2026-05-11 - 2026-11-11
Overview
3 Releases published by 2 users
Published
v1.2.0
InboxOS v1.2.0 — 0/1 disposition (audit trail only)
Published
v1.1.0
InboxOS v1.1.0
Published
v1.0.0
v1.0.0 — InboxOS Full Deployment
29 Pull requests merged by 12 users
Merged
#194 docs(verbiage): TL;DR prologues per comms-etiquette v1.0
Merged
#147 [story #124] Frontend: Ops Console dashboard, logs, config, users views (INB-1.5-B-S4)
Merged
#146 [story #119] Frontend: Mailbox Owner Dashboard (INB-1.5-A-S4)
Merged
#145 Update .gitea/workflows/live-pipeline.yml
Merged
#144 docs(roadmap): correct v1.5 status line — Pillar I Gate passed
Merged
#142 [story #129] data-engineer: idempotent RBAC schema migration (apply, --check, --down, --seed)
Merged
#139 [story #134] Frontend: responsive layouts and navigation patterns (D-S3)
Merged
#141 [story #135] DevOps: design-system lint + Lighthouse a11y as merge gates
Merged
#136 CTO: Architecture + TRDs + Engineering Plan v1.5 (Pillar II Gate)
Merged
#138 [story #133] Frontend: design-system token module (D-S2)
Merged
#137 [story #132] UX: design-system token set, lint rules, and UI specs for v1.5
Merged
#108 SAA: Pillar I Gate — Roadmap v1.5 revision (REQ-001 intake)
Merged
#106 docs(intake): add Client Intake Guide for requirements submission
Merged
#105 [Pillar II] S-E1: DPIA data-flow diagram aligned to Architecture v1 §4.2 (REQ-INB-58)
Merged
#104 [Pillar II] S-F1: Trust boundary map for threat-model directory (REQ-INB-59b)
Merged
#98 [story #52] UX: operator-tutorial readability spec + revised outline
Merged
#97 [story #54] backend: explain_run.py operator CLI + offline tests
Merged
#96 test(pipelines): forward dry_run_override in offline test PapraConfig fixtures
Merged
#44 docs(security): threat-model architecture-v1.4 lift (Mermaid + SVG + PNG)
Merged
#43 test(papra_index): add --check coverage (REQ-INB-38)
Merged
#42 test(imapclient-shim): add runtime-shim coverage (REQ-INB-39)
Merged
#45 CTO: Pillar II Gate — InboxOS Architecture v1 + 4 TRDs (Operator Self-Service, Security & Compliance, Dual-Approval Governance, Tech-Debt Lane)
Merged
#25 SAA: Pillar I Gate — InboxOS Strategic Roadmap v1 (MAJOR scope + MINOR release list)
Merged
#23 v1.4: Operator UX + Product-Grade Security (23 candidates EXECUTED, 5 DEFERRED)
Merged
#6 inb-120: surface historical-pipeline early-stop in Gitea workflow status
Merged
#5 INB-117: correct documented SeaweedFS bucket and historical .mbox key
Merged
#4 inb-45: pin historical-pipeline upload-artifact to v3 (Gitea 1.x / GHES)
Merged
#3 INB-33: provision second self-hosted Gitea Actions runner (gitea-runner-2)
Merged
#1 inb-21: drop model-escalation chain; pin single gemma4:e4b model; add PR CI
162 Issues closed from 8 users
Closed
#99 MAJOR v1 — InboxOS Strategic Roadmap
Closed
#195 Project: v1 — work package (coreci/inboxos-v1)
Closed
#37 EPIC-INB-1.4-G: PII Scrub (held)
Closed
#124 INB-1.5-B-S4 — Implement Ops Console frontend
Closed
#117 INB-1.5-A-S2 — Implement Mailbox Owner Dashboard backend API
Closed
#122 INB-1.5-B-S2 — Implement Ops Console backend API
Closed
#127 INB-1.5-C-S2 — Implement RBAC middleware and role checks
Closed
#120 INB-1.5-A-S5 — QA Mailbox Owner Dashboard integration tests
Closed
#125 INB-1.5-B-S5 — QA Ops Console integration tests
Closed
#130 INB-1.5-C-S5 — Integrate RBAC middleware with frontend routing
Closed
#131 INB-1.5-C-S6 — Security test RBAC enforcement verification
Closed
#110 EPIC-INB-1.5-B: Admin/Operator Ops Console
