[E00-S02-T07] amd64 and arm64 are build targets #174

New Issue

Closed

opened 2026-08-27 00:07:15 +00:00 by kpcto · 10 comments

kpcto commented 2026-08-27 00:07:15 +00:00

Owner

Copy Link

Copy Source

Parent story: [E00-S02] Docker Compose baseline (#59)

Intent

Ensure amd64 and arm64 are both image build targets.

Acceptance criteria

• amd64 is a build target
• arm64 is a build target

Explicitly out of scope

• read-only root filesystem (E00-S02-T06)
• secrets not embedded (E00-S02-T08)

Test plan

• build the image for both amd64 and arm64

Rollback note

• revert the multi-arch build configuration

Owning stream

platform

Risk quadrant

agent-full

> Parent story: [E00-S02] Docker Compose baseline (#59) ## Intent Ensure amd64 and arm64 are both image build targets. ## Acceptance criteria - `amd64` is a build target - `arm64` is a build target ## Explicitly out of scope - read-only root filesystem (E00-S02-T06) - secrets not embedded (E00-S02-T08) ## Test plan - build the image for both amd64 and arm64 ## Rollback note - revert the multi-arch build configuration ### Owning stream platform ### Risk quadrant agent-full

kpcto added this to the Sprint 0 milestone 2026-08-27 00:07:15 +00:00

kpcto added the

kind

task

status

ready

labels 2026-08-27 00:07:15 +00:00

bot-dispatcher added

status

proposed

and removed

status

ready

kind

task

labels 2026-08-27 00:07:17 +00:00

bot-dispatcher commented 2026-08-27 00:07:18 +00:00

Member

Copy Link

Copy Source

Auto-reverted by dispatcher: DoR lint: required section "Intent" is empty; required section "Acceptance criteria" is empty; required section "Explicitly out of scope" is empty; required section "Test plan" is empty; required section "Rollback note" is empty; acceptance criteria: no bullet assertions found

status/ready may only be applied by a human maintainer.

> Auto-reverted by dispatcher: DoR lint: required section "Intent" is empty; required section "Acceptance criteria" is empty; required section "Explicitly out of scope" is empty; required section "Test plan" is empty; required section "Rollback note" is empty; acceptance criteria: no bullet assertions found `status/ready` may only be applied by a human maintainer.

kpcto added the

kind

task

label 2026-08-27 21:24:36 +00:00

kpcto added

status

ready

and removed

status

proposed

labels 2026-08-29 01:03:47 +00:00

bot-dispatcher added

loop

1

status

in-progress

and removed

status

ready

labels 2026-08-29 01:03:55 +00:00

bot-dispatcher commented 2026-08-29 01:03:55 +00:00

Member

Copy Link

Copy Source

agent: dispatcher
phase: complete
plan_summary: Dispatch #174: [E00-S02-T07] amd64 and arm64 are build targets (platform, security-gated)

```yaml agent: dispatcher phase: complete plan_summary: Dispatch #174: [E00-S02-T07] amd64 and arm64 are build targets (platform, security-gated) ```

bot-dispatcher added the needs/security-reviewneeds/security-review labels 2026-08-29 01:03:55 +00:00

bot-implementer commented 2026-08-29 01:08:21 +00:00

Member

Copy Link

Copy Source

agent: implementer
phase: start
issue: 174
task: "[E00-S02-T07] amd64 and arm64 are build targets"
plan_summary: |
  Implement multi-arch build targets on top of the E00-S02-T01..T06 Compose
  baseline:
  1. compose.yaml: declare build.platforms (linux/amd64, linux/arm64) on the
     app service (Compose Build spec `platforms` — `docker compose build`
     produces a multi-arch image; `docker compose up` still builds/runs the
     host platform, so the T01..T06 real-stack probes are unaffected); update
     the header doc (T07 in scope, T08 remains).
  2. apps/server/Dockerfile: header doc only — both stages already use the
     official multi-arch node:24.19.0-bookworm-slim base and the build has no
     native deps, so no image change is needed for amd64/arm64 targets.
  3. tests/build-targets.test.mjs (new): static assertions (app service build
     declares both platforms), non-vacuous mutation probes (drop one platform,
     drop both, empty list, wrong arch strings, platforms on db only), and a
     Docker-gated probe (`docker compose build --print` bake targets include
     both platforms; `docker buildx imagetools inspect` on the base image
     lists linux/amd64 and linux/arm64).
  4. Open PR with criterion -> test table; CI (frozen install) green.
out_of_scope:
  - read-only root filesystem (E00-S02-T06)   # already landed
  - secrets not embedded (E00-S02-T08)

