Thore Cimbal 24ae5b9d2b docs: Gate 1 for #0051 — the backlog is three piles, not one ...

Now that the pipeline sees the whole estate, the numbers in the issue are
obsolete and the work decomposes. A hundred and fifteen critical findings in
running images have a fix version and are an update exercise. Sixty-eight have
none, concentrated on eight images, and each needs a decision with an expiry
rather than a patch. Sixty-two sit on three build artefacts that run nowhere and
are almost entirely unfixable — for those, remediation is the wrong answer; they
belong out of the registry or out of the target set.

Concentration matters for scoping: forty-one running images carry critical
findings, but nineteen of them carry eighty percent.

The pass is deliberately critical-first. Twenty-six hundred high findings in
running images are a category, not an undertaking, and saying so belongs in the
closeout rather than in a footnote.

2026-08-21 12:00:00 +00:00

..

0001-matrix-03-www-matrix-axion1337-de-ist.md

docs(issues): close #0001, #0003 — matrix/game www cleanup done

2026-08-14 12:00:00 +00:00

0002-game-01-host-von-cfgmon-aus-nicht-erreichbar-2.md

#0002 abgeschlossen: Game-Host ist angebunden, alle Targets up

2026-08-20 12:00:00 +00:00

0003-game-02-www-game-axion1337-de-ist-ueberfluessig.md

docs(issues): close #0001, #0003 — matrix/game www cleanup done

2026-08-14 12:00:00 +00:00

0004-overmind-02-e1000e-nic-hang-beobachtung-nach.md

issues: M1 down to one — #0056 and #0004 struck, #0078 taken up

2026-08-21 12:00:00 +00:00

0005-zone-01-ionos-default-records-bereinigen-www.md

docs(issues): close #0005 — IONOS zone cleanup complete

2026-08-14 12:00:00 +00:00

0006-zone-02-apex-dmarc-ist-p-none-und-schuetzt.md

docs(issues): close #0006 — apex DMARC already at p=reject, DKIM present

2026-08-14 12:00:00 +00:00

0007-cfgmon-01-zertifikatserneuerung-braucht-offene.md

docs(issues): close #0007 done — DNS-01 live and verified

2026-08-14 12:00:00 +00:00

0008-cfgmon-03-prometheus-remote-write-und-loki.md

docs(issues): close #0008 with its reservation stated

2026-08-19 12:00:00 +00:00

0009-cfgmon-04-grafana-admin-credentials-aus-env.md

feat: slice 4 - the open management issues live in the repo

2026-08-11 12:00:00 +00:00

0010-cfgmon-09-gitea-backups-off-host-borg-storage.md

docs(issues): reject #0010 (Gitea is a mirror), age key escrow resolves #0030 risk

2026-08-14 12:00:00 +00:00

0014-cfgmon-14-root-zugang-ueber-die-docker-gruppe.md

docs(issues): review all waiting issues, close #0041 and #0025

2026-08-15 12:00:00 +00:00

0015-cfgmon-15-token-hygiene-einmal-tokens-der.md

docs(issues): defer token rotation to platform acceptance (#0015, #0027 W4)

