Open Issues
Live issues from the Celilo Forgejo tracker.
- #1409 The completion coverage gate reads wrapped help prose as subcommands, and names words that exist nowhere in the code
- #1408 module-deploy's stale-project guard has no refusal test, so nobody has seen it fail (Rule 7.6)
- #1407 The repo-root `bun run test` gate cannot reach apps/celilo/test-integration, so an integration-only break merges green and is found by CI on main
- #1406 main is red: remote-client's denial test asserts the pre-#1404 outcome shape, so the fix that makes a denial speak fails the gate
- #1405 A provider config written but never reloaded is permanently invisible: the reload fires only on the file write's `changed`, so an interrupted converge leaves the running config stale forever
- #1404 Audit remote-API authz: the read-only principal's grant list is hand-maintained and incomplete, denials are silent (exit 126, no message), and the read/write split is nominal because celilo-mcp-rw holds `*`
- #1403 caddy's route reconcile costs 70-75s because it re-places every static release on every route change, so a consumer's on_install cannot wait for it
- #1402 caddy's Terraform state is gone, so `module deploy caddy` plans to REPLACE the live public-ingress container — only the post-import safety gate stops it
- #1401 caddy's reconcile_routes crashes with "{} is not iterable", so every public_web route change is abandoned and static-site consumers cannot deploy
- #1400 celilo-mgmt's playbook stamps 0.10.1 while its manifest says 0.10.3, so main is red and every deploy records the wrong version
- #1399 A live dispatcher whose heartbeat lags under deploy load reads as "no dispatcher running", so route reconciles are abandoned during the one operation that generates route changes
- #1398 The event dispatcher can register and then die silently: `events status` reports `no_dispatcher` with `dispatcherCount=1`, and nothing recovers it
- #1395 cele2e host status reports "The VM matches the policy" on a VM at half the policy CPUs: the budget is printed but never comparedcategory:bug severity:medium
- #1394 Guard the forgejo-runner binary download with creates:, so a transient egress blip cannot fail a deploy that needs no downloadcategory:bug severity:medium
- #1392 Say when a split-horizon record was registered: technitium logs only the delete-tolerance, so ten successful registrations read as ten failurescategory:bug severity:medium
- #1391 Nothing detects a stale bundled install under modules/*/scripts, so a module's tests can run against types a major behind its own pin
- #1390 cele2e doctor green-lights a hollow management image: it checks the container starts, not that celilo is in it
- #1389 e2e base images pull floating :latest tags, and minio's two are now delisted from Docker Hub, so every cold-cache bake fails
- #1385 Make caddy-internal's health check trust its own internal CA: on the live fleet it can never pass, and its route probes never runcategory:bug severity:medium
- #1384 Check optional capabilities against the provider's major too: an optional consumer on the old contract passes deploy validation and fails at runtimecategory:bug severity:medium
- #1382 Re-classify a machine's stored interface zones when the zone model changes, and say "mislabelled" rather than "no interface"category:bug severity:high
- #1381 Let system update upgrade the module that clears its own BLOCKED audit, and stop reporting that refusal as "no-network"category:bug severity:high
- #1380 Make celilo-mgmt converge on a host with a stale or pre-existing HashiCorp apt source: the key refresh runs after the apt cache update that the stale key breakscategory:bug severity:high
- #1379 Keep the management server's bun in lockstep with celilo: the postinst seeds the pin once, and there is no celilo route to change itcategory:bug severity:high
- #1378 Let celilo reboot the management server: a pending kernel update can only be applied over SSH todaycategory:feature severity:medium
- #1376 Pin the e2e base images and stop pulling them anonymously: npm-consumer-smoke fails on a Docker Hub pull, and it only ever runs on release commitscategory:bug severity:high
- #1375 The merge gate's "Install dependencies" step fails intermittently on transient package fetches, and each failure costs a whole gate run
- #1373 Give the events daemon's launchd unit a PATH that resolves bun: on macOS the celilo wrapper cannot find bun and the job crash-loopscategory:bug severity:medium
- #1372 check-gate-reach.ts: validateExcuseTable existence checks are dead codecategory:bug severity:medium
- #1370 Report the registry's real refusal when a publish fails, instead of crashing on a null error bodycategory:bug severity:medium
- #1369 Deliver the CLI even when a module fails to publish: the release's module sweep aborts on its first failure, before the .debcategory:bug severity:high
- #1368 Make burner's package fit the module registry: four compiled bun binaries gzip to 146.6 MB against a 100 MiB publish limitcategory:bug severity:high
- #1367 The merge gate runs bun 1.3.3 from ~/.bun/bin, not the pinned 1.4.2, even though every ci.yml step says mise exec
- #1365 npm-consumer-smoke's bake step times out waiting for install.sh over HTTPS on celilo-builder, so no full smoke run has passed today and the release's version PR cannot mergecategory:bug severity:high
- #1364 Parse every changeset in CI: one with an empty package name passed changeset-check, landed on main, and killed the release at changeset versioncategory:bug category:tooling severity:medium
- #1363 Record a failed upgrade as failed: celilo-website reads 1.0.5+6 VERIFIED after five failed auto-upgrade deployscategory:bug severity:medium
- #1362 Keep progress output off stdout under --json: system audit and system update --dry-run each emit about 1 MB of FuelGauge frames before the JSONcategory:bug severity:medium
- #1361 Bump a capability's major version when a provider function's contract breaks: public_web.publishStaticSite dropped sourceDir, and every celilo-website auto-upgrade now failscategory:bug severity:medium
- #1359 Jail unit tests that gate on the ambient jail policy skip on every host under the off default, and measure nothingcategory:bug severity:medium
- #1356 network discovery records the control-plane subnet under network.internal.* on a fresh segmented bootstrapcategory:bug severity:high
- #1355 e2e: module-redeploy-ships-new-artifact collides with leaked vmid 2100 on pve1 (recovery fails, manual import required); knot-unbound-dns hits a Pebble routing timeout (suspected flake)
- #1354 e2e: the deferred bootstrap deploy never completes within the 300s suite budget under the secure-mgmt topology (migration-restore, bootstrap-apt)
- #1353 e2e: under the secure-mgmt default, `celilo machine add` cannot authenticate — 'Cannot connect with provided SSH key' — 19 of 55 suites die at the same call
- #1352 e2e: a failed network start leaks the half-started stack (no NetworkHandle to stop), and the next run refuses (exit 3) until someone sweeps Docker by hand
- #1351 e2e: management container crash-loops on the internal topology — Docker assigns its requested static IP 10.226.1.100 to nothing, startup script exits "Nexthop has invalid gateway", every internal-topology suite times out at network start
- #1350 Control-plane trust falls back to the internal subnet, so a management server on secure-mgmt with no celilo-mgmt module is untrusted on every firewall
- #1348 Merge-gate verdict is not recorded on the work bead, so a red-on-main merge cannot be traced to a gate decisioncategory:tooling severity:medium
- #1347 main is red: two executor jail-policy tests require bubblewrap on the test host, so ci/validate fails on any runner without itcategory:bug severity:high
- #1346 hook-jail-apparmor cannot measure the half that matters: bubblewrap is missing from celilo-builder, so the gate reports FAILURE where it means unmeasured — and its path filter fires on any stale branchcategory:bug category:tooling severity:high