Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

Finish accepted GitHub and co-work outcomes after the manual-override slice

Open
  • Is something wrong?
#479 1 comment 0 reactions 1 assignee View on GitHub

Maintainers usually reply within 1 day

@Zamojski5 is already working on this.

Since Oct 11, 2026.

Assessment

This issue has not been assessed yet.

Description

Parent: #74. This child preserves the remaining accepted GitHub/co-work outcomes after the bounded manual-override/CAS/dormant-export slice in #379. It is tracking of existing v0.1 scope, not a new feature or a deferral. The parent stays open until every criterion below passes.

Acceptance criteria

  • AC-1: Authorized project settings bind zero or more repositories using least-privilege GitHub App access. Login, installation, project integration and repo bindings are distinct. Callback state binds user/project; verify current access and selected repositories. No global current repo, automatic new-repository grant expansion or tokens in models/exports. Private repository facts require current Flux and verified repo access. Test two projects, two owners and install/binding revocation.
  • AC-2: Verified many-to-many task↔PR links use binding/provider-host/stable repo/object IDs and role; support multi-repository required outputs and related-only links. Verify local CLI-created PRs before linking, preserve source timestamps and original authorship. Linking #42 from another repo/project cannot correlate incorrectly or leak metadata; same-repo bindings never share private Flux context.
  • AC-3: Signed webhooks enter a durable inbox before processing; deduplicate, handle out-of-order/redelivery and reconcile gaps/current provider state without an LLM. One binding failure cannot discard another binding delivery. Retry under current permission; uncertain external writes reconcile before retry. Disconnect/outage/import preserve permitted history with truthful unavailable/stale state and no active grants or autoruns. Bridge relevant events/comments of linked PRs into #153's targeted inbox under current access and explicit subscriptions/standing policy; correlate local request and provider event to suppress echoes/duplicate reviews. Gaps reconcile known objects without global model-driven repository scans. Untrusted external comments never expand grants or arbitrarily start work.
  • AC-4: Explain and enable standing automation rules for the SAME Flux task under current task authority and optimistic versions. PR/CI can move stages; closed-unmerged is not completion, merge/green checks alone cannot satisfy unmet task/device criteria, all required links matter, related-only links do not drive completion. Manual correction suspends automation until resumed. New SHA invalidates relevant review; no reassignment/audience expansion by incidental webhook. Preserve existing task statuses and separate execution/CI state.
  • AC-5: Docker integration tests and a real least-privilege test installation demonstrate binding, PR/CI/review/merge, duplicates/out-of-order events, manual override, access loss and recovery at the tested head. Verify current primary GitHub API/webhook/auth requirements. Preserve required GitHub approvals/checks and distinguish Flux assessment from eligible approval. Code execution stays in local owner clients; optional broker writes need separately scoped authority. CW-4 keeps routine ready/review/fixed coordination in Flux. When required or useful to external collaborators, publish substantive GitHub review once through an eligible authorized identity and link the external review ID to its Flux assessment. Existing GitHub review threads/checks/approvals remain real gates; never substitute a Flux-only verdict.

Already integrated evidence: #168 verified linking/durable delivery; #270 disclosed G-1a rule; #379 delivers only its declared manual override/CAS/migration0068/dormant-export increment. These slices do not certify the complete criteria above.

Remaining work includes real least-privilege App installation/public HTTPS, G-1b polling, G-1c manifest setup, G-1d suggested links; #153 current-recipient bridge, causal echo suppression and eligible once-only external review; and integrated multi-project/current-access/revocation/recovery/provider/client verification at one candidate. Optional UI pins and private-source/import proposals are not silently admitted. Preserve current contracts, final Prostota UI, public permissions and all actual GitHub approval/check gates.

Owner: Zamojski5 (handoff of the remaining #74 work). Evaluator: PelikanFix16. Subsequent bounded implementation resumes within the existing WIP queue. No additional implementation is started by this tracking record.

Ownership handoff, 2026-10-11: at the user's explicit request, remaining implementation is assigned to Zamojski5; independent evaluator is PelikanFix16. Acceptance criteria and required v0.1 scope are unchanged. This queues existing work, not an extra simultaneous implementation beyond the WIP limit. See the pinned handoff comment.

Dominant language
TypeScript
Stars
3
Forks
0
Avg merge
19h 9m
Merged PRs (30d)
334

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from ColdPhase/flux

All issues in ColdPhase/flux

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.