SP00-T46 rulings — Scylla's init container makes the pod Guaranteed; libretranslate rolls one pod at a time
SP00-T49 rulings — the worldgen agent's unit is installed before its env file; NATS violation checks grep what the server logs
Task 49 Step 3 now deploys universe-earthdata's unit on k3m1 (the live one points at 127.0.0.1 and reads no env file), logs in as kamo@k3m1, and carries its own...
Own NATS login
kamo-internal's three NATS connections (org changes, worldgen, world live) present svc_kamo_internal from the nats-user-kamo-internal Secret instead of the shar...
SP00-T44 fix round 1 — the OTA step reads memory only through a value-keyed redactor, and never under set -x
Phase A printed the node password twice, reading two memories the step cites. Step 3 now sources a preamble that holds commands only, reads memory through memre...
SP00-T21 ship ruling — the KB backlog catch-up is blocked by the embedding model's sizing; parked
A socket's one-time key is not a sign-in hand-off
Since 46191c47 every browser WebSocket authenticates with ?otk=<key>. The EmailService sockets connect through the same-origin /email-ws rewrite, so they pass t...
SP00-T31 ruling — the eleven MLOS repos roll back without restoring the unbuildable 1.6.0 pin
New mail shows on /messages as soon as the badge counts it
The badge and the list hear the same socket, and EmailService relays every arrival (verified on NATS: email.changed ARRIVED from both pods, then the unread snap...
SP00-T23 plan text — the event gate sits behind EventRequest.invitesByEmail(); tests beside the brief's
SP00-T45 ruling — the rollback deletes the Qdrant NetworkPolicy; the network check needs curl's 000
SP00-T23 ruling — a calendar save needs a seat only when it invites by email; SP07/SP08 keep the seat gate
SP00 plan — log checks read every line (kubectl logs -l prints only the last 10)
Task 29's daemon and compute checks and Task 45's RAG check now pass --tail=-1. With a label selector, kubectl logs defaults to the last 10 lines, so the daemon...
SP00-T42 ruling — the help-center import Usage block reads the Redis login
The Redis login
The pod logs in to Redis as the platform ACL user (Secret redis-auth: REDIS_USERNAME, REDIS_PASSWORD), which app/lib/redis.ts already reads, so sign-in keeps wo...
SP00-T21 ruling — gRPC at compile scope, wiring tests beside the brief's, replay trade-off recorded
SP00-T22 ruling — precondition counts configured instances; unscoped RC overloads removed; null-safe TURN member
SP00-T27 ruling — anchored key pattern with its own test; platform-only catalog comment
SP00 task 19 ruling — session fixtures carry userID, two admin-read tests beside the brief's
SP00 task 26 ruling — manifest secret pins, a startup flag for AIService's secret, python -m pytest
SP00 task 25 ruling — the sidecar image copies hostEligibility.js; mayHost; a 5 s fail-open bound; wiring tests
SP00-T14 ruling — a session-less kill-switch read is the interceptor's 403
SP00-T18 ruling — a socket turn runs in a persistence context, and a revoked tab stops receiving answers
The chat picker lists only the models the member may pick
The picker read the administrator's model list (403 without MANAGE_AI_MODELS) and offered providers, which never selected a model. It now reads GET /api/ai/mode...
SP00-T14 ruling — shared-lib pin restored to one version (1.6.1) before the securityservice push
SP00-T17 ruling — the ownership rule and both pin call sites get their own tests
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.