Closed
#111 EPIC-INB-1.5-C: RBAC & Auth Layer
Closed
#112 EPIC-INB-1.5-A: Mailbox Owner Dashboard
Closed
#113 EPIC-INB-1.5-D: Design-System Compliance & UI Polish
Closed
#109 Initiate INTV-5 — Mailbox & Administrative Management Interface (v1.5)
Closed
#115 TRD — INTV-5 Mailbox & Administrative Management Interface (v1.5)
Closed
#114 Architecture v1.5 — Mailbox & Administrative Management Interface
Closed
#193 comms-etiquette v1.0 verbiage pass: TL;DR prologues
Closed
#40 EPIC-INB-1.0-TD-2: imapclient runtime-shim test (REQ-INB-39)
Closed
#41 EPIC-INB-1.0-TD-3: .gitignore opencode.json un-shadow (REQ-INB-35c)
Closed
#30 INTV-4 — Tech-Debt Lane (v1.0-MVP carry)
Closed
#39 EPIC-INB-1.0-TD-1: papra_index --check test (REQ-INB-38)
Closed
#35 EPIC-INB-1.4-E: DPIA
Closed
#36 EPIC-INB-1.4-F: Threat Model
Closed
#38 EPIC-INB-1.4-H: v1.4.0 Re-dispatch Under Dual Approval
Closed
#32 EPIC-INB-1.4-B: NocoDB Operator Views
Closed
#33 EPIC-INB-1.4-C: Recovery & Explain Tools
Closed
#34 EPIC-INB-1.4-D: Container Hardening
Closed
#28 INTV-2 — Product-Grade Security & Compliance (v1.4)
Closed
#29 INTV-3 — Dual-Approval Governance (v1.4 carry-through)
Closed
#31 EPIC-INB-1.4-A: Quickstart + Operator Tutorial
Closed
#27 INTV-1 — Operator Self-Service Surface (v1.4)
Closed
#152 TRD — INTV-3 Dual-Approval Governance (v1.4)
Closed
#153 TRD — INTV-4 Tech-Debt Lane (v1.0-MVP carry)
Closed
#149 Architecture v1 — InboxOS Strategic Roadmap
Closed
#150 TRD — INTV-1 Operator Self-Service Surface (v1.4)
Closed
#151 TRD — INTV-2 Product-Grade Security & Compliance (v1.4)
Closed
#188 INTV-3 — Audit v1.4.0 re-dispatch wave for 100% dual APPROVED review compliance (REQ-INB-37g/h/i)
Closed
#189 INTV-4 — Add papra_index --check flag and offline test (REQ-INB-38)
Closed
#190 INTV-4 — Add imapclient runtime-shim offline test (REQ-INB-39)
Closed
#191 INTV-4 — Fix .gitignore opencode.json shadow and add regression test (REQ-INB-35c)
Closed
#185 INTV-2 — Create architecture lift diagram (Mermaid + SVG + PNG) (REQ-INB-59)
Closed
#186 INTV-2 — Publish public-facing threat model summary and seek CPO review (REQ-INB-59)
Closed
#187 INTV-3 — Configure main branch protection requiring dual APPROVED reviews (REQ-INB-37a/b/c/d/e/f)
Closed
#182 INTV-2 — Build component × STRIDE table (REQ-INB-59)
Closed
#183 INTV-2 — Maintain threat register with severity and status (REQ-INB-59)
Closed
#184 INTV-2 — Produce threat-to-control matrix referencing container hardening (REQ-INB-59)
Closed
#178 INTV-2 — Draft DPIA lawful-basis table and data-minimisation checklist (REQ-INB-58c/d)
Closed
#179 INTV-2 — Define DPIA retention schedule and rights-request workflow (REQ-INB-58e/f)
Closed
#180 INTV-2 — Complete DPIA review pass with CPO (REQ-INB-58)
Closed
#181 INTV-2 — Produce trust boundary map for v1.4 architecture (REQ-INB-59)
Closed
#175 INTV-2 — Lock supply-chain with lockfile + Renovate config (REQ-INB-55i)
Closed
#176 INTV-2 — Define canary rollout and rollback runbook recipe (REQ-INB-55j)
Closed
#177 INTV-2 — Produce DPIA data-flow diagram mirroring Architecture §4.2 (REQ-INB-58b)
Closed
#171 INTV-2 — Add Seccomp and AppArmor profiles (REQ-INB-55f/g)
Closed
#172 INTV-2 — Add HEALTHCHECK directive to long-running services (REQ-INB-55d)
Closed
#173 INTV-2 — Enable cosign sign + SBOM in build pipeline (REQ-INB-55h)
Closed
#174 INTV-2 — Add admission hook rejecting unsigned images (REQ-INB-55h)
Closed
