BLOCKERS

READINESS_AUTHORITY: non-authoritative blocker register. This file is a narrow list of unresolved external/operator risks and is not the deploy readiness source of truth. The canonical readiness source is docs/improvement-plan/OPERATOR-CHECKLIST.md; feature/runtime truth remains in the linked feature docs, manifests, and runbooks.

Live external/operator blocker register. Keep only unresolved risks here. Resolved incident details are intentionally not kept in this live file; use git history for forensic archaeology and the canonical feature/runbook docs for current runtime truth.

Active Blockers

B-006 — External Security Review of WASM Sandbox

Status: waiting-for-operator-procurement Owner: operator/external security reviewer Blocks: production rollout of third-party plugin execution.

The plugin runtime foundation has internal tests and production fail-closed gates, but production enablement remains blocked until an external security firm reviews the WASM sandbox and capability gateway.

Review scope:

Sandbox-escape resistance
Capability-gateway tampering resistance
Ed25519 signature trust model
Crash-tracker bypass scenarios
Audit-log tamper-evidence

Staging/foundation use is allowed behind PLUGIN_RUNTIME_PRODUCTION_ENABLED=false. Production signoff must happen through docs/security/plugin-runtime-signoff.md; current implementation truth lives in docs/features/plugins.md, docs/operations/plugin-lifecycle.md, and docs/security/plugin-internal-findings.md.

Next operator step: procure the review, file findings under docs/improvement-plan/06-plugin-system/security-findings/, address all Critical/High findings, then record final signoff in the security runbook.

Unresolved Risks

B-012 — Gitea-runner Docker `default-address-pool` recurrence risk

Status: mitigated-now-but-recurs-without-config-change Owner: operator Blocks: no active deploy; future push-to-main deploys can be blocked if self-hosted runner Docker networks leak again.

The self-hosted Gitea Actions runner previously exhausted Docker's default address pool after leaked per-job networks accumulated beside long-lived service networks. A one-time prune restored deploy workflow execution, but recurrence remains possible until the runner host is hardened.

Permanent operator actions:

Enlarge Docker default-address-pools on the runner host and restart Docker during a maintenance window.
Add scheduled cleanup for orphaned Gitea Actions task networks.
Consider moving CI runners to dedicated infrastructure so CI network churn cannot contend with long-lived service stacks.

Repo-side support already exists through deploy and Docker baseline checks: pnpm run verify:deploy-workflow and pnpm run verify:docker-baseline.

Resolved

Resolved entries were removed from this live register on 2026-05-28 to avoid stale operational claims and sensitive incident residue. Canonical current docs:

docs/improvement-plan/OPERATOR-CHECKLIST.md
docs/features/plugins.md
docs/operations/plugin-lifecycle.md
docs/ops/worker-queues.md
docs/architecture/csrf.md
docs/observability/sentry-selfhost.md
docs/ops/stripe-meters-migration.md

3.2 KiB Raw Blame History