.py — implementation target
• control-plane/platformctl/tests/test_smoke.py and test_validate.py — existing test conventions

Tests

• PYTHONPATH=control-plane python3 -m pytest control-plane/platformctl/tests/test_safety_phase3.py -q — 128 passed

• PYTHONPATH=control-plane python3 -m pytest control-plane/platformctl/tests -q — 311 passed

• PYTHONPATH=control-plane python3 -m platformctl.cli validate modules/honcho-redis --strict-v2 --json — exit 0

• git diff --check — clean

• Iteration note 1: amended after Ollama caught redirect-without-whitespace and env-dir deletion bypasses; added tests for cmd>path, &>, env dir, cp/install/ln/rsync/sed -i/bash -c/cd-then-rm.

• Iteration note 2: amended after expensive review caught fd append redirects, -t target options, sed --in-place, -- option terminator handling, shell flags before -c, and cd flags.

• Iteration note 3: amended after expensive review caught clobber redirect >|, $HOME expansion, cd + relative redirect, nested shell after outer cd, and missing direct postgres directory coverage.

• Iteration note 4: amended after expensive review caught tilde remote-home bypass; also hardened semicolon separators, >&, touch, mkdir, zsh -c, and OPENCLAW_HOME expansion.

• Iteration note 5: amended after expensive review caught shell-glob/direct directory-copy bypasses and unset $OPENCLAW_HOME remote expansion; added conservative glob overlap and sacred-exact directory target refusal, with cached rule normalization to keep tests fast.

• Iteration note 6: amended after Kimi non-blocking review surfaced shell -c positional-argument hiding and parse-failure fallback risk; added fail-closed tokenization, shell-argument path checks, optional initial_cwd, and exact-prefix mkdir -p evidence tests.

• Iteration note 7: amended after DeepSeek review found command-substitution bypass (rm $(echo /etc/ssh/sshd_config)); added fail-closed $(/backtick handling and tests.

• Iteration note 8: amended after DeepSeek review found missing common mutators; added chattr, shred, rename, fallocate, setfacl, and setfattr coverage.

• Iteration note 9: amended after Kimi analysis surfaced common file-write tools; added curl -o/--output, wget -O/--output-document, and scp host:/path target handling.

• Iteration note 10: amended after DeepSeek review found $0 positional-argument bypass for bash -c; now all shell -c arguments are checked.