#168 INTV-2 — Build multi-stage Dockerfile with pinned base digest (REQ-INB-55a/b)
Closed
#169 INTV-2 — Enforce non-root UID across services (REQ-INB-55c)
Closed
#170 INTV-2 — Apply runtime policy bundle: cap-drop, no-new-privileges, read-only rootfs (REQ-INB-55e)
Closed
#164 INTV-1 — Implement reclassify.py for classification override (REQ-INB-44)
Closed
#165 INTV-1 — Implement replay.py for archive slice re-run (REQ-INB-45)
Closed
#166 INTV-1 — Implement daily_digest.py and cron workflow (REQ-INB-50)
Closed
#167 INTV-1 — Add secret redaction offline test (REQ-INB-56)
Closed
#162 INTV-1 — Implement apply_views.py and offline test (REQ-INB-41)
Closed
#163 INTV-1 — Implement explain_run.py for run diagnostics (REQ-INB-42)
Closed
#158 INTV-1 — Author operator-tutorial.md as single point-of-entry (REQ-INB-53)
Closed
#159 INTV-1 — Add apply_schemas.py --check offline test (REQ-INB-38 carry)
Closed
#160 INTV-1 — Define NocoDB views for Finance and CRM modules (REQ-INB-41)
Closed
#161 INTV-1 — Define NocoDB views for Intel and Promotions modules (REQ-INB-41)
Closed
#157 INTV-1 — Implement quickstart.sh for green-field spin-up (REQ-INB-40)
Closed
#155 Test milestone
Closed
#156 Test assign cto
Closed
#148 Test Issue
Closed
#154 Test assignee
Closed
#119 INB-1.5-A-S4 — Implement Mailbox Owner Dashboard frontend
Closed
#129 INB-1.5-C-S4 — Implement Users/Roles tables and migrations
Closed
#134 INB-1.5-D-S3 — Implement responsive layouts and navigation patterns
Closed
#135 INB-1.5-D-S4 — Add design-system lint to CI
Closed
#121 INB-1.5-B-S1 — Spec Ops Console API contract
Closed
#126 INB-1.5-C-S1 — Spec RBAC API contract and middleware
Closed
#116 INB-1.5-A-S1 — Spec Mailbox Owner Dashboard API contract
Closed
#133 INB-1.5-D-S2 — Implement design-system tokens in frontend
Closed
#107 REQ-001 - Mailbox & Administrative Management Interface
Closed
#128 INB-1.5-C-S3 — Spec Users/Roles data model
Closed
#123 INB-1.5-B-S3 — Spec Ops Console UI
Closed
#118 INB-1.5-A-S3 — Spec Mailbox Owner Dashboard UI
Closed
#132 INB-1.5-D-S1 — Spec design-system token set and lint rules
Closed
#26 MAJOR v1 — InboxOS Self-Hosted Personal ERP/CRM Pipeline
Closed
#16 INB-240: PATH-overlay fix so non-interactive opencode_local agent shells can resolve tea (per INB-171)
Closed
#17 v1.3.0 release recovery: main advanced (b49cfb7b → 63c0f59), v1.3.0 quarantined, re-dispatch required (per INB-295)
Closed
#18 [v1.4 IDEATE] 23 candidates (15 UX + 5 Security + 3 carries) - CPO review
Closed
#20 [v1.3 carry / v1.0-MVP tech-debt] REQ-INB-35c — .gitignore opencode.json line shadows tracked file
Closed
#21 [v1.3 carry / v1.0-MVP tech-debt] REQ-INB-38 — apply_schemas.py --check offline test for papra_index
Closed
#22 [v1.3 carry / v1.0-MVP tech-debt] REQ-INB-39 — test_papra_link_parity_offline.py imapclient runtime-shim
Closed
#24 [v1.4.0 re-dispatch] corrected shape per INB-328 — REQ-INB-57 split out, 3 carries peeled off, dual-approval gate enforced
Closed
#46 CTO: Pillar II Architecture — InboxOS v1 (MAJOR-scoped)
Closed
#47 CTO: TRD — INTV-1 Operator Self-Service Surface (v1.4)
Closed
#48 CTO: TRD — INTV-2 Product-Grade Security & Compliance (v1.4)
Closed
#49 CTO: TRD — INTV-3 Dual-Approval Governance (v1.4 carry-through)
Closed
#50 CTO: TRD — INTV-4 Tech-Debt Lane (v1.0-MVP carry)
Closed
#51 [story] S-A1: scripts/quickstart.sh — green-field spin-up in 15 min (REQ-INB-40)
Closed
#52 [story] S-A2: docs/operator-tutorial.md — single point-of-entry for the operator (REQ-INB-53)
