From 1ac5bbba06b469e3f7597ae1a148eb877dc26fc0 Mon Sep 17 00:00:00 2001 From: CodePilot Date: Fri, 17 Jul 2026 08:59:07 +0200 Subject: [PATCH 1/8] docs: triage remote desktop lease blocker --- ops/agents/escalations/issue-triage.md | 11 +++---- ops/agents/triage/2026-07-17-issue-triage.md | 34 ++++++++++++++++++++ 2 files changed, 38 insertions(+), 7 deletions(-) create mode 100644 ops/agents/triage/2026-07-17-issue-triage.md diff --git a/ops/agents/escalations/issue-triage.md b/ops/agents/escalations/issue-triage.md index 1e83430a..3889c0fd 100644 --- a/ops/agents/escalations/issue-triage.md +++ b/ops/agents/escalations/issue-triage.md @@ -1,10 +1,7 @@ # Issue Triage Escalations -Date: 2026-07-18 +Date: 2026-07-17 -- No active maintainer decision escalations for issue triage. -- Follow-up check found no new GitHub issues created on 2026-07-04. -- OTA build and public OTA asset verification are still required for the iOS changes, but were not run in this unattended pass because non-GitHub external system mutation is prohibited by the current public write policy. -- Public screenshot capture remains pending; the manifest exists, but actual image capture still needs sanitized app/device state and manual pixel review before any public use. -- Issue #27 requires maintainer review and merge of the prepared public-beta documentation, then repository administration to enable GitHub Pages, set the verified website and description, and enable private vulnerability reporting. -- No pricing, legal, App Store, credential, or public-posting decision is requested. +- Release blocker: GitHub issue #25 is confirmed. Remote Desktop frame capture, input, and signaling do not consistently enforce an approved device and active signed lease at the gateway and native-host boundaries; the iOS control view also bypasses the signed-session setup flow. +- Required intervention: assign and coordinate a cross-stack security fix, and keep OTA, TestFlight, and App Store distribution containing Remote Desktop blocked until the issue's authorization regression coverage passes. +- Issue triage did not attempt a partial fix because the change is security-sensitive and spans iOS, gateway, native RPC, expiry/revocation, and WebRTC/HTTP parity. diff --git a/ops/agents/triage/2026-07-17-issue-triage.md b/ops/agents/triage/2026-07-17-issue-triage.md new file mode 100644 index 00000000..76fb0d29 --- /dev/null +++ b/ops/agents/triage/2026-07-17-issue-triage.md @@ -0,0 +1,34 @@ +# CodePilot Issue Triage - 2026-07-17 + +Remote write policy: public GitHub writes are limited to new issues and draft pull requests after a privacy audit. This pass did not make a public write. + +## Reviewed Issues + +- #25 Enforce paired-device leases on every Remote Desktop path + - Proposed labels: `bug`, `remote-desktop`, `mac`, `ios`, `gateway`, `severity: critical`. + - Current labels already match the proposal; no label change is needed. + - Classification: confirmed security defect and release blocker for OTA, TestFlight, and App Store distribution. + +## Reproduction and Diagnosis + +- Gateway frame capture calls `frame.capture` without a lease identifier or proof. +- Gateway signaling accepts an arbitrary syntactically valid session ID, queues the signal, and forwards it to the native host. +- The native signaling handler starts a peer connection for the supplied ID without validating it against `SessionLeaseStore`. +- Native input validation only enforces monotonically increasing sequence numbers per caller-supplied session ID; it does not validate a trusted device or active lease. +- The iOS Remote Desktop view generates a random session ID on appearance and immediately starts frame polling, WebRTC signaling, and input. It does not pair or call `startSession` first. +- Existing gateway tests explicitly pass arbitrary session IDs to frame, signaling, clipboard, and input paths and expect success. + +## Verification + +- `python3 -m unittest gateway.test_remote_desktop_gateway.RemoteDesktopGatewayTests`: passed. +- `swift test --filter RemoteDesktop`: passed (20 tests). +- Full `gateway.test_remote_desktop_gateway` execution was blocked by the local Python 3.9 runtime lacking the standard-library `tomllib` module required by the phone gateway. This does not affect the confirmed authorization-path diagnosis. + +## Action + +- No code fix was attempted. Correct enforcement spans the iOS session lifecycle, gateway routing, native RPC boundary, lease expiry/revocation, and HTTP/WebRTC parity; a partial patch would be security-sensitive and outside low-risk issue triage. +- Keep Remote Desktop distribution blocked until regression tests prove that unpaired, expired, revoked, replayed, arbitrary, and mismatched sessions fail at both gateway and native boundaries. + +## Blockers + +- A maintainer must assign and coordinate the cross-stack security fix before any OTA, TestFlight, or App Store distribution containing Remote Desktop. From fc887c65286864fe1b6ee0d1c18a65e7cae8213f Mon Sep 17 00:00:00 2001 From: CodePilot Date: Fri, 17 Jul 2026 09:51:09 +0200 Subject: [PATCH 2/8] docs: record issue triage draft PR --- ops/agents/triage/2026-07-17-issue-triage.