KNEL/KNEL-TSYSDevStack-SupportStack-Cloudron
6
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: sync founder ruling wave; landed tickets to Feedback [#632]

Browse Source 
Killed: Runme, OpenBoxes, Gophish, WireViz, Pimcore (open-core),
Mender (SSO tax). DataHub -> k8s queue. NCAT #673 approved+queued.
Landed 10 moved Resolved->Feedback per founder (UAT pending).
GitUrlList 46->41; standing policies recorded (no-Node, no-open-core,
no-SSO-tax, RustFS makes S3 a non-blocker). Builds still on hold.
This commit is contained in:
mrcharles
2026-09-06 19:48:48 -05:00
parent ccd0a721af
commit c77e596ecd
3 changed files with 33 additions and 34 deletions
Download Patch File Download Diff File Expand all files Collapse all files
STATUS.md
+31 -22
View File
@@ -59,16 +59,16 @@ GitUrlList pruned 56 → 46 accordingly.
|--------|-----|----------|--------|
| #633 | GoAlert | Monitoring | DONE 2026-09-06 (18th package, grind-verified) |
| #634 | Tirreno | Security | GO (verify-only; already deployed; local auth) |
| #635 | Runme | Automation | disposition: OUT OF SCOPE (CLI/editor tool, no service) |
| #636 | DataHub | Data-Management | BLOCKED (ES + Kafka, ~8 services) |
| #635 | Runme | Automation | KILLED by ruling (CLI tool) |
| #636 | DataHub | Data-Management | → k8s queue by ruling (was: blocked) |
| #637 | Docassemble | Legal | GO-with-risk (monolith container; OIDC via social config) |
| #638 | Pimcore | Business-Apps | GO-with-risk (composer build; OIDC bundle; PHP 8.4 pin) |
| #638 | Pimcore | Business-Apps | KILLED by ruling (open-core license) |
| #639 | Database-Gateway | Infrastructure | DONE (12th package) |
| #640 | FX | DevOps-Tools | DONE (13th package) |
| #642 | Rundeck | Automation | GO (official image; OSS LDAP, no OIDC) |
| #643 | HyperSwitch | Financial-Payments | GO-with-risk (no-node hit on dashboard; local auth) |
| #644 | PayrollEngine | Business-Apps | BLOCKED (local-only WebApp + MSSQL) |
| #645 | OpenBoxes | Business-Apps | GO w/ explicit local-auth acceptance (LDAP = dead config) |
| #645 | OpenBoxes | Business-Apps | KILLED by ruling (local-only auth not accepted) |
| #646 | Nautilus Trader | Financial-Trading | disposition: OUT OF SCOPE (framework) — ruling pending |
| #647 | Fleet | Monitoring | GO-with-risk (SAML first-class; build parked pending ruling) |
| #648 | NetBox | Infrastructure | DONE (16th package) |
@@ -78,11 +78,11 @@ GitUrlList pruned 56 → 46 accordingly.
| #653 | ConsulDemocracy | Collaboration | DONE (17th package, grind-verified) |
| #654 | BOINC | Scientific-Computing | disposition: OUT OF SCOPE — ruling pending |
| #655 | Slurm | System-Administration | disposition: OUT OF SCOPE — ruling pending |
| #656 | Gophish | Security | BLOCKED (local-only confirmed; phishing-console policy) |
| #656 | Gophish | Security | KILLED by ruling |
| #657 | SniperPhish | Security | upstream GONE (404 reconfirmed 09-06) |
| #658 | InvenTree | Business-Apps | DONE 2026-09-06 (19th package, grind-verified) |
| #659 | Mender | System-Administration | BLOCKED (Mongo + NATS + S3, ~10 services) |
| #661 | WireViz | Documentation-Tools | disposition: covered by wireviz-web package |
| #659 | Mender | System-Administration | KILLED by ruling (SSO tax) |
| #661 | WireViz | Documentation-Tools | KILLED by ruling (covered by wireviz-web) |
| #662 | KillBill | Business-Apps | GO (killbill+kaui in 1 container; mariadb addon) |
| #666 | SigNoz | Monitoring | blocked: OSS local-only auth + mandatory ClickHouse |
| #667 | Sentry | Monitoring | blocked: 56-service Kafka/CH mesh |
@@ -90,7 +90,7 @@ GitUrlList pruned 56 → 46 accordingly.
| #669 | eLabFTW | Business-Apps | DONE (15th package) |
| #671 | Resgrid Core | Project-Management | GO-with-risk (bundle RabbitMQ; 5 processes) |
| #672 | SDRangel | Infrastructure | disposition: OUT OF SCOPE (Qt desktop) — ruling pending |
| #673 | NCA Toolkit | Low-Code | GO (Flask API-key only; proxy-eligible; stale upstream) |
| #673 | NCA Toolkit | Low-Code | APPROVED by ruling — queued (builds on hold) |
| #675 | Security Awareness Training | Security | OUT OF SCOPE (Marp slide deck, not an app) |
## Packaging Patterns Established
@@ -115,13 +115,13 @@ Full write-ups of each pattern + challenges are in [`JOURNAL.md`](JOURNAL.md).