```yaml agent: implementer phase: start issue: 174 task: "[E00-S02-T07] amd64 and arm64 are build targets" plan_summary: | Implement multi-arch build targets on top of the E00-S02-T01..T06 Compose baseline: 1. compose.yaml: declare build.platforms (linux/amd64, linux/arm64) on the app service (Compose Build spec `platforms` — `docker compose build` produces a multi-arch image; `docker compose up` still builds/runs the host platform, so the T01..T06 real-stack probes are unaffected); update the header doc (T07 in scope, T08 remains). 2. apps/server/Dockerfile: header doc only — both stages already use the official multi-arch node:24.19.0-bookworm-slim base and the build has no native deps, so no image change is needed for amd64/arm64 targets. 3. tests/build-targets.test.mjs (new): static assertions (app service build declares both platforms), non-vacuous mutation probes (drop one platform, drop both, empty list, wrong arch strings, platforms on db only), and a Docker-gated probe (`docker compose build --print` bake targets include both platforms; `docker buildx imagetools inspect` on the base image lists linux/amd64 and linux/arm64). 4. Open PR with criterion -> test table; CI (frozen install) green. out_of_scope: - read-only root filesystem (E00-S02-T06) # already landed - secrets not embedded (E00-S02-T08) ```

bot-implementer referenced this issue 2026-08-29 01:13:54 +00:00

[E00-S02-T07] amd64 and arm64 are build targets #388

bot-security commented 2026-08-29 01:14:46 +00:00

Member

Copy Link

Copy Source

agent: security
task: "security review of PR #388 (feature/174) for issue #174"
phase: started
pr: 388
head_branch: feature/174
scope: "compose.yaml, apps/server/Dockerfile, tests/build-targets.test.mjs"
plan:
  - "deterministic scans: gitleaks, osv-scanner, semgrep (if installed)"
  - "manual authz/input-boundary trace over the diff (build/test infra)"
  - "post final verdict YAML (approve | request-changes) on this issue"
status: in-progress

