mem.jbnx.io · Project tracker

ai.jbnx.io

Deleted product. Kitchen-sink box jbnx (9eb04ce3) stays.

Working now

0 agents

No agent has touched this project in the last 3 hours.

55 / 127

Done

43%

Waiting on you

Blocked

In review

PRs and checks

Done In progress In review Blocked Not started

Lanes

Tap a lane to see its tasks.

Agent accountability layer

67% 2 / 3

OPS-2 Build the escalation reply path Done Jul 25, 5:55 PM

OPS-4 Deploy the agent_ops schema Done Jul 26, 8:56 AM

OPS-3 Scope agent_ops per project Not started Jul 25, 5:55 PM

General

43% 53 / 1241 blocked

OPS-5 Four agent_ops tables have RLS disabled, including the quality gate evidence store Done Jul 26, 10:44 PM

OPS-6 Fourteen pf_* views and four RPCs hand the whole ops schema to anyone with the publishable key Done Jul 26, 10:44 PM

OPS-7 auth.users holds an account with no portfolio.members row, and nothing decides whether it should exist Done Jul 26, 5:31 PM

OPS-8 The anon-exposure detector is half-blind: it watches only schema public and only the anon role, while authenticated can execute 25 SECURITY DEFINER company-control functions Done Jul 26, 6:30 PM

OPS-9 Something outside the agents writes to portfolio.tasks and reverts done back to in_progress Blocked Jul 28, 11:41 PM

OPS-10 The uptime monitor reports every critical site down when its own instrument fails Done Jul 26, 11:21 PM

OPS-11 The quality gate's four independent verifiers are all one session, so "proof" is self-certification Not started Jul 28, 5:39 PM

OPS-8B agent_ops was readable by any signed-in account: 45 relations granted to authenticated behind policies that only checked you were logged in Done Jul 26, 8:30 PM

OPS-8C New tables in schema public are born fully writable by any signed-in account, with RLS off - close_new_objects() only covers relations in agent_ops Done Jul 26, 9:17 PM

OPS-8D One word separates a safe public view from an OPS-6 repeat, and no detector reads that word: owner-run views in public bypass every control below them Done Jul 26, 8:50 PM

OPS-8E A SECURITY DEFINER function in schema public is the third member of the owner-rights family, and it is the one nothing watches Done Jul 26, 10:56 PM

OPS-8H CREATE EXTENSION ... WITH SCHEMA public mints anon-writable objects that nothing can revoke Not started Jul 26, 9:18 PM

OPS-8G Moving an existing object INTO schema public bypasses the born-closed guard entirely Done Jul 26, 11:53 PM

OPS-8I The fourth owner-rights family member: SECURITY DEFINER TRIGGER functions on tables a member may write Not started Jul 26, 10:03 PM

OPS-8J The gate probe borrows an orphan account, so foreign keys mask fail-opens it should catch Not started Jul 26, 10:56 PM

OPS-12 Two lease registries that cannot see each other, so the lease does not prevent the duplicate work it exists to prevent Done Jul 26, 11:55 PM

OPS-8K Two detectors disagree about the same six public.portal_* tables: one says LEAK, the other says fail-closed Done Aug 15, 3:40 AM

OPS-8L Schema portfolio gets no relation treatment from the born-closed guard, on either the create or the arrival path Done Aug 15, 3:40 AM

OPS-13 A portal editor can write portfolio.tasks.claimed_by by hand, and since OPS-12 that also refuses an agent lease Not started Jul 26, 11:55 PM

OPS-8M A table dragged its owned sequence into public and nothing hardened it Done Jul 27, 6:12 AM

OPS-15 The quality gate counts proof recorded before the task was reopened, so a refuted fix can be re-closed on the evidence that was refuted Done Jul 27, 2:46 AM

OPS-16 The quality gate was BEFORE UPDATE only, so a task could be born done with no proof at all Done Jul 27, 2:44 AM

OPS-18 A critical task under a project lease sinks past the end of the page shift_brief prints, so the next shift never sees it Not started Jul 28, 5:39 PM

OPS-17 Two agents shipped overlapping fixes to the same ticket 19 seconds apart, because assigned_code is set but no lease is ever claimed Not started Jul 28, 5:39 PM

OPS-16B Closing a task by SQL never stamped completed_at, so the revert detector was blind to exactly the rows most likely to be reverted Done Jul 27, 2:45 AM

OPS-19 Proof is only invalidated when a task was done and got reopened, so a fix found broken earlier keeps its stale proof Not started Jul 28, 5:39 PM

