Approved pilot priorities and cross-chat handoff workflow #14
Loading…
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Approved work order (2026-10-24)
This issue is the coordination index. The linked issues and their comments are the source of truth for scope, decisions, implementation and handoffs.
Workflow for each issue
Current development status (2026-10-27): PRs #15, #16, #17, #18 and #20 are merged. At the owner's request, the completed development issues #2, #4, #6, #7, #8, #9, #10 and #11 have final handoffs and are closed. Documentation updates are merged in PR #21. See integration status for commit/evidence mappings and the release and installation checklist for outstanding native CI, coordinated deployment and real-provider/pilot checks. Issue closure does not complete or waive those checks.
PR #22 is also merged in
09085fa7b7bdaf46be48b34cd8ac3068f315320e, preserving feature commit2ff357ea691e88047bede8943b47cedffdb7899b: configurable live SSO button text and readable OIDC profile names. At the explicit request of the owner after review and merge, issues #1 and #3 have final handoffs and are closed. The merged source exactly matches the locally validated tree; native release and actual-provider/deployed checks remain outstanding. Issue #13 is now merged in PR #23 (44c36de10d3c4c8a4a72c01750e20bd2e88ab969) and closed at the explicit request of the owner after completed review and merge. Its merged source exactly matches the validated feature tree. Issue #5 is now merged and closed in PR #24 (0a47f4f6fc2455dc304df49fa8c45084ff4a2d65), preserving featuree274c617aa64ace46a6a53a558de717083f37545after independent source review and passing local UI/browser/contract checks. Merged main exactly matches its validated feature tree. All currently approved development issues are closed. Final-main native run 24 is waiting; the native release gate and documented physical-device/installation/pilot checks remain outstanding. Issue #12 and PR #19 remain on hold. No additional issue is started by this status update, and no deployment or interruption of active uploads/tasks is authorized. This coordination issue remains open.Starting the owner-requested open-PR integration review after reading #14 and the linked issue handoffs. Scope: validate and integrate PRs #15, #16, #17, #18 and #20 in dependency order, preserve all existing work and resolve any integration conflicts. PR #19 and its malware-scanning branch remain on hold and will not be modified or merged. Validation uses an isolated worktree and disposable local resources. No pilot deployment or active upload/task interruption is planned. Native Forgejo jobs are currently waiting; local verification and release/deployment readiness will be reported separately, and the existing release gates remain unchanged.
Open-PR integration completed at the owner's request. PRs #15, #16, #17, #18 and #20 are merged into main, preserving their original feature commits and branches. Final main:
f9885d4175b52d65f47d113b821caafd457a3c9b.Merge commits:
15993b0c7c7c02495234e75466c544043d4e25da.fc14673089972764ea8be29a59b6b4a4368c7a25.82307417a94341d3202162c0e9c2eccf17fdb9de.4de3f35f20fa29e019e6372dcda219a77bd73a6f.f9885d4175b52d65f47d113b821caafd457a3c9b.Conflict resolution
3cc5c33keeps BOTH the analysis context cancellation check and metadata/other-entry counts. Its prerequisite tree matches the previously implemented combined prerequisite merge54479e0. PR #20 was retargeted to main and updated with its merged prerequisites in00075d8, preserving the original email feature commit and eliminating the stacked merge-base ambiguity. No force pushes/merges were used. Final main has Git tree139e865ae06fcae66c07ed7582ecd3ebeb3c7083, exactly equal to the locally validated combined source and original PR #20 source. Every eligible original feature commit remains an ancestor of main.Checks actually passed on the combined source:
PR #19 was deliberately excluded. It is the only remaining open PR, still draft at unchanged head
dc6003743056822cca9c4e81fc1f436bc5ac8635and unchanged base. Its branch and original checkout were left untouched, and its scanning commits are absent from main. Malware scanning remains on hold.State and next handoff: source is merged, not deployed or release-image-published. Forgejo run 16 for final main is waiting for native AMD64/ARM64 source jobs; downstream jobs and the release gate remain pending. No native ARM64/full Forgejo pass or gate waiver is claimed. The existing UI bundle-size advisory remains. Real-provider SSO/relay delivery, representative large-library capacity and deployed pilot behavior remain unverified.
Issues #2, #4, #6, #7, #8, #9, #10 and #11 stay open through their documented pilot checkpoints. Next: complete the existing native release validation, coordinate an idle app/runner/processor installation, then run the new owner preview and per-feature pilot checks. No pilot service or active task/upload was restarted or interrupted; no real photo library or email delivery was used. Disposable validation containers, networks and volumes were removed. Previously discarded diagnostics cannot be recovered retrospectively.
Owner-requested final development closure completed: issues #2, #4, #6, #7, #8, #9, #10 and #11 each received an issue-specific final comment linking their merged PR, preserved commits, checks and feature documentation, and are now closed. This supersedes the earlier instruction in comment 175 to keep those development issues open through deployment.