Security review of PR #388 starting. Final verdict will be posted on this issue when complete.

```yaml agent: security task: "security review of PR #388 (feature/174) for issue #174" phase: started pr: 388 head_branch: feature/174 scope: "compose.yaml, apps/server/Dockerfile, tests/build-targets.test.mjs" plan: - "deterministic scans: gitleaks, osv-scanner, semgrep (if installed)" - "manual authz/input-boundary trace over the diff (build/test infra)" - "post final verdict YAML (approve | request-changes) on this issue" status: in-progress ``` _Security review of PR #388 starting. Final verdict will be posted on this issue when complete._

bot-implementer commented 2026-08-29 01:15:20 +00:00

Member

Copy Link

Copy Source

agent: implementer
phase: end
issue: 174
task: "[E00-S02-T07] amd64 and arm64 are build targets"
outcome: done
pr: 388
pr_url: https://gitea:3000/Fabrika/PersonalBlog/pulls/388
summary: |
  Multi-arch build targets implemented and PR open:
  - compose.yaml: the app service's build config now declares
    build.platforms: [linux/amd64, linux/arm64] (Compose Build spec
    `platforms`), so `docker compose build` produces a multi-arch image;
    `docker compose up` still builds/runs the host platform (compose clears
    the multi-platform list for up/run), so the T01..T06 real-stack probes are
    unaffected. Header doc updated (T07 in scope, T08 remains).
  - apps/server/Dockerfile: header doc only — both stages already build on the
    official multi-arch node:24.19.0-bookworm-slim base and the build has no
    native deps, so no image change is needed for amd64/arm64 targets.
  - tests/build-targets.test.mjs (new, 11 tests): static assertions (app
    service build.platforms lists linux/amd64 and linux/arm64; every Dockerfile
    stage uses the multi-arch base image), non-vacuous mutation probes (remove
    either target, replace arm64 with linux/386, drop/empty the platforms list,
    platforms on the image-only db service — all fail), plus two Docker-gated
    probes (docker compose build --print bake config lists both platforms;
    docker buildx imagetools inspect on the base image reports linux/amd64 and
    linux/arm64 manifests). Against a clean main worktree the file gives
    7 fail / 2 pass / 2 skip — criteria genuinely fail without the committed
    state.
ci:
  - "CI / Frozen lockfile install (pull_request)": success (46s)
tests:
  new_file: "9/9 pass + 2 Docker-gated skips (no Docker daemon in sandbox)"
  full_suite: "86 pass / 12 fail / 7 skip; identical 12 environmental failures on clean main (77 pass / 12 fail / 5 skip in a fresh worktree, Node 22, no node_modules) — zero new failures"
acceptance_criteria:
  - "amd64 is a build target": covered (static build.platforms + mutation probes + Docker-gated bake/imagetools probes)
  - "arm64 is a build target": covered (static build.platforms + mutation probes + Docker-gated bake/imagetools probes)
out_of_scope_respected:
  - read-only root filesystem (E00-S02-T06)   # untouched
  - secrets not embedded (E00-S02-T08)   # untouched
rollback_note: drop the `platforms` list from the `app` build config in compose.yaml

```yaml agent: implementer phase: end issue: 174 task: "[E00-S02-T07] amd64 and arm64 are build targets" outcome: done pr: 388 pr_url: https://gitea:3000/Fabrika/PersonalBlog/pulls/388 summary: | Multi-arch build targets implemented and PR open: - compose.yaml: the app service's build config now declares build.platforms: [linux/amd64, linux/arm64] (Compose Build spec `platforms`), so `docker compose build` produces a multi-arch image; `docker compose up` still builds/runs the host platform (compose clears the multi-platform list for up/run), so the T01..T06 real-stack probes are unaffected. Header doc updated (T07 in scope, T08 remains). - apps/server/Dockerfile: header doc only — both stages already build on the official multi-arch node:24.19.0-bookworm-slim base and the build has no native deps, so no image change is needed for amd64/arm64 targets. - tests/build-targets.test.mjs (new, 11 tests): static assertions (app service build.platforms lists linux/amd64 and linux/arm64; every Dockerfile stage uses the multi-arch base image), non-vacuous mutation probes (remove either target, replace arm64 with linux/386, drop/empty the platforms list, platforms on the image-only db service — all fail), plus two Docker-gated probes (docker compose build --print bake config lists both platforms; docker buildx imagetools inspect on the base image reports linux/amd64 and linux/arm64 manifests). Against a clean main worktree the file gives 7 fail / 2 pass / 2 skip — criteria genuinely fail without the committed state. ci: - "CI / Frozen lockfile install (pull_request)": success (46s) tests: new_file: "9/9 pass + 2 Docker-gated skips (no Docker daemon in sandbox)" full_suite: "86 pass / 12 fail / 7 skip; identical 12 environmental failures on clean main (77 pass / 12 fail / 5 skip in a fresh worktree, Node 22, no node_modules) — zero new failures" acceptance_criteria: - "amd64 is a build target": covered (static build.platforms + mutation probes + Docker-gated bake/imagetools probes) - "arm64 is a build target": covered (static build.platforms + mutation probes + Docker-gated bake/imagetools probes) out_of_scope_respected: - read-only root filesystem (E00-S02-T06) # untouched - secrets not embedded (E00-S02-T08) # untouched rollback_note: drop the `platforms` list from the `app` build config in compose.yaml ```

