Repository navigation
Merge approvals pending #12
Description
Oversight lists each fork PR here once it has passed the gate and the independent review. The maintainer approves merges from this list; nothing merges without that approval.
| PR | Record | Evidence | Review | Status |
|---|---|---|---|---|
| #11 | #7 go-ntlmssp CVE | CVE regression test + NTLMv2 handshake test; lint 0; GO-2026-5543 gone. e2e + e2e-aws at 85fa93a (2026-10-20) PASS (2 known-bug skips, tracked in #13/#14) | Opus 5.5 (low) re-review: APPROVE at 85fa93a | ready for approval |
Blocked records (need a test environment or a decision)
| Record | Theme | Blocked on |
|---|---|---|
| #15 AAD/Entra MFA | 3 | Test env: Entra ID tenant with AWS app, MFA registration policy, CMSI |
| #18 Duo Universal Prompt | 7 | Test env: Duo tenant. Decision: native support vs Browser provider |
| #19 Okta to Identity Center | 8 | Test env: msp-agent customer-b Okta test org (fixtures being built). Decision: in scope at all? |
| #16 PingOne modern | 9 | Test env: msp-agent customer-a PingOne test (fixtures being built as config as code). Decision: new provider vs Browser route |
| #17 GoogleApps passkey | 10 | Parked by the maintainer. Test env: Workspace tenant (SAML app + 2SV are console-only) |
| #27 Live ADFS NTLM check | 5 | Test env: ADFS server |
| #28 | #22 deps vulns | govulncheck: 17 module findings → 0. x/net v0.60.0, jose2go v1.7.0, go-ntlmssp v0.1.1. go.mod go line raised to 1.26 (maintainer-accepted; release note). 9 stdlib findings need Go 1.27.2 toolchain. Overlaps #11 on go-ntlmssp: land #11 first, then #28 rebases clean. e2e + e2e-aws PASS at 9b63e95 (2026-10-20) |
Open questions for the maintainer
- Can we get any of the test tenants above (Entra first, since it has the most user pain)?
- For bug: GoogleApps passkey challenge and stale #1259 cluster #17: accept carrying the 3-line fix(googleapps): challenge node change Versent/saml2aws#1442 fix on fixture evidence alone, without a live reproduction?
fix(keycloak): Keycloak 26 wrong password re-post loop (#13) #20 re-post capDecided 2026-10-20: keep 3.fix: list-roles empty for single-role users (#14) #21 labelDecided 2026-10-20: acceptAccount: <id>and the fallback.- For gap: Duo Universal Prompt support #18, bug: PingOne (modern) sign-in unsupported by pingone provider #16 and bug: GoogleApps passkey challenge and stale #1259 cluster #17: is the Browser provider the supported route for IdPs we can't test natively?
Merged 2026-10-20 (maintainer-approved)
#10 (6aaa6c5), #20 (679d0da), #21 (f6e7159), #31 (e86fec9). Also merged: #30 (security review APPROVE), #29 (after rework: 0600 file fallback, security re-review APPROVE), #33 (d6aad13; #26, hardened, Sonnet APPROVE, e2e green), #11 (a0f5fe1; macOS TestAutoFill failure was a flake, passed on rerun). Awaiting: #28 (rebase after #11 + govulncheck citation).
Activity