v0.9-decisions

New issue

Open

No due date

•Last updated Oct 3, 2026

Waiting on an owner ruling. Not workable by a session. An issue leaves here the moment its decision lands.

9% complete

ci(frontend): assertions that pass alone and fail under instrumentation — a class, not two tests
mrveiss/AutoBot-AI#17365 · opened on Sep 24, 2026 · v0.9-decisions
6
deploy(npu-worker): the last code_source read on a fleet node needs an autobot_shared decision, not a rewrite
mrveiss/AutoBot-AI#17334 · opened on Sep 23, 2026 · v0.9-decisions
3
security(vnc): both VNC launch paths bind the RFB port on every interface although only loopback websockify uses it
mrveiss/AutoBot-AI#17055 · opened on Sep 18, 2026 · v0.9-decisions
settings.json TS/Vue lint branches key on nonexistent autobot-user-frontend dir
mrveiss/AutoBot-AI#17045 · opened on Sep 18, 2026 · v0.9-decisions
2
long-running: wire the indexing, KB-population, security-scan and code-analysis operations to their existing implementations, or retire them — no parallel implementation
mrveiss/AutoBot-AI#17023 · opened on Sep 18, 2026 · v0.9-decisions
2
security(api-keys): every request carrying X-API-Key writes an audit row before validation — a free DB-write flood; decide rate-limit vs aggregation
mrveiss/AutoBot-AI#17007 · opened on Sep 18, 2026 · v0.9-decisions
bug(safety): emergency_system_stop doesn't stop, pause, or interrupt anything
mrveiss/AutoBot-AI#16843 · opened on Sep 16, 2026 · v0.9-decisions
1
feat(agents): AutoBot as a participant in its own development loop, via a service-token path
mrveiss/AutoBot-AI#16698 · opened on Sep 14, 2026 · v0.9-decisions
3
core.hooksPath override silently disables every hook in a worktree
mrveiss/AutoBot-AI#15961 · opened on Sep 7, 2026 · v0.9-decisions
12
bug(kb): chat-to-knowledge summaries were generated from a prompt containing no conversation
mrveiss/AutoBot-AI#15630 · opened on Sep 4, 2026 · v0.9-decisions
7
ci: #13405's wedged-concurrency state is live again — 5 Frontend Testing Suite runs queued 39h, including Dev_new_gui, while both self-hosted runners are online
mrveiss/AutoBot-AI#15185 · opened on Aug 28, 2026 · v0.9-decisions
9
security: SecurityPolicyManager and SSOIntegrationFramework read policy files that have never existed
mrveiss/AutoBot-AI#15154 · opened on Aug 28, 2026 · v0.9-decisions
2
llm: degradation store cannot distinguish a dead credential from a transient failure — dead tokens retry every TTL forever
mrveiss/AutoBot-AI#15022 · opened on Aug 25, 2026 · v0.9-decisions
3
bug(ci): self-hosted jobs cannot start — codeload returns HTTP 429 fetching actions, and runner-health reports starvation
mrveiss/AutoBot-AI#14444 · opened on Aug 17, 2026 · v0.9-decisions
7
fix(llm): speculative decoding is an operator-facing config surface with no implementation — the API accepts it, nothing consumes it
mrveiss/AutoBot-AI#14214 · opened on Aug 13, 2026 · v0.9-decisions
1
MCP tool calls bypass canonical RBAC — three parallel authorization models, default-allow blocklist
mrveiss/AutoBot-AI#13228 · opened on Aug 1, 2026 · v0.9-decisions
13
bug(slm): the terminal's SSH WebSocket has no server on either side — the backend route is deprecated 'use SLM' and the SLM never implemented it
mrveiss/AutoBot-AI#15230 · opened on Aug 28, 2026 · v0.9-decisions
4
security(arch): decide the edge — one proxy interface facing users with only 443 exposed, one on the infrastructure network, and no service publishing its own port
mrveiss/AutoBot-AI#17797 · opened on Sep 29, 2026 · v0.9-decisions
3
decision(architecture): a capability can only be shipped or deleted — there is no hidden-but-resolvable state
mrveiss/AutoBot-AI#17808 · opened on Sep 29, 2026 · v0.9-decisions
Central vendor management in SLM: one catalogue for local and cloud vendors, credentials from the central secrets storage
mrveiss/AutoBot-AI#17816 · opened on Sep 29, 2026 · v0.9-decisions
1

Issues