| 011250a2 |
open |
internal/server/api is the weakest package on both mutation axes |
a73x |
|
backlog |
2026-08-23 14:53 |
| 017d47bc |
open |
site: 53 surviving mutants (largest pool in the tree) |
a73x |
|
backlog |
2026-08-22 15:51 |
| 08bfa70b |
open |
A host's declared cap never reaches the wire |
a73x |
|
backlog |
2026-08-18 14:43 |
| 08d8325c |
open |
Untested code: 419 mutants no test reaches (boot, run, hostinfo, smoke) |
a73x |
|
backlog |
2026-08-22 15:51 |
| 11b9c17a |
open |
Wire: reserve DesiredVM field 9 (persistent) now the fleet is past v0.0.5 |
a73x |
|
backlog |
2026-08-18 14:41 |
| 3465dd3d |
open |
[followup] vcpus/mem_mb=0 burns full create budget (permanence gap) |
a73x |
|
backlog |
2026-07-04 18:02 |
| 359ee0d8 |
open |
[followup] captureLogs exists byte-identical in three packages and is t.Parallel-hostile |
a73x |
|
backlog |
2026-08-14 14:02 |
| 40ab963a |
open |
serialpump: 17 surviving mutants, 58.5% efficacy (worst in tree) |
a73x |
|
backlog |
2026-08-22 15:51 |
| 431cc417 |
open |
There is no CI: the pre-push hook is the only gate |
a73x |
|
backlog |
2026-08-18 14:41 |
| 4636c0b9 |
open |
image_url is unvalidated and the image download is uncapped |
a73x |
|
backlog |
2026-08-22 10:59 |
| 481e55be |
open |
make ci fails on a fresh worktree: the web coverage floor assumes a built SPA |
a73x |
|
backlog |
2026-08-23 10:44 |
| 4cb268b3 |
open |
[followup] internal/agent/syncclient coverage floor 82 is flaky (timing-sensitive test) |
a73x |
|
backlog |
2026-08-14 15:53 |
| 4cdf3438 |
open |
Mac TCC: the agent's per-binary permissions are unproven since the rewrite |
a73x |
|
backlog |
2026-08-18 14:44 |
| 4d3c3a86 |
open |
Retire testPAT/testReg from the api test packages |
a73x |
|
backlog |
2026-08-18 14:44 |
| 4ea6afac |
open |
Capabilities(): the Provisioner seam has no verb for what a host can do |
a73x |
|
backlog |
2026-08-18 14:44 |
| 571002f4 |
open |
eitri is the only thing that can dial an eitri guest: SSHArgv never emits ssh_config |
a73x |
|
|
2026-08-22 16:10 |
| 57f6d164 |
open |
No GET /api/v1/vms/{id}: a single VM can only be read by polling the list |
a73x |
|
backlog |
2026-08-18 14:42 |
| 5a39478b |
open |
Teardown observability: a quarantined VM reports power_state=running with all actual-state fields blank |
a73x |
|
backlog |
2026-08-21 18:31 |
| 679f347a |
open |
Flaky: TestUDPSessionIsPromotedOnlyByAGuestReply races the promotion |
a73x |
|
backlog |
2026-08-19 04:15 |
| 7250604a |
open |
Host cert lifecycle: 10-year certs, no revocation, reusable VM names defeat 'recreate the VM' |
a73x |
|
backlog |
2026-08-22 10:59 |
| 73c53e44 |
open |
Coverage gate is fail-open: an unlisted package is silently ungated |
a73x |
|
backlog |
2026-08-18 14:44 |
| 8499750c |
open |
[followup] exposeproxy TestUDPSessionIsPromotedOnlyByAGuestReply flakes under whole-suite load |
a73x |
|
backlog |
2026-08-14 14:47 |
| 8b89d197 |
open |
Volumes have no CLI, MCP, or console surface: v0.0.8 shipped an HTTP API and nothing else |
a73x |
|
|
2026-09-05 19:33 |
| 991e03e0 |
open |
A jinja or gzipped cloud_init is refused at the seed build, not as a 400 at the API |
a73x |
|
backlog |
2026-09-02 09:12 |
| 9939dbde |
open |
[followup] ParseACK lacks a fragment guard (filter is the only defense) |
a73x |
|
backlog |
2026-08-14 12:47 |
| 99613bd8 |
open |
Enrollment rate-limit bucket scope unresolved: per-source or plane-wide? |
a73x |
|
backlog |
2026-08-22 11:00 |
| 999147f6 |
open |
MCP has no host_list: the fleet is only visible through error messages |
a73x |
|
backlog |
2026-09-01 18:26 |
| 9a7edf81 |
open |
No idle timeout on established gate tunnels |
a73x |
|
backlog |
2026-08-22 10:59 |
| 9e0b280e |
open |
cloudhv tests SIGKILL the process group when kill guard is mutated |
a73x |
|
backlog |
2026-08-22 16:20 |
| a0a18e7f |
open |
syncclient: leaked Run goroutine races the computeCapacity test hook under -shuffle |
a73x |
|
backlog |
2026-08-23 05:38 |
| a2aa88b8 |
open |
Multi-identity: one operator, several identities across planes |
a73x |
|
backlog |
2026-08-18 14:44 |
| ab893035 |
open |
The join command never emits --bridge-cidr or --host-network |
a73x |
|
backlog |
2026-08-18 14:42 |
| b3c1d136 |
open |
[followup] imagecache eviction uses apparent size, not allocated blocks |
a73x |
|
backlog |
2026-07-04 18:02 |
| c4f319d0 |
open |
API vocabulary: deprecations owed, scope not recorded |
a73x |
|
backlog |
2026-08-18 14:44 |
| cf4a75da |
open |
Smoke VMs leak: smoke-c546aac6 survived 11 days on onyx |
a73x |
|
backlog |
2026-09-02 09:23 |
| d78939ca |
open |
Mutation-testing baseline 2026-08-22: 281 surviving mutants, 419 unreached |
a73x |
|
backlog |
2026-08-23 14:42 |
| db8dab2c |
open |
RecordVMStatus is unscoped by host: any agent can write any VM's status |
a73x |
|
backlog |
2026-08-18 14:42 |
| e698610c |
open |
VMs cannot move between hosts |
a73x |
|
backlog |
2026-08-21 18:31 |
| e8a9c92a |
open |
Guest/gate principal collision: safe here, unguarded for self-hosters on a 2-label gate domain |
a73x |
|
backlog |
2026-08-22 11:00 |
| f1fd3117 |
open |
syncclient: 10 surviving mutants on the agent's control-plane link |
a73x |
|
backlog |
2026-08-22 15:51 |
| f283feff |
open |
Revisit mutate-report: threshold, or drop it |
a73x |
|
backlog |
2026-08-22 16:01 |
| fb095e7b |
open |
VM backends (vfkit, cloudhv) lack build tags: macOS tests compile and fail on Linux (and vice versa) |
a73x |
|
|
2026-08-25 08:50 |
| fe02e480 |
open |
Smoke places its VM on hostList[0] but reads serial from AGENT_HOSTS |
a73x |
|
backlog |
2026-08-18 14:42 |
| fe206dc0 |
open |
Serverless: design-first, no code yet |
a73x |
|
backlog |
2026-08-18 14:44 |