bot-security commented 2026-08-29 01:17:29 +00:00

Member

Copy Link

Copy Source

agent: security
task: "security review of PR #388 (feature/174) for issue #174"
pr: 388
head_branch: feature/174
head_sha: f663fd23eb5b39cfea8dbae1a0f25e5f4857a39d
phase: completed
verdict: approve
findings: []
scans:
  gitleaks:
    command: "gitleaks detect --source . --no-git --redact"
    result: "no leaks found (exit 0)"
  gitleaks_pr_commits:
    command: "gitleaks detect --redact --log-opts=8a01b19..f663fd2"
    result: "2 commits scanned, no leaks found (exit 0)"
  osv_scanner:
    command: "osv-scanner --recursive ."
    result: "No issues found (pnpm-lock.yaml, 3 packages)"
  semgrep:
    result: "not installed — skipped per playbook; gap covered by manual authz/input trace"
authz_trace:
  new_endpoints: 0
  notes:
    - "no application code changed — diff is compose.yaml (build.platforms), Dockerfile comment-only doc fix, and a new test file"
    - "no default-allow path introduced; no data access added"
    - "pipeline tripwire clear: no changes to agents/, CI config, .gitea/workflows/, or review process"
input_boundaries:
  command_injection: "clean — tests/build-targets.test.mjs spawnSync calls use fixed argv arrays, no shell:true, no untrusted interpolation; all calls carry timeouts"
  ssrf: "clean — only outbound touch is `docker buildx imagetools inspect node:24.19.0-bookworm-slim`, a hardcoded official-image reference, not user-influenced"
  deserialization: "clean — JSON.parse runs on local docker CLI output and fails the test safely; the hand-rolled YAML parser reads only the repo's own committed files (test helper, not a security boundary)"
  injection: "clean — no SQL/command/template/header construction anywhere in the diff"
notes:
  - severity: nit
    location: "compose.yaml:52-54,84"
    what: "pre-existing default dev DB credentials (postgres://eppp:eppp@db:5432/eppp) visible as context lines"
    assessment: "NOT introduced by this PR (T01..T06 baseline) and explicitly out of scope — 'secrets not embedded' is task E00-S02-T08; tracked there, no action for this PR"
verification:
  tests_on_branch: "node --test tests/build-targets.test.mjs → 9 pass / 0 fail / 2 skip (Docker-gated probes skip without a daemon)"
  tests_on_clean_main: "same file against 8a01b19 → 7 fail / 2 pass / 2 skip — criteria genuinely fail without the committed state, assertions are non-vacuous"
  test_honesty: "no deleted, weakened or environment-skipped pre-existing tests; skips are daemon-gated (same pattern as T01..T06 suites); mutation probes prove the static assertions bite"
conclusion: "No blockers, no should-level findings. The change adds a build-time multi-arch declaration (linux/amd64 + linux/arm64) with zero runtime attack-surface impact; scanners are clean and the manual trace found no injection, authz, secret or SSRF issues."

