events-cli 0.6.1__tar.gz → 0.9.0__tar.gz

{events_cli-0.6.1 → events_cli-0.9.0}/.claude/skills.local.yaml.example

@@ -13,4 +13,4 @@ culture_server_yaml: ~/.culture/server.yaml
 sibling_projects:
   - ../guildmaster
   - ../steward
-  - ../teken
+  - ../agentfront

events_cli-0.9.0/.devague/current

@@ -0,0 +1 @@
+events-first-slice

events_cli-0.9.0/.devague/current_plan

@@ -0,0 +1 @@
+events-first-slice

events_cli-0.9.0/.devague/deliveries/events-first-slice.json

@@ -0,0 +1,31 @@
+{
+  "plan_slug": "events-first-slice",
+  "schema_version": 1,
+  "created": "2026-07-24T04:29:51Z",
+  "updated": "2026-07-24T13:18:58Z",
+  "deviations": [
+    {
+      "id": "d1",
+      "what": "Pinned eclipse-mosquitto:2.1.2, not a 2.0.x \u2014 the floating eclipse-mosquitto:2 tag now resolves to 2.1.2, and 2.1 ships an unauthenticated http_api dashboard on 9883 by DEFAULT. The generated mosquitto.conf therefore replaces the image's bundled config wholesale to suppress 9883, rather than relying on the 2.0 upstream defaults the spec assumed. allow_anonymous=false and localhost-only-with-no-listener still hold in 2.1.2 (verified locally), so the loopback+anonymous-on-loopback posture is unchanged; only the 'rely on defaults' premise for the dashboard changed to 'actively suppress'.",
+      "task_ref": "t5",
+      "reason": "The spec's Mosquitto-facts section and honesty h4 named eclipse-mosquitto:2 and 'Mosquitto 2.0 already defaults the way #1 wants'; verified on the box that :2 is 2.1.2 with a new default exposure (9883). The security outcome the spec wanted (nothing off-loopback, no anonymous LAN access) is preserved, but via explicit config not default-reliance.",
+      "affects": [
+        "c4",
+        "c27"
+      ],
+      "origin": "llm",
+      "status": "proposed",
+      "classification": "acceptable"
+    },
+    {
+      "id": "d2",
+      "what": "Corrected the image pin to eclipse-mosquitto:2.1.2-alpine \u2014 the tag d1 chose, eclipse-mosquitto:2.1.2, is NOT published on Docker Hub (docker manifest inspect returns 'no such manifest'), so events up would fail to pull on any clean host and only worked here off a locally-cached image. The 2.1 line is published exclusively with the -alpine suffix (2.1.0-alpine, 2.1.1-alpine, 2.1.2-alpine). Verified eclipse-mosquitto:2 and eclipse-mosquitto:2.1.2-alpine resolve to an IDENTICAL manifest digest (sha256:6dba0f1b2795ddcb, linux/amd64), so the -alpine pin is byte-identical to what the floating tag serves today and d1's 9883-suppression reasoning is unchanged.",
+      "task_ref": "t8",
+      "reason": "d1 derived the version from the locally-cached image's org.opencontainers.image.version label (2.1.2) and pinned that string, without probing the registry for whether a tag of that exact name is published. The label reports the software version; it is not a tag name. Docker never pulled because the local cache satisfied the reference, so the gap stayed invisible until t8's integration suite tried a real pull.",
+      "affects": [],
+      "origin": "llm",
+      "status": "proposed",
+      "classification": "acceptable"
+    }
+  ]
+}