From 8c9e81d24282d86c6b60faa09a8f68c2ec4c1f96 Mon Sep 17 00:00:00 2001 From: Garry Tan Date: Mon, 17 Aug 2026 10:56:23 -0700 Subject: [PATCH] =?UTF-8?q?chore:=20TODOS.md=20=E2=80=94=20strike=20the=20?= =?UTF-8?q?six=20wave-fixed=20residuals,=20add=20two=20follow-ups?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The v1.67 adversarial-review residuals section shrinks to the one item the wave couldn't reach (iOS tap routing — needs real-device verification). New entries: skillify structural isolation (a prose warning is not a boundary for page-derived generated code) and the slug store migration (pre-fix sessions on stray-marker machines filed data under the degraded slug; post-fix reads go to the correct store, so history needs a merge/alias). Co-Authored-By: Claude Fable 5 --- TODOS.md | 61 +++++++++++++++++++++++++++++++++----------------------- 1 file changed, 36 insertions(+), 25 deletions(-) diff --git a/TODOS.md b/TODOS.md index 38f69c9de..cd5404754 100644 --- a/TODOS.md +++ b/TODOS.md @@ -47,37 +47,17 @@ wave"). Each was explicitly deferred with rationale, not dropped: ### P2: v1.67 adversarial-review residuals (verified, deferred with rationale) -Filed at v1.67 ship time from the Codex + Claude adversarial passes. Each was -verified real but needs design input or device access the wave lacked: +Filed at v1.67 ship time from the Codex + Claude adversarial passes. Six of +the seven landed in the v1.68 fix wave (brain-sync spool-dir queue, pair-agent +consent gate, bin-context walk-up parity, per-project MCP scoping + +precedence flip, next-version ls-remote fallback + width pin, stop-hook +global-path registration + re-point). Remaining: -- **brain-sync enqueue lock** — the drain's surgical rewrite closes the reader - side, but a lockless producer appending between the live re-read and the - tmp+mv can still orphan one record. Needs a shared enqueue/drain lock - (mkdir-style, like the drain's). Effort S. - **iOS tap routing across windows** — Bridges template's frontmostWindow can swallow taps when a keyboard/menu/transparent overlay window is topmost but doesn't handle the coordinate. Needs hit-test-aware routing + real-device verification. Effort M. (Related: the multi-window rewrite has no static pins — see the test-gap backlog below.) -- **pair-agent implicit --force-restart** — pair-agent auto-kills a healthy - headless daemon (tabs/cookies) with no consent, contradicting the #2219 - iron rule it now sits beside. Needs a consent prompt or explicit-flag - requirement; UX call. Effort S. -- **bin-context slugFromEnvironment walk-up parity (win32)** — the native - fallback slugs the INNERMOST repo while bash gstack-slug walks to the - outermost canonical remote; nested/vendored repos split stores. Effort S. -- **hasRemoteOnlyGbrainMcp is machine-global** — one project's remote gbrain - registration reclassifies broken local engines as thin-client everywhere; - also confirm Claude Code's user-vs-project MCP precedence against - brain-cache's user-first assumption. Effort S. -- **next-version git-fallback breadth** — the degraded path counts every - remote-tracking ref on every remote (stale experiment branches inflate the - allocation) and a failed 3-digit base read flips width to 4. Warned today; - tighten to origin + width-pin. Effort S. -- **Stop-hook registration pins the setup-time absolute path** — registering - from a dev worktree bakes that path into settings.json; deleting the - worktree leaves a dead hook erroring on every session stop until removed. - Register the global-install path or re-point on upgrade. Effort S. - **Accepted threat-model notes (documented, no action planned):** redact-prepush treats content pushed to ANY private remote as already-left (accident-only threat model); a parcel-shaped twin within 400 chars can @@ -85,6 +65,37 @@ verified real but needs design input or device access the wave lacked: codex-probe's 400-signature grep can misread a transient proxy 400 as MODEL_UNUSABLE (bounded by the 15-min negative-cache TTL). +### P2: skillify structural isolation (filed from the v1.68 wave reviews) + +**What:** /skillify turns scraped page content into durable executable skill +code on disk. The v1.68 wave added the untrusted-content warning to its prose +(#2441), but a warning is not a boundary — generated actions derived from +hostile page content need structural isolation, sanitization of synthesized +selectors/names, or an explicit approval step scoped to the generated code. + +**Why:** A poisoned page could steer the generated script.ts toward actions +the user never reviewed; the current gate is the Step 9 approval, which shows +the code but doesn't highlight page-derived strings. + +**Effort:** M → S with CC. **Priority:** P2. **Depends on:** none. + +### P2: slug store migration — merge pre-fix `projects/garrytan/` data (v1.68 follow-up) + +**What:** The v1.68 slug-parity fix (gstack-slug now matches remote-slug's +owner-repo form) means machines that hit the degraded-slug bug (stray strong +marker above a repo, e.g. an empty ~/.git) have historical decisions / +timeline / ceo-plans / learnings filed under the marker-basename store +(observed: `~/.gstack/projects/garrytan/`) instead of per-repo stores. Define +and ship the merge/alias: attribute each misfiled record to its repo where +derivable (timeline entries carry branch; decisions carry scope), else leave +in place with a pointer file. + +**Why:** Post-fix sessions read the CORRECT store, so pre-fix history is +invisible to Context Recovery until migrated. + +**Effort:** M → S with CC. **Priority:** P2. **Depends on:** the v1.68 wave +(shipped the fix + parity tests). + ### P2: v1.67 coverage-audit test-gap backlog (5-agent sweep, ranked) The wave's Step-7 coverage audit (5 subsystem agents, ~700 changed paths,