Verdict: ✅ approve — security review of PR #388 complete. Evidence and full YAML summary above; no findings at blocker/should severity. (One informational nit on pre-existing, out-of-scope default dev credentials — tracked as T08.)

```yaml agent: security task: "security review of PR #388 (feature/174) for issue #174" pr: 388 head_branch: feature/174 head_sha: f663fd23eb5b39cfea8dbae1a0f25e5f4857a39d phase: completed verdict: approve findings: [] scans: gitleaks: command: "gitleaks detect --source . --no-git --redact" result: "no leaks found (exit 0)" gitleaks_pr_commits: command: "gitleaks detect --redact --log-opts=8a01b19..f663fd2" result: "2 commits scanned, no leaks found (exit 0)" osv_scanner: command: "osv-scanner --recursive ." result: "No issues found (pnpm-lock.yaml, 3 packages)" semgrep: result: "not installed — skipped per playbook; gap covered by manual authz/input trace" authz_trace: new_endpoints: 0 notes: - "no application code changed — diff is compose.yaml (build.platforms), Dockerfile comment-only doc fix, and a new test file" - "no default-allow path introduced; no data access added" - "pipeline tripwire clear: no changes to agents/, CI config, .gitea/workflows/, or review process" input_boundaries: command_injection: "clean — tests/build-targets.test.mjs spawnSync calls use fixed argv arrays, no shell:true, no untrusted interpolation; all calls carry timeouts" ssrf: "clean — only outbound touch is `docker buildx imagetools inspect node:24.19.0-bookworm-slim`, a hardcoded official-image reference, not user-influenced" deserialization: "clean — JSON.parse runs on local docker CLI output and fails the test safely; the hand-rolled YAML parser reads only the repo's own committed files (test helper, not a security boundary)" injection: "clean — no SQL/command/template/header construction anywhere in the diff" notes: - severity: nit location: "compose.yaml:52-54,84" what: "pre-existing default dev DB credentials (postgres://eppp:eppp@db:5432/eppp) visible as context lines" assessment: "NOT introduced by this PR (T01..T06 baseline) and explicitly out of scope — 'secrets not embedded' is task E00-S02-T08; tracked there, no action for this PR" verification: tests_on_branch: "node --test tests/build-targets.test.mjs → 9 pass / 0 fail / 2 skip (Docker-gated probes skip without a daemon)" tests_on_clean_main: "same file against 8a01b19 → 7 fail / 2 pass / 2 skip — criteria genuinely fail without the committed state, assertions are non-vacuous" test_honesty: "no deleted, weakened or environment-skipped pre-existing tests; skips are daemon-gated (same pattern as T01..T06 suites); mutation probes prove the static assertions bite" conclusion: "No blockers, no should-level findings. The change adds a build-time multi-arch declaration (linux/amd64 + linux/arm64) with zero runtime attack-surface impact; scanners are clean and the manual trace found no injection, authz, secret or SSRF issues." ``` **Verdict: ✅ approve** — security review of PR #388 complete. Evidence and full YAML summary above; no findings at blocker/should severity. (One informational nit on pre-existing, out-of-scope default dev credentials — tracked as T08.)

bot-dispatcher removed the needs/security-reviewneeds/security-review labels 2026-08-29 01:17:30 +00:00

bot-reviewer commented 2026-08-29 01:18:06 +00:00

Member

Copy Link

Copy Source

agent: reviewer
verdict: approve

```yaml agent: reviewer verdict: approve ```

bot-dispatcher added

status

review

and removed

status

in-progress

loop

1

kind

task

labels 2026-08-29 01:18:08 +00:00

bot-dispatcher commented 2026-08-29 01:18:10 +00:00

Member

Copy Link

Copy Source

Security approved; dispatching reviewer.

> Security approved; dispatching reviewer.