| Documentation-Tools | 3 | 2/3 | wireviz-web, draw.io done |
| Low-Code | 2 | 1/2 | corteza done (openblocks removed) |
| Monitoring | 5 | 2/5 | healthchecks, goalert done (langfuse removed) |
| Automation | 3 | 1/3 | windmill done (huginn removed) |
| Business-Apps | 6 | 2/6 | elabftw, inventree done (midday removed) |
| Automation | 2 | 1/2 | windmill done (huginn, runme removed) |
| Business-Apps | 4 | 2/4 | elabftw, inventree done (midday, openboxes, pimcore removed) |
| Collaboration | 2 | 1/2 | consuldemocracy done |
| Infrastructure | 6 | 5/6 | easy-gate, rathole, database-gateway, chirpstack, netbox done |
| Data-Management | 2 | 0/2 | datahub, seatunnel |
| Security | 4 | 0/4 | tirreno, gophish, sniperphish, sat (comply removed) |
| System-Administration | 2 | 0/2 | mender, slurm |
| Security | 2 | 0/2 | tirreno pending ruling (gophish, sniperphish, sat, comply removed) |
| System-Administration | 1 | 0/1 | slurm (mender removed) |
| Scientific-Computing | 2 | 0/2 | boinc, jamovi |
| Financial-Payments | 1 | 0/1 | hyperswitch |
| Financial-Trading | 1 | 0/1 | nautilus (out-of-scope pending ruling) |
@@ -167,19 +167,28 @@ LDAP acceptable (risk flag), 🔄 = auth-proxy (no users), ❌ = local-only
| Gophish | no | no | ❌ blocked | Local admin login only, no SSO — do not package until auth added |
**State (2026-09-06, end of disposition pass): every remaining ticket
carries a researched disposition note on Redmine — the full list now
awaits human rulings before any further builds.**
**State (2026-09-06 evening, after the founder's ruling wave): landed
packages sit in Feedback (awaiting live-Cloudron UAT); builds are ON
HOLD while the founder reviews the queue.**
| Bucket | Tickets |
|--------|---------|
| Landed (Resolved) | #633 #639 #640 #648 #650 #651 #653 #658 #668 #669 |
| GO — awaiting go-order | #634 (verify-only) · #642 Rundeck · #662 KillBill · #673 NCA Toolkit (proxy) · #645 OpenBoxes (needs explicit local-auth acceptance) · #647 Fleet (SAML risk; research+digest banked) · #833 jamovi (new ticket; proxy; 3-origin risk) |
| GO-with-risk — heavier | #637 Docassemble · #638 Pimcore · #643 HyperSwitch (no-node dashboard workaround) · #671 Resgrid (bundle RabbitMQ) |
| BLOCKED | #636 DataHub · #644 PayrollEngine · #656 Gophish · #659 Mender · #666 SigNoz · #667 Sentry |
| OUT OF SCOPE (ruling pending) | #635 Runme · #646 Nautilus · #649 SeaTunnel · #654 BOINC · #655 Slurm · #672 SDRangel · #675 SAT (slide deck) |
| Upstream gone / covered | #657 SniperPhish (404) · #661 WireViz (covered by wireviz-web) |
| Ruled already (removed/k8s) | #660 #641 #670 (no-node) · #663 #678 (k8s) · deleted: Huginn/Midday/OpenBlocks/Warp/Comply/TODO-policies |
| Landed — Feedback (awaiting UAT) | #633 #639 #640 #648 #650 #651 #653 #658 #668 #669 |
| APPROVED — queued (hold) | #673 NCA Toolkit (proxy-eligible Flask API; RustFS makes S3 a non-issue) |
| GO — no explicit ruling yet | #634 Tirreno (verify-only; already deployed) · #642 Rundeck (OSS LDAP, no OIDC) · #662 KillBill · #647 Fleet (SAML risk; digest banked) · #833 jamovi (new; proxy; 3-origin risk) |
| GO-with-risk — no ruling yet | #637 Docassemble · #643 HyperSwitch (no-node dashboard workaround needed) · #671 Resgrid (bundle RabbitMQ) |
| KILLED by rulings (this wave) | #635 Runme · #645 OpenBoxes · #656 Gophish · #661 WireViz · #638 Pimcore (open-core) · #659 Mender (SSO tax) |
| → k8s queue | #636 DataHub (joins #663 #678) |
| OUT OF SCOPE (ruling pending) | #646 Nautilus · #649 SeaTunnel · #654 BOINC · #655 Slurm · #672 SDRangel · #675 SAT |
| Upstream gone | #657 SniperPhish (404) |
| Ruled earlier (removed) | #660 #641 #670 (no-node) · deleted: Huginn/Midday/OpenBlocks/Warp/Comply/TODO-policies |
**Standing policies (founder, 2026-09-06): no Node-served apps; no
open-core licenses; NO SSO TAX (enterprise-gated SSO = dealbreaker);
RustFS on the Cloudron makes S3-compatible storage a non-blocker.**
**Tech debt:** add `httpAuth` proxy to Webhook + WireViz Web (stateless apps);
revise Puter auth.
**Deferred:** Gophish #656 (blocked-on-auth, policy-sensitive).
**Tech debt:** add `httpAuth` proxy to Webhook + WireViz Web (stateless apps);
revise Puter auth.
@@ -215,7 +224,7 @@ revise Puter auth.
| Component | Details |
|-----------|---------|
| Goal | Package ~57 upstream FLOSS apps for Cloudron (TSYS PaaS of choice) |
| Upstream source list | [`GitUrlList.txt`](GitUrlList.txt) (46 repos after the 09-06 rulings) |
| Upstream source list | [`GitUrlList.txt`](GitUrlList.txt) (41 repos after the 09-06 rulings) |
| Workspace | `Package-Workspace/<Category>/<app>/` (cloned upstream `repo/` dirs are gitignored) |
| Templates | `Package-Templates/` (python-app, django-app, official-wrapper) |
| Git remote | `ssh://git@git.knownelement.com:29418/KNEL/TSYSDevStack-SupportStack-Cloudron.git` (`origin/main`) |