docs: record launch triage blockers

ops/agents/escalations/issue-triage.md

@@ -1,10 +1,9 @@
 # Issue Triage Escalations
 
-Date: 2026-07-18
+Date: 2026-07-17
 
-- No active maintainer decision escalations for issue triage.
-- Follow-up check found no new GitHub issues created on 2026-07-04.
-- OTA build and public OTA asset verification are still required for the iOS changes, but were not run in this unattended pass because non-GitHub external system mutation is prohibited by the current public write policy.
-- Public screenshot capture remains pending; the manifest exists, but actual image capture still needs sanitized app/device state and manual pixel review before any public use.
-- Issue #27 requires maintainer review and merge of the prepared public-beta documentation, then repository administration to enable GitHub Pages, set the verified website and description, and enable private vulnerability reporting.
-- No pricing, legal, App Store, credential, or public-posting decision is requested.
+- Release blocker: GitHub issue #25 is confirmed. Remote Desktop frame capture, input, and signaling do not consistently enforce an approved device and active signed lease at the gateway and native-host boundaries; the iOS control view also bypasses the signed-session setup flow.
+- Required intervention: assign and coordinate a cross-stack security fix, and keep OTA, TestFlight, and App Store distribution containing Remote Desktop blocked until the issue's authorization regression coverage passes.
+- Issue triage did not attempt a partial fix because the change is security-sensitive and spans iOS, gateway, native RPC, expiry/revocation, and WebRTC/HTTP parity.
+- Containment update (2026-07-18): draft security PR #22 disables the native Remote Desktop host and fail-closes the public remote-control routes. If merged, that safely removes the exposed path, but Remote Desktop must remain disabled until #25's paired-device lease enforcement and regression coverage are complete.
+- Public beta repository settings (issue #27): review and merge draft PR #17, then enable GitHub Pages from `main`/`docs`, verify the landing, privacy, and support pages, add the verified URL to the repository website field, and enable private vulnerability reporting. Repository administration and pull-request merge are outside this unattended run's authority.

ops/agents/triage/2026-07-17-issue-triage.md

@@ -0,0 +1,44 @@
+# CodePilot Issue Triage - 2026-07-17
+
+Remote write policy: public GitHub writes require a privacy audit. This pass pushed the focused `agent/issue-triage-remote-desktop-lease-blocker` branch and opened draft PR #26 after the audit passed.
+
+## Reviewed Issues
+
+- #25 Enforce paired-device leases on every Remote Desktop path
+  - Proposed labels: `bug`, `remote-desktop`, `mac`, `ios`, `gateway`, `severity: critical`.
+  - Current labels already match the proposal; no label change is needed.
+  - Classification: confirmed security defect and release blocker for OTA, TestFlight, and App Store distribution.
+- #2 Support or disable the iOS Same Network setup path
+  - Current labels already matched the proposal: `setup`, `ios`, `gateway`, `severity: medium`.
+  - Merged PR #14 already disabled Same Network for the public beta, so the stale resolved issue was closed.
+- #3 Require clear Remote Desktop pairing approval in setup
+  - Current labels already matched the proposal: `setup`, `remote-desktop`, `mac`, `ios`, `severity: high`.
+  - Merged PR #14 already requires explicit Mac approval, so the stale resolved issue was closed.
+- #8 Prepare sanitized public screenshot set
+  - Current labels already match the proposal: `documentation`, `severity: low`.
+  - The issue remains open for approved demo-only screenshot capture; no screenshot asset was created or published in this pass.
+
+## Reproduction and Diagnosis
+
+- Gateway frame capture calls `frame.capture` without a lease identifier or proof.
+- Gateway signaling accepts an arbitrary syntactically valid session ID, queues the signal, and forwards it to the native host.
+- The native signaling handler starts a peer connection for the supplied ID without validating it against `SessionLeaseStore`.
+- Native input validation only enforces monotonically increasing sequence numbers per caller-supplied session ID; it does not validate a trusted device or active lease.
+- The iOS Remote Desktop view generates a random session ID on appearance and immediately starts frame polling, WebRTC signaling, and input. It does not pair or call `startSession` first.
+- Existing gateway tests explicitly pass arbitrary session IDs to frame, signaling, clipboard, and input paths and expect success.
+
+## Verification
+
+- `python3 -m unittest gateway.test_remote_desktop_gateway.RemoteDesktopGatewayTests`: passed.
+- `swift test --filter RemoteDesktop`: passed (20 tests).
+- Full gateway test discovery ran 23 tests but reported four import errors because the available Python 3.9 runtime lacks the standard-library `tomllib` module required by the phone gateway. The focused Remote Desktop gateway tests still passed, so this does not affect the confirmed authorization-path diagnosis.
+
+## Action
+
+- No code fix was attempted. Correct enforcement spans the iOS session lifecycle, gateway routing, native RPC boundary, lease expiry/revocation, and HTTP/WebRTC parity; a partial patch would be security-sensitive and outside low-risk issue triage.
+- Keep Remote Desktop distribution blocked until regression tests prove that unpaired, expired, revoked, replayed, arbitrary, and mismatched sessions fail at both gateway and native boundaries.
+- Closed superseded draft PR #15 after confirming its #2 and #3 fixes had already landed through merged PR #14 with passing CI.
+
+## Blockers
+
+- A maintainer must assign and coordinate the cross-stack security fix before any OTA, TestFlight, or App Store distribution containing Remote Desktop.

ops/agents/triage/2026-07-18-issue-triage.md

@@ -1,25 +1,41 @@
 # CodePilot Issue Triage - 2026-07-18
 
-Four open GitHub issues were reviewed for the Mac app, iOS app, gateway, release tooling, setup flow, and public documentation.
+One new GitHub issue was opened after the earlier 2026-07-18 triage pass. The three open issues and related draft pull requests were reviewed for changes.
 
