docs: add fix prompts for the four open quasar runtime defects #9

Merged

nsaspy merged 2 commits from docs/quasar-fix-prompts into main

2026-09-06 23:12:48 +00:00

nsaspy commented

2026-09-06 23:12:45 +00:00

Owner

One task prompt per issue from the deployment record (infra issue #90), so each fix can be picked up as its own slice:

quasar-scope-capability.md — the live starintel-server closed scope vocabulary cannot grant the plugin-required quasar scope; the entitlement gate blocks every real login. Server-side fix + real-store verification.
bridge-transport-hardening.md — the escaped USOCKET condition that aborted the whole runtime image; transport errors must degrade to the auth_unavailable JSON contract.
production-logging-hygiene.md — the clack backtrace middleware that printed login credentials into journald; production listeners must never echo request content.
real-login-page.md — the operator asked for a real login page: a sign-in route in the standalone SPA posting to the existing /biz/auth/login bridge, with the gateway Basic gate, quasar #71/#72, and OIDC explicitly deferred and labeled in the UI.

Also scrubs the pre-existing internal host address from next-agent-runtime-slice.md (environment addresses do not belong in this public repository).

Local verification evidence: four prompts pass the section-contract + no-credential-material scan; quasar-auth standalone suite 36 checks 0 failures; prolog-verify check passed (observations recorded at c97f162).

One task prompt per issue from the deployment record (infra issue #90), so each fix can be picked up as its own slice: - quasar-scope-capability.md — the live starintel-server closed scope vocabulary cannot grant the plugin-required quasar scope; the entitlement gate blocks every real login. Server-side fix + real-store verification. - bridge-transport-hardening.md — the escaped USOCKET condition that aborted the whole runtime image; transport errors must degrade to the auth_unavailable JSON contract. - production-logging-hygiene.md — the clack backtrace middleware that printed login credentials into journald; production listeners must never echo request content. - real-login-page.md — the operator asked for a real login page: a sign-in route in the standalone SPA posting to the existing /biz/auth/login bridge, with the gateway Basic gate, quasar #71/#72, and OIDC explicitly deferred and labeled in the UI. Also scrubs the pre-existing internal host address from next-agent-runtime-slice.md (environment addresses do not belong in this public repository). Local verification evidence: four prompts pass the section-contract + no-credential-material scan; quasar-auth standalone suite 36 checks 0 failures; prolog-verify check passed (observations recorded at c97f162).

nsaspy added 2 commits

2026-09-06 23:12:45 +00:00

docs: add fix prompts for the four open quasar runtime defects 37fcacf7b6

One prompt per issue from the deployment record: the server-side quasar
scope vocabulary gap, bridge transport-error hardening (never abort the
runtime image), production logging hygiene (no credentials in any
output), and the real login page for the standalone edition, with the
gateway Basic gate, quasar #71/#72, and OIDC explicitly deferred.

docs: drop the internal host address from the runtime slice prompt c97f16228a

Environment addresses belong to the deploying infrastructure inventory,
not to this public repository.

nsaspy merged commit ae11147639 into main

2026-09-06 23:12:48 +00:00

nsaspy referenced this pull request from a commit

2026-09-06 23:12:49 +00:00

Merge pull request 'docs: add fix prompts for the four open quasar runtime defects' (#9) from docs/quasar-fix-prompts into main

No reviewers

No labels

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

starintel-labs/starintel-biz!9

No description provided.

Rows
Columns