Documentation was reviewed and updated first, then merged in PR #21, commit
5ed71910c66f8da58afac684a24c3fc48827b477(documentation commite2cc3b0). README now links activity/email guidance and integration status.docs/integration-status.mdrecords the five merged feature PRs, issue/commit mappings, validation evidence, conflict preservation and scanning exclusion.docs/deployment.mdrecords the implemented features and retains unchecked native release gates plus per-feature installation/pilot checks for private diagnostics, real-provider SSO recovery, activity/cancellation, metadata coverage and actual owner-relay delivery.Documentation validation passed: all nine CI policy/contract tests, links/anchors/encoding, tracked-file/workflow contracts and diff checks. Only README and documentation changed; the previously validated application source is unchanged. No image rebuild, release publication, installation or running-service interruption was performed. Native release CI and real-provider/deployed-pilot verification remain outstanding; closure does not waive them.
This coordination issue stays open for subsequent priorities and the retained release/installation handoff. Issue #12 and draft PR #19 remain on hold and untouched. Unrelated open issues have not been closed or started.
Owner-approved PR #22 is merged in
09085fa7b7bdaf46be48b34cd8ac3068f315320e, preserving2ff357e. No conflicts; merged source tree exactly equals the locally validated feature tree. Issues #1 and #3 each received a final merge/validation/installation handoff and are now closed at the explicit request of the owner. Their previous instructions to remain open through review/merge are superseded. Remaining development issues are #5 and #13; no additional work has been started. Source is merged, not deployed or release-image-published. Native Forgejo AMD64/ARM64 checks and the aggregate release gate remain outstanding; run 20 is waiting. Closing this issue does not waive release or installation checks. Next: complete native validation, coordinate an idle installation, and verify the actual provider plus desktop/mobile behavior using the installation checklist and OIDC guide. No pilot service or active upload/task was restarted or interrupted. Held #12/PR #19 remain untouched.Owner-requested #13 is implemented and published for review in draft PR #23, commit
bae39615514f4d0376fdb871f8152c7ee7590b80, based on current main09085fa. The initially closed, explained interactive controls preserve confirmable defaults, validate conflicts and save exact preview/import option snapshots. The final #13 handoff records checks, pinned-importer quirks, the reviewed flag allowlist and remaining installation checks. Local backend/vet/race, real Docker isolation, full disposable browser/queue/upload/settings walkthrough, focused advanced/activity/email browsers, source advisory policies, dependency audit, nine CI policy tests and secret scans passed. Source is not merged, release-published or deployed. Native Forgejo run 21 is waiting, and native AMD64/ARM64 plus the release gate remain outstanding. Issue #13 stays open for review. Next: review the PR, complete native validation, then coordinate idle installation and actual-destination synthetic preview/import checks. No running service or active upload/task was interrupted. #5 was not started; held #12/PR #19 remain untouched.Owner-approved PR #23 is merged in
44c36de10d3c4c8a4a72c01750e20bd2e88ab969, preservingbae3961and its feature branch. No conflicts: merged main exactly matches the validated feature tree. The owner confirmed reviews were complete and explicitly requested #13 closure after merge; #13 has its final merge/validation/installation handoff and is now closed. The earlier keep-open-for-review instruction is superseded. Remaining development issue: #5; it has not been started by this merge. Held #12/PR #19 remain untouched atdc6003743056822cca9c4e81fc1f436bc5ac8635.Existing backend/vet/race, browser/mobile, real Docker isolation, full disposable walkthrough, security-policy/audit and secret-scan evidence applies to the unchanged source. Merge-time tree equality, parent ancestry, clean checkout and documentation/workflow/source contracts passed. Source is merged, not deployed or release-image-published. Native final-main run 22 is waiting; native AMD64/ARM64 checks and the aggregate release gate remain required. Next: complete native validation, coordinate idle installation of all three matching images, then verify actual-destination advanced preview/import behavior with synthetic data. No active upload/task or running service was interrupted. This coordination issue stays open.
Owner-requested #5 is implemented and published for review in draft PR #24, commit
e274c617aa64ace46a6a53a558de717083f37545, based on merged main44c36de. Its final issue handoff records the clipping reproduction, labelled native ZIP scrolling, keyboard/touch controls, selection/status preservation, 3/16-file responsive checks, independent-session monitoring/reconnect, the passing disposable upload/queue/settings walkthrough, lint/build/audit, CI policy/contracts and secret scans. #5 remains open for review. Source is not merged, release-published or deployed. Native run 23 is waiting; native AMD64/ARM64 and the release gate plus actual-device/installation checks remain outstanding. No running service or active upload/task was interrupted. Held #12/PR #19 and its original checkout remain untouched atdc6003743056822cca9c4e81fc1f436bc5ac8635. Next: review, native validation, then coordinated idle installation and device/pilot checks.Owner-requested #5 review and merge completed in PR #24, main
0a47f4f6fc2455dc304df49fa8c45084ff4a2d65, preservinge274c617aa64ace46a6a53a558de717083f37545and its branch. #5 is closed with its final merge/verification/installation handoff. Merged main exactly equals the validated feature tree; expected parents/ancestry and clean checkout verified. Independent UI lint/build/audit, mobile/touch/keyboard/monitoring regression, activity/email/advanced-import browser suites, nine CI policy tests and source/workflow/document contracts all passed. No blocking source-review findings or merge conflicts; no force merge or gate changes.All currently approved development issues are now closed. Held #12 and draft PR #19 remain unchanged, including their original checkout, at