2026-08-15 12:00:00 +00:00

0018-doc-01-wiki-rollout-abschliessen-ci-freigaben.md

docs(issues): reject #0018 as moot, close #0028 as already running

2026-08-15 12:00:00 +00:00

0019-doc-02-veralteten-wiki-branch-im-gitops-repo.md

feat: slice 4 - the open management issues live in the repo

2026-08-11 12:00:00 +00:00

0020-doc-03-wiki-oberflaeche-entscheiden-docusaurus.md

docs: resolve wiki hostname + surface decisions, track the two follow-ups

2026-08-11 12:00:00 +00:00

0021-overmind-03-windows-build-vm-verschwindet-ci.md

docs(issues): review all waiting issues, close #0041 and #0025

2026-08-15 12:00:00 +00:00

0022-build-01-macos-client-reproduzierbar-bauen.md

feat: slice 4 - the open management issues live in the repo

2026-08-11 12:00:00 +00:00

0023-doc-04-navbar-logo-im-docusaurus-wiki-wird.md

docs(issues): reject #0023 (obsolete post-Wikijs), plan #0007 cert renewal

2026-08-14 12:00:00 +00:00

0024-wiki-hostname-klaeren-wiki-lab-oder-axionwiki.md

docs: resolve wiki hostname + surface decisions, track the two follow-ups

2026-08-11 12:00:00 +00:00

0025-deploy-uebergabe-cve-alarme-aggregiert-receiver.md

docs(issues): review all waiting issues, close #0041 and #0025

2026-08-15 12:00:00 +00:00

0027-audit-01-acht-widersprueche-aus-dem-labnet-02.md

docs(issues): reopen #0027 — W5 and W7 are unresolved again

2026-08-15 12:00:00 +00:00

0028-mirror-01-ein-ausfall-der-push-mirrors-bleibt.md

docs(issues): reject #0018 as moot, close #0028 as already running

2026-08-15 12:00:00 +00:00

0029-ui-harmonisieren-gleiche-farben-und-formen.md

feat: slice 4 - the open management issues live in the repo

2026-08-11 12:00:00 +00:00

0030-der-restore-ist-nie-geprobt-sicherungen-sind.md

docs: the widened alarms are live, and their fallback is no longer theory

2026-08-21 12:00:00 +00:00

0031-stillstandspruefung-gitea-token-und-authentik.md

docs(issues): close #0031 and #0104 - green is the normal state again

2026-08-19 12:00:00 +00:00

0032-gameserver-hat-keinen-push-mirror-und-auf-gitea.md

STATUS nach Meilenstein gruppieren, #0032 abgelehnt

2026-08-20 12:00:00 +00:00

0033-overmind-01-element-desktop-build-lab-registry.md

chore(issues): record the mirror addresses from the first full run

2026-08-18 12:00:00 +00:00

0034-cfgmon-11-gitea-ci-rueckbau-abschliessen.md

chore(issues): record the mirror addresses from the first full run

2026-08-18 12:00:00 +00:00

0035-rollout-agents-pointer-axion1337-chat-gitops.md

docs(issues): close #0035-#0039 — group-rules pointers rolled out

2026-08-15 12:00:00 +00:00

0036-rollout-agents-pointer-threadnet-web.md

docs(issues): close #0035-#0039 — group-rules pointers rolled out

2026-08-15 12:00:00 +00:00

0037-rollout-agents-pointer-threadnet-call.md

docs(issues): close #0035-#0039 — group-rules pointers rolled out

2026-08-15 12:00:00 +00:00

0038-rollout-agents-pointer-thread-net-git.md

docs(issues): close #0035-#0039 — group-rules pointers rolled out

2026-08-15 12:00:00 +00:00

0039-rollout-agents-pointer-threadnet-operating.md

docs(issues): close #0035-#0039 — group-rules pointers rolled out

2026-08-15 12:00:00 +00:00

0040-neckbeard-rueckmeldungen-einreichen.md

AARs nachgeholt: vier Pflichtfaelle, die ich uebergangen habe

2026-08-20 12:00:00 +00:00

0041-wartegrund-der-importierten-waiting-issues.md

docs(issues): review all waiting issues, close #0041 and #0025

2026-08-15 12:00:00 +00:00

0042-migration-in-betrieb-nehmen-push-spiegel-schedule.md

docs(issues): close #0042 - the schedule step was already satisfied

2026-08-18 12:00:00 +00:00

0043-invitation-flow-eindeutigkeit-case-insensitiv.md

docs(issues): close #0043, record the coverage map for #0044

2026-08-15 12:00:00 +00:00

0044-sops-secret-aenderung-startet-dienst-nicht-neu.md

docs(issues): close #0044 — no reloader, the moving secrets are already covered

2026-08-15 12:00:00 +00:00

0045-report-event-kein-kontaktweg-fuer-melder.md

docs(issues): close #0045 — reporting no longer ends in silence

2026-08-15 12:00:00 +00:00

0046-wiki-in-threadnet-server-suite-umziehen.md

docs(issues): close #0046/#0049/#0050 — wiki move, abschottung verified, theming done