 ## Reviewed Issues
 
-- #28 Fail gateway tests when a worker thread raises
-  - Proposed labels: `bug`, `gateway`, and `severity: low`.
-  - Reproduced: the focused unit test exited successfully while its daemon worker raised a `TypeError` because the test double used the old `run_turn` signature.
-  - Fixed on `agent/issue-28-worker-thread-tests`: the test double accepts the current reasoning-effort argument and the affected test runs its worker synchronously so worker exceptions fail the owning test.
-  - Verification: the focused regression test and all 90 gateway tests pass without a background exception.
 - #27 Complete public beta repository settings
-  - Proposed labels: `documentation` and `severity: high`.
-  - Still requires maintainer review and merge of the prepared documentation, followed by repository administration for Pages, repository metadata, and private vulnerability reporting.
+  - Proposed labels are `documentation` and `severity: high`. No `release` component label currently exists; `documentation` is the closest available component label.
+  - Reproduced the reported configuration gap: the GitHub Pages API returns 404, the repository website field is empty, and private vulnerability reporting is disabled.
+  - Draft PR #17 contains the prepared `docs/` landing, privacy, support, and security pages and remains open, mergeable, and passing its `Test and Audit` check.
+  - Completion requires maintainer review and merge of PR #17 followed by repository-setting changes. This unattended run is not authorized to merge pull requests or change repository settings.
 - #25 Enforce paired-device leases on every Remote Desktop path
-  - Proposed labels: `bug`, `remote-desktop`, `mac`, `ios`, `gateway`, and `severity: critical`; current labels match.
-  - Remains a cross-stack security and distribution blocker. Keep Remote Desktop disabled until the signed-lease requirements and authorization regression coverage pass.
+  - Proposed labels remain `bug`, `remote-desktop`, `mac`, `ios`, `gateway`, and `severity: critical`; the current labels match.
+  - The critical authorization defect remains open and release-blocking. `origin/main` has not changed since the confirmed 2026-07-17 reproduction.
+  - Draft security PR #22 now contains fail-closed containment: it disables the native Remote Desktop host and makes public remote-control routes unavailable. This removes the exposed path if merged, but it does not implement the paired-device lease behavior or regression coverage required to resolve #25.
+  - PR #22 is open, mergeable, and passing its `Test and Audit` check.
+  - Draft PR #26 remains open, mergeable, and passing its `Test and Audit` check.
 - #8 Prepare sanitized public screenshot set
-  - Proposed labels: `documentation` and `severity: low`; current labels match.
-  - The approved demo-only screenshot task remains open. No screenshot assets were created or published in this pass.
+  - Proposed labels remain `documentation` and `severity: low`; the current labels match.
+  - The approved demo-only capture task remains open. No screenshot assets were added or published in this pass.
+
+## Action
+
+- No issue labels were changed. Added a concise #25 comment linking the containment in PR #22 while keeping the lease-enforcement blocker explicit.
+- Recorded #27's verified configuration state and maintainer-only completion steps in the issue-triage escalation.
+- No code change was attempted. Issue #25 requires a coordinated cross-stack security fix, and issue #8 requires full-resolution visual inspection of newly captured demo assets.
+- After the privacy audit passed, the triage branch was updated and the containment note was added to #25.
 
 ## Blockers
 
-- #25 requires a coordinated security fix across iOS, gateway, native RPC, expiry and revocation, and WebRTC/HTTP paths.
-- #27 requires maintainer approval and repository administration that this unattended run is not authorized to perform.
+- The existing #25 escalation remains active. PR #22 provides safe fail-closed containment if merged, but keep Remote Desktop disabled and distribution blocked until the required authorization regression coverage passes.
+- Issue #27 requires maintainer approval and repository administration: review and merge PR #17, enable Pages from `main`/`docs`, verify the site, set the repository website URL, enable private vulnerability reporting, and then update security-reporting links.
+
+## Follow-up Pass
+
+- No new GitHub issues or issue updates appeared after the preceding pass. The open queue remains #27, #25, and #8.
+- The proposed labels and existing blocker assessments remain unchanged.
+- `origin/main` remains unchanged. GitHub Pages still returns 404, the repository website field remains empty, and private vulnerability reporting remains disabled.
+- Draft PR #17 received public-metadata and documentation updates, and draft PR #22 received agent-write audit hardening. Neither update changes the #27 maintainer steps or resolves #25's paired-device lease requirements.
+- Draft PRs #17, #22, and #26 remain open, mergeable, and passing `Test and Audit` on their latest commits.
+- No additional issue comment, branch, or code fix was needed. The existing escalation covers the two maintainer actions that remain necessary.