Refs #142

Canary status: missing — fire canary 3+3 manually before merge ## Canary Context Pack ### Product story Phase 3 needs `platformctl` to be allowed to inspect and eventually apply platform state without risking sacred runtime data. This PR hardens the deterministic safety layer before transport/apply work builds on it. ### What changed - Split sacred path rules into exact, prefix, path-glob, name-glob, and allow-glob lists. - Added `is_sacred_path()` and `check_command()` for command-level mutation refusal. - Added coverage for charter §11 categories including env files, postgres/minio/vault/forgejo data, OpenClaw workspace/persona paths, backups, ssh/sudoers, and Mac baseline/session paths. - Added parser coverage for no-space redirects, fd append redirects, clobber redirects, `>&`, `-t`/`--target-directory`, `sed --in-place`, `--` option terminators, shell flags before `-c`, shell positional arguments after `-c`, fail-closed command substitution/parse failure, common mutating file utilities, `curl`/`wget` output targets, `scp` remote-path targets, inherited `cd`/initial cwd context, semicolon separators, nested shells after `cd`, `$HOME`/tilde/`$OPENCLAW_HOME` expansion, shell-glob overlap, sacred-exact directory targets, and `&&/||` mutation sequences. ### Why it changed Phase 3 Packet 3.5 requires a central sacred-path enforcer before any SSH transport or apply command can be trusted. ### Files touched - `control-plane/platformctl/safety.py` - `control-plane/platformctl/tests/test_safety_phase3.py` ### Relevant context - `prompts/codex-cutover-flight/phase-3-operational.md` Packet 3.5 - `PLATFORM_CHARTER.md` §11 sacred paths - `docs/forgejo-agent-operations.md` - `AGENTS.md` security-sensitive class of service ### Runtime evidence No runtime mutation. Code-only PR. ### Known constraints `policies/sacred-paths.yaml` is referenced by the charter but does not exist on `origin/main`; this PR keeps enforcement in existing `safety.py` and tests the charter categories directly. ### Explicit out-of-scope - No SSH transport implementation. - No `platformctl apply` implementation. - No production mutation. - No edit to sacred runtime paths. ### Requested decision Review as security-sensitive Phase 3 foundation. Merge only after full canary / operator process. ### Merge blockers - Any sacred path category from charter §11 not blocked by tests. - Any normal platform repo path blocked as a false positive. - Any command parser behavior that would allow common sacred-path mutation patterns. ## Spec sources read - `prompts/codex-cutover-flight/dispatch.md` — phase sequencing and gates - `prompts/codex-cutover-flight/phase-3-operational.md` — Packet 3.5 acceptance criteria - `PLATFORM_CHARTER.md` §11 — sacred path categories - `docs/forgejo-agent-operations.md` — Forgejo/identity protocol - `AGENTS.md` — security-sensitive class of service and PR rules - `control-plane/platformctl/safety.py` — implementation target - `control-plane/platformctl/tests/test_smoke.py` and `test_validate.py` — existing test conventions ## Tests - `PYTHONPATH=control-plane python3 -m pytest control-plane/platformctl/tests/test_safety_phase3.py -q` — 128 passed - `PYTHONPATH=control-plane python3 -m pytest control-plane/platformctl/tests -q` — 311 passed - `PYTHONPATH=control-plane python3 -m platformctl.cli validate modules/honcho-redis --strict-v2 --json` — exit 0 - `git diff --check` — clean - Iteration note 1: amended after Ollama caught redirect-without-whitespace and env-dir deletion bypasses; added tests for `cmd>path`, `&>`, env dir, cp/install/ln/rsync/sed -i/bash -c/cd-then-rm. - Iteration note 2: amended after expensive review caught fd append redirects, `-t` target options, `sed --in-place`, `--` option terminator handling, shell flags before `-c`, and `cd` flags. - Iteration note 3: amended after expensive review caught clobber redirect `>|`, `$HOME` expansion, `cd` + relative redirect, nested shell after outer `cd`, and missing direct postgres directory coverage. - Iteration note 4: amended after expensive review caught tilde remote-home bypass; also hardened semicolon separators, `>&`, `touch`, `mkdir`, `zsh -c`, and `OPENCLAW_HOME` expansion. - Iteration note 5: amended after expensive review caught shell-glob/direct directory-copy bypasses and unset $OPENCLAW_HOME remote expansion; added conservative glob overlap and sacred-exact directory target refusal, with cached rule normalization to keep tests fast. - Iteration note 6: amended after Kimi non-blocking review surfaced shell `-c` positional-argument hiding and parse-failure fallback risk; added fail-closed tokenization, shell-argument path checks, optional `initial_cwd`, and exact-prefix `mkdir -p` evidence tests. - Iteration note 7: amended after DeepSeek review found command-substitution bypass (`rm $(echo /etc/ssh/sshd_config)`); added fail-closed `$(`/backtick handling and tests. - Iteration note 8: amended after DeepSeek review found missing common mutators; added `chattr`, `shred`, `rename`, `fallocate`, `setfacl`, and `setfattr` coverage. - Iteration note 9: amended after Kimi analysis surfaced common file-write tools; added `curl -o`/`--output`, `wget -O`/`--output-document`, and `scp host:/path` target handling. - Iteration note 10: amended after DeepSeek review found `$0` positional-argument bypass for `bash -c`; now all shell `-c` arguments are checked. Refs #142

codex added 1 commit 2026-05-10 01:30:17 +02:00

feat(platformctl): harden sacred path safety 745d746587

codex added the

class/security-sensitive

label 2026-05-10 01:30:23 +02:00

codex force-pushed codex/issues/142-phase3-safety from 745d746587 to b99969e68c 2026-05-10 01:37:09 +02:00 Compare

codex force-pushed codex/issues/142-phase3-safety from b99969e68c to 42c5e8a6e1 2026-05-10 01:49:33 +02:00 Compare

