Sweep Sprint. Plan, Oath SG1-SG7, work order, decision list: docs/sprints/audio-upload-followups-2026-10.md (commit 24d65b2). Phase 1 (read-only research) is done; phase 2 has not started and waits for the owner's go.
Headline:#48. POST /account/delete has no CSRF/origin check; a sibling *.d-ma.be origin can forge it (reproduced in a scratch test). #49: a 900-stream file costs about 570 MB against the 512 Mi pod limit.
DECISION NEEDED (owner): D1-D10 in the plan doc, each with a recommendation. The ones that block v0.31.1: D1 (#41) and D2 (#50). Both recommend the lighter option.
Not in this sprint: infra#523 (other keys' drift), infra#524 (phantom whisper spend).
Sweep Sprint. Plan, Oath SG1-SG7, work order, decision list: `docs/sprints/audio-upload-followups-2026-10.md` (commit 24d65b2). Phase 1 (read-only research) is done; **phase 2 has not started and waits for the owner's go.**
**v0.31.1 (milestone 10), in order:** #41 lint gate, #48 cross-origin POST (P0), #49 ffprobe/ffmpeg limits (P0), #47 concurrent-upload cap, #50 SIGTERM interim.
**v0.32.0 (milestone 11):** #52, #53, #51, #37, #36, #38, #46 (remainder), #45 (question).
**Headline:** #48. `POST /account/delete` has no CSRF/origin check; a sibling `*.d-ma.be` origin can forge it (reproduced in a scratch test). #49: a 900-stream file costs about 570 MB against the 512 Mi pod limit.
**DECISION NEEDED (owner):** D1-D10 in the plan doc, each with a recommendation. The ones that block v0.31.1: D1 (#41) and D2 (#50). Both recommend the lighter option.
Not in this sprint: infra#523 (other keys' drift), infra#524 (phantom whisper spend).
---
_Created via git-mcp on behalf of @mathias_
mathias
added this to the v0.31.1 - security and robustness milestone 2026-10-03 18:50:39 +00:00
Shipped and deployed: v0.31.1 (PR #55, e037c6b: #41, #47, #48, #49, #50) and v0.32.0 (PR #58, 85f4cc3: #37, #51, #52, #53). Plan and status: docs/sprints/audio-upload-followups-2026-10.md.
Adversarial reviews (agent, by execution, verdicts on the PRs): v0.31.1 BLOCK then APPROVE; v0.32.0 BLOCK, BLOCK, APPROVE, APPROVE. Every BLOCK was a real defect fixed test-first: a shutdown racing a commit that could mark a finished upload failed, untested production defaults (twice), vacuous tests, a false data-egress statement on all-local reconciled transcripts, and a cloud engine judged local (twice).
Closed with evidence: #41, #47, #48, #49 (live 403s on production), #50 (old pod Completed, observed), #51, #53 (tests + review; no live trigger exists).
Open, waiting on an authenticated look (not a decision):#37 (Recordings link, delete control) and #52 (cloud-served note): checklists in their comments.
Open, the owner's call (milestone 11):#36, #38, #45, #46 remainder; decisions D4-D6, D8-D10 in the plan are unchanged. Filed from the reviews: #56 (slow-drip bodies hold a receive slot), #57 (shutdown logging, second signal), #59 (start-up exits on an OIDC discovery 503).
Oath: SG1 holds for what shipped; the sprint is NOT closed because #37 and #52 lack a live observation and the owner-held items remain, so the Sweep Sprint closing ritual is not complete.
**Sweep Sprint status, 2026-10-04.**
Shipped and deployed: **v0.31.1** (PR #55, e037c6b: #41, #47, #48, #49, #50) and **v0.32.0** (PR #58, 85f4cc3: #37, #51, #52, #53). Plan and status: `docs/sprints/audio-upload-followups-2026-10.md`.