Closed
#53 [story] S-A3: scripts/apply_schemas.py --check offline test (REQ-INB-38)
Closed
#54 [story] S-C1: scripts/explain_run.py (REQ-INB-42)
Closed
#55 [story] S-B1: docs/nocodb-views/finance.json + crm.json (REQ-INB-41)
Closed
#56 [story] S-B2: docs/nocodb-views/intel.json + promotions.json (REQ-INB-41)
Closed
#57 [story] S-C5: scripts/_tests/test_secret_redaction_offline.py (REQ-INB-56)
Closed
#58 [story] S-C4: scripts/daily_digest.py + workflow (REQ-INB-50)
Closed
#59 [story] S-C3: scripts/replay.py (REQ-INB-45)
Closed
#60 [story] S-B3: scripts/apply_views.py + offline test (REQ-INB-41)
Closed
#61 [story] S-C2: scripts/reclassify.py (REQ-INB-44)
Closed
#62 [story] S-H1: Configure branch protection on main (REQ-INB-37a..e)
Closed
#63 [story] S-H2: docs/governance/dual-approval.md — configuration record (REQ-INB-37f)
Closed
#64 [story] S-H3: Sandbox verification: force-merge rejected, stale-approval dismissed, stale-main blocked (REQ-INB-37c, b, e)
Closed
#65 [story] S-H4: v1.4.0 wave audit + umbrella Epic #38 closing comment (REQ-INB-37g, h, i)
Closed
#66 [story] S-D1: Multi-stage Dockerfile + pinned base by digest (REQ-INB-55a, b)
Closed
#67 [story] S-D2: Non-root UID + USER directive across services (REQ-INB-55c)
Closed
#68 [story] S-D3: Runtime policy bundle: cap-drop, no-new-privileges, read-only rootfs, tmpfs /tmp (REQ-INB-55e)
Closed
#69 [story] S-D4: Seccomp profile + AppArmor profile (REQ-INB-55f, g)
Closed
#70 [story] S-D5: HEALTHCHECK directive on every long-running service (REQ-INB-55d)
Closed
#71 [story] S-D6: cosign sign + SBOM attach in build pipeline (REQ-INB-55h)
Closed
#72 [story] S-D7: Admission hook rejecting unsigned images (REQ-INB-55h)
Closed
#73 [story] S-D8: Supply-chain pinning: lockfile + Renovate config (REQ-INB-55i)
Closed
#74 [story] S-D9: Canary rollout + runbook rollback recipe (REQ-INB-55j)
Closed
#76 [story] S-E2: DPIA lawful-basis table + data-minimisation checklist
Closed
#77 [story] S-E3: DPIA retention schedule + rights-request workflow (deferred impl)
Closed
#78 [story] S-E4: DPIA docs/security/dpia.md review pass with CPO
Closed
#80 [story] S-F2: Component × STRIDE table (the main artefact)
Closed
#81 [story] S-F3: Threat register (severity, status, link to REQ-INB-*)
Closed
#82 [story] S-F4: Threat-to-control matrix
Closed
#83 [story] S-F5: Architecture lift diagram: Mermaid + SVG + PNG
Closed
#84 [story] S-F6: Public-facing one-page summary + CPO review
Closed
#85 [story] S-TD1: scripts/apply_schemas.py --check + offline test (REQ-INB-38)
Closed
#86 [story] S-TD2: imapclient shim offline test (REQ-INB-39)
Closed
#87 [story] S-TD3: .gitignore opencode.json un-shadow + regression test (REQ-INB-35c)
Closed
#88 [story] S-G1: pipelines/pii_scrub.py::scrub(body) — pattern detection (SSN/CC/IBAN/phone) (REQ-INB-57a)
Closed
#89 [story] S-G2: pii_scrub.scrub_attachment(blob, mime) (REQ-INB-57b)
Closed
#90 [story] S-G3: Integration into live_pipeline.py and historical_pipeline.py (REQ-INB-57c)
Closed
#91 [story] S-G4: Integration into operator scripts (reclassify.py, replay.py, dry_run.py) (REQ-INB-57d)
Closed
#92 [story] S-G5: pipelines/_tests/test_pii_scrub_offline.py (REQ-INB-57e)
Closed
#94 defect(ci): .gitea/workflows/ci-pr.yml on.pull_request.branches filter skips every release/v1 PR — no CI on tech-debt lane
Closed
#75 [story] S-E1: DPIA data-flow diagram (mirrors Architecture §4.2)
Closed
#79 [story] S-F1: Trust boundary map (mirrors Architecture §2)