codex force-pushed codex/issues/142-phase3-safety from 42c5e8a6e1 to 26e8ef139c 2026-05-10 02:06:44 +02:00 Compare

codex force-pushed codex/issues/142-phase3-safety from 26e8ef139c to f1f43a1cc2 2026-05-10 02:17:40 +02:00 Compare

codex force-pushed codex/issues/142-phase3-safety from f1f43a1cc2 to f3a2e17df2 2026-05-10 02:34:42 +02:00 Compare

codex force-pushed codex/issues/142-phase3-safety from f3a2e17df2 to 11fe3869c9 2026-05-10 02:48:18 +02:00 Compare

codex force-pushed codex/issues/142-phase3-safety from 11fe3869c9 to b49bf7089c 2026-05-10 02:57:21 +02:00 Compare

codex force-pushed codex/issues/142-phase3-safety from b49bf7089c to 6a6f006332 2026-05-10 03:02:51 +02:00 Compare

codex force-pushed codex/issues/142-phase3-safety from 6a6f006332 to 4e3e2370df 2026-05-10 03:11:50 +02:00 Compare

codex force-pushed codex/issues/142-phase3-safety from 4e3e2370df to cd59296be9 2026-05-10 03:17:55 +02:00 Compare

codex commented 2026-05-10 03:28:35 +02:00

Author

Collaborator

Copy link

Phase 3 safety status for final commit cd59296be91b05e321434acde14937819221de4f:

• Local tests: PYTHONPATH=control-plane python3 -m pytest control-plane/platformctl/tests/test_safety_phase3.py -q — 128 passed
• Local tests: PYTHONPATH=control-plane python3 -m pytest control-plane/platformctl/tests -q — 311 passed
• Validate: PYTHONPATH=control-plane python3 -m platformctl.cli validate modules/honcho-redis --strict-v2 --json — pass
• Whitespace: git diff --check — clean
• Identity: commit author is codex <codex@noreply.git.pdurlej.com>
• Runtime: no production mutation

Ollama Cloud expensive review, final counted pass:

• deepseek-v4-pro:cloud — APPROVE, blocking findings: None
• kimi-k2.6:cloud — APPROVE, blocking findings: None
• minimax-m2.7:cloud — APPROVE, blocking findings: None

Earlier review iterations found real bypass classes and were fixed in this PR: shell globs, unset $OPENCLAW_HOME, directory-copy targets, shell -c positional args including $0, command substitution, common mutating utilities, and curl/wget/scp write targets.

Official canary status remains as the PR body says: missing — this PR still needs the normal platform canary/owner merge process before merge.

Phase 3 safety status for final commit `cd59296be91b05e321434acde14937819221de4f`: - Local tests: `PYTHONPATH=control-plane python3 -m pytest control-plane/platformctl/tests/test_safety_phase3.py -q` — 128 passed - Local tests: `PYTHONPATH=control-plane python3 -m pytest control-plane/platformctl/tests -q` — 311 passed - Validate: `PYTHONPATH=control-plane python3 -m platformctl.cli validate modules/honcho-redis --strict-v2 --json` — pass - Whitespace: `git diff --check` — clean - Identity: commit author is `codex <codex@noreply.git.pdurlej.com>` - Runtime: no production mutation Ollama Cloud expensive review, final counted pass: - `deepseek-v4-pro:cloud` — APPROVE, blocking findings: None - `kimi-k2.6:cloud` — APPROVE, blocking findings: None - `minimax-m2.7:cloud` — APPROVE, blocking findings: None Earlier review iterations found real bypass classes and were fixed in this PR: shell globs, unset `$OPENCLAW_HOME`, directory-copy targets, shell `-c` positional args including `$0`, command substitution, common mutating utilities, and `curl`/`wget`/`scp` write targets. Official canary status remains as the PR body says: `missing` — this PR still needs the normal platform canary/owner merge process before merge.