OPS-20 The quality gate fails OPEN when its own policy row is missing: delete one row and every task in the company closes with no proof Done Jul 27, 5:33 AM

OPS-21 agent_ops.next_work reads the same one policy row the gate does, and still trusts its shape Not started Jul 27, 5:28 AM

OPS-22 Every quality-gate override is attributed to agent 02, whoever actually took it Not started Jul 27, 5:30 AM

OPS-23 Every gate in the estate can be switched off for a session with one SET, and nothing notices Not started Jul 28, 5:39 PM

OPS-24 The anon-exposure detector cannot see sequences, which is the one object type three tickets have now been raised about Done Aug 15, 3:40 AM

OPS-25 The whole-estate regression run was a hand-typed list, so a suite could be silently dropped and the assertion count was only as honest as whoever typed it In review Jul 27, 6:04 AM

OPS-26 RE-ENTRY IS NOT TREATED AS AN ARRIVAL: a relation that leaves public (or portfolio) and comes back keeps the grants it picked up while away, because its registry row survived Not started Jul 28, 5:39 PM

OPS-8P The born-closed guard treated "seen once" as "already safe", so an object could round-trip out of public and back wide open Done Aug 1, 5:26 AM

OPS-8T A verification FAIL recorded after a task is done changes nothing - the gate is close-time only Not started Jul 28, 5:39 PM

OPS-8S CREATE OR REPLACE VIEW on a resident public view silently strips operator grants Not started Jul 27, 6:35 AM

OPS-8R CREATE PROCEDURE is impossible in public, agent_ops and portfolio - the guard aborts it Not started Jul 28, 5:39 PM

OPS-8Q The born-closed guard revoked from anon but never from the PUBLIC pseudo-role, which anon inherits Done Aug 1, 2:27 AM

OPS-8U CREATE EXTENSION ... WITH SCHEMA public lands its members past the born-closed guard entirely Not started Jul 28, 5:39 PM

OPS-8V The guard only hardens on ARRIVAL, so a GRANT made after an object is resident is never re-examined Not started Jul 28, 5:39 PM

OPS-8W ALTER SCHEMA RENAME is an arrival the born-closed guard cannot see, and it poisons the registry permanently Done Aug 1, 8:46 AM

OPS-8X Nothing watches the born-closed guard's own enabled state, and the ticket that was supposed to cover it never mentions event triggers Not started Jul 28, 5:39 PM

OPS-27 The uptime watchdog has exactly one instrument and it is robots.txt-gated, so two critical sites went 6h unverified while both were healthy Not started Jul 28, 5:39 PM

OPS-28 public.pf_runs is still granted to anon after OPS-6, so the entire internal work log is readable by anyone holding the publishable key Done Jul 27, 5:29 PM

OPS-8Y The born-closed guard cannot harden an object it does not own, and REVOKE fails as a WARNING - so foreign-owned objects arrive wide open Done Aug 1, 8:54 AM

OPS-8Z The born-closed guard now roughly doubles the cost of every DDL statement in the database Not started Jul 27, 4:47 PM

OPS-8AA close_one_object applies the residency gate to relations and routines but not to sequences, and the sweep excludes extension routines but not extension relations Not started Jul 27, 4:47 PM

OPS-32 A held critical falls off the queue page the shift brief prints, so a stalled critical is invisible to the next shift Not started Jul 27, 5:30 PM

OPS-31 supabase_admin still holds a default ACL that grants anon full rights on anything it creates in schema public Not started Jul 27, 5:30 PM

OPS-33 A fabricated outage cannot be retracted: recording NULL does not clear an earlier ok=false, so a false DOWN can only be undone by proving health Not started Jul 27, 5:38 PM

OPS-34 The uptime sweep asks the CEO for permission it does not need, because it reaches for WebFetch before free platform telemetry Not started Jul 27, 5:39 PM

OPS-8AB One COMMENT ON a portfolio function blanks the whole portal: the guard strips EXECUTE from the four RLS policy helpers Done Aug 1, 2:27 AM

OPS-8AD Four agent_ops tables have RLS off - no live exposure, but the second lock is missing Done Jul 28, 8:54 AM

OPS-36 All four verifiers passed a build that was exploitable minutes later, because they re-ran the fix author's suite and that suite pinned the GUC that hides the hole Done Aug 1, 11:35 AM

OPS-37 The born-closed guard only enforces at ADMISSION, so one in-place ALTER re-opens any resident object - proven on the live public.portal_bot_log Done Jul 28, 2:48 AM

OPS-38 close_new_objects skips GRANT and REVOKE command tags, so CREATE-then-GRANT as two statements walks past the guard entirely - into portfolio Done Jul 28, 2:48 AM

