docs: plan 0.9.0, and correct how the 0.8.0 image defects escaped CI - #3
Merged
Conversation
Adds ROADMAP_0.9.0.md and documents the v0.8.0 tag/image discrepancy as a known, accepted issue rather than fixing it in place. Corrects a misdiagnosis I merged in the previous PR -------------------------------------------------- STATUS.md and CHANGELOG.md both said the four image defects escaped "because the `docker` job builds images and does not exercise what it built." That is wrong. The `docker` job builds the API image, starts it, probes its shutdown grace and fails if it runs as root — a genuine test. The actual gap is narrower and more actionable: it is the *only* image CI touches. `Dockerfile.tools` and `pangolin_ui/Dockerfile` are never built in CI at all, which is precisely why all four defects were in those two images and none in the API image. Fixing the wrong diagnosis would have produced the wrong remedy, so both files now say what actually happened, and R1 in the roadmap closes the real hole. The v0.8.0 tag/image drift -------------------------- `--version` was added to the CLIs after the tag was cut, so the released binaries reject `--version` while the container image accepts it. Impact is one help flag; no functional, data or security difference. Not corrected in place because re-cutting a published tag is the one thing a version number exists to prevent — and the release script already refuses the equivalent for images, so the tooling should not hold a stricter standard than the people using it. Resolved in 0.9.0 by R2, which also adds the guard that would have caught it. ROADMAP_0.9.0.md ---------------- Six buckets, ordered by what would hurt most if left undone: 1. Authorization — `authz.rs:39` returns Ok(true) for any TenantAdmin on any scope, and PermissionScope carries no tenant, so the check cannot be done without a lookup it never performs. Reachability across the 41 call sites is unverified. This is the most important item in 0.9.0. 2. Release integrity — CI must build and run all three images; the release must verify artefacts match the tag; publishing must move off a laptop. 3. Multi-replica — rate limiting and pending OAuth logins are both per-process. 4. Backend parity — 59 store-trait methods default to a runtime "not supported". 5. Debt with ratchets already in CI — clippy 30 to 0, and 0 of 90 UI components use Svelte 5 runes. 6. Operational hygiene — plaintext root password, the GitHub OIDC asymmetry, the GHSA decision. Every figure in the roadmap was confirmed against main with the command shown beside it, and each was re-run before commit: 41 call sites, 59 defaults, 0/90 components, 10 TODOs, both ratchet budgets, and all four named TODO lines. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
✅ Deploy Preview for lustrous-pithivier-968b22 ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
|
Bugbot is not enabled for your account, so this pull request was not reviewed. Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds
ROADMAP_0.9.0.md, documents thev0.8.0tag/image discrepancy as accepted rather than fixing it in place, and corrects a misdiagnosis I merged in #2.The correction first
#2 said the four image defects escaped "because the
dockerjob builds images and does not exercise what it built." That is wrong. Thedockerjob builds the API image, starts it, probes its shutdown grace, and fails if it runs as root.The real gap is narrower and more useful: it is the only image CI touches.
Dockerfile.toolsandpangolin_ui/Dockerfileare never built in CI at all — which is exactly why all four defects were in those two images and none in the API image. The wrong diagnosis would have produced the wrong remedy.v0.8.0tag vs image--versionwas added to the CLIs after the tag was cut, so released binaries reject it while the image accepts it. One help flag; no functional, data, or security difference. Not corrected in place — re-cutting a published tag is the one thing a version number exists to prevent, andbuild_docker_sequential.shalready refuses the equivalent for images. Documented indocs/known-issues/v0.8.0-tag-image-drift.mdand resolved by roadmap item R2.The 0.9.0 plan
authz.rs:39returnsOk(true)for anyTenantAdminon any scope.PermissionScopecarries no tenant, so the check cannot be performed without a lookup it never does. Reachability across 41 call sites is unverified — the most important item in 0.9.0."Operation not supported". This is how cloud-credential features once shipped without ever compiling..env, the GitHub OIDC asymmetry, the GHSA decision.Explicitly not in 0.9.0: re-cutting
v0.8.0, and 1.0.0 — a multi-tenant catalog should not call itself 1.0 with an unverified cross-tenant authorization path.Verification
Every figure in the roadmap ships with the command that produces it, and all were re-run immediately before commit: 41 call sites, 59 defaults, 0/90 components, 10 TODOs, both ratchet budgets, and all four named TODO line numbers.
🤖 Generated with Claude Code