codex referenced this pull request 2026-05-10 03:33:20 +02:00

feat(platformctl): add tailscale transport adapter #158

codex referenced this pull request 2026-05-10 03:35:50 +02:00

feat(platformctl): add tailscale transport adapter #158

codex referenced this pull request 2026-05-10 03:35:50 +02:00

[coordination-lane] Cutover Flight Phase 2: v2 catalog to gate #142

codex referenced this pull request 2026-05-10 03:43:00 +02:00

feat(platformctl): implement read-only plan drift check #159

pdurlej merged commit 77beb59f9b into main 2026-05-10 23:06:54 +02:00

pdurlej referenced this pull request from a commit 2026-05-10 23:06:55 +02:00

Merge pull request 'feat(platformctl): harden sacred path safety' (#157) from codex/issues/142-phase3-safety into main

claude referenced this pull request 2026-05-11 22:00:04 +02:00

chore(governance): ADR-0016 — DeepSeek-v4-Pro as 8th cousin (deep-reviewer lane) #185

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

W6d-automerge-calibration

  

agent/claude-code

Vistula actor: Claude Code.

  

agent/codex

Vistula actor: Codex.

  

agent/hermes

Vistula actor: Hermes Upstream.

  

agent/iskra

Vistula actor: Iskra.

  

agent/ollama

Vistula actor: Ollama or compatible model.

  

agent/patchwarden

Vistula actor: Patchwarden.

  

automerge-candidate

Candidate for narrow W6d autonomous merge readiness pilot

  

class/security-sensitive

Security-sensitive class of service: smallest coherent PRs and full canary

  

cutover-gate

blocks production declare / final RS2000 replacement

  

dependency/blocked

Vistula dependency state: blocked.

  

dependency/blocks-others

Vistula dependency state: blocks other work.

  

dependency/cross-repo

Vistula dependency scope: cross-repository.

  

dependency/needs-confirmation

Vistula dependency state: needs confirmation.

  

domain:agents

Agent identity, delegation, subagents, routing, or workflows.

  

domain:ci

CI, checks, Actions, runners, or release automation.

  

domain:docs

Documentation, packets, practices, or source-of-truth text.

  

domain:forgejo

Forgejo issues, PRs, labels, repo settings, or identity.

  

domain:infra

Infrastructure, storage, backup, DNS, network, or host substrate.

  

domain:memory

Memory, recall, write gates, salience, or Honcho-adjacent behavior.

  

domain:runtime

Runtime services, deploys, daemons, timers, or live behavior.

  

domain:signal

Signal UX, delivery, context, or outbound behavior.

  

domain:ux

Product UX, operator experience, or conversation ergonomics.

  

flow/architecture

Vistula lifecycle: architecture phase in progress.

  

flow/blocked

Vistula lifecycle: blocked on dependency or decision.

  

flow/deployed

Vistula lifecycle: deployed to runtime where applicable.

  

flow/done

Vistula lifecycle: work merged or otherwise done.

  

flow/implementation

Vistula lifecycle: implementation phase in progress.

  

flow/intake

Vistula lifecycle: incoming signal not refined yet.

  

flow/maintained

Vistula lifecycle: maintained/steady state.

  

flow/observed

Vistula lifecycle: observed after delivery.

  

flow/ready

Vistula lifecycle: ready for architecture or implementation.

  

flow/refining

Vistula lifecycle: Hermes/spec refinement in progress.

  

flow/retired

Vistula lifecycle: retired or intentionally closed.

  

flow/review

Vistula lifecycle: review phase in progress.

  

iterating

Orchestrator/Codex actively amending in response to review — operator can ignore until resolved

  

judge/codex-candidate

Candidate for Codex implementation.

  

judge/hermes-candidate

Candidate for Hermes discovery/research.

  

judge/low-confidence

Judgment confidence is low.

  

judge/needs-refinement

Needs clearer evidence or scope.

  

judge/operator-needed

Needs Piotr decision or input.

  

judge/p0

Urgent, operator attention or unblock now.

  

judge/p1

High value, schedule soon.

  

judge/p2

Useful, normal queue.

  

judge/p3

Low priority, keep but do not chase.

  

judge/park

Parked from current attention.

  

judge/patchwarden-candidate

Needs Patchwarden merge-safety attention.

  

judge/stale-priority

Existing priority judgment appears stale.

