Issues

• XC-157: The production overlay names the development object store: minio.enabled stays on in a production render

  parkedseverity:medium
  AI-Riksarkivet/rask#647 · Filter by author Borg93 opened on Oct 16, 2026

• XC-156: The development OpenFGA pod mounts a ServiceAccount token nothing in it uses

  parkedseverity:low
  AI-Riksarkivet/rask#646 · Filter by author Borg93 opened on Oct 16, 2026

• LH-499: The catalog is OpenFGA's only runtime writer — maintenance and the annotator write grants through catalog doors

  criterion-2parkedphase-1
  AI-Riksarkivet/rask#645 · Filter by author Borg93 opened on Oct 16, 2026

• XC-155: Dagger lanes built on base() cannot build on an aarch64 host: lance-graph has no wheel and the base image has no C compiler

  parked
  AI-Riksarkivet/rask#644 · Filter by author Borg93 opened on Oct 16, 2026

• LH-498: a version committed through version/create is never announced when the handler fails after the finalize

  criterion-4parked
  AI-Riksarkivet/rask#643 · Filter by author Borg93 opened on Oct 16, 2026

• XC-154: governance-chain grants lineage its provenance rungs the way the chart does

  parked
  AI-Riksarkivet/rask#642 · Filter by author Borg93 opened on Oct 16, 2026

• LH-497: A committed version whose announcement was lost is found and announced: the commit is the outbox

  parked
  AI-Riksarkivet/rask#641 · Filter by author Borg93 opened on Oct 15, 2026

• LH-496: The dev Postgres for OpenFGA and the Dapr state store becomes a stock-Postgres fixture; nothing needs AGE

  parked
  AI-Riksarkivet/rask#640 · Filter by author Borg93 opened on Oct 15, 2026
  1

• LH-494: Maintenance scales out: per-table expiry leases and a singleton backstop tick, replacing the pinned single replica

  criterion-5phase-1-after-launchphase-1severity:medium
  AI-Riksarkivet/rask#638 · Filter by author Borg93 opened on Oct 15, 2026

• LH-488: OpenFGA checks that follow a write set no consistency preference, so an enabled check cache could allow a just-revoked grant

  parkedseverity:low
  AI-Riksarkivet/rask#620 · Filter by author Borg93 opened on Oct 13, 2026

• LH-487: A keyed door that refuses before writing keeps its idempotency claim, so a corrected retry gets 409 for up to 300 s

  parkedseverity:low
  AI-Riksarkivet/rask#619 · Filter by author Borg93 opened on Oct 13, 2026

• LH-486: Responses that carry vended credentials set no Cache-Control, so a shared cache may store them

  parkedseverity:low
  AI-Riksarkivet/rask#618 · Filter by author Borg93 opened on Oct 13, 2026

• LH-485: Error bodies leave the spec's instance field empty, so a redacted 5xx cannot be traced to its occurrence

  parkedseverity:low
  AI-Riksarkivet/rask#617 · Filter by author Borg93 opened on Oct 13, 2026

• LH-484: Maintenance reports an ungoverned table but never restores its parent edges, so the table stays unreadable to everyone

  parkedseverity:low
  AI-Riksarkivet/rask#616 · Filter by author Borg93 opened on Oct 13, 2026

• LH-483: Request-serving Deployments roll with a quarter of their pods unavailable, so every upgrade drops capacity

  parkedseverity:medium
  AI-Riksarkivet/rask#615 · Filter by author Borg93 opened on Oct 13, 2026

• LH-482: A lost commit announcement is rebuilt as an anonymous reconcile run, though the commit can carry its own provenance

  parkedseverity:medium
  AI-Riksarkivet/rask#614 · Filter by author Borg93 opened on Oct 13, 2026

• LH-479: While the IdP or issuer mirror is down, every request carrying any bearer makes its own 15 s key-set or discovery fetch

  bugparkedseverity:medium
  AI-Riksarkivet/rask#611 · Filter by author Borg93 opened on Oct 13, 2026

• SPEC: the catalog holds every gate; provenance is a rask service (ADRs 0154-0158)

  criterion-1criterion-2criterion-3criterion-4phase-1ready-for-agent
  AI-Riksarkivet/rask#593 · Filter by author Borg93 opened on Oct 12, 2026

• CP-061: runners/ingest: ingest as a client job on bring-your-own compute

  phase-1-after-launchseverity:medium
  AI-Riksarkivet/rask#583 · Filter by author Borg93 opened on Oct 12, 2026

• XC-151: new-machine.sh pushes pinned images to :5000 but renders them bare (localImages=true) — a fresh machine's make k3s-up ImagePullBackOffs on docker.io/library/*

  bugneeds-triagephase-1-after-launch
  AI-Riksarkivet/rask#577 · Filter by author carpelan opened on Oct 12, 2026
  2

• LH-460: Assist frame fetch accepts scheme-relative // URLs: the viewer is not the only authority reachable

  bugneeds-triagephase-1-after-launchseverity:medium
  AI-Riksarkivet/rask#576 · Filter by author carpelan opened on Oct 12, 2026

• XC-146: values-prod ships the Ingress with host: "" — a host-less catch-all rule the chart's own values.yaml documents as a cluster-wide path claim (routing capture) in prod

  bugcriterion-2needs-triagephase-1severity:medium
  AI-Riksarkivet/rask#573 · Filter by author carpelan opened on Oct 12, 2026

• LH-458: location_claims.release() read-then-unconditional-delete can delete a claim a concurrent rename hand-over just wrote, reopening the two-ids-on-one-location hazard

  bugcriterion-2needs-triagephase-1severity:high
  AI-Riksarkivet/rask#571 · Filter by author carpelan opened on Oct 12, 2026

• FE-20: studio /api/infer path validator permits '..' segments despite the stated no-.. contract, unfencing the chosen Serve app

  bugneeds-triagephase-1-after-launchseverity:medium
  AI-Riksarkivet/rask#570 · Filter by author carpelan opened on Oct 12, 2026

• FE-19: Annotator remote commands interpolate client-controlled strings into upstream fetch paths without encoding or picklists

  bugneeds-triagephase-1-after-launchseverity:medium
  AI-Riksarkivet/rask#569 · Filter by author carpelan opened on Oct 12, 2026