Issues

• Files tab keeps showing a token error after rotation: panel never re-fetches on token change (follow-up to #3504)

  bug
  mcdonc/klangk#3547 · Filter by author runyaga opened on Oct 3, 2026

• Workspace token can expire unrenewed (reconnect doesn't mint, renewal clock/backoff wrong); LLM access lost

  bug
  mcdonc/klangk#3546 · Filter by author runyaga opened on Oct 3, 2026
  3

• super-e2e runner:nix dies in devenv-setup: nix-installer requires sudo on the NixOS VM

  bug
  mcdonc/klangk#3506 · Filter by author mcdonc opened on Oct 1, 2026

• super-e2e on stock runners: workspace containers never reach container_ready (nested rootless podman)

  bug
  mcdonc/klangk#3505 · Filter by author mcdonc opened on Oct 1, 2026

• Fuzz daily run killed by runner shutdown signal (exit 143) — 6 of last 10 runs

  mcdonc/klangk#3471 · Filter by author mcdonc opened on Sep 19, 2026

• Workspace backend interface: draft it and conform the podman path to it

  mcdonc/klangk#3466 · Filter by author mcdonc opened on Sep 15, 2026

• trufflehog pre-commit hook scans nothing (git --since-commit HEAD is always the empty set)

  mcdonc/klangk#3465 · Filter by author mcdonc opened on Sep 14, 2026

• Move workspace token outside of /tmp

  mcdonc/klangk#3463 · Filter by author runyaga opened on Sep 13, 2026

• aws-credential: SeaweedFS e2e suite (#3427)

  mcdonc/klangk#3437 · Filter by author mcdonc opened on Sep 12, 2026

• aws-credential: operator and end-user docs (#3427)

  mcdonc/klangk#3436 · Filter by author mcdonc opened on Sep 12, 2026

• aws-credential: workspace direct-AWS-access setting (#3427)

  mcdonc/klangk#3435 · Filter by author mcdonc opened on Sep 12, 2026

• aws-credential: signer-only egress - marks, ipset, never-learn (#3427)

  mcdonc/klangk#3434 · Filter by author mcdonc opened on Sep 12, 2026

• aws-credential: no-federation access-key fallback (#3427)

  mcdonc/klangk#3433 · Filter by author mcdonc opened on Sep 12, 2026

• aws-credential: feature bundle - tooling install and popup screens (#3427)

  mcdonc/klangk#3432 · Filter by author mcdonc opened on Sep 12, 2026

• aws-credential: klangkd OAuth client, IdP connect, STS exchange (#3427)

  mcdonc/klangk#3431 · Filter by author mcdonc opened on Sep 12, 2026

• aws-credential: tmux session-env delivery in the workspace runtime (#3427)

  mcdonc/klangk#3430 · Filter by author mcdonc opened on Sep 12, 2026

• aws-credential: placeholder minting and consent-channel distribution (#3427)

  mcdonc/klangk#3429 · Filter by author mcdonc opened on Sep 12, 2026

• aws-credential: sidecar AWS API front and SigV4 re-signer (#3427)

  mcdonc/klangk#3428 · Filter by author mcdonc opened on Sep 12, 2026

• Credential-free AWS service access from workspaces: sidecar SigV4 signer + per-user OIDC connect

  mcdonc/klangk#3427 · Filter by author mcdonc opened on Sep 12, 2026
  1

• Flaky 100% coverage gate: monitor_heartbeat_loop race-window arc 161->153

  mcdonc/klangk#3400 · Filter by author mcdonc opened on Sep 9, 2026

• Gate browser-delegate fetch (and browser-fetch feature) on egress consent

  mcdonc/klangk#3386 · Filter by author mcdonc opened on Sep 9, 2026

• FQDN egress: DNS-learned rules auto-allow private/reserved IPs

  mcdonc/klangk#3384 · Filter by author mcdonc opened on Sep 9, 2026

• Workspace ports publish unauthenticated on all interfaces

  mcdonc/klangk#3383 · Filter by author mcdonc opened on Sep 9, 2026

• Banner gate breaks feature-plugin callback routes carrying one-time credentials (same class as #3371)

  mcdonc/klangk#3381 · Filter by author mcdonc opened on Sep 9, 2026

• Dual-target flow for main + stable/2.0: fast-forward while unfrozen, labeled backports after freeze

  mcdonc/klangk#3361 · Filter by author mcdonc opened on Sep 8, 2026
  2