  

kind/adr

Vistula work kind: architecture decision record.

  

kind/bug

Vistula work kind: bug fix.

  

kind/chore

Vistula work kind: chore.

  

kind/feature

Vistula work kind: feature.

  

kind/infra

Vistula work kind: infrastructure.

  

kind/ops

Vistula work kind: operations.

  

kind/refactor

Vistula work kind: refactor.

  

kind/research

Vistula work kind: research/discovery.

  

large-impact

Per charter §3 review-by-impact: large impact (≥300 LOC OR new module OR identity/secret change OR architectural pivot) — Oracle pre-review recommended

  

merge/auto

Vistula merge mode: automated merge.

  

merge/manual

Vistula merge mode: manual merge.

  

merge/manual-dependency-conflict

Manual merge reason: dependency conflict.

  

merge/manual-failing-tests

Manual merge reason: failing tests.

  

merge/manual-merge-conflict

Manual merge reason: merge conflict.

  

merge/manual-missing-review

Manual merge reason: missing review.

  

merge/manual-operator-preference

Manual merge reason: operator preference.

  

merge/manual-red-zone

Manual merge reason: red-zone risk.

  

merge/manual-security-sensitive

Manual merge reason: security-sensitive work.

  

merge/manual-unclear-scope

Manual merge reason: unclear scope.

  

merge/manual-unknown

Manual merge reason: unknown.

  

meta

meta-decomposition issue; first agent decomposes into atomic children

  

mode:operator-only

Apply step requires explicit operator approval.

  

mode:patchwarden-iskra-approved

Work eligible for Patchwarden/Iskra approval inside repo policy.

  

mode:safe-auto

Low-risk work eligible for lightweight autonomous handling.

  

needs-operator-decision

PR is blocked on operator yes/no decision — fresh-Claude/Codex won't make this call alone

  

needs-triage

decomposing agent has open questions / unknowns

  

not-ready

reviewed but blocked on a precondition

  

observed/erroring

Vistula observation: erroring.

  

observed/needs-followup

Vistula observation: needs follow-up.

  

observed/pending

Vistula observation: pending.

  

observed/retire-candidate

Vistula observation: retire candidate.

  

observed/unused

Vistula observation: unused.

  

observed/used

Vistula observation: used.

  

operator-emotional

operator-emotional importance (Iskra memory etc.)

  

owner-attention

owner must decide; blocks default path

  

phase/02

Phase 02 cataloging

  

phase/03

Phase 03 control plane (platformctl)

  

priority:p0

Immediate safety, uptime, data, or operator-blocking issue.

  

priority:p1

Important active work; should be pulled soon.

  

priority:p2

Useful normal-priority work.

  

priority:p3

Opportunistic cleanup, research, or backlog work.

  

proposed

auto-generated by meta-decomposition; awaiting human review

  

ready-for-agent

reviewed and pickable; agents may claim per cookbook

  

ready-for-operator

PR is ready for operator review/merge — orchestrator finished its part

  

recovery

disaster recovery / restore semantics relevant

  

review:claude-reviewed

Reviewed by Claude-family agent.

  

review:codex-reviewed

Reviewed by Codex-family agent.

  

review:dziadek-reviewed

Reviewed by Dziadek pinch-point reviewer.

  

review:needs-human

Needs human review before merge or apply.

  

risk/exposure

incorrectly public/private/tailnet/auth/routed

  

risk/process

workflow/review/orchestration may produce bad outcomes

  

risk/product

work may have lost owner/user value

  

risk/runtime

platform may not run, recover, validate, behave reproducibly

  

safety:external-write

May write to external systems, users, rooms, repos, or services.

  

safety:no-prod-mutation

Must not mutate production or live external state.

  

safety:prod-impact

May affect production/runtime behavior.

  

safety:secret-touch

Touches secrets, credentials, auth, or secret-adjacent config.

  

size/large

Vistula size: large.

  

size/medium

Vistula size: medium.

  

size/small

Vistula size: small.

  

size/tiny

Vistula size: tiny.

  

size/unknown

Vistula size: not classified yet.