2026-08-13 12:00:00 +00:00

0047-wiki-oberflaeche-ueber-bookstack-hinaus-pruefen.md

docs: decide Wiki.js (ADR-0014, supersedes 0007) + wiki build issues

2026-08-12 12:00:00 +00:00

0048-wikijs-in-der-suite-deployen.md

docs(issue): close #0048 — wikijs postgres backup live, all criteria met

2026-08-13 12:00:00 +00:00

0049-wikijs-oidc-rollen-abschottung.md

docs(issues): close #0046/#0049/#0050 — wiki move, abschottung verified, theming done

2026-08-13 12:00:00 +00:00

0050-wikijs-theming-farben-logo.md

docs(issues): close #0046/#0049/#0050 — wiki move, abschottung verified, theming done

2026-08-13 12:00:00 +00:00

0051-cve-remediation-pass.md

docs: Gate 1 for #0051 — the backlog is three piles, not one

2026-08-21 12:00:00 +00:00

0052-update-kadenz-latest-beseitigen.md

docs(issues): close #0052 — no :latest left, coturn pinned and verified

2026-08-15 12:00:00 +00:00

0053-historien-durchgang-nicht-kanonische-commits.md

chore(issues): record the mirror addresses from the first full run

2026-08-18 12:00:00 +00:00

0054-ki-geraeuschunterdrueckung-element-call.md

docs(issues): #0054 — phone test cancelled, not deferred (sorb)

2026-08-17 12:00:00 +00:00

0055-npm-scope-aufloesung-threadnet-web.md

#0055: Korrektur - "vollstaendig geschlossen" stimmte nicht

2026-08-20 12:00:00 +00:00

0056-gitops-9-external-postgresql-migration-cloudnativepg-o.md

issues: M1 down to one — #0056 and #0004 struck, #0078 taken up

2026-08-21 12:00:00 +00:00

0057-gitops-11-element-call-vp9-codec-retry.md

feat(issues): adopt the component trackers — one backlog, one numbering (ADR-0019)

2026-08-18 12:00:00 +00:00

0058-gitops-14-web-application-firewall-waf.md

feat(issues): adopt the component trackers — one backlog, one numbering (ADR-0019)

2026-08-18 12:00:00 +00:00

0059-gitops-16-pod-security-admission-restricted.md

feat(issues): adopt the component trackers — one backlog, one numbering (ADR-0019)

2026-08-18 12:00:00 +00:00

0060-gitops-17-federation-allowlist-or-closed-federation-dec.md

docs(issues): close #0060 - group call verified with federation closed

2026-08-19 12:00:00 +00:00

0061-gitops-20-external-secrets-operator-vs-current-sops-set.md

feat(issues): adopt the component trackers — one backlog, one numbering (ADR-0019)

2026-08-18 12:00:00 +00:00

0062-gitops-21-renovate-dependabot-for-chart-and-image-updat.md

feat(issues): adopt the component trackers — one backlog, one numbering (ADR-0019)

2026-08-18 12:00:00 +00:00

0063-gitops-22-security-advisory-monitoring-ess-element.md

feat(issues): adopt the component trackers — one backlog, one numbering (ADR-0019)

2026-08-18 12:00:00 +00:00

0064-gitops-23-disable-automountserviceaccounttoken-where-no.md

feat(issues): adopt the component trackers — one backlog, one numbering (ADR-0019)

2026-08-18 12:00:00 +00:00

0065-gitops-25-k3s-api-security-hardening.md

feat(issues): adopt the component trackers — one backlog, one numbering (ADR-0019)

2026-08-18 12:00:00 +00:00

0066-gitops-26-auditd-for-file-integrity-syscall-audit.md

feat(issues): adopt the component trackers — one backlog, one numbering (ADR-0019)

2026-08-18 12:00:00 +00:00

0067-gitops-27-kernel-hardening-sysctl.md

feat(issues): adopt the component trackers — one backlog, one numbering (ADR-0019)

2026-08-18 12:00:00 +00:00

0068-gitops-28-lynis-security-baseline.md

feat(issues): adopt the component trackers — one backlog, one numbering (ADR-0019)