dc6003743056822cca9c4e81fc1f436bc5ac8635. This coordination issue remains open. Source is merged, not deployed or release-image-published; final-main native run 24 is waiting. Native AMD64/ARM64 plus the aggregate release gate and documented actual-device/installation/pilot checks remain outstanding and required. Next: complete native validation, then coordinate idle installation of all three matching images and physical-device/provider/pilot checks. No running service or active upload/task was interrupted.At the owner's explicit request, #12/PR #19 has resumed under PR #19 comment 332. It was rebased onto current main
0a47f4fand remains draft, now targeting main; the olddc60037head is preserved on backup/issue-12-pre-layered-20261027. Published head23cfc67contains a passing rebase baseline, a shared integrity/AV entry stream and the layered-redesign specification. The final #12 handoff records exact commits, checks, limited microbenchmark evidence and remaining classification/structural/reporting/authorization/synthetic-workload work. The earlier hold is superseded for this owner-requested work only. The redesign is unfinished; no merge/deployment, gate waiver, real-media access or running task/upload interruption occurred. Other issues were not reopened or started.Owner-requested #12/PR #19 continuation is published at
0b318ee(draft, main unchanged at0a47f4f). It adds bounded private per-file evidence, owner-only paging/download/UI and retention/restart/deletion coverage under policy 3. The #12 handoff (comment 426) records exact final source/backend/race/engine/isolation/browser checks, the reporting-only microbenchmark, the scoped RW report-mount/software-quota limitation, and next authenticated-reuse/aggregate/realistic-workload/release steps. Cross-stage scan reuse and the 150 GB / 15% target remain unimplemented/unmeasured. #12 and #19 remain open/draft; no deployment, merge, gate waiver or other issue work occurred.#12 continuation is published at
dcc2e5ein draft PR #19, still targeting unchanged main0a47f4f. Authenticated expiring scan evidence and scoped one-use execution permits now avoid repeated scanning across analysis/preview/import; private original-run findings and retention remain owner scoped. The latest #12 handoff and docs/security-evidence.md record exact source/backend/race/managed-engine/restricted-Docker/API/key/browser/config/secret checks and remaining limits. Aggregate stage reporting and realistic reduced/150 GB performance validation are next; the 15% target is unmeasured. Native release/image gates and existing findings remain open. No merge/deployment/production interruption or other issue work occurred.Owner-requested #12 work is published at
edee4a3in draft PR #19, main unchanged at0a47f4f. Saved outcome counts and optional overlapping stage timings now complement authenticated reuse. Plain File check summary and separate Technical timing details preserve a nontechnical default. The latest #12 handoff and versioned reduced measurements record full checks and substantial observed AV costs: 64-asset main/layered medians 0.312/11.421 s; 512-asset 0.417/22.941 s. These functional profiles are far above 15% and do not establish 150 GB behavior. Both security and practical performance remain requirements; no checks/gates were weakened. Realistic media, steady-state profiling, precise resource accounting and native release work remain. #12 stays open; #19 stays draft. No merge/deployment/production interruption or other issue work occurred.#12 real-archive continuation is published at
c6ea848in draft PR #19, main unchanged at0a47f4f. One 155 GB baseline completed; security analysis held at one JPEG format-layout heuristic after 184 AV-clean files, leaving 66,828 unvisited. Bounded selected-member diagnosis and a generated real-engine reproducer narrow the compatibility issue without accepting incomplete coverage. Plain fixed hold reasons are now preserved through reports. The #12 handoff and versioned sanitized results record checks, cleanup, private retention and exact resume steps; no benchmark remains active and no complete overhead/15% result exists. Native release/performance/destination gates remain open. No merge/deployment/production interruption or other issue work occurred.Owner-authorized #12 continuation is published at
723d9f3in draft PR #19, main unchanged at0a47f4f. Policy 4 adds narrowly verified AVI-name/MP4-content compatibility on the same stream and bounded continued per-file assessment (128 findings, 16 MiB rejected entry / 64 MiB total rejected draining). Holds/blocks never obtain execution authority; older signed policy evidence requires fresh explicit analysis. Full local source/backend/race/managed-engine/required-Docker/budget/auth/importer-fixture checks passed with unchanged security baseline. The #12 handoff (468) and versioned sanitized observations record exact checks and limits. One new RO real-data assessment is active; do not duplicate it. No complete performance/15% result exists; native CI has been waiting for runners and release/destination work remains open. No merge/deployment/production interruption or other issue work occurred.#12 continuation is published at
be5dd3ein draft PR #19, clean/synced with main unchanged at0a47f4f. Policy 5 requires bounded shared-stream structural proof plus eligible AV for selected known same-family aliases; unknown/custom names and incomplete AV remain held/blocked. Local backend/vet/races, real/managed engine, required Docker isolation/authority, pinned importer synthetic destination, source policies/contracts/secrets checks pass. The #12 checkpoint records exact checks, cleanup and next steps. The policy-4 real assessment finished held at 1,637 entries; originals unchanged, all readers/controllers cleaned, no full assessment active. Custom-name clarification, bounded auxiliary-format policy, original JPEG compatibility, complete performance/destination/native release gates remain open. Latest native CI has 13 pending contexts, including source jobs waiting to run. No 15% claim, merge/deployment/production interruption or real destination access. No other issue work occurred.Follow-up #12 documentation/context checkpoint published at