  

source/adr

Vistula source: ADR.

  

source/agent-generated

Vistula source: agent generated.

  

source/manual

Vistula source: manual entry.

  

source/operator-chat

Vistula source: operator chat.

  

source/voice-note

Vistula source: voice note.

  

status:blocked

Blocked by missing dependency, evidence, access, or operator decision.

  

status:codex-ready

Ready for a Codex implementation pass.

  

status:merged:pending-evidence

Merged but waiting for live or artifact evidence before closure.

  

status:needs-evidence

Needs proof, logs, tests, or operator-visible evidence.

  

status:operator-needed

Requires explicit operator input before safe progress.

  

status:parked

Intentionally deferred; not active campaign work.

  

tier/full

Full review tier per ADR-0007

  

tier/lite

Lite review tier per ADR-0007

  

tier/stacked

Stacked PR (base != main) escape hatch per ADR-0017. Requires consolidator-PR plan in PR body.

  

tier:0-platform-substrate

Data, secrets, backup, storage, or critical platform substrate.

  

tier:1-iskra-value-layer

Iskra/OpenClaw behavior, memory, runtime, or value-layer work.

  

tier:2-tools-products-modules

Tools, products, modules, experiments, and lower-blast-radius work.

  

type:bug

Incorrect behavior or regression.

  

type:chore

Maintenance, cleanup, metadata, or operational task.

  

type:docs

Documentation-only work.

  

type:feat

New capability or product behavior.

  

type:policy

Governance, protocol, boundary, or decision-contract change.

  

type:research

Investigation, spike, or evidence-gathering task.

No labels

W6d-automerge-calibration

agent/claude-code

agent/codex

agent/hermes

agent/iskra

agent/ollama

agent/patchwarden

automerge-candidate

class/security-sensitive

cutover-gate

dependency/blocked

dependency/blocks-others

dependency/cross-repo

dependency/needs-confirmation

domain:agents

domain:ci

domain:docs

domain:forgejo

domain:infra

domain:memory

domain:runtime

domain:signal

domain:ux

flow/architecture

flow/blocked

flow/deployed

flow/done

flow/implementation

flow/intake

flow/maintained

flow/observed

flow/ready

flow/refining

flow/retired

flow/review

iterating

judge/codex-candidate

judge/hermes-candidate

judge/low-confidence

judge/needs-refinement

judge/operator-needed

judge/p0

judge/p1

judge/p2

judge/p3

judge/park

judge/patchwarden-candidate

judge/stale-priority

kind/adr

kind/bug

kind/chore

kind/feature

kind/infra

kind/ops

kind/refactor

kind/research

large-impact

merge/auto

merge/manual

merge/manual-dependency-conflict

merge/manual-failing-tests

merge/manual-merge-conflict

merge/manual-missing-review

merge/manual-operator-preference

merge/manual-red-zone

merge/manual-security-sensitive

merge/manual-unclear-scope

merge/manual-unknown

meta

mode:operator-only

mode:patchwarden-iskra-approved

mode:safe-auto

needs-operator-decision

needs-triage

not-ready

observed/erroring

observed/needs-followup

observed/pending

observed/retire-candidate

observed/unused

observed/used

operator-emotional

owner-attention

phase/02

phase/03

priority:p0

priority:p1

priority:p2

priority:p3

proposed

ready-for-agent

ready-for-operator

recovery

review:claude-reviewed

review:codex-reviewed

review:dziadek-reviewed

review:needs-human

risk/exposure

risk/process

risk/product

risk/runtime

safety:external-write

safety:no-prod-mutation

safety:prod-impact

safety:secret-touch

size/large

size/medium

size/small

size/tiny

size/unknown

source/adr

source/agent-generated

source/manual

source/operator-chat

source/voice-note

status:blocked

status:codex-ready

status:merged:pending-evidence

status:needs-evidence

status:operator-needed

status:parked

tier/full

tier/lite

tier/stacked

tier:0-platform-substrate

tier:1-iskra-value-layer

tier:2-tools-products-modules

type:bug

type:chore

type:docs

type:feat

type:policy

type:research

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

pdurlej/platform!157

No description provided.