atlas — Task Board

Blocking decisions (must answer before Phase 1): 00-decisions.md

Rules carried from the ADR:

I1: riotpiao.com is the only public hostname, ever
I2: browser never talks to an internal API directly — atlas is the only origin
I3: redaction is allowlist-only, enforced by DTO construction
I4: no free-form string reaches an internal system (closed enum, snapshot-membership validation)
I5: GPU chat concurrency capped at 6 of 8 sequence slots, disconnect cancels upstream immediately
TDD: RED (tests named before code) -> GREEN (minimal code) -> REFACTOR, per phase
Playwright e2e is a hard requirement for every UI-shipping phase (2, 3, 4, 5) — no surface merges without a passing spec

0 — Unblock

Task	Description
0.1	Resolve GitOps repo ownership
0.2	Fix NXDOMAIN repoURL/image reference
0.3	Replace :latest with commit-SHA tag
0.4	Diagnose forgejo-gitea stuck Init:0/3 — done
0.5	Diagnose apex 403
0.6	Add Vitest + Testing Library + msw
0.6a	Add Playwright (hard requirement)
0.7	Triage unrelated cluster issues

Task	Description
1.1	redact_test.go (RED)
1.2	rbac_test.go (RED)
1.3	snapshot_test.go (RED)
1.4	ClusterRole (GREEN)
1.5	client-go informers (GREEN)
1.6	Reducer: informer events -> snapshot (GREEN)
1.7	DTO construction, allowlist only (GREEN)
1.8	Redis publish (GREEN)
1.9	NetworkPolicy on atlas (GREEN)
1.10	Container hardening (GREEN)
1.11	simplify skill pass (REFACTOR)
1.12	Go error-handling / context hygiene (REFACTOR)

Task	Description
2.1	stream_test.go (RED)
2.2	topology.test.tsx (RED)
2.3	topology.e2e.ts (RED, Playwright — hard requirement)
2.4	GET /api/topology (GREEN)
2.5	GET /api/stream (GREEN)
2.6	Frontend: React Flow topology graph (GREEN)
2.7	Security headers (GREEN)
2.8	Rate limiting Tier 1 + Tier 2 (GREEN)
2.9	simplify skill pass (REFACTOR)

Task	Description
3.1	delivery_test.go (RED)
3.2	delivery.test.tsx (RED)
3.3	delivery.e2e.ts (RED, Playwright — hard requirement)
3.4	GET /api/delivery (GREEN)
3.5	GET /api/delivery/{app}/resources (GREEN)
3.6	Frontend: wave columns + resource tree (GREEN)
3.7	Live sync animation (GREEN)
3.8	Redaction check specific to delivery surface (GREEN)
3.9	simplify skill pass (REFACTOR)
3.10	Landing page: remove fabricated stats and dead links (GREEN)

Task	Description
4.1	exec_parse_test.go (RED)
4.2	exec_test.go (RED)
4.3	terminal.e2e.ts (RED, Playwright — hard requirement)
4.4	POST /api/exec (GREEN)
4.5	Command set (GREEN)
4.6	Namespace/resource-name validation by snapshot membership (GREEN)
4.7	No shell, no exec, no kubectl binary in image (GREEN)
4.8	Frontend: wire InteractiveTerminal to /api/exec (GREEN)
4.9	Structured logging of rejections (GREEN)
4.10	simplify skill pass (REFACTOR)

Task	Description
5.1	ratelimit_test.go (RED)
5.2	disconnect_test.go (RED)
5.3	budget_test.go (RED)
5.4	injection_test.go (RED)
5.5	context_test.go (RED)
5.6	chat.e2e.ts (RED, Playwright — hard requirement)
5.7	POST /api/chat (GREEN)
5.8	Rate limiting Tier 3 (atlas) (GREEN)
5.9	Queue position streamed as SSE (GREEN)
5.10	Prompt injection defenses (GREEN)
5.11	Context budget (GREEN)
5.12	Chat SSE event types (GREEN)
5.13	Frontend: chat component (GREEN)
5.14	Prometheus metrics (GREEN)
5.15	Alertmanager rule (GREEN)
5.16	pnpm audit + govulncheck CI gate (GREEN)
5.17	simplify skill pass (REFACTOR)

Not started, Phase 0 partially unblocked. 5 decisions still block Phase 1 — see 00-decisions.md.

Status as of 2026-08-18:

0.4 (forgejo-gitea Init stuck) — resolved, pod Running 1/1
0.7 (longhorn-config OutOfSync) — resolved, now Synced/Healthy; sms Degraded still open
*.riotpiao.homelab.com fully retired, replaced by *.riotpiao.com — confirmed root cause for 0.2 (dead-domain repoURL, not a broken forgejo pod)
0.1/0.2 (portfolio GitOps repo, dead-domain repoURL) — still open, application portfolio not found in cluster, fix is now a known domain swap
0.5 (apex 403) — still open, curl riotpiao.com returns 403; no in-cluster ingress exists for bare apex, still need Cloudflare-side confirmation