Closed
#100 Initiate INTV-1 — Operator Self-Service Surface (v1.4)
Closed
#101 Initiate INTV-2 — Product-Grade Security & Compliance (v1.4)
Closed
#102 Initiate INTV-3 — Dual-Approval Governance (v1.4 carry-through)
Closed
#103 Initiate INTV-4 — Tech-Debt Lane (v1.0-MVP carry)
Closed
#93 fix(pipelines): backport dry_run_override to test_live_pipeline_offline.py PapraConfig callsites (regression on main, blocks PR #45 CI)
Closed
#95 CIA-50 verification — label taxonomy test
Closed
#19 [SMOKE-TEST] ignore — payload validation, please close
Closed
#8 INB-183: opencode-local adapter — append $HOME/.local/bin to spawned env PATH
Closed
#15 INB-193: scripts/with-gitea-env.sh — per-agent GITEA_USER/GITEA_PASS wrapper for tea CLI (Path A, unblocks QA)
Closed
#9 CPO: backfill docs/requirements.md and docs/roadmap.md for 5 already-shipped PRs (INB-21/33/45/117/120)
Closed
#7 INB-184: Seed Gitea kanban issue (synchronize Gitea with Paperclip/INB)
Closed
#14 REQ-MVP-005: historical-pipeline early-stop exit code — INB-120
Closed
#13 REQ-MVP-004: canonical SeaweedFS bucket and historical .mbox key — INB-117
Closed
#12 REQ-MVP-003: actions/upload-artifact v3 pin (Gitea 1.x / GHES) — INB-45
Closed
#11 REQ-MVP-002: two self-hosted Gitea Actions runners — INB-33
Closed
#10 REQ-MVP-001: single-model LLM contract (no escalation chain) — INB-21
162 Issues created by 0 users
Opened
#7 INB-184: Seed Gitea kanban issue (synchronize Gitea with Paperclip/INB)
Opened
#8 INB-183: opencode-local adapter — append $HOME/.local/bin to spawned env PATH
Opened
#9 CPO: backfill docs/requirements.md and docs/roadmap.md for 5 already-shipped PRs (INB-21/33/45/117/120)
Opened
#10 REQ-MVP-001: single-model LLM contract (no escalation chain) — INB-21
Opened
#11 REQ-MVP-002: two self-hosted Gitea Actions runners — INB-33
Opened
#12 REQ-MVP-003: actions/upload-artifact v3 pin (Gitea 1.x / GHES) — INB-45
Opened
#13 REQ-MVP-004: canonical SeaweedFS bucket and historical .mbox key — INB-117
Opened
#14 REQ-MVP-005: historical-pipeline early-stop exit code — INB-120
Opened
#15 INB-193: scripts/with-gitea-env.sh — per-agent GITEA_USER/GITEA_PASS wrapper for tea CLI (Path A, unblocks QA)
Opened
#16 INB-240: PATH-overlay fix so non-interactive opencode_local agent shells can resolve tea (per INB-171)
Opened
#17 v1.3.0 release recovery: main advanced (b49cfb7b → 63c0f59), v1.3.0 quarantined, re-dispatch required (per INB-295)
Opened
#18 [v1.4 IDEATE] 23 candidates (15 UX + 5 Security + 3 carries) - CPO review
Opened
#19 [SMOKE-TEST] ignore — payload validation, please close
Opened
#20 [v1.3 carry / v1.0-MVP tech-debt] REQ-INB-35c — .gitignore opencode.json line shadows tracked file
Opened
#21 [v1.3 carry / v1.0-MVP tech-debt] REQ-INB-38 — apply_schemas.py --check offline test for papra_index
Opened
#22 [v1.3 carry / v1.0-MVP tech-debt] REQ-INB-39 — test_papra_link_parity_offline.py imapclient runtime-shim
Opened
#24 [v1.4.0 re-dispatch] corrected shape per INB-328 — REQ-INB-57 split out, 3 carries peeled off, dual-approval gate enforced
Opened
#26 MAJOR v1 — InboxOS Self-Hosted Personal ERP/CRM Pipeline
Opened
#27 INTV-1 — Operator Self-Service Surface (v1.4)
Opened
#28 INTV-2 — Product-Grade Security & Compliance (v1.4)
Opened
#29 INTV-3 — Dual-Approval Governance (v1.4 carry-through)
Opened
#30 INTV-4 — Tech-Debt Lane (v1.0-MVP carry)
Opened
#31 EPIC-INB-1.4-A: Quickstart + Operator Tutorial
Opened
#32 EPIC-INB-1.4-B: NocoDB Operator Views
