Issues

• [architect] routes.rs Phase 1: extract presence handlers into presence_routes.rs

  agent/architectarchitecturehive/new-hive-99tech-debt
  tuna-os/spindle#519 · Filter by author hanthor-hive-agent opened on Oct 1, 2026

• [sec-check] benchmark workflow allows shell injection through rounds input

  agent/sec-checkhive/hive-school-tunaossecurity
  tuna-os/spindle#516 · Filter by author hanthor-hive-agent opened on Sep 30, 2026

• [architect] AppState couples session lifecycle, messaging, presence, and media into a 30+ field God object

  agent/architectarchitecturehive/new-hive-99tech-debt
  tuna-os/spindle#515 · Filter by author hanthor-hive-agent opened on Sep 30, 2026

• [sec-check] Security: 7 workflows missing top-level permissions block

  agent/sec-checkhive/hive-school-tunaossecurity
  tuna-os/spindle#513 · Filter by author hanthor-hive-agent opened on Sep 28, 2026

• [sec-check] Dockerfile base images should be pinned to specific digests

  agent/sec-checkhive/new-hive-99security
  tuna-os/spindle#512 · Filter by author hanthor-hive-agent opened on Sep 28, 2026

• [architect] routes.rs handler extraction and test coverage consolidation

  agent/architectarchitecturehive/hive-school-tunaostech-debt
  tuna-os/spindle#511 · Filter by author hanthor-hive-agent opened on Sep 28, 2026

• [architect] Extract presence and moderation handlers from routes.rs into domain modules

  agent/architectarchitecturehive/hive-school-tunaostech-debt
  tuna-os/spindle#508 · Filter by author hanthor-hive-agent opened on Sep 28, 2026

• Sliding sync works but /versions does not advertise org.matrix.simplified_msc3575

  tuna-os/spindle#507 · Filter by author hanthor opened on Sep 28, 2026

• [guide] ROADMAP.md v0.0.x gate says no tagged release exists; v0.0.1/v0.0.2 are published and #308 is closed

  agent/guidedocumentationhive/covered-by-prhive/hive-school-tunaos
  tuna-os/spindle#504 · Filter by author hanthor-hive-agent opened on Sep 27, 2026

• [guide] SECURITY.md fallback describes private reporting as not yet enabled (it is, #307 closed)

  agent/guidedocumentationhive/covered-by-prhive/hive-school-tunaos
  tuna-os/spindle#503 · Filter by author hanthor-hive-agent opened on Sep 27, 2026

• [architect] routes.rs is a 10.8k-line orchestration layer — 190 handlers should live in domain modules

  agent/architectarchitecturehive/hive-school-tunaostech-debt
  tuna-os/spindle#502 · Filter by author hanthor-hive-agent opened on Sep 26, 2026

• [strategist] Contributor entry: formalize onboarding and first-contribution guidance

  agent/strategisthive/hive-good-frogroadmap
  tuna-os/spindle#501 · Filter by author hanthor-hive-agent opened on Sep 26, 2026

• [strategist] v0.1.0 release maturity: track and audit evidence gates systematically

  agent/strategisthive/hive-good-frogroadmap
  tuna-os/spindle#500 · Filter by author hanthor-hive-agent opened on Sep 26, 2026

• [strategist] v0.0.x addressability: establish weekly prerelease tags and release notes discipline

  agent/strategisthive/hive-good-frogroadmap
  tuna-os/spindle#499 · Filter by author hanthor-hive-agent opened on Sep 26, 2026

• [architect] Handlers couple directly to AppState — unit testing requires spinning up full infrastructure (storage, config, auth, etc.)

  agent/architecthive/hive-school-tunaos
  tuna-os/spindle#498 · Filter by author hanthor-hive-agent opened on Sep 26, 2026

• [architect] Internal module contracts are unversioned — refactoring internal APIs is unsafe without checking all call sites

  agent/architecthive/hive-school-tunaos
  tuna-os/spindle#497 · Filter by author hanthor-hive-agent opened on Sep 26, 2026

• [architect] Module namespace is flat: 50+ top-level modules with no layering (API/domain/infrastructure)

  agent/architecthive/hive-school-tunaos
  tuna-os/spindle#496 · Filter by author hanthor-hive-agent opened on Sep 26, 2026

• [architect] AppState is a God object with 20+ Arc-wrapped fields — all modules bypass encapsulation

  agent/architecthive/hive-school-tunaos
  tuna-os/spindle#495 · Filter by author hanthor-hive-agent opened on Sep 26, 2026

• [architect] routes.rs is a 10.8K-line God module coupling all route registration, handlers, and middleware

  agent/architecthive/hive-school-tunaos
  tuna-os/spindle#494 · Filter by author hanthor-hive-agent opened on Sep 26, 2026

• [architect] routes.rs (10.8k LOC, 147 handlers, 111 functions) couples all HTTP endpoints in one god file

  agent/architectarchitecturehive/hive-school-tunaostech-debt
  tuna-os/spindle#493 · Filter by author hanthor-hive-agent opened on Sep 26, 2026

• [guide] SECURITY.md and ROADMAP.md still say the vulnerability-reporting gate is open; #307/#308 both closed it

  agent/guidedocumentationhive/covered-by-prhive/hive-school-tunaos
  tuna-os/spindle#491 · Filter by author hanthor-hive-agent opened on Sep 25, 2026

• [strategist] nightly Matrix compliance run flags REGRESSED protected test tests::room::test_room_account_data on main (SDK pin unchanged) — dashboard claims M2 Done

  agent/strategisthive/hive-school-tunaosroadmap
  tuna-os/spindle#488 · Filter by author hanthor-hive-agent opened on Sep 25, 2026

• [architect] Rooms::state / state_where stay pub, so the read gate is still enforced by semgrep, not by the type

  agent/architectarchitecturehive/covered-by-prhive/hive-school-tunaostech-debt
  tuna-os/spindle#486 · Filter by author hanthor-hive-agent opened on Sep 25, 2026

• security contact request

  agent/securityhive/hive-good-frog
  tuna-os/spindle#485 · Filter by author hanthor-hive-agent opened on Sep 25, 2026

• [guide] Document external hanthor repository dependencies and forks in mesh docs

  agent/guidedocumentationhive/hive-good-frog
  tuna-os/spindle#483 · Filter by author hanthor-hive-agent opened on Sep 24, 2026