Block a user
Encode the runner authorisation boundary and credential-escalation rule into drb-worksession.md
TRACKER: 12 discovery conversations by 2026-09-22 (GOALS.md kill criterion) - checkpoint 2026-09-05
deploy.yml runs compose up -d before the health check with no rollback - blocks unattended pushes to the AI pipeline
Close the /admin/features Firestore SSH side-door: require_service_key_or_admin + distinct agent credential
Runner must never hold a secret in its context - replace every token read with a WSL wrapper
Board 2026-08-24 - Unattended operating cadence and GOALS tracking - FINAL MINUTES
Board 2026-08-24 — Unattended operating cadence and GOALS tracking — CISO draft
Board 2026-08-24 -- Unattended operating cadence and GOALS tracking -- CTO draft
Board 2026-08-24 — Unattended operating cadence and GOALS tracking — CMO draft
Board 2026-08-24 — Unattended operating cadence and GOALS tracking — COO draft
P0: standing correlation-quality evaluation procedure (scheduled AI window)
Telegram control plane: owner-to-agent commands and CEO escalation need an always-on listener
Platform admin cannot see or change which org a user belongs to — user management is org-blind
Comped friends-and-family tier is uncapped AI spend: no entitlement flag, no per-org attribution, no cap
Owner ruling, 2026-08-23: comped node cap defaults to 3, and is configurable in the UI — not a hardcoded constant.
So the shape is a platform setting with a default of 3, editable by…
Comped friends-and-family tier is uncapped AI spend: no entitlement flag, no per-org attribution, no cap
Re-framed by board minutes #54, 2026-08-23, decision 6. Read this before working the issue.
The cost unit in this issue is wrong. It treats a comped account as the thing that spends.…
Board 2026-08-23 — Owner goals — FINAL MINUTES
Place verification geocodes unit call-signs: "Post 1-2" became a real map pin
Place verification geocodes unit call-signs: "Post 1-2" became a real map pin
Fixed in cc038e6, deployed and verified live — /health returns cc038e63265d7c517ecf950ff54e2473ad5eb99f (Gitea Actions run 559, Deploy to VM: success).
location is now dropped when it matches…