ed55633, product policy unchanged frombe5dd3e. Owner confirmed direct Takeout downloads; a bounded RO metadata audit found 32 noncatalog-name entries with matching Photos sidecars and media prefixes. Owner format identification is no longer a prerequisite; bounded admission/importer handling still needs implementation and holds remain. See latest #12 checkpoint for limits and exact next steps. Originals unchanged, reader removed/locks released, no full assessment active. Docs/contracts/secrets checks pass; no new backend/native gate claim or deployment.#12 continuation published at
b9444fc, clean/synced with main0a47f4funchanged. PR #19 comment 332's full architecture write-up remains incorporated/controlling. Policy 6 requires full AV+structure for explicit observed Takeout cases with no oversized exemption for unfamiliar/companion names. Importer bridge.5 now counts the two unfamiliar cases as unsupported skips with exact private identities and a plain files-left-out warning; it does not rename or import them. Local backend/vet/races/engine/managed/required-Docker/browser/source/binary/source-package/contracts/secrets checks pass. Bounded real diagnosis confirms three prior custom-name cases pass both checks, original JPEG still held and four motion companions fail current structure, with no AV verdict for those four. Originals unchanged, readers/locks cleaned, no full assessment active. The latest #12 checkpoint records exact checks, publication, private resume instructions and next bounded topology diagnosis. Native image/release, real destination, complete-library/performance acceptance remains open; no 15% claim or gate waiver. No production interruption/deployment/merge/real destination access or other issue work.#12 motion-companion compatibility increment published at
d588fc4, clean/synced with main unchanged at0a47f4f. Policy 7 corrects final-sample zero timing and bounded documented Android metadata layouts while retaining positive video duration, full eligible original-byte AV, local references, sample bounds and all worker/resource/authorization limits. The same 13-member private batch now has 12 clean AV / 13 structural passes, including all four former companion holds; the original JPEG AV warning remains. Originals unchanged, all readers/locks cleaned and no full assessment active. Local full backend/vet/focused races/real+managed engine/required Docker/source/contracts/secrets checks pass; detailed validation and exact resume/next steps are in the latest #12 checkpoint. Wider real-library/native-format/performance/destination/native release gates remain open; CI is queued, no gate waiver or 15% claim. #14 and PR #19 comment 332 steering remain in force. No real destination access, deployment, merge, production interruption or other issue work.Owner added later-phase scope to #12: once scanning is fully complete/ready/validated, add admin-panel configurability for scan enablement, posture, blocking vs reporting and other useful tuneables. Details/order are recorded in the latest #12 comment. Explicitly defer that UI/configuration implementation until scanning readiness; current native/auxiliary compatibility/security/performance work continues. No new issue/chat/automation or deployment started.
Issue #12 compatibility increment published at
4163df9ccfin WIP PR #19; main unchanged at0a47f4f. Exact changes/checks/limits/resume instructions: #12 (comment). Policy 8 / importer bridge.6 adds narrow native-format handling and explicit unsupported outcomes, with source, actual importer, real engine, fresh signatures and required-mode Docker authority/isolation checks passing. Three serial private batches fully scanned 41 selected members; 40 meet classification policy, while the unsupported large BMP remains held despite clean AV. Original JPEG hold remains. No complete real performance pair/15% acceptance, full-library readiness, native release success or final-image clearance is claimed. No real destination, deployment, restart, merge or issue closure. The owner-requested admin controls remain a subsequent phase ONLY after scanning readiness (506/507); no panel was added. #12/#14 remain open.Issue #12 continuation published at
c08e677acbin WIP PR #19; main remains0a47f4f, production policy 8/importer bridge.6 unchanged. Exact evidence/resume/next steps: #12 (comment). All 29 remaining unfamiliar-name members plus a 64/424 companion sample pass full AV/structure (93 members, six bounded serial batches). Originals unchanged and readers/locks cleaned; JPEG/unsupported BMP holds remain. Extended actual required-mode Docker tests now complete real processor/importer preview and upload for clean and acknowledged-partial generated media, without rescanning or permitting missing/replayed authority, with exact bytes and private reporting. Full backend/vet/focused races pass; actual Docker suite passes normally (36.61 s) and with race-instrumented controller (38.03 s); contracts/policy/secrets pass. Recovery-copy proposal is committed for owner review but creation is unimplemented pending scope decision: current design excludes ZIP rewriting. No full-library/performance/15%/native-release success, real destination, deployment, restart, merge or closure. Admin controls stay deferred until readiness. #12/#14 remain open.Owner approved assessment-first, deferring recovery. Policy-9 foundation published at
5469cc659f; main0a47f4funchanged. Separate signed per-file evidence and safe independent assessment are implemented/tested; held collections remain blocked and recovery/admin controls are not started. Exact changes/checks and active full read-only real-set run resume instructions: #12 (comment). One bounded scanner is active; do not duplicate it or interrupt its original-file sharing locks. All 67,013 entries inventoried; final assessment/performance/cleanup result pending. Local backend/vet/races, managed/actual required Docker, source/UI/browser/contracts/secrets checks pass; native release/image gates remain. No real destination, deployment, merge or closure.Issue #12 continuation published at