Opened
#33 EPIC-INB-1.4-C: Recovery & Explain Tools
Opened
#34 EPIC-INB-1.4-D: Container Hardening
Opened
#35 EPIC-INB-1.4-E: DPIA
Opened
#36 EPIC-INB-1.4-F: Threat Model
Opened
#37 EPIC-INB-1.4-G: PII Scrub (held)
Opened
#38 EPIC-INB-1.4-H: v1.4.0 Re-dispatch Under Dual Approval
Opened
#39 EPIC-INB-1.0-TD-1: papra_index --check test (REQ-INB-38)
Opened
#40 EPIC-INB-1.0-TD-2: imapclient runtime-shim test (REQ-INB-39)
Opened
#41 EPIC-INB-1.0-TD-3: .gitignore opencode.json un-shadow (REQ-INB-35c)
Opened
#46 CTO: Pillar II Architecture — InboxOS v1 (MAJOR-scoped)
Opened
#47 CTO: TRD — INTV-1 Operator Self-Service Surface (v1.4)
Opened
#48 CTO: TRD — INTV-2 Product-Grade Security & Compliance (v1.4)
Opened
#49 CTO: TRD — INTV-3 Dual-Approval Governance (v1.4 carry-through)
Opened
#50 CTO: TRD — INTV-4 Tech-Debt Lane (v1.0-MVP carry)
Opened
#51 [story] S-A1: scripts/quickstart.sh — green-field spin-up in 15 min (REQ-INB-40)
Opened
#52 [story] S-A2: docs/operator-tutorial.md — single point-of-entry for the operator (REQ-INB-53)
Opened
#53 [story] S-A3: scripts/apply_schemas.py --check offline test (REQ-INB-38)
Opened
#54 [story] S-C1: scripts/explain_run.py (REQ-INB-42)
Opened
#55 [story] S-B1: docs/nocodb-views/finance.json + crm.json (REQ-INB-41)
Opened
#56 [story] S-B2: docs/nocodb-views/intel.json + promotions.json (REQ-INB-41)
Opened
#57 [story] S-C5: scripts/_tests/test_secret_redaction_offline.py (REQ-INB-56)
Opened
#58 [story] S-C4: scripts/daily_digest.py + workflow (REQ-INB-50)
Opened
#59 [story] S-C3: scripts/replay.py (REQ-INB-45)
Opened
#60 [story] S-B3: scripts/apply_views.py + offline test (REQ-INB-41)
Opened
#61 [story] S-C2: scripts/reclassify.py (REQ-INB-44)
Opened
#62 [story] S-H1: Configure branch protection on main (REQ-INB-37a..e)
Opened
#63 [story] S-H2: docs/governance/dual-approval.md — configuration record (REQ-INB-37f)
Opened
#64 [story] S-H3: Sandbox verification: force-merge rejected, stale-approval dismissed, stale-main blocked (REQ-INB-37c, b, e)
Opened
#65 [story] S-H4: v1.4.0 wave audit + umbrella Epic #38 closing comment (REQ-INB-37g, h, i)
Opened
#66 [story] S-D1: Multi-stage Dockerfile + pinned base by digest (REQ-INB-55a, b)
Opened
#67 [story] S-D2: Non-root UID + USER directive across services (REQ-INB-55c)
Opened
#68 [story] S-D3: Runtime policy bundle: cap-drop, no-new-privileges, read-only rootfs, tmpfs /tmp (REQ-INB-55e)
Opened
#69 [story] S-D4: Seccomp profile + AppArmor profile (REQ-INB-55f, g)
Opened
#70 [story] S-D5: HEALTHCHECK directive on every long-running service (REQ-INB-55d)
Opened
#71 [story] S-D6: cosign sign + SBOM attach in build pipeline (REQ-INB-55h)
Opened
#72 [story] S-D7: Admission hook rejecting unsigned images (REQ-INB-55h)
Opened
#73 [story] S-D8: Supply-chain pinning: lockfile + Renovate config (REQ-INB-55i)
Opened
#74 [story] S-D9: Canary rollout + runbook rollback recipe (REQ-INB-55j)
Opened
#75 [story] S-E1: DPIA data-flow diagram (mirrors Architecture §4.2)
Opened
#76 [story] S-E2: DPIA lawful-basis table + data-minimisation checklist
Opened
#77 [story] S-E3: DPIA retention schedule + rights-request workflow (deferred impl)
Opened
#78 [story] S-E4: DPIA docs/security/dpia.md review pass with CPO
Opened
#79 [story] S-F1: Trust boundary map (mirrors Architecture §2)
Opened
#80 [story] S-F2: Component × STRIDE table (the main artefact)
Opened
#81 [story] S-F3: Threat register (severity, status, link to REQ-INB-*)
Opened
