diff --git a/ops/agents/escalations/issue-triage.md b/ops/agents/escalations/issue-triage.md index 1e83430a..0206f684 100644 --- a/ops/agents/escalations/issue-triage.md +++ b/ops/agents/escalations/issue-triage.md @@ -1,10 +1,9 @@ # Issue Triage Escalations -Date: 2026-07-18 +Date: 2026-07-17 -- No active maintainer decision escalations for issue triage. -- Follow-up check found no new GitHub issues created on 2026-07-04. -- OTA build and public OTA asset verification are still required for the iOS changes, but were not run in this unattended pass because non-GitHub external system mutation is prohibited by the current public write policy. -- Public screenshot capture remains pending; the manifest exists, but actual image capture still needs sanitized app/device state and manual pixel review before any public use. -- Issue #27 requires maintainer review and merge of the prepared public-beta documentation, then repository administration to enable GitHub Pages, set the verified website and description, and enable private vulnerability reporting. -- No pricing, legal, App Store, credential, or public-posting decision is requested. +- Release blocker: GitHub issue #25 is confirmed. Remote Desktop frame capture, input, and signaling do not consistently enforce an approved device and active signed lease at the gateway and native-host boundaries; the iOS control view also bypasses the signed-session setup flow. +- Required intervention: assign and coordinate a cross-stack security fix, and keep OTA, TestFlight, and App Store distribution containing Remote Desktop blocked until the issue's authorization regression coverage passes. +- Issue triage did not attempt a partial fix because the change is security-sensitive and spans iOS, gateway, native RPC, expiry/revocation, and WebRTC/HTTP parity. +- Containment update (2026-07-18): draft security PR #22 disables the native Remote Desktop host and fail-closes the public remote-control routes. If merged, that safely removes the exposed path, but Remote Desktop must remain disabled until #25's paired-device lease enforcement and regression coverage are complete. +- Public beta repository settings (issue #27): review and merge draft PR #17, then enable GitHub Pages from `main`/`docs`, verify the landing, privacy, and support pages, add the verified URL to the repository website field, and enable private vulnerability reporting. Repository administration and pull-request merge are outside this unattended run's authority. diff --git a/ops/agents/triage/2026-07-17-issue-triage.md b/ops/agents/triage/2026-07-17-issue-triage.md new file mode 100644 index 00000000..44e9d2d5 --- /dev/null +++ b/ops/agents/triage/2026-07-17-issue-triage.md @@ -0,0 +1,44 @@ +# CodePilot Issue Triage - 2026-07-17 + +Remote write policy: public GitHub writes require a privacy audit. This pass pushed the focused `agent/issue-triage-remote-desktop-lease-blocker` branch and opened draft PR #26 after the audit passed. + +## Reviewed Issues + +- #25 Enforce paired-device leases on every Remote Desktop path + - Proposed labels: `bug`, `remote-desktop`, `mac`, `ios`, `gateway`, `severity: critical`. + - Current labels already match the proposal; no label change is needed. + - Classification: confirmed security defect and release blocker for OTA, TestFlight, and App Store distribution. +- #2 Support or disable the iOS Same Network setup path + - Current labels already matched the proposal: `setup`, `ios`, `gateway`, `severity: medium`. + - Merged PR #14 already disabled Same Network for the public beta, so the stale resolved issue was closed. +- #3 Require clear Remote Desktop pairing approval in setup + - Current labels already matched the proposal: `setup`, `remote-desktop`, `mac`, `ios`, `severity: high`. + - Merged PR #14 already requires explicit Mac approval, so the stale resolved issue was closed. +- #8 Prepare sanitized public screenshot set + - Current labels already match the proposal: `documentation`, `severity: low`. + - The issue remains open for approved demo-only screenshot capture; no screenshot asset was created or published in this pass. + +## Reproduction and Diagnosis + +- Gateway frame capture calls `frame.capture` without a lease identifier or proof. +- Gateway signaling accepts an arbitrary syntactically valid session ID, queues the signal, and forwards it to the native host. +- The native signaling handler starts a peer connection for the supplied ID without validating it against `SessionLeaseStore`. +- Native input validation only enforces monotonically increasing sequence numbers per caller-supplied session ID; it does not validate a trusted device or active lease. +- The iOS Remote Desktop view generates a random session ID on appearance and immediately starts frame polling, WebRTC signaling, and input. It does not pair or call `startSession` first. +- Existing gateway tests explicitly pass arbitrary session IDs to frame, signaling, clipboard, and input paths and expect success. + +## Verification + +- `python3 -m unittest gateway.test_remote_desktop_gateway.RemoteDesktopGatewayTests`: passed. +- `swift test --filter RemoteDesktop`: passed (20 tests). +- Full gateway test discovery ran 23 tests but reported four import errors because the available Python 3.9 runtime lacks the standard-library `tomllib` module required by the phone gateway. The focused Remote Desktop gateway tests still passed, so this does not affect the confirmed authorization-path diagnosis. + +## Action + +- No code fix was attempted. Correct enforcement spans the iOS session lifecycle, gateway routing, native RPC boundary, lease expiry/revocation, and HTTP/WebRTC parity; a partial patch would be security-sensitive and outside low-risk issue triage. +- Keep Remote Desktop distribution blocked until regression tests prove that unpaired, expired, revoked, replayed, arbitrary, and mismatched sessions fail at both gateway and native boundaries. +- Closed superseded draft PR #15 after confirming its #2 and #3 fixes had already landed through merged PR #14 