078103836d; main unchanged at0a47f4f. Exact results and resume: #12 (comment). The old full run ended incomplete (47,588/67,013 results); originals/cleanup and signed diagnostic manifest review pass. A real small-ZIP64 descriptor incompatibility is fixed under policy 10, with whole-set metadata preflight before AV. All three real archive layouts / 67,013 entries now pass in 79.346 s without another AV pass. Full backend/vet/focused races, real ClamAV, final required-mode Docker with race controller (50.48 s), source policies (41 existing reviewed findings, no suppressions/baseline expansion), canonical images/contracts/secrets pass. Selected JPEG format/structure holds and AV performance still require work; native HEAD has 13 pending checks. No complete corrected-policy assessment, 15% result, final-image/native release clearance or real-provider claim. Recovery and admin controls remain deferred until readiness; no real import, deployment, restart, merge or closure. PR #19 stays WIP.Issue #12 continuation published at
aade4509dc, main unchanged at0a47f4f. Exact checks/results and ACTIVE full-run resume: #12 (comment). Shared existing entry metadata checks now preflight before AV; all 67,013 real entries pass metadata checks. Bounded JPEG audit explains selected trailers/missing marker but preserves holds; the stream-coalescing profile remains test-only, with no production coverage/configuration change. Full backend/vet/races, real ClamAV, actual required Docker with race controller (44.73 s), canonical images, source policies (41 existing reviewed findings, no suppressions/baseline expansion), contracts/secrets pass. ONE corrected full read-only assessment is now active on the committed source with normal bounds; session 67292 owns source sharing locks. Do not duplicate AV work, interrupt locks or rebuild active tags. Final completeness/performance/cleanup result pending; native HEAD has 13 queued checks. Recovery/admin phases stay deferred until readiness. No real destination, deployment, restart, merge or closure; PR #19 stays WIP.The corrected full Takeout assessment and requested post-scan diagnosis are complete and published at
545e29a01e(test diagnostics/docs only; production scanner source/policy unchanged). Main remains0a47f4f. Results and exact resume: #12 (comment). All 67,013 files have decisions, zero unvisited, about 3 h 52 min; 66,302 clean AV, 16 explicit oversized exceptions, 688 JPEG format holds and seven type blocks, no recorded known-malware detection. Manifest/proof/digest reconciliation, unchanged originals and exact cleanup pass. No active full scan remains. Bounded diagnostics identify legacy QuickTime recognition AND structural compatibility gaps in all five MOV blocks, late JFIF/trailing-data questions in a 12-JPEG sample, and two bitmap-signature blocks. No hold was waived. Full backend/vet, focused diagnostic races and contracts/privacy/secrets pass. Next: narrow tested QuickTime support, then bounded JPEG trailer/composite diagnosis; no automatic full rescan. Performance/native/image/deployed-updater/broader readiness gates remain. Recovery/admin controls stay deferred; PR #19 remains WIP; no real import, deployment, restart, merge or closure.Owner-approved examination export published at
c2752ff00b, main unchanged0a47f4f. Details/checks/resume: #12 (comment). The actual private 695-file bundle and readable/JSON reports are ready; no actual manifest, identity, hash, path or archive is committed or posted publicly. Selected contents and reports verify; originals and exact cleanup pass; no new AV, import authority or clearing of holds. This is private operator tooling, not an in-app/deployed download action. Full backend/vet, exporter races and privacy/contracts/secrets pass. Approved-remainder recovery/selective import and admin controls remain deferred; later conditional analysis-duration/leave-return/completion-email guidance is recorded. Native/performance/scanning readiness gates remain. No active scan/export, real destination, deployment, restart, merge or closure; PR #19 stays WIP.Review-set diagnosis published at
0db7a1ce85; main unchanged0a47f4f. Handoff: #12 (comment). All 695 copied payloads verify; 679 extended-XMP packet sets validate framing/identifier/XML; 654 JPEGs share one diagnostic-like trailer, with smaller no-trailer/missing-marker/vendor/component groups. Six wanted non-JPEG members receive clean supplementary AV after a separate managed test-definition refresh; original holds/authority remain unchanged. Owner-confirmed game package remains unsupported, with generated embedded-bitmap-prefix regression. Actual per-file reports/names/hashes/metadata stay private. Full backend/vet, focused diagnostic races and privacy/contracts/secrets pass. Next: narrow BMP/legacy-QuickTime validation and JPEG framing/engine-coverage fixtures. No active diagnostic/updater, full-library AV repeat, new production-policy/UI change, deployment, import, merge or closure. Native/performance/readiness gates and later approved-remainder recovery/admin phases remain; PR #19 stays WIP.Policy-11 increment published at
bf4073d237; main unchanged0a47f4f. Handoff: #12 (comment). All five wanted MOVs now pass combined complete structure and actual AV on unchanged bytes (31.696 s), without conversion. Normal incremental CLD generation identity is fixed and required-mode race-controller integration passes (47.61 s). Safe JPEG controls prove a later supported thumbnail can be missed after the format warning, so JPEG holds/alerts remain. Next: bounded supported metadata/component coverage for the 24 no-trailer JPEGs, then separate trailer/vendor/missing-marker cases. BMP-under-JPEG and game packages remain review/unsupported; this supersedes the old BMP-alias suggestion. Full backend/vet, focused races, actual engine fixtures, four canonical builds, source policy and privacy/contracts/secrets pass locally; 13 native checks remain pending. Private readable/JSON MOV reports are beside the existing examination ZIP; no actual media identities/manifests are public. Original reports remain unchanged, old reusable evidence is invalid under policy 11, and diagnostic results do not authorize import. No active scanner/updater, full-library rescan, real import, deployment, restart, merge, closure or waiver. PR #19 remains WIP; performance/readiness and later approved-remainder recovery/selective import/admin controls remain outstanding.Test-only JPEG component prototype published at