OPS-39 90 of 118 done tasks rest on zero evidence - 38 of them critical or high - and they are one bounded legacy cohort, not a live gate hole Not started Jul 28, 5:39 PM

OPS-40 The guard's declared policy and the portal's actual design disagree: 17 resident objects were in violation before enforcement existed Not started Jul 28, 5:39 PM

OPS-8AE The born-closed guard closes the ACL but never enables RLS, so OPS-8AD will reopen every time anyone creates a table Done Aug 1, 2:27 AM

OPS-41 The born-closed guard does not fingerprint RLS POLICIES, so ALTER/CREATE/DROP POLICY walks past it - proven on portfolio.tasks, 0 to 326 rows as authenticated Done Jul 28, 2:45 PM

OPS-42 projects.jbnx.io answers 200 to GET //xmlrpc.php, which marks the host as a live WordPress target for scanners Done Jul 31, 4:30 AM

OPS-43 13 of 33 selftest suites are DEAD in production: the resident re-check can detect a bad grant but can never remediate one, so it aborts the statement instead Done Jul 28, 8:46 AM

OPS-44 DECIDE which policy wins: an in-place grant on a resident gated object is either always forbidden (OPS-37/38) or explicitly allowed (the arrival negative controls). Both are live and they contradict. Done Jul 31, 11:24 PM

OPS-45 The last 7 dead selftest suites are a harness problem, not a guard problem: they prove the detector works by deliberately opening a fixture, and the guard now correctly refuses that In review Jul 31, 8:36 PM

OPS-47 A grant to PUBLIC is detected by the born-closed guard and can never be remediated by it - the same defect OPS-43 fixed, one grantee over Not started Jul 28, 5:39 PM

OPS-46 The 7 revived selftest suites cannot plant a leak any more: 18 checks fail because the guard now reverts the fixture inside the same statement Not started Jul 28, 5:39 PM

OPS-48 OPS-37 is closed but its defect is LIVE: an in-place ALTER TABLE ... DISABLE ROW LEVEL SECURITY on a resident gated table is neither refused nor re-hardened, and authenticated then reads rows that were invisible - 0 to 2 on my own fixture Done Jul 28, 2:49 PM

OPS-49 Detection-only hole left by OPS-41: a widening RLS predicate that is not the literal true is recorded but not refused Not started Jul 28, 5:39 PM

OPS-50 The born-closed guard is blind to the two easiest ways to publish a gated table: a definer VIEW in public and a SECURITY DEFINER function in public. Both are born OPEN. Proven at 349 rows of portfolio.tasks read as authenticated. Not started Aug 21, 4:29 AM

OPS-51 agent_ops.reconcile_one takes 11.5-13.2 seconds, and it sits on the path of every ADMITTED resident DDL statement Not started Jul 28, 5:39 PM

OPS-52 The born-closed guard does not defend its own event triggers: one DROP EVENT TRIGGER removes it, and the OPS-48 exploit immediately returns - 0 to 351 rows as authenticated Done Jul 28, 5:32 PM

OPS-53 A critical task under a PROJECT lease falls to rank 35 while the shift brief prints only 8, so it silently leaves the brief Not started Jul 28, 5:39 PM

OPS-55 The closure guard re-enters itself through its own remediation DDL: one CREATE TABLE drives close_new_objects into unbounded recursion and never returns Done Jul 28, 11:36 PM

OPS-59 A critical held under a project lease falls off the brief the next shift reads: rank 39 when the page prints 8 Done Jul 29, 2:46 AM

OPS-58 Seven SECURITY DEFINER RPCs that authenticated can call have no identity probe, so nothing tests who they think you are Not started Jul 28, 11:38 PM

OPS-56 The owner-authority rule OPS-36 shipped has come undone: all three foreign-owner routes are ADMITTED again, and nobody saw it because the census could not run Done Jul 29, 2:39 AM

OPS-60 The portal shows a stuck shift that is not stuck and hides one that is running: I beat under an unregistered schedule key, so delivery-lead-shift reads 4h overdue when it actually fired Not started Jul 28, 11:45 PM

OPS-61 A foreign-owned SEQUENCE enters public with authenticated usage/select intact, because sequences are outside the owner-authority set Not started Jul 29, 2:37 AM

OPS-62 agent_ops.closure_exceptions is a silent, permanent, per-object bypass of the owner-authority rule: one row admits a foreign-owned object into a gated schema and the guard still reports itself fully armed Not started Jul 29, 6:04 AM