#82 [story] S-F4: Threat-to-control matrix
Opened
#83 [story] S-F5: Architecture lift diagram: Mermaid + SVG + PNG
Opened
#84 [story] S-F6: Public-facing one-page summary + CPO review
Opened
#85 [story] S-TD1: scripts/apply_schemas.py --check + offline test (REQ-INB-38)
Opened
#86 [story] S-TD2: imapclient shim offline test (REQ-INB-39)
Opened
#87 [story] S-TD3: .gitignore opencode.json un-shadow + regression test (REQ-INB-35c)
Opened
#88 [story] S-G1: pipelines/pii_scrub.py::scrub(body) — pattern detection (SSN/CC/IBAN/phone) (REQ-INB-57a)
Opened
#89 [story] S-G2: pii_scrub.scrub_attachment(blob, mime) (REQ-INB-57b)
Opened
#90 [story] S-G3: Integration into live_pipeline.py and historical_pipeline.py (REQ-INB-57c)
Opened
#91 [story] S-G4: Integration into operator scripts (reclassify.py, replay.py, dry_run.py) (REQ-INB-57d)
Opened
#92 [story] S-G5: pipelines/_tests/test_pii_scrub_offline.py (REQ-INB-57e)
Opened
#93 fix(pipelines): backport dry_run_override to test_live_pipeline_offline.py PapraConfig callsites (regression on main, blocks PR #45 CI)
Opened
#94 defect(ci): .gitea/workflows/ci-pr.yml on.pull_request.branches filter skips every release/v1 PR — no CI on tech-debt lane
Opened
#95 CIA-50 verification — label taxonomy test
Opened
#99 MAJOR v1 — InboxOS Strategic Roadmap
Opened
#100 Initiate INTV-1 — Operator Self-Service Surface (v1.4)
Opened
#101 Initiate INTV-2 — Product-Grade Security & Compliance (v1.4)
Opened
#102 Initiate INTV-3 — Dual-Approval Governance (v1.4 carry-through)
Opened
#103 Initiate INTV-4 — Tech-Debt Lane (v1.0-MVP carry)
Opened
#107 REQ-001 - Mailbox & Administrative Management Interface
Opened
#109 Initiate INTV-5 — Mailbox & Administrative Management Interface (v1.5)
Opened
#110 EPIC-INB-1.5-B: Admin/Operator Ops Console
Opened
#111 EPIC-INB-1.5-C: RBAC & Auth Layer
Opened
#112 EPIC-INB-1.5-A: Mailbox Owner Dashboard
Opened
#113 EPIC-INB-1.5-D: Design-System Compliance & UI Polish
Opened
#114 Architecture v1.5 — Mailbox & Administrative Management Interface
Opened
#115 TRD — INTV-5 Mailbox & Administrative Management Interface (v1.5)
Opened
#116 INB-1.5-A-S1 — Spec Mailbox Owner Dashboard API contract
Opened
#117 INB-1.5-A-S2 — Implement Mailbox Owner Dashboard backend API
Opened
#118 INB-1.5-A-S3 — Spec Mailbox Owner Dashboard UI
Opened
#119 INB-1.5-A-S4 — Implement Mailbox Owner Dashboard frontend
Opened
#120 INB-1.5-A-S5 — QA Mailbox Owner Dashboard integration tests
Opened
#121 INB-1.5-B-S1 — Spec Ops Console API contract
Opened
#122 INB-1.5-B-S2 — Implement Ops Console backend API
Opened
#123 INB-1.5-B-S3 — Spec Ops Console UI
Opened
#124 INB-1.5-B-S4 — Implement Ops Console frontend
Opened
#125 INB-1.5-B-S5 — QA Ops Console integration tests
Opened
#126 INB-1.5-C-S1 — Spec RBAC API contract and middleware
Opened
#127 INB-1.5-C-S2 — Implement RBAC middleware and role checks
Opened
#128 INB-1.5-C-S3 — Spec Users/Roles data model
Opened
#129 INB-1.5-C-S4 — Implement Users/Roles tables and migrations
Opened
#130 INB-1.5-C-S5 — Integrate RBAC middleware with frontend routing
Opened
#131 INB-1.5-C-S6 — Security test RBAC enforcement verification
Opened
#132 INB-1.5-D-S1 — Spec design-system token set and lint rules
Opened
#133 INB-1.5-D-S2 — Implement design-system tokens in frontend
Opened
#134 INB-1.5-D-S3 — Implement responsive layouts and navigation patterns
Opened
#135 INB-1.5-D-S4 — Add design-system lint to CI
Opened
#148 Test Issue
Opened
#149 Architecture v1 — InboxOS Strategic Roadmap