Adversarial reviews (agent, by execution, verdicts on the PRs): v0.31.1 BLOCK then APPROVE; v0.32.0 BLOCK, BLOCK, APPROVE, APPROVE. Every BLOCK was a real defect fixed test-first: a shutdown racing a commit that could mark a finished upload failed, untested production defaults (twice), vacuous tests, a false data-egress statement on all-local reconciled transcripts, and a cloud engine judged local (twice).
Closed with evidence: #41, #47, #48, #49 (live 403s on production), #50 (old pod `Completed`, observed), #51, #53 (tests + review; no live trigger exists).
**Open, waiting on an authenticated look (not a decision):** #37 (Recordings link, delete control) and #52 (cloud-served note): checklists in their comments.
**Open, the owner's call (milestone 11):** #36, #38, #45, #46 remainder; decisions D4-D6, D8-D10 in the plan are unchanged. Filed from the reviews: #56 (slow-drip bodies hold a receive slot), #57 (shutdown logging, second signal), #59 (start-up exits on an OIDC discovery 503).
Oath: SG1 holds for what shipped; the sprint is NOT closed because #37 and #52 lack a live observation and the owner-held items remain, so the Sweep Sprint closing ritual is not complete.
---
_Created via git-mcp on behalf of @mathias_
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Sweep Sprint. Plan, Oath SG1-SG7, work order, decision list:
docs/sprints/audio-upload-followups-2026-10.md(commit24d65b2). Phase 1 (read-only research) is done; phase 2 has not started and waits for the owner's go.v0.31.1 (milestone 10), in order: #41 lint gate, #48 cross-origin POST (P0), #49 ffprobe/ffmpeg limits (P0), #47 concurrent-upload cap, #50 SIGTERM interim.
v0.32.0 (milestone 11): #52, #53, #51, #37, #36, #38, #46 (remainder), #45 (question).
Headline: #48.
POST /account/deletehas no CSRF/origin check; a sibling*.d-ma.beorigin can forge it (reproduced in a scratch test). #49: a 900-stream file costs about 570 MB against the 512 Mi pod limit.DECISION NEEDED (owner): D1-D10 in the plan doc, each with a recommendation. The ones that block v0.31.1: D1 (#41) and D2 (#50). Both recommend the lighter option.
Not in this sprint: infra#523 (other keys' drift), infra#524 (phantom whisper spend).
Created via git-mcp on behalf of @mathias
Sweep Sprint status, 2026-10-04.
Shipped and deployed: v0.31.1 (PR #55,
e037c6b: #41, #47, #48, #49, #50) and v0.32.0 (PR #58,85f4cc3: #37, #51, #52, #53). Plan and status:docs/sprints/audio-upload-followups-2026-10.md.Adversarial reviews (agent, by execution, verdicts on the PRs): v0.31.1 BLOCK then APPROVE; v0.32.0 BLOCK, BLOCK, APPROVE, APPROVE. Every BLOCK was a real defect fixed test-first: a shutdown racing a commit that could mark a finished upload failed, untested production defaults (twice), vacuous tests, a false data-egress statement on all-local reconciled transcripts, and a cloud engine judged local (twice).
Closed with evidence: #41, #47, #48, #49 (live 403s on production), #50 (old pod
Completed, observed), #51, #53 (tests + review; no live trigger exists).Open, waiting on an authenticated look (not a decision): #37 (Recordings link, delete control) and #52 (cloud-served note): checklists in their comments.
Open, the owner's call (milestone 11): #36, #38, #45, #46 remainder; decisions D4-D6, D8-D10 in the plan are unchanged. Filed from the reviews: #56 (slow-drip bodies hold a receive slot), #57 (shutdown logging, second signal), #59 (start-up exits on an OIDC discovery 503).
Oath: SG1 holds for what shipped; the sprint is NOT closed because #37 and #52 lack a live observation and the owner-held items remain, so the Sweep Sprint closing ritual is not complete.
Created via git-mcp on behalf of @mathias