bot-tester commented 2026-08-29 01:19:33 +00:00

Member

Copy Link

Copy Source

agent: tester
phase: start
issue: 174
pr: 388
head_branch: feature/174
head_sha: f663fd23eb5b39cfea8dbae1a0f25e5f4857a39d
task: "independent probe of PR #388 for issue #174"
objective: "independently verify both acceptance criteria (amd64 is a build target; arm64 is a build target) without relying on the implementer's test file"
constraints:
  - "never edit the implementer's tests in the same PR"
acceptance_criteria:
  - "amd64 is a build target"
  - "arm64 is a build target"
plan:
  - "inspect PR #388 diff (compose.yaml, apps/server/Dockerfile, tests/build-targets.test.mjs)"
  - "independently parse compose.yaml and confirm app.build.platforms lists linux/amd64 and linux/arm64 (own script, not the implementer's test)"
  - "confirm the Dockerfile base image (node:24.19.0-bookworm-slim) is multi-arch via a registry manifest probe"
  - "run node --test on the build-targets suite and the full tests/*.test.mjs suite; compare failures against clean main"
  - "collect CI run/job links for the PR head"
status: in-progress

```yaml agent: tester phase: start issue: 174 pr: 388 head_branch: feature/174 head_sha: f663fd23eb5b39cfea8dbae1a0f25e5f4857a39d task: "independent probe of PR #388 for issue #174" objective: "independently verify both acceptance criteria (amd64 is a build target; arm64 is a build target) without relying on the implementer's test file" constraints: - "never edit the implementer's tests in the same PR" acceptance_criteria: - "amd64 is a build target" - "arm64 is a build target" plan: - "inspect PR #388 diff (compose.yaml, apps/server/Dockerfile, tests/build-targets.test.mjs)" - "independently parse compose.yaml and confirm app.build.platforms lists linux/amd64 and linux/arm64 (own script, not the implementer's test)" - "confirm the Dockerfile base image (node:24.19.0-bookworm-slim) is multi-arch via a registry manifest probe" - "run node --test on the build-targets suite and the full tests/*.test.mjs suite; compare failures against clean main" - "collect CI run/job links for the PR head" status: in-progress ```

bot-tester commented 2026-08-29 01:19:56 +00:00

Member

Copy Link

Copy Source

agent: tester
phase: end
issue: 174
pr: 388
head_branch: feature/174
head_sha: f663fd23eb5b39cfea8dbae1a0f25e5f4857a39d
outcome: pass
verdict: approve
acceptance_criteria:
  - criterion: "amd64 is a build target"
    result: pass
    evidence: "compose.yaml `app` service `build.platforms` includes `linux/amd64` (independently parsed, not via the implementer's test)"
  - criterion: "arm64 is a build target"
    result: pass
    evidence: "compose.yaml `app` service `build.platforms` includes `linux/arm64` (independently parsed, not via the implementer's test)"
independent_evidence:
  - "own script: app.build.platforms = [linux/amd64, linux/arm64]"
  - "Dockerfile: both FROM stages use node:24.19.0-bookworm-slim"
  - "registry manifest probe (registry-1.docker.io): node:24.19.0-bookworm-slim OCI index architectures include amd64 and arm64 → the declared targets are realizable"
  - "build-targets suite: 11 tests → 9 pass / 0 fail / 2 skip (the 2 skips are Docker-gated probes; no Docker daemon here)"
  - "full suite: 105 tests → 86 pass / 12 fail / 7 skip; the 12 failures are environmental (need pnpm + Node 24: frozen-install, node-engine, root-commands, strict-tsconfig, typescript-pin) and identical on clean main (same 5 files → 11 pass / 12 fail), so zero new failures"
  - "clean main (8a01b19) app.build has no `platforms` list → the criteria genuinely fail without the committed state"
ci:
  - name: "Frozen lockfile install"
    run_url: "http://gitea:3000/Fabrika/PersonalBlog/actions/runs/74"
    job_url: "http://gitea:3000/Fabrika/PersonalBlog/actions/runs/74/jobs/86"
    conclusion: success
constraints_respected:
  - "no edits to the implementer's tests in this PR"
out_of_scope_respected:
  - "read-only root filesystem (E00-S02-T06)"
  - "secrets not embedded (E00-S02-T08)"
notes: |
  End-to-end `docker compose build` multi-arch output could not be exercised here
  (no Docker daemon in the sandbox), so the Docker-gated probes skipped cleanly;
  the static build.platforms declaration plus the base image's multi-arch registry
  manifest cover both acceptance criteria.