OPS-8AG A closure exception cannot say "PUBLIC", so an approval naming anon and authenticated silently admits a world-readable object Done Jul 31, 2:50 AM

OPS-8AH Closure exceptions are column-blind, never garbage-collected, and accept wildcards in role_name and priv Done Jul 31, 2:58 AM

OPS-8AF The closure-exception rule is written in FOUR places, and the other three are still the loose pre-OPS-8Y predicate Done Jul 31, 2:42 AM

OPS-8AI A gated schema is not "closed" - it is closed to exactly two named roles, and a grant to any third role walks in with no exception row at all Done Jul 30, 2:46 AM

OPS-63 Pausing the born-closed guard leaves a permanent hole: nothing that arrived while it was paused is ever swept when it is re-armed Not started Jul 29, 11:37 AM

OPS-64 selftest_reentry_is_an_arrival has lost both of its negative controls, so it can now pass on a build where OPS-8P has been reverted Not started Jul 30, 6:26 PM

OPS-65 agent_ops.finish_run has two live overloads, so the 3-argument call every charter mandates fails 42725 - two selftest suites went red/RAISED today because of it Done Jul 29, 5:44 PM

OPS-66 pf_invite_redeem keeps its anon EXECUTE because of closure_exceptions, not because of OPS-8W's routine residency gate - so the only witness every verifier uses cannot fail Not started Jul 29, 2:40 PM

OPS-67 Deleting an agent_run with telemetry now fails 23503: usage_events_run_id_fkey is NO ACTION, so finish_run's own ORG-4 usage row makes the run undeletable Not started Jul 29, 2:59 PM

OPS-69 The born-closed guard never hardens pg_namespace.nspacl, so a schema arriving by rename can carry anon USAGE *and CREATE* into a gated namespace Done Jul 30, 9:31 PM

OPS-70 selftest_schema_rename_is_an_arrival contains zero ALTER SCHEMA RENAME statements, so OPS-8W's own suite tests the sweep but never the event-trigger wiring and passes on the build 06 just exploited Done Jul 30, 8:42 PM

OPS-68 service_role holds arwdDxtm on guard_control, guard_reentry and both residency registries, so anything acting as service_role can switch the born-closed guard off and poison residency undetectably Done Jul 30, 11:56 AM

OPS-72 The quality gate requires a refutation from seat 09, but 09 is active=false so start_run refuses it - no critical task in the company can ever be closed through the front door Done Jul 29, 11:35 PM

OPS-71 agent_ops.run_all_selftests() silently omits three suites, one of them RED, because it only discovers the exact result signature TABLE(check_name, passed, detail) Not started Jul 29, 5:44 PM

OPS-74 Nothing runs the selftest suites on a schedule, so the safety nets only fire when a shift happens to ask - which is exactly how the OPS-72 regression hid for six hours Not started Jul 29, 11:36 PM

OPS-75 selftest_queue_hygiene "a project lease still demotes" is red and it is not transient - the assertion and next_work's own design comment contradict each other Not started Jul 29, 11:38 PM

OPS-77 selftest_queue_hygiene asserts an ABSOLUTE rank, so it reddens whenever the queue gets better-prioritised - my OPS-36 lift tripped it and the property it actually guards still holds Not started Jul 30, 3:13 PM

OPS-8AJ A bare GRANT on a schema is never swept at all, so one statement restores anon USAGE+CREATE on a gated schema and the USAGE half is permanent Not started Jul 30, 3:13 PM

OPS-8AK authenticated holds USAGE on schema agent_ops, so the gate on the control schema rests on object ACLs alone with nothing behind them Not started Jul 30, 9:32 PM

OPS-8AM pg_default_acl for agent_ops still grants service_role full write on every new table and EXECUTE on every new function, so the next object recreates the hole OPS-68 and OPS-69 each closed by hand Not started Jul 30, 5:55 PM

OPS-8AL service_role holds EXECUTE on a SECURITY DEFINER selftest owned by postgres whose body runs CREATE ROLE, CREATE SCHEMA and GRANT ... TO anon Not started Jul 30, 9:32 PM

OPS-8AN Guard registries key object residency by schema NAME, not id (rule 8 fuse) Not started Jul 30, 10:05 PM

OPS-8AP arrival_suite_ddl_evidence is comment-spoofable, so the estate's shared "is this suite real" measure passes a suite that tests nothing Not started Jul 30, 8:43 PM

OPS-8AQ selftest queue_hygiene flaps red on a hardcoded rank<=10 threshold that moves with live queue volume, so a real regression and normal growth are indistinguishable Not started Jul 30, 9:32 PM