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ops/agents/triage/2026-07-17-issue-triage.md b/ops/agents/triage/2026-07-17-issue-triage.md index 76fb0d29..bdf1e077 100644 --- a/ops/agents/triage/2026-07-17-issue-triage.md +++ b/ops/agents/triage/2026-07-17-issue-triage.md @@ -1,6 +1,6 @@ # CodePilot Issue Triage - 2026-07-17 -Remote write policy: public GitHub writes are limited to new issues and draft pull requests after a privacy audit. This pass did not make a public write. +Remote write policy: public GitHub writes require a privacy audit. This pass pushed the focused `agent/issue-triage-remote-desktop-lease-blocker` branch and opened draft PR #26 after the audit passed. ## Reviewed Issues From 86b5edc9b7ee017ef7e61a2efcdaddaa15a84c70 Mon Sep 17 00:00:00 2001 From: CodePilot Date: Fri, 17 Jul 2026 14:51:16 +0200 Subject: [PATCH 3/8] docs: clarify gateway verification result --- ops/agents/triage/2026-07-17-issue-triage.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ops/agents/triage/2026-07-17-issue-triage.md b/ops/agents/triage/2026-07-17-issue-triage.md index bdf1e077..8d348f08 100644 --- a/ops/agents/triage/2026-07-17-issue-triage.md +++ b/ops/agents/triage/2026-07-17-issue-triage.md @@ -22,7 +22,7 @@ Remote write policy: public GitHub writes require a privacy audit. This pass pus - `python3 -m unittest gateway.test_remote_desktop_gateway.RemoteDesktopGatewayTests`: passed. - `swift test --filter RemoteDesktop`: passed (20 tests). -- Full `gateway.test_remote_desktop_gateway` execution was blocked by the local Python 3.9 runtime lacking the standard-library `tomllib` module required by the phone gateway. This does not affect the confirmed authorization-path diagnosis. +- Full gateway test discovery ran 23 tests but reported four import errors because the available Python 3.9 runtime lacks the standard-library `tomllib` module required by the phone gateway. The focused Remote Desktop gateway tests still passed, so this does not affect the confirmed authorization-path diagnosis. ## Action From ce3855142fefe93fea9a03dff9775ab7c3b12b95 Mon Sep 17 00:00:00 2001 From: CodePilot Date: Fri, 17 Jul 2026 16:42:29 +0200 Subject: [PATCH 4/8] docs: record resolved issue cleanup --- ops/agents/triage/2026-07-17-issue-triage.md | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/ops/agents/triage/2026-07-17-issue-triage.md b/ops/agents/triage/2026-07-17-issue-triage.md index 8d348f08..44e9d2d5 100644 --- a/ops/agents/triage/2026-07-17-issue-triage.md +++ b/ops/agents/triage/2026-07-17-issue-triage.md @@ -8,6 +8,15 @@ Remote write policy: public GitHub writes require a privacy audit. This pass pus - Proposed labels: `bug`, `remote-desktop`, `mac`, `ios`, `gateway`, `severity: critical`. - Current labels already match the proposal; no label change is needed. - Classification: confirmed security defect and release blocker for OTA, TestFlight, and App Store distribution. +- #2 Support or disable the iOS Same Network setup path + - Current labels already matched the proposal: `setup`, `ios`, `gateway`, `severity: medium`. + - Merged PR #14 already disabled Same Network for the public beta, so the stale resolved issue was closed. +- #3 Require clear Remote Desktop pairing approval in setup + - Current labels already matched the proposal: `setup`, `remote-desktop`, `mac`, `ios`, `severity: high`. + - Merged PR #14 already requires explicit Mac approval, so the stale resolved issue was closed. +- #8 Prepare sanitized public screenshot set + - Current labels already match the proposal: `documentation`, `severity: low`. + - The issue remains open for approved demo-only screenshot capture; no screenshot asset was created or published in this pass. ## Reproduction and Diagnosis @@ -28,6 +37,7 @@ Remote write policy: public GitHub writes require a privacy audit. This pass pus - No code fix was attempted. Correct enforcement spans the iOS session lifecycle, gateway routing, native RPC boundary, lease