Issues

• security(agents): run the clone-gitops init container as non-root

  mctlhq/mctl-gitops#1720 · Filter by author mashkovd opened on Oct 9, 2026

• security(argo-workflows): label the namespace warn/audit restricted

  mctlhq/mctl-gitops#1719 · Filter by author mashkovd opened on Oct 9, 2026

• feat(claude-remote): roll labs remote session from Sonnet to Claude Haiku 5.5 after channel validation

  mctlhq/mctl-gitops#1706 · Filter by author mashkovd opened on Oct 8, 2026

• cli(mctl): three P3 follow-ups from the sign-in review (#1700)

  mctlhq/mctl-gitops#1701 · Filter by author mashkovd opened on Oct 7, 2026

• chore(agent-platform): hardening follow-ups to the agent runtime boundary

  security
  mctlhq/mctl-gitops#1690 · Filter by author mashkovd opened on Oct 6, 2026

• feat(agent-platform): refuse a profile that grants more than its proposer holds

  mctlhq/mctl-gitops#1684 · Filter by author mashkovd opened on Oct 5, 2026

• portal: default_disabled=false exposes every newly synced tool until the catalogue apply

  mctlhq/mctl-gitops#1674 · Filter by author mashkovd opened on Oct 4, 2026

• vault: give each tenant its own KV mount instead of secret/teams/<t>

  mctlhq/mctl-gitops#1670 · Filter by author mashkovd opened on Oct 4, 2026

• Promtail cannot persist positions: every restart replays all node logs

  mctlhq/mctl-gitops#1664 · Filter by author mashkovd opened on Oct 4, 2026

• cloudflare-apply: plan digest trips on live-state churn during a slow approval

  mctlhq/mctl-gitops#1652 · Filter by author mashkovd opened on Oct 4, 2026

• observability: nobody notices if vmalert or Alertmanager die (Watchdog routed to null)

  mctlhq/mctl-gitops#1638 · Filter by author mashkovd opened on Oct 4, 2026

• Tenant contact email: store in Vault, not in the public gitops repo

  mctlhq/mctl-gitops#1627 · Filter by author mashkovd opened on Oct 4, 2026
  1

• test: CI policy matrix for the human-tenant Vault policy

  mctlhq/mctl-gitops#1624 · Filter by author mashkovd opened on Oct 4, 2026

• Login V2 shows "Unknown error occurred" when the chosen account has no access to the app

  mctlhq/mctl-gitops#1615 · Filter by author mashkovd opened on Oct 4, 2026

• Login V2 still discloses passkey users' existence and display name with ignore_unknown_usernames

  mctlhq/mctl-gitops#1612 · Filter by author mashkovd opened on Oct 4, 2026

• feat(grafana): persistent database and per-tenant organizations

  mctlhq/mctl-gitops#1601 · Filter by author mashkovd opened on Oct 4, 2026
  3

• test: fixture tests for the OpenTofu apply guard in zitadel-iac and vault-human-auth-iac

  mctlhq/mctl-gitops#1578 · Filter by author mashkovd opened on Oct 4, 2026

• ci: build and test cli/mctl on pull requests

  mctlhq/mctl-gitops#1571 · Filter by author mashkovd opened on Oct 4, 2026
  1

• fix(security): harden platform session cookies against same-site cookie tossing

  mctlhq/mctl-gitops#1560 · Filter by author mashkovd opened on Oct 4, 2026
  2

• feat(zitadel): declarative ZITADEL configuration through an in-cluster OpenTofu Job

  mctlhq/mctl-gitops#1520 · Filter by author mashkovd opened on Oct 3, 2026
  2

• Refuse reserved platform hostnames early in tenant and service creation paths

  mctlhq/mctl-gitops#1513 · Filter by author mashkovd opened on Oct 3, 2026

• wft-create-tenant breaks validate: the RBAC render baseline is not updated

  mctlhq/mctl-gitops#1511 · Filter by author mashkovd opened on Oct 3, 2026

• feat(unified-identity): move tenant applications to a separate PSL-listed domain

  roadmap
  mctlhq/mctl-gitops#1504 · Filter by author mashkovd opened on Oct 3, 2026
  1

• feat(unified-identity): offer tenant applications sign-in through a per-tenant ZITADEL organization

  roadmap
  mctlhq/mctl-gitops#1501 · Filter by author mashkovd opened on Oct 3, 2026
  4

• privacy: move personal email addresses out of live values in the public repo

  mctlhq/mctl-gitops#1467 · Filter by author mashkovd opened on Sep 29, 2026