OPS-8AT A schema rename round trip permanently strips authenticated EXECUTE from four portfolio functions, and nothing puts it back Not started Jul 30, 9:32 PM

OPS-8AS The OPS-69 selftest-frame detector is defeated by a newline inside a comment, because its control input is still attacker-supplied text Not started Jul 30, 10:05 PM

OPS-8AR The OPS-69 vacancy fix fails CLOSED into an outage: one benign grant on a parked public strips anon USAGE and the PUBLIC grant, and pf_invite_redeem starts refusing 42501 Not started Jul 30, 9:32 PM

OPS-8AU run_all_selftests discovers 33 suites and selftest_census discovers 39, so six suites are invisible to the runner every verifier uses - and one of the six is RED right now Not started Jul 30, 10:05 PM

OPS-8AW No selftest asserts the seven guard-surface ACLs, so reverting any of the OPS-68/OPS-8W lockdowns leaves both censuses fully green Not started Jul 30, 10:38 PM

OPS-8AV reconcile_one and revoke_closed build dynamic SQL with %s instead of %I on a caller-supplied identifier, inside SECURITY DEFINER bodies running as postgres Not started Jul 30, 10:38 PM

OPS-8AX A FIFTH place decides closure exceptions: the unconditional "revoke all from authenticated" on matviews and foreign tables in public Not started Jul 31, 2:41 AM

OPS-8AZ selftest_next_work_lifts_critical_path goes RED when the company finishes its critical path, because its discriminator reads live data instead of planting a fixture Not started Aug 1, 2:28 AM

OPS-8BA Owner-run public views leak to a non-member: 30 leaking rows across seven pf_ views Done Aug 21, 4:27 AM

OPS-78 A permissive RLS policy rides in with the object: the arrival sweep forces RLS on but never reads pg_policy, so a using(true) policy for authenticated survives and the table stays readable Done Jul 31, 11:35 AM

OPS-80 portfolio.is_member_reader() is fail-open: SECURITY DEFINER rebinds current_user to the owner, so every member-gated public view is readable by ANY signed-in account Done Jul 31, 5:35 PM

OPS-81 public.pf_spend and pf_spend_daily are ungated definer views over agent_ops.vendor_charges: every signed-in account reads company vendor spend Done Jul 31, 5:41 PM

OPS-82 public.pf_guards and pf_surge_sweep authorize with a current_user gate from inside their own SECURITY DEFINER frame, so their authorization check is constant-true for any signed-in account Done Jul 31, 5:39 PM

OPS-83 The four-verifier quality gate cannot detect that all four verifiers are the same process, because agent_ops.verifications records no actor or engine — this is the structural cause under OPS-36 Not started Jul 31, 6:59 PM

OPS-85 Run the seats the way hi.jbnx.io runs contractors: agent_ops.boot() ships at 504 tokens against shift_brief 6,084 — adopt it as the shift entry point In review Jul 31, 7:10 PM

OPS-86 selftest_lease_registries plants its fixture lease on a REAL project keyed by SLUG, so it raises whenever that project is genuinely claimed - the suite is blind exactly when the company is busy Not started Jul 31, 8:33 PM

OPS-87 selftest_guard_resident_reenforcement A3 asserts the MECHANISM (the GRANT is refused) instead of the EFFECT (the privilege is gone) - it has been red for three days with no ticket, and it is the third instance of the same superseded-spec pattern Not started Jul 31, 8:36 PM

OPS-89 Two selftest suites assert opposite sides of the decided OPS-44 policy, and the one that is wrong is invisible to run_all_selftests Not started Aug 1, 5:34 AM

OPS-90 agent_ops.verifications is not append-only: a recorded FAIL can be UPDATEd to pass and any row can be DELETEd, with no audit trail — the quality gate's entire evidence base is rewritable Not started Aug 1, 11:26 AM

OPS-91 The verification doctrine is printed, never enforced: a sign-off that ADMITS IN ITS OWN TEXT to re-running the fix author's suite, naming no red-on-revert check and citing no build fingerprint is accepted without complaint Not started Aug 1, 11:33 AM

OPS-92 The build fingerprint every verification round cites is FUNCTION-ONLY and therefore data-blind: one INSERT into closure_exceptions flips a guard decision from false to true while the composite md5 stays byte-identical Not started Aug 1, 11:34 AM

Source of truth: mem (Supabase mem_entities / mem_facts / mem_relations), aggregated by brain.tracker_projects() at request time. Data as of Nov 12, 9:10 AM ET.
Canonical project page: mem.jbnx.io/project/brain · Public mirror: jbnx.io/p · The 3D memory map stays owner-only at mem.jbnx.io.