f40f4d0a50; main unchanged0a47f4f. Handoff: #12 (comment). All 24 no-trailer JPEGs are inventoried: three embedded panorama JPEGs, and 42 encoded/compressed camera wrappers in 21 files. A bounded one-forward-read path shares original AV/structure/digest/ZIP integrity, retains only headers and then checks decoded components sequentially. All 339 decoded-content AV requests are clean; all 24 originals retain their JFIF-position warning, and three optional debug slots remain unresolved. Actual XMP canaries show why ordinary JPEGs also need encoded-component coverage. No production eligibility, policy-11, engine configuration, dependency or authorization change. Full backend/vet, focused component/HDRP/capture races, actual-engine canaries, private batch and CI/privacy/contracts/secrets pass. Private readable/JSON reports stay beside the examination archive; no actual identities/manifests are public. Next: strict supported production metadata/component profile, starting with the three panorama candidates, completing EXIF/ICC/unknown-marker/recursion/failure/authorization rules first. No active scanner/updater, full-library rescan, real import, deployment, restart, merge, closure or waiver. 13 native checks remain pending; performance/readiness and later recovery/selective import/admin phases stay open. PR #19 remains WIP.Owner-requested #25 is implemented and published directly on main at
7663404f7a. Full change/check/limitation/next-step handoff: #25 (comment). It adds protected retained-ZIP analysis re-runs and independent progressive workflow sections, preserving files/settings/history and per-operation notification consent. Local backend/vet/races, desktop/mobile focused browsers, final-image disposable queue/upload/settings/browser walkthrough, policy/contracts and secret checks pass. Companion build/deployment preparation is also published and validated for 0.1.1-pilot.1, explicitly a prerelease pilot rather than 1.0, using importer 0.32.0-bridge.4. No native build/registry publication/rollout was dispatched, no real destination or active pilot task was touched, and the existing encrypted runtime environment is retained until new reviewed digests exist. Native main has 13 pending checks; unchanged-lockfile audit advisories and native/image/provider/performance/installation gates remain, without waivers. #12/PR #19 and its original work remain untouched. #25 stays open for owner review; #14 remains the coordination index.Owner-requested publication update: pilot 0.1.1-pilot.1 is now published for Linux ARM64 from main
7663404f7a, with unchanged importer 0.32.0-bridge.4. The native pipeline passed backend/race, runner-race, browser-upload-client and actual-importer targets, built/published app + runner + processor, verified runtime/license material, and published matching Bridge/importer source with checksums. Independent registry inspection confirms the exact version, source SHA and ARM64 architecture on all three images; reported and registry digests agree. Companion deployment image pins are updated and configuration validation passed, with every other encrypted setting preserved. This supersedes the earlier image-publication-pending status only. No live deployment, service restart, real import or #12/PR #19 modification occurred. This remains a prerelease pilot; full dual-architecture/image release gates and installed-provider/library checks remain separate.Owner explicitly authorized deployment after the latest companion infrastructure validation completed. That exact validation passed, and the deployment of pilot 0.1.1-pilot.1 to the authorized pilot target has now succeeded using the three reviewed immutable image pins. Independent post-deployment public HTTPS checks return 200 Ready, and the served application bundle contains Re-Run analysis, Analysis setup and Preview results from main
7663404f7a. The registered mount-guarded lifecycle completed without failed/unreachable tasks. No owner analysis, preview or import was started for verification, and no #12/PR #19 work was touched. This supersedes the earlier deployment-pending status only. Native ARM64 pilot publication/deployment is complete; full dual-architecture/image release gates, dependency audit follow-up and authenticated real-provider/relay/library walkthroughs remain separate. No 1.0 release or full-library success is claimed.Security branch rebased/published at
36b230aonto current main7663404, preserving all 28 #12 commits and #25 workflow. Handoff: #12 (comment). Retained-analysis reset clears prior private execution evidence; UI consent/report caches follow operation identity and require fresh acknowledgement even for an identical coverage digest. Progressive sections/history/settings/private findings remain. Full backend/vet, focused races, six synthetic browsers, four canonical builds, actual required-mode isolation/reuse integration and source/privacy/secrets contracts pass locally. Main/deployed pilot remain untouched. No JPEG eligibility change yet (policy 11); continuing strict panorama rules on this new baseline. Native/release/performance/readiness and later recovery/admin gates remain; no waiver, real import, restart, merge or closure. PR #19 stays WIP.Issue #25's approved follow-up is published on main at