expiry/revocation, and HTTP/WebRTC parity; a partial patch would be security-sensitive and outside low-risk issue triage. - Keep Remote Desktop distribution blocked until regression tests prove that unpaired, expired, revoked, replayed, arbitrary, and mismatched sessions fail at both gateway and native boundaries. +- Closed superseded draft PR #15 after confirming its #2 and #3 fixes had already landed through merged PR #14 with passing CI. ## Blockers From 17fcb29ccb9c839a084628bbb07fe9672a602fe1 Mon Sep 17 00:00:00 2001 From: CodePilot Date: Sat, 18 Jul 2026 00:32:06 +0200 Subject: [PATCH 5/8] docs: record 2026-07-18 issue triage --- ops/agents/escalations/issue-triage.md | 1 + ops/agents/triage/2026-07-18-issue-triage.md | 30 ++++++++++---------- 2 files changed, 16 insertions(+), 15 deletions(-) diff --git a/ops/agents/escalations/issue-triage.md b/ops/agents/escalations/issue-triage.md index 3889c0fd..6d2231a9 100644 --- a/ops/agents/escalations/issue-triage.md +++ b/ops/agents/escalations/issue-triage.md @@ -5,3 +5,4 @@ Date: 2026-07-17 - Release blocker: GitHub issue #25 is confirmed. Remote Desktop frame capture, input, and signaling do not consistently enforce an approved device and active signed lease at the gateway and native-host boundaries; the iOS control view also bypasses the signed-session setup flow. - Required intervention: assign and coordinate a cross-stack security fix, and keep OTA, TestFlight, and App Store distribution containing Remote Desktop blocked until the issue's authorization regression coverage passes. - Issue triage did not attempt a partial fix because the change is security-sensitive and spans iOS, gateway, native RPC, expiry/revocation, and WebRTC/HTTP parity. +- Containment update (2026-07-18): draft security PR #22 disables the native Remote Desktop host and fail-closes the public remote-control routes. If merged, that safely removes the exposed path, but Remote Desktop must remain disabled until #25's paired-device lease enforcement and regression coverage are complete. diff --git a/ops/agents/triage/2026-07-18-issue-triage.md b/ops/agents/triage/2026-07-18-issue-triage.md index b2acdab1..35019e83 100644 --- a/ops/agents/triage/2026-07-18-issue-triage.md +++ b/ops/agents/triage/2026-07-18-issue-triage.md @@ -1,25 +1,25 @@ # CodePilot Issue Triage - 2026-07-18 -Four open GitHub issues were reviewed for the Mac app, iOS app, gateway, release tooling, setup flow, and public documentation. +No new GitHub issues were opened after the 2026-07-17 triage pass. The two open issues and the existing draft triage PR were reviewed for changes. ## Reviewed Issues -- #28 Fail gateway tests when a worker thread raises - - Proposed labels: `bug`, `gateway`, and `severity: low`. - - Reproduced: the focused unit test exited successfully while its daemon worker raised a `TypeError` because the test double used the old `run_turn` signature. - - Fixed on `agent/issue-28-worker-thread-tests`: the test double accepts the current reasoning-effort argument and the affected test runs its worker synchronously so worker exceptions fail the owning test. - - Verification: the focused regression test and all 90 gateway tests pass without a background exception. -- #27 Complete public beta repository settings - - Proposed labels: `documentation` and `severity: high`. - - Still requires maintainer review and merge of the prepared documentation, followed by repository administration for Pages, repository metadata, and private vulnerability reporting. - #25 Enforce paired-device leases on every Remote Desktop path - - Proposed labels: `bug`, `remote-desktop`, `mac`, `ios`, `gateway`, and `severity: critical`; current labels match. - - Remains a cross-stack security and distribution blocker. Keep Remote Desktop disabled until the signed-lease requirements and authorization regression coverage pass. + - Proposed labels remain `bug`, `remote-desktop`, `mac`, `ios`, `gateway`, and `severity: critical`; the current labels match. + - The critical authorization defect remains open and release-blocking. `origin/main` has not changed since the confirmed 2026-07-17 reproduction. + - Draft security PR #22 now contains fail-closed containment: it disables the native Remote Desktop host and makes public remote-control routes unavailable. This removes the exposed path if merged, but it does not implement the paired-device lease behavior or regression coverage required to resolve #25. + - PR #22 is open, mergeable, and passing its `Test and Audit` check. + - Draft PR #26 remains open, mergeable, and