2026-08-18 12:00:00 +00:00

0069-gitops-29-crowdsec-integration.md

feat(issues): adopt the component trackers — one backlog, one numbering (ADR-0019)

2026-08-18 12:00:00 +00:00

0070-gitops-30-falco-runtime-monitoring.md

feat(issues): adopt the component trackers — one backlog, one numbering (ADR-0019)

2026-08-18 12:00:00 +00:00

0071-gitops-31-trivy-image-scanning-for-cves.md

feat(issues): adopt the component trackers — one backlog, one numbering (ADR-0019)

2026-08-18 12:00:00 +00:00

0072-gitops-34-dsgvo-datenschutz-compliance-konkretisieren.md

milestones: M6 — Zuletzt, and M1 closes with it (ADR-0027)

2026-08-21 12:00:00 +00:00

0073-gitops-35-architektur-monorepo-umbau-mit-generalisierte.md

feat(issues): adopt the component trackers — one backlog, one numbering (ADR-0019)

2026-08-18 12:00:00 +00:00

0074-gitops-39-cleanup-checkliste-laufend.md

docs(issues): #0074 - lucky locked, and why locked is not deactivated

2026-08-18 12:00:00 +00:00

0075-gitops-40-neue-issues-erscheinen-nicht-automatisch-im-g.md

docs: relevance pass over the backlog - close #0055, retire four stale issues

2026-08-18 12:00:00 +00:00

0076-gitops-41-registry-git-traffic-zum-gitea-host-ueber-pri.md

feat(issues): adopt the component trackers — one backlog, one numbering (ADR-0019)

2026-08-18 12:00:00 +00:00

0077-gitops-42-grafana-dashboard-fuer-clamav-scan-ergebnisse.md

#0077 erledigt, #0002 vermessen

2026-08-20 12:00:00 +00:00

0078-gitops-45-cve-meldeweg-v2-metriken-grafana-dashboard-al.md

issues: #0078 was already built and delivering — #0106 for what it hides

2026-08-21 12:00:00 +00:00

0079-gitops-46-issue-migration-nach-gitlab-zentrale-projekt.md

docs: relevance pass over the backlog - close #0055, retire four stale issues

2026-08-18 12:00:00 +00:00

0080-gitops-47-raidplaner-mit-sozialer-komponente-verfuegbar.md

feat(issues): adopt the component trackers — one backlog, one numbering (ADR-0019)

2026-08-18 12:00:00 +00:00

0081-gitops-48-gaeste-invite-workflow-per-bot-3-tage-account.md

feat(issues): adopt the component trackers — one backlog, one numbering (ADR-0019)

2026-08-18 12:00:00 +00:00

0082-gitops-49-cve-alarme-eine-matrix-nachricht-pro-cve-flut.md

docs(issues): close #0082 - its headline was fixed the day it was written

2026-08-19 12:00:00 +00:00

0083-gitops-50-monitoring-deploy-geaenderte-configs-greifen.md

docs: #0083 closed by measurement, #0088 corrected to the measured state

2026-08-21 12:00:00 +00:00

0084-gitops-51-ci-canonize-token-fuer-die-automatische-turn.md

docs(issues): close #0084 - the token exists and is proven to work

2026-08-19 12:00:00 +00:00

0085-gitops-52-docs-traegt-zwei-altbestaende-abgeschlossener.md

feat(issues): adopt the component trackers — one backlog, one numbering (ADR-0019)

2026-08-18 12:00:00 +00:00

0086-gitops-53-k8s-ressourcen-heissen-noch-element-web-docs.md

feat(issues): adopt the component trackers — one backlog, one numbering (ADR-0019)

2026-08-18 12:00:00 +00:00

0087-gitops-55-logo-fuer-die-authentik-anmeldemaske-entwerfe.md

feat(issues): adopt the component trackers — one backlog, one numbering (ADR-0019)

2026-08-18 12:00:00 +00:00

0088-gitops-56-networkpolicy-ausgehender-verkehr-ist-unbesch.md

docs: close #0088 — the call is measured, ADR-0025 accepted

2026-08-21 12:00:00 +00:00

0089-gitops-58-eigene-images-sind-unsigniert-beim-deploy-pru.md

feat(issues): adopt the component trackers — one backlog, one numbering (ADR-0019)