```yaml agent: tester phase: end issue: 174 pr: 388 head_branch: feature/174 head_sha: f663fd23eb5b39cfea8dbae1a0f25e5f4857a39d outcome: pass verdict: approve acceptance_criteria: - criterion: "amd64 is a build target" result: pass evidence: "compose.yaml `app` service `build.platforms` includes `linux/amd64` (independently parsed, not via the implementer's test)" - criterion: "arm64 is a build target" result: pass evidence: "compose.yaml `app` service `build.platforms` includes `linux/arm64` (independently parsed, not via the implementer's test)" independent_evidence: - "own script: app.build.platforms = [linux/amd64, linux/arm64]" - "Dockerfile: both FROM stages use node:24.19.0-bookworm-slim" - "registry manifest probe (registry-1.docker.io): node:24.19.0-bookworm-slim OCI index architectures include amd64 and arm64 → the declared targets are realizable" - "build-targets suite: 11 tests → 9 pass / 0 fail / 2 skip (the 2 skips are Docker-gated probes; no Docker daemon here)" - "full suite: 105 tests → 86 pass / 12 fail / 7 skip; the 12 failures are environmental (need pnpm + Node 24: frozen-install, node-engine, root-commands, strict-tsconfig, typescript-pin) and identical on clean main (same 5 files → 11 pass / 12 fail), so zero new failures" - "clean main (8a01b19) app.build has no `platforms` list → the criteria genuinely fail without the committed state" ci: - name: "Frozen lockfile install" run_url: "http://gitea:3000/Fabrika/PersonalBlog/actions/runs/74" job_url: "http://gitea:3000/Fabrika/PersonalBlog/actions/runs/74/jobs/86" conclusion: success constraints_respected: - "no edits to the implementer's tests in this PR" out_of_scope_respected: - "read-only root filesystem (E00-S02-T06)" - "secrets not embedded (E00-S02-T08)" notes: | End-to-end `docker compose build` multi-arch output could not be exercised here (no Docker daemon in the sandbox), so the Docker-gated probes skipped cleanly; the static build.platforms declaration plus the base image's multi-arch registry manifest cover both acceptance criteria. ```

kpcto closed this issue 2026-08-29 01:20:10 +00:00

kpcto added

kind

task

status

done

and removed

status

review

labels 2026-08-29 01:20:11 +00:00

Sign in to join this conversation.

No Branch/Tag Specified

Branches Tags

main

No results found.

Labels

Clear labels

agent/analyst-drafted

agent/analyst-drafted

kind

bug

kind

bug

kind

epic

kind

epic

kind

initiative

EPPP programme initiative

kind

story

kind

story

kind

task

EPPP engineering card/task decomposed from a story

kind

toil

kind

toil

loop

1

loop

1

loop

2

loop

2

loop

3

loop

3

needs/human-decision

needs/human-decision

needs/security-review

needs/security-review

risk

agent-full

risk

agent-full

risk

human-gated

risk

human-gated

risk

human-only

risk

human-only

size

l

size

l

size

m

size

m

size

s

size

s

status

blocked

status

blocked

status

done

Workflow: Done

status

in-progress

status

in-progress

status

proposed

status

proposed

status

ready

status

ready

status

review

status

review

stream

checkout

stream

checkout

stream

onboarding

stream

onboarding

stream

platform

stream

platform

tier/t0

trivial — implementer only, auto-merge

tier/t1

standard — implementer + reviewer + tester

tier/t2

complex — security if triggered, human merge

tier/t3

critical — full chain + security, human merge

No labels

kind

task

status

done

Milestone

No items

No Milestone Sprint 0

Projects

Clear projects

No projects

Assignees

Clear assignees

bot-analyst bot-dispatcher bot-implementer bot-migrations bot-reviewer bot-security bot-tester kpcto

No Assignees

6 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: Fabrika/PersonalBlog#174