pastilhasandClaude Fable 5
6071ded175
TODO.md had reached 1050 lines and 72 open items across 28 sections, read mostly on a phone. It is now a directory: todo/<theme>/<item>.md, one card per file, with frontmatter carrying id, status, created date and order, and the prose body copied across verbatim. TODO.md becomes a generated index (bun run todo:index). Dates: where an item's prose stated one it is used; otherwise its old section's; otherwise 2026-08-20, floored at the day before the split rather than invented. date_source records which. Shaped for a two-way Kanban board, filed as todo/tooling — a card is a file, id is the identity, frontmatter is the machine's half and the body is the owner's. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
743 B
743 B
id, title, theme, status, created, date_source, order
| id | title | theme | status | created | date_source | order |
|---|---|---|---|---|---|---|
| multi-user/pty-vault-and-opencode-receive-no-identity-at | `pty`, `vault` and `opencode` receive no identity at all | multi-user | open | 2026-08-20 | assumed | 15 |
pty, vault and opencode receive no identity at all. Every other sidecar validates
X-Officer-User. The pty sidecar keys purely on a sessionId from the query string and its
/_officer/sessions endpoints list and kill every session on the box; vault and opencode take
no user argument. All three are covered today only because terminal, vault and the agent are
owner-only permissions — that is a correct outcome resting on the wrong layer, and it is the
thing to fix first if any of them is ever granted.