Opened
#150 TRD — INTV-1 Operator Self-Service Surface (v1.4)
Opened
#151 TRD — INTV-2 Product-Grade Security & Compliance (v1.4)
Opened
#152 TRD — INTV-3 Dual-Approval Governance (v1.4)
Opened
#153 TRD — INTV-4 Tech-Debt Lane (v1.0-MVP carry)
Opened
#154 Test assignee
Opened
#155 Test milestone
Opened
#156 Test assign cto
Opened
#157 INTV-1 — Implement quickstart.sh for green-field spin-up (REQ-INB-40)
Opened
#158 INTV-1 — Author operator-tutorial.md as single point-of-entry (REQ-INB-53)
Opened
#159 INTV-1 — Add apply_schemas.py --check offline test (REQ-INB-38 carry)
Opened
#160 INTV-1 — Define NocoDB views for Finance and CRM modules (REQ-INB-41)
Opened
#161 INTV-1 — Define NocoDB views for Intel and Promotions modules (REQ-INB-41)
Opened
#162 INTV-1 — Implement apply_views.py and offline test (REQ-INB-41)
Opened
#163 INTV-1 — Implement explain_run.py for run diagnostics (REQ-INB-42)
Opened
#164 INTV-1 — Implement reclassify.py for classification override (REQ-INB-44)
Opened
#165 INTV-1 — Implement replay.py for archive slice re-run (REQ-INB-45)
Opened
#166 INTV-1 — Implement daily_digest.py and cron workflow (REQ-INB-50)
Opened
#167 INTV-1 — Add secret redaction offline test (REQ-INB-56)
Opened
#168 INTV-2 — Build multi-stage Dockerfile with pinned base digest (REQ-INB-55a/b)
Opened
#169 INTV-2 — Enforce non-root UID across services (REQ-INB-55c)
Opened
#170 INTV-2 — Apply runtime policy bundle: cap-drop, no-new-privileges, read-only rootfs (REQ-INB-55e)
Opened
#171 INTV-2 — Add Seccomp and AppArmor profiles (REQ-INB-55f/g)
Opened
#172 INTV-2 — Add HEALTHCHECK directive to long-running services (REQ-INB-55d)
Opened
#173 INTV-2 — Enable cosign sign + SBOM in build pipeline (REQ-INB-55h)
Opened
#174 INTV-2 — Add admission hook rejecting unsigned images (REQ-INB-55h)
Opened
#175 INTV-2 — Lock supply-chain with lockfile + Renovate config (REQ-INB-55i)
Opened
#176 INTV-2 — Define canary rollout and rollback runbook recipe (REQ-INB-55j)
Opened
#177 INTV-2 — Produce DPIA data-flow diagram mirroring Architecture §4.2 (REQ-INB-58b)
Opened
#178 INTV-2 — Draft DPIA lawful-basis table and data-minimisation checklist (REQ-INB-58c/d)
Opened
#179 INTV-2 — Define DPIA retention schedule and rights-request workflow (REQ-INB-58e/f)
Opened
#180 INTV-2 — Complete DPIA review pass with CPO (REQ-INB-58)
Opened
#181 INTV-2 — Produce trust boundary map for v1.4 architecture (REQ-INB-59)
Opened
#182 INTV-2 — Build component × STRIDE table (REQ-INB-59)
Opened
#183 INTV-2 — Maintain threat register with severity and status (REQ-INB-59)
Opened
#184 INTV-2 — Produce threat-to-control matrix referencing container hardening (REQ-INB-59)
Opened
#185 INTV-2 — Create architecture lift diagram (Mermaid + SVG + PNG) (REQ-INB-59)
Opened
#186 INTV-2 — Publish public-facing threat model summary and seek CPO review (REQ-INB-59)
Opened
#187 INTV-3 — Configure main branch protection requiring dual APPROVED reviews (REQ-INB-37a/b/c/d/e/f)
Opened
#188 INTV-3 — Audit v1.4.0 re-dispatch wave for 100% dual APPROVED review compliance (REQ-INB-37g/h/i)
Opened
#189 INTV-4 — Add papra_index --check flag and offline test (REQ-INB-38)
Opened
#190 INTV-4 — Add imapclient runtime-shim offline test (REQ-INB-39)
Opened
#191 INTV-4 — Fix .gitignore opencode.json shadow and add regression test (REQ-INB-35c)
Opened
#193 comms-etiquette v1.0 verbiage pass: TL;DR prologues
Opened
#195 Project: v1 — work package (coreci/inboxos-v1)