Skip to content
Cockpit0.29.0
A snapshot: read at commit 707a04c7ce8 on 2026-10-18T00:06:01Z by majordomus 0.29.0. Nothing on this page is read again. See it live

I0920

The image's dependencies are known and its advisories are policy

Where it stands

devtask.issue
Readiness
blocked 1 of its dependencies is not DONE
Status
BLOCKED
Can start
not now
Milestone
fly-deployment
Milestone status
ACTIVE
Wave
4
Waiting on
I0909
Holds back
I0932
Behind it in all
1
Evidence
0 of 4
In the waySubjectDetail
issueI0909I0909 is not DONE

Moves

plan.transition
A move writes the repository: it stamps one field of this issue's record and appends one event to the ledger, and a commit will carry both.
The same moves from a terminal

majordomus plan start I0920

majordomus plan verify I0920

majordomus plan done I0920

What it is

Objective
Record what the production image contains, obtain a dependency audit and a vulnerability verdict, and state a severity and fix-availability policy so that the gate is meaningful rather than permanently red.
Why
An image of unknown contents cannot be reasoned about after a disclosure. A scanner wired to fail on every advisory in every database is turned off within a week, which is worse than no scanner.
Now
No image, no inventory, no scan and no policy exist.
Wanted
The package inventory and the dependency audit are obtained by the same verification that runs everything else, and the policy states which findings block and which are recorded.
Done when
unknown: the record declares no `completion`
Risk
A policy that blocks on everything is a policy nobody keeps. The threshold has to be stated where it can be reviewed rather than buried in a workflow.

Acceptance

  • The runtime package inventory of the image is obtained and recorded
  • A dependency audit runs and its verdict is part of the gate
  • The severity and fix-availability policy is declared as data, not as prose, and the gate reads it
  • Where the repository's practice supports it, a bill of materials is produced alongside the image
  • External workflow actions are pinned to immutable references according to the repository's convention
Validation
bash test/run.shmajordomus deploy doctor
Evidence required
dependency_auditpackage_inventoryseverity_policyactions_pinned
Evidence present
unknown: the record carries no `evidence` entries

Scope

Touches
.ai/repo/policy.yaml.github/workflows/validate.yml
Not
A security dashboard or a vulnerability database of our ownFailing the build on advisories with no available fix and no exploitable path
Depends on
I0909
Priority
p2
Profile
implementation
Parallel safe
true
Owner
unknown: the record declares no `owner`

The work so far

Branches
none
Merged
none
Commits
0
Trunk
master
Sessions
none
Created
2026-09-06
Updated
2026-09-06
Started
unknown: the record declares no `started_at`
Verified
unknown: the record declares no `verified_at`
Completed
unknown: the record declares no `completed_at`

Synchronisation

Adapter
scripts/github-sync
Repository
unknown: the derived plan's header carries no repository
External issue
unknown: a live GitHub state; this executable makes no network call, so only `scripts/github-sync --check` can answer it
State there
unknown: a live GitHub state; this executable makes no network call, so only `scripts/github-sync --check` can answer it

Findings

Nothing is wrong with these records.