Conversation
* catalog gaps: record two openmausbot entries Both come from the OpenMausBot import (store #98), and both are second or third instances of a class rather than new mechanisms. no-public-url: the app runs two inbound listeners and malmo routes one port. The main server has a unix-socket seam the catalog compose relays onto; the webhook receiver is started with no host and has no socket, so there is nothing to reach. openclaw hit the same wall in July for its inbound webhook channels and recorded it only on the store side, so this is the class's first ledger entry and its second app. host-only-admin: the app installs its agent CLIs from Settings, but only accepts a plain npm one-liner. Six of thirteen agents install by piping a shell script into bash, so they need a terminal on the machine, which no box user has. Third app in the class after openclaw and pocket-id. Worth stating in the second entry: the sandbox was not the blocker. npm install -g into a path the app owns worked first time under cap_drop ALL as an arbitrary uid, with no sudo. * Fix the review finding: cite the right specs, and drop a stale claim Greptile flagged the APP_ISOLATION.md citation on the host-only-admin entry. It was right, and the underlying claim was worse than the citation. "The hosted profile gives the owner no shell at all" stopped being true on 2026-09-09, one day before this entry: os #463 turned hosted SSH on per account with a mandatory public key (ENVIRONMENT.md # Access & files, AUTH.md # Device access, DECISIONS.md 2026-09-09). An admin is in sudo, so a determined box owner could docker exec into an app and run the six installers by hand. The entry now says so. That does not weaken the gap, it sharpens it. What is missing is the product surface: nothing in the dashboard or the store runs a command inside an app, and the escape hatch is admin-only, outside anything the store models, and lost on reinstall. APP_ISOLATION.md is still the right cite for that shape (# Trust tiers: escape means Tier-2 curation or the admin's own docker run over SSH, never an app-store action), so it stays alongside the two specs that actually document the SSH posture. The pocket-id entry above carries the same stale sentence, and is left alone here: it is a merged record of a different run.
Release v0.12.0
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Carries the v0.12.0 release commits back into
devso the next release starts from a clean branch (docs/dev/contributing.md# Cutting a release, step by step).Opened by hand because
sync-dev.ymlcould not: the run failed with "GitHub Actions is not permitted to create or approve pull requests". That is a repository setting, under Settings, Actions, General. Turning it on would let the workflow do this itself next time.