cc91065266. Exact changes, checks, diagnosis, remaining wording and next steps: #25 (comment). Five guided workflow groups, explicit Next/back collapse, mobile/re-run/history/reload behavior, the exact owner-provided background paragraph, clearer analysis wording, accessible email denial reasons and safe existing-account SSO profile refresh/administrator diagnostics are implemented. Full local backend/vet/focused races, UI/browser/disposable-stack, contracts and secret checks pass. Source gosec has no new findings; new module-only x/net advisories and retained npm advisories block release clearance without a gate waiver. Source is published, not rebuilt/deployed; existing 0.1.1-pilot.1 remains unchanged. Fresh real SSO/email verification and a new pilot build identity/rollout remain. #12/PR #19 are untouched; #25/#14 remain open.Published #12 policy-12 panorama checkpoint
e143297b44, rebased onto maina279a1bwith all 30 prior commits preserved, plus guided-consent/locale integration and expanded real-engine controls. Handoff and next steps: #12 (comment). Targeted recorded test gives three panoramas allowed / 21 camera-debug photos held, all 24 private outcomes verified and no collection authority. Original warning remains separate compatibility evidence. Latest full backend/vet/races, canonical images, real engine, seven synthetic browsers, source/privacy/secrets checks and required-mode Docker integration (61.18 s) pass locally. Native checks: pending (13 checks). Main/deployed pilot untouched; PR #19 remains WIP. Next is supported camera-debug semantics and remaining trailer/marker/composite cases, with no recovery/selective import/admin work or gate waiver. Actual media identities/manifests/digests stay outside Git.Owner-requested 0.1.2-pilot.1 build and APP-02 rollout completed. Exact source, guards, digest pins, checks, limitations and owner follow-up: #25 (comment). App
a279a1band infrastructure build 6c03ba0/pins a7a3f87 are published on main. Native build #257 passed backend/race/upload-client/importer and fresh Go/npm/importer/all-image policies before publication; independent public registry/source verification passed. Preview #259 and apply #260 succeeded on the exact pinned infrastructure revision, including the read-only idle check before restart. HTTPS readiness/new UI bundle, local/SSO availability, retained SSO accounts and admin diagnostic fields pass deployed checks. All other decrypted SOPS values were preserved. Fresh owner SSO sign-in/email consent/inbox and broader pilot/full native release checks remain; reviewed unfixed OS findings are still tracked. #12/PR #19 remain untouched; #25/#14 remain open. Published versions cannot be reused.Owner has now verified the deployed 0.1.2-pilot.1 fresh-SSO checkpoint: the expected name appears after re-login and the analysis email checkbox is interactive. Update: #25 (comment). Completion-email delivery remains pending the current analysis; do not treat inbox delivery as verified or close #25 yet. No additional task/deployment/test email was started.
Issue #25 is closed at the owner's explicit request after successful validation of deployed 0.1.2-pilot.1, including the new layout, fresh SSO profile refresh, notification consent and analysis-completion email. Final acceptance: #25 (comment). Build/deployment and scoped security evidence remain in #25 comment 641. Broader release/performance/security work remains separate; #12/PR #19 are untouched. This coordination issue remains open.
Issue #12 camera-metadata validation is published at
941c440573; handoff: #12 (comment). Test/diagnostic/docs changes only: all 255 preview buffers now decode after fixing three diagnostic parser-boundary failures, narrow ICC/Exif checks pass, and 465 component representations return negative AV. Two camera-log byte fields per file still lack supported semantics; all 21 camera-debug photos remain held under production policy 12. Next: settle that treatment and test one versioned production profile before eligibility changes. Private readable/JSON findings are beside the examination ZIP; no media identities/manifests are published. Local backend/races/actual-engine/negative/privacy checks pass; exact-head native checks remain pending (13). PR #19 stays WIP. Main/deployed pilot unchanged; no import, restart/deployment, recovery/admin work, merge or closure. Separately completed #25 acceptance does not waive #12 gates.Issue #12 camera merge-field checkpoint
1e6a5d6c3fis published. Handoff: #12 (comment). The two previously opaque leaves have a packed-float frame-weight/factor candidate corroborated by four named readable details in 18 photos; three lack those lines and are recorded as absent. All 21 pass bounded binary candidates but remain HELD under production policy 12. Numeric/forged-text canary controls prove decoded AV remains mandatory. Test/diagnostic/docs changes only; full backend/vet/focused races, actual-engine fixtures, generated fuzz and contracts/privacy checks pass. Private reports remain beside the examination ZIP; no identities/manifests published. Next: complete and integrate one versioned camera/HDRP/Exif/ICC profile with full decision-path/failure/mixed-file validation. Native checks pending (13); PR #19 WIP. Main/deployed pilot unchanged. No recovery/admin/import/deployment/restart/merge/closure or gate waiver.Issue #12 policy-13 camera checkpoint
bd677ba900is published; final handoff: #12 (comment). All 21 targeted camera photos and three panorama controls pass the complete recorded path without conversion, with original warnings preserved and 480 component AV responses checked. The complete audit also accounts for three additional encoded records missed by the earlier diagnostic. Private reports remain beside the examination ZIP; no identities/manifests published. Local backend/vet/races, four image builds, actual-engine controls, generated fuzz, source/Go/npm policies, UI/private browser and required-mode race-controller camera analysis/reuse/preview/synthetic-upload workflow (46.09 s) pass. Native state: pending (13 checks). PR #19 stays WIP; next is the largest remaining held JPEG family from the private census. Main/deployed pilot unchanged; no original-library rescan, real import, recovery/admin work, deployment/restart, merge or closure. Overall #12/performance/release gates remain open.Issue #12 trailer diagnostic checkpoint