2026-08-18 12:00:00 +00:00

0090-gitops-59-kein-kubernetes-audit-log-zugriffe-an-der-api.md

feat(issues): adopt the component trackers — one backlog, one numbering (ADR-0019)

2026-08-18 12:00:00 +00:00

0091-gitops-61-enrollment-kollidierender-localpart-uebernimm.md

docs: relevance pass over the backlog - close #0055, retire four stale issues

2026-08-18 12:00:00 +00:00

0092-threadnet-web-1-default-client-einstellungen-theme-features-f.md

feat(issues): adopt the component trackers — one backlog, one numbering (ADR-0019)

2026-08-18 12:00:00 +00:00

0093-threadnet-web-3-settings-normalisieren-video-audio-einstellun.md

feat(issues): adopt the component trackers — one backlog, one numbering (ADR-0019)

2026-08-18 12:00:00 +00:00

0094-threadnet-web-4-direkter-link-zur-2fa-passkey-einrichtung-in.md

feat(issues): adopt the component trackers — one backlog, one numbering (ADR-0019)

2026-08-18 12:00:00 +00:00

0095-threadnet-web-6-windows-desktop-code-signing-installer-brandi.md

feat(issues): adopt the component trackers — one backlog, one numbering (ADR-0019)

2026-08-18 12:00:00 +00:00

0096-threadnet-web-7-rebranding-element-axion1337-web-desktop-gesa.md

feat(issues): adopt the component trackers — one backlog, one numbering (ADR-0019)

2026-08-18 12:00:00 +00:00

0097-threadnet-web-9-feedback-bugreport-weg-eigener-rageshake-oder.md

feat(issues): adopt the component trackers — one backlog, one numbering (ADR-0019)

2026-08-18 12:00:00 +00:00

0098-threadnet-web-11-themes-rollout-2026-08-02-web-live-linux-wind.md

docs: relevance pass over the backlog - close #0055, retire four stale issues

2026-08-18 12:00:00 +00:00

0099-threadnet-web-12-upstream-sicherheitsfixes-lassen-sich-nicht-m.md

#0099: Tor deckt den ganzen Baum ab, Spiegel ist wieder gleichauf

2026-08-20 12:00:00 +00:00

0100-threadnet-web-13-asset-pfade-tragen-weiterhin-element-themes-e.md

feat(issues): adopt the component trackers — one backlog, one numbering (ADR-0019)

2026-08-18 12:00:00 +00:00

0101-threadnet-call-4-kaputtes-paket-0-19-2-threadnet-6-in-der-regi.md

feat(issues): adopt the component trackers — one backlog, one numbering (ADR-0019)

2026-08-18 12:00:00 +00:00

0102-dmarc-und-mail-haertung-der-zone-axion1337-chat.md

#0102 abgeschlossen: DMARC gehoert wieder uns und ist scharf

2026-08-20 12:00:00 +00:00

0103-wiki-zugang-ohne-gruppe-endet-stumm.md

#0103 abgeschlossen: der gruppenlose Zustand ist jetzt erkennbar

2026-08-20 12:00:00 +00:00

0104-daueralarme-melden-nichts-mehr.md

docs(issues): close #0031 and #0104 - green is the normal state again

2026-08-19 12:00:00 +00:00

0105-projekt-wiki-vor-projektabschluss-klaeren.md

chore(issues): record #0105's mirror address

2026-08-18 12:00:00 +00:00

0106-cve-scan-deckt-nur-die-haelfte-zielliste-ist-handgepflegt.md

docs: close #0106, accept ADR-0026 — and the two AARs I had argued away

2026-08-21 12:00:00 +00:00

0107-aktives-konto-ohne-profil-zeile-faellt-nur-durch-beschwerde-auf.md

issues: #0107 — an account without a profile row only surfaces as a complaint

2026-08-21 12:00:00 +00:00

template.md

feat: slice 1 - the neckbeard framework chain runs end to end

2026-08-11 12:00:00 +00:00