passing its `Test and Audit` check. - #8 Prepare sanitized public screenshot set - - Proposed labels: `documentation` and `severity: low`; current labels match. - - The approved demo-only screenshot task remains open. No screenshot assets were created or published in this pass. + - Proposed labels remain `documentation` and `severity: low`; the current labels match. + - The approved demo-only capture task remains open. No screenshot assets were added or published in this pass. + +## Action + +- No issue labels needed updating. Added a concise #25 comment linking the containment in PR #22 while keeping the lease-enforcement blocker explicit. +- No code change was attempted. Issue #25 requires a coordinated cross-stack security fix, and issue #8 requires full-resolution visual inspection of newly captured demo assets. +- After the privacy audit passed, the triage branch was updated and the containment note was added to #25. ## Blockers -- #25 requires a coordinated security fix across iOS, gateway, native RPC, expiry and revocation, and WebRTC/HTTP paths. -- #27 requires maintainer approval and repository administration that this unattended run is not authorized to perform. +- The existing #25 escalation remains active. PR #22 provides safe fail-closed containment if merged, but keep Remote Desktop disabled and distribution blocked until the required authorization regression coverage passes. From 1dbca40e3e7c608f02f5e777d8b05be45ef41a46 Mon Sep 17 00:00:00 2001 From: CodePilot Date: Sat, 18 Jul 2026 07:05:28 +0200 Subject: [PATCH 6/8] docs: triage public repository settings --- ops/agents/escalations/issue-triage.md | 1 + ops/agents/triage/2026-07-18-issue-triage.md | 11 +++++++++-- 2 files changed, 10 insertions(+), 2 deletions(-) diff --git a/ops/agents/escalations/issue-triage.md b/ops/agents/escalations/issue-triage.md index 6d2231a9..0206f684 100644 --- a/ops/agents/escalations/issue-triage.md +++ b/ops/agents/escalations/issue-triage.md @@ -6,3 +6,4 @@ Date: 2026-07-17 - Required intervention: assign and coordinate a cross-stack security fix, and keep OTA, TestFlight, and App Store distribution containing Remote Desktop blocked until the issue's authorization regression coverage passes. - Issue triage did not attempt a partial fix because the change is security-sensitive and spans iOS, gateway, native RPC, expiry/revocation, and WebRTC/HTTP parity. - Containment update (2026-07-18): draft security PR #22 disables the native Remote Desktop host and fail-closes the public remote-control routes. If merged, that safely removes the exposed path, but Remote Desktop must remain disabled until #25's paired-device lease enforcement and regression coverage are complete. +- Public beta repository settings (issue #27): review and merge draft PR #17, then enable GitHub Pages from `main`/`docs`, verify the landing, privacy, and support pages, add the verified URL to the repository website field, and enable private vulnerability reporting. Repository administration and pull-request merge are outside this unattended run's authority. diff --git a/ops/agents/triage/2026-07-18-issue-triage.md b/ops/agents/triage/2026-07-18-issue-triage.md index 35019e83..f437ba1a 100644 --- a/ops/agents/triage/2026-07-18-issue-triage.md +++ b/ops/agents/triage/2026-07-18-issue-triage.md @@ -1,9 +1,14 @@ # CodePilot Issue Triage - 2026-07-18 -No new GitHub issues were opened after the 2026-07-17 triage pass. The two open issues and the existing draft triage PR were reviewed for changes. +One new GitHub issue was opened after the earlier 2026-07-18 triage pass. The three open issues and related draft pull requests were reviewed for changes. ## Reviewed Issues +- #27 Complete public beta repository settings + - Proposed labels are `documentation` and `severity: high`. No `release` component label currently exists; `documentation` is the closest available component label. + - Reproduced the reported configuration gap: the GitHub Pages API returns 404, the repository website field is empty, and private vulnerability reporting is disabled. + - Draft PR #17 contains the prepared `docs/` landing, privacy, support, and security pages and remains open, mergeable, and passing its `Test and Audit` check. + - Completion requires maintainer review and merge of PR #17 followed by repository-setting changes. This unattended run is not authorized to merge pull requests or change repository settings. - #25 Enforce paired-device leases on every Remote Desktop path - Proposed labels remain `bug`, `remote-desktop`, `mac`, `ios`, `gateway`, and `severity: critical`; the current labels match. - The critical authorization defect remains open and release-blocking. `origin/main` has not changed since the confirmed 2026-07-17 reproduction. @@ -16,10 +21,12 @@ No new GitHub issues were opened after the 2026-07-17 triage pass. The two open ## Action -- No issue labels needed updating. Added a concise #25 comment linking the containment in PR #22 while keeping the lease-enforcement blocker explicit. +- No issue labels were changed. Added a concise #25 comment linking the containment in PR #22 while keeping the lease-enforcement blocker explicit. +- Recorded #27's verified configuration state and maintainer-only completion steps in the issue-triage escalation. - No code change was attempted. Issue #25 requires a coordinated cross-stack security fix, and issue #8 requires full-resolution visual inspection of newly captured demo assets. - After the privacy audit passed, the triage branch was updated and the containment note was added to #25. ## Blockers - The existing #25 escalation remains active. PR #22 provides safe fail-closed containment if merged, but keep Remote Desktop disabled and distribution blocked until the required authorization regression coverage passes. +- Issue #27 requires maintainer approval and repository administration: review and merge PR #17, enable Pages from `main`/`docs`, verify the site, set the repository website URL, enable private vulnerability reporting, and then update security-reporting links. From c0b4402a88d03ebf9ee3f53359947e68142048c1 Mon Sep 17 00:00:00 2001 From: CodePilot Date: Sat, 18 Jul 2026 09:56:50 +0200 Subject: [PATCH 7/8] docs: record issue triage follow-up --- ops/agents/triage/2026-07-18-issue-triage.md | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/ops/agents/triage/2026-07-18-issue-triage.md b/ops/agents/triage/2026-07-18-issue-triage.md index f437ba1a..7a9468a8 100644 --- a/ops/agents/triage/2026-07-18-issue-triage.md +++ b/ops/agents/triage/2026-07-18-issue-triage.md @@ -30,3 +30,10 @@ One new GitHub issue was opened after the earlier 2026-07-18 triage pass. The th - The existing #25 escalation remains active. PR #22 provides safe fail-closed containment if merged, but keep Remote Desktop disabled and distribution blocked until the required authorization regression coverage passes. - Issue #27 requires maintainer approval and repository administration: review and merge PR #17, enable Pages from `main`/`docs`, verify the site, set the repository website URL, enable private vulnerability reporting, and then update security-reporting links. + +## Follow-up Pass + +- No new GitHub issues or issue updates appeared after the preceding pass. The open queue remains #27, #25, and #8. +- The proposed labels and existing blocker assessments remain unchanged. +- Draft PRs #17, #22, and #26 remain open, mergeable, and passing `Test and Audit`. +- No additional issue comment, branch, or code fix was needed. The existing escalation covers the two maintainer actions that remain necessary. From 38f02b735bdeee9c7cfd6f506ed82706d16730fe Mon Sep 17 00:00:00 2001 From: CodePilot Date: Sat, 18 Jul 2026 11:49:36 +0200 Subject: [PATCH 8/8] docs: refresh issue triage blockers --- ops/agents/triage/2026-07-18-issue-triage.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/ops/agents/triage/2026-07-18-issue-triage.md b/ops/agents/triage/2026-07-18-issue-triage.md index 7a9468a8..b9db11e1 100644 --- a/ops/agents/triage/2026-07-18-issue-triage.md +++ b/ops/agents/triage/2026-07-18-issue-triage.md @@ -35,5 +35,7 @@ One new GitHub issue was opened after the earlier 2026-07-18 triage pass. The th - No new GitHub issues or issue updates appeared after the preceding pass. The open queue remains #27, #25, and #8. - The proposed labels and existing blocker assessments remain unchanged. -- Draft PRs #17, #22, and #26 remain open, mergeable, and passing `Test and Audit`. +- `origin/main` remains unchanged. GitHub Pages still returns 404, the repository website field remains empty, and private vulnerability reporting remains disabled. +- Draft PR #17 received public-metadata and documentation updates, and draft PR #22 received agent-write audit hardening. Neither update changes the #27 maintainer steps or resolves #25's paired-device lease requirements. +- Draft PRs #17, #22, and #26 remain open, mergeable, and passing `Test and Audit` on their latest commits. - No additional issue comment, branch, or code fix was needed. The existing escalation covers the two maintainer actions that remain necessary.