4189520ecbis published; handoff: #12 (comment). Fresh fetch/rebase is a no-op: published maina279a1band its Go/dependency updates are already included. Independent bounded framing accounts for 421 of 654 recurring JPEG debug trailers; 233 focus layouts remain unrecognized. All 654 retain holds because payload validation is unfinished; production policy stays 13. New private readable/JSON reports are beside the examination ZIP. Only test/docs/aggregate changes; full backend/vet/focused races, generated framing/failure controls, CI/contracts/privacy/secret checks pass. Native checks pending (13); PR #19 WIP. Next: establish focus framing and typed payload schemas, check complete headers, then prove bounded original/component AV and streaming/evidence paths before eligibility changes. Main/deployed pilot unchanged; no import, recovery/admin work, deployment/restart, merge, closure or readiness/performance waiver.Issue #12 checkpoint
30fdec7e3dis published; handoff: #12 (comment). The wrapper-aware diagnostic now accounts for all 654 targeted JPEG trailers: the 233 previously unexplained focus blocks are bounded single-member gzip. Payload semantics remain unresolved, so all 654 holds and policy 13 remain. Independent header checks identify 238 existing profile candidates and 416 requiring compatibility work, mostly 396 camera-log variants. New private readable/JSON findings are beside the examination ZIP; no media identities, values or manifests are published. Test/docs/aggregate changes only; canonical backend/vet/focused races, malware/negative/refusal tests, actual-engine synthetic controls and CI/contracts/privacy/secret checks pass. No private-data AV or full image/library rescan in these diagnostics. Main/dependencies are already included; fresh rebase is up to date. Native checks pending (13); PR #19 WIP. Next: explicit payload schemas and header variants, then full bounded AV/streaming/evidence integration before eligibility and representative performance acceptance. No import, recovery/admin work, deployment/restart, merge, closure or gate waiver.Issue #12 checkpoint
5bb88ce6a6is published; handoff: #12 (comment). The gap audit identifies added fields/presence variants in the 396 unsupported camera logs. All 636 reachable logs have readable framing and pass the known weight subset. Existing flat notes match in 259; 375 table layouts match known exponent/count/indices/factors, while maximum-weight correspondence remains explicitly unverified. The proposed alias to ordinary weights is rejected (166 coincidental matches, 209 disagreements). Unsupported notes/properties are not treated as absent or successfully checked. All 654 holds and policy 13 remain. Bounded private header snapshots avoid repeated archive reads; new readable/JSON findings are beside the examination ZIP. Only tests/docs/aggregates change; full backend/vet/focused races, generated refusal/negative tests, real-ClamAV synthetic factor controls and CI/contracts/privacy/secret checks pass. Main/dependencies already included; rebase up to date. Native pending (13); PR #19 WIP. Next: bounded log/note schemas, then trailer schemas and complete AV/streaming/budget/evidence integration before eligibility/performance acceptance. No real import, recovery/admin work, deployment/restart, merge, closure or gate waiver.Issue #12 checkpoint
24db3ffdf4is published; handoff: #12 (comment). The explicit bounded candidate supports all 636 reachable saved logs, with 2,544 managed fresh unchanged-definition representation AV requests / 684,774 bytes, all completed without detection. Normalized numeric AV catches a tag-separated synthetic canary missed by raw wire. The twenty remaining header cases are narrowed, but property/note integration and typed trailers remain unfinished; policy 13/all 654 original holds remain. New readable/JSON private reports are beside the examination ZIP; no identities, values or manifest rows published. All 39 security commits are rebased onto main532f520, retaining exact stack fixes and Takeout reporting as bridge.7. Full combined backend/vet/races/importer, four images, real-engine fixtures, matching source and importer vulnerability policy pass. Required-mode race-controller Docker workflow passes in 56.14 s with generated camera media, authenticated reuse, preview/synthetic upload, held refusal, partial consent and cleanup. CI/contracts/privacy/staged/full-history secret checks pass. Native: pending, 13 checks. PR #19 remains WIP. Next: remaining XMP/note variants and typed trailer schemas, then complete one-read AV/budget/evidence integration before eligibility and representative performance acceptance. No real import, recovery/admin work, deployment/restart, merge, closure or gate waiver.Issue #12 checkpoint
2cfea71066is published; handoff: #12 (comment). Staged XML parsing accounts for all 654 saved headers; 15 of 20 remaining cases have complete XMP component plans with 365 managed AV requests / 7,584,496 bytes, all completed without detection, including both plain-text notes. Five deeper byte-field cases remain unsupported. All 654 saved trailers / 1,872 blocks complete 2,105 wire/gzip representation requests / 20,126,895 bytes without detection, while nested types remain unresolved. Exact same-file header-record correspondence gives zero supporting matches; no guessed schema allowance. Policy 13/all 654 original holds remain. Private readable/JSON reports are beside the examination ZIP; no identities, values or manifests published. Full backend/vet/races, real-engine fixtures, source policy/govulncheck, guided XML fuzz (204,358 executions), CI/contracts/privacy/secret checks pass. Main532f520remains included; normal push, bridge.7 retained. Native: pending, 13 checks. Next: explicit added log/numeric-note byte-field types and trailer schemas, then complete one-read AV/budget/evidence integration before eligibility and representative performance acceptance. PR #19 WIP; no real import, recovery/admin work, deployment/restart, owner-task interruption, merge, closure or gate waiver.