with passing CI. + +## Blockers + +- A maintainer must assign and coordinate the cross-stack security fix before any OTA, TestFlight, or App Store distribution containing Remote Desktop. diff --git a/ops/agents/triage/2026-07-18-issue-triage.md b/ops/agents/triage/2026-07-18-issue-triage.md index b2acdab1..b9db11e1 100644 --- a/ops/agents/triage/2026-07-18-issue-triage.md +++ b/ops/agents/triage/2026-07-18-issue-triage.md @@ -1,25 +1,41 @@ # CodePilot Issue Triage - 2026-07-18 -Four open GitHub issues were reviewed for the Mac app, iOS app, gateway, release tooling, setup flow, and public documentation. +One new GitHub issue was opened after the earlier 2026-07-18 triage pass. The three open issues and related draft pull requests were reviewed for changes. ## Reviewed Issues -- #28 Fail gateway tests when a worker thread raises - - Proposed labels: `bug`, `gateway`, and `severity: low`. - - Reproduced: the focused unit test exited successfully while its daemon worker raised a `TypeError` because the test double used the old `run_turn` signature. - - Fixed on `agent/issue-28-worker-thread-tests`: the test double accepts the current reasoning-effort argument and the affected test runs its worker synchronously so worker exceptions fail the owning test. - - Verification: the focused regression test and all 90 gateway tests pass without a background exception. - #27 Complete public beta repository settings - - Proposed labels: `documentation` and `severity: high`. - - Still requires maintainer review and merge of the prepared documentation, followed by repository administration for Pages, repository metadata, and private vulnerability reporting. + - Proposed labels are `documentation` and `severity: high`. No `release` component label currently exists; `documentation` is the closest available component label. + - Reproduced the reported configuration gap: the GitHub Pages API returns 404, the repository website field is empty, and private vulnerability reporting is disabled. + - Draft PR #17 contains the prepared `docs/` landing, privacy, support, and security pages and remains open, mergeable, and passing its `Test and Audit` check. + - Completion requires maintainer review and merge of PR #17 followed by repository-setting changes. This unattended run is not authorized to merge pull requests or change repository settings. - #25 Enforce paired-device leases on every Remote Desktop path - - Proposed labels: `bug`, `remote-desktop`, `mac`, `ios`, `gateway`, and `severity: critical`; current labels match. - - Remains a cross-stack security and distribution blocker. Keep Remote Desktop disabled until the signed-lease requirements and authorization regression coverage pass. + - Proposed labels remain `bug`, `remote-desktop`, `mac`, `ios`, `gateway`, and `severity: critical`; the current labels match. + - The critical authorization defect remains open and release-blocking. `origin/main` has not changed since the confirmed 2026-07-17 reproduction. + - Draft security PR #22 now contains fail-closed containment: it disables the native Remote Desktop host and makes public remote-control routes unavailable. This removes the exposed path if merged, but it does not implement the paired-device lease behavior or regression coverage required to resolve #25. + - PR #22 is open, mergeable, and passing its `Test and Audit` check. + - Draft PR #26 remains open, mergeable, and passing its `Test and Audit` check. - #8 Prepare sanitized public screenshot set - - Proposed labels: `documentation` and `severity: low`; current labels match. - - The approved demo-only screenshot task remains open. No screenshot assets were created or published in this pass. + - Proposed labels remain `documentation` and `severity: low`; the current labels match. + - The approved demo-only capture task remains open. No screenshot assets were added or published in this pass. + +## Action + +- No issue labels were changed. Added a concise #25 comment linking the containment in PR #22 while keeping the lease-enforcement blocker explicit. +- Recorded #27's verified configuration state and maintainer-only completion steps in the issue-triage escalation. +- No code change was attempted. Issue #25 requires a coordinated cross-stack security fix, and issue #8 requires full-resolution visual inspection of newly captured demo assets. +- After the privacy audit passed, the triage branch was updated and the containment note was added to #25. ## Blockers -- #25 requires a coordinated security fix across iOS, gateway, native RPC, expiry and revocation, and WebRTC/HTTP paths. -- #27 requires maintainer approval and repository administration that this unattended run is not authorized to perform. +- The existing #25 escalation remains active. PR #22 provides safe fail-closed containment if merged, but keep Remote Desktop disabled and distribution blocked until the required authorization regression coverage passes. +- Issue #27 requires maintainer approval and repository administration: review and merge PR #17, enable Pages from `main`/`docs`, verify the site, set the repository website URL, enable private vulnerability reporting, and then update security-reporting links. + +## Follow-up Pass + +- No new GitHub issues or issue updates appeared after the preceding pass. The open queue remains #27, #25, and #8. +- The proposed labels and existing blocker assessments remain unchanged. +- `origin/main` remains unchanged. GitHub Pages still returns 404, the repository website field remains empty, and private vulnerability reporting remains disabled. +- Draft PR #17 received public-metadata and documentation updates, and draft PR #22 received agent-write audit hardening. Neither update changes the #27 maintainer steps or resolves #25's paired-device lease requirements. +- Draft PRs #17, #22, and #26 remain open, mergeable, and passing `Test and Audit` on their latest commits. +- No additional issue comment, branch, or code fix was needed. The existing escalation covers the two maintainer actions that remain necessary.