picatz/flowstate

Stars: 9
Forks: 0
Open beginner issues: 5
Indexed issues: 540
Avg merge: 3h 3m
Merged PRs (30d): 509

Dominant language: Go
License: MIT
Last GitHub push: Sep 14, 2026
Latest indexed: Sep 19, 2026
Contributing guide: Contributing guide
Code of conduct: Code of conduct
Beginner labels: No beginner labels indexed

Beginner friendly Everything

Open All

540 open issues indexed

flowfile: alias inlining builds the expansion before anything bounds it, and a per-site byte charge is the wrong shape of fix Open

Difficulty 5/5 Over a week Newbie friendliness 35/100

picatz/flowstate#2045 · Opened Sep 14, 2026
cmd/flow: three refusal surfaces reach stdout with a sensitive value the redaction set cannot see Open

Difficulty 5/5 Over a week Newbie friendliness 35/100

picatz/flowstate#2044 · Opened Sep 14, 2026
agents: two scanner findings about agent-host trust are accepted risk, and nothing in the tree says so where a reader would look Open

Difficulty 2/5 1-3 hours Newbie friendliness 85/100

picatz/flowstate#2043 · Opened Sep 14, 2026
flowtest: a var seeded from one case's `secrets:` prints in full for every other case Open

Difficulty 4/5 3-5 days Newbie friendliness 48/100

picatz/flowstate#2041 · 1 comment · Opened Sep 14, 2026
auth: seven refusals outside ValidateHTTPSURL still quote a raw URL a credential can reach Open

Difficulty 4/5 3-5 days Newbie friendliness 68/100

picatz/flowstate#2039 · Opened Sep 13, 2026
auth: `ValidateHTTPSURL` accepts an issuer whose credentials url.Parse reads as host:port and a path Open

Difficulty 3/5 1-2 days Newbie friendliness 74/100

picatz/flowstate#2038 · 1 comment · Opened Sep 13, 2026
plugins: five bounded-read and precision follow-ups from #2021's review rounds Open

Difficulty 4/5 3-5 days Newbie friendliness 48/100

picatz/flowstate#2037 · Opened Sep 13, 2026
plugins: a `tls`/`ca` plugin — certificate and chain inspection, SPIFFE identity matching, and CSR signing against an operator-configured CA Open

Difficulty 5/5 Over a week Newbie friendliness 25/100

picatz/flowstate#2036 · Opened Sep 13, 2026
plugins: a `grpc` plugin — one unary call against reflection or a pinned descriptor set, the `buf curl` shape the ecosystem has no answer for Open

Difficulty 5/5 Over a week Newbie friendliness 35/100

picatz/flowstate#2035 · Opened Sep 13, 2026
pkg/flowstate/v1: Evaluator.Eval re-extends the environment on every call, rebinding 100+ CEL functions — 14.9% of all allocations in parse-and-validate Open

engine enhancement

Difficulty 4/5 3-5 days Newbie friendliness 52/100

picatz/flowstate#2034 · Opened Sep 13, 2026
pkg/flowstate/v1: the http response scrub round-trips the body through string and back, so two full copies now cost more than the scan they wrap Open

engine enhancement

Difficulty 5/5 Over a week Newbie friendliness 48/100

picatz/flowstate#2032 · Opened Sep 13, 2026
tools/wallclock: decide whether the analyzer should type-check, since the false negatives that remain are the ones a parse cannot reach Open

Difficulty 5/5 Over a week Newbie friendliness 35/100

picatz/flowstate#2033 · Opened Sep 13, 2026
pkg/flowstate/v1/secrets: registering one value costs 5.7x to 20.9x its length in needle bytes, and nothing bounds the total Open

enhancement security

Difficulty 5/5 Over a week Newbie friendliness 35/100

picatz/flowstate#2031 · Opened Sep 13, 2026
CI: a merged commit on main can end with no green run, because the next merge cancels its in-flight one Open

Difficulty 4/5 3-5 days Newbie friendliness 68/100

picatz/flowstate#2030 · Opened Sep 13, 2026
tools/shipcheck: every evidence loader needs GitHub GraphQL, so the required gate cannot run where a session's egress is REST-only Open

Difficulty 5/5 Over a week Newbie friendliness 35/100

picatz/flowstate#2029 · Opened Sep 13, 2026
auth: a scheme-less URL carrying credentials is still echoed raw by the "must name a host" refusal Open

Difficulty 4/5 3-5 days Newbie friendliness 52/100

picatz/flowstate#2028 · 1 comment · Opened Sep 13, 2026
Three claims about replay pinning, cancellation outcome, and redaction cost that nobody can currently state correctly in one sentence Open

documentation

Difficulty 5/5 Over a week Newbie friendliness 25/100

picatz/flowstate#2027 · Opened Sep 13, 2026
internal/commitcheck: the forge-tail premise is exactly one shape wide, and neither the exemption it grants nor the rule spellings it misses is pinned Open

Difficulty 3/5 1-2 days Newbie friendliness 76/100

picatz/flowstate#2025 · Opened Sep 13, 2026
tools/commitcheck: the package doc says the plan job flips `-strict` on 2026-09-21, and nothing flips it Open

Difficulty 4/5 3-5 days Newbie friendliness 55/100

picatz/flowstate#2024 · Opened Sep 13, 2026
tools/hooks/mergeguard: a `gh pr merge` that supplies its own squash message is never held to the commit conventions Open

Difficulty 3/5 1-2 days Newbie friendliness 72/100

picatz/flowstate#2023 · Opened Sep 13, 2026
tools/artifacts: the removal advice is shell-safe but not pathspec-safe — a tracked `:(glob)**` unstages more than it names Open

Difficulty 3/5 1-2 days Newbie friendliness 55/100

picatz/flowstate#2020 · Opened Sep 13, 2026
flowstate/v1: the secret-walk depth comment and its test now disagree about what can be nested past MaxStructureDepth Open

ci

Difficulty 2/5 1-3 hours Newbie friendliness 84/100

picatz/flowstate#2019 · Opened Sep 13, 2026
internal/textbound: Cut's straddle-backup block cannot change what Cut returns, because ToValidUTF8 already drops the incomplete rune Open

ci

Difficulty 3/5 1-2 days Newbie friendliness 68/100

picatz/flowstate#2015 · Opened Sep 13, 2026
gate: a go.mod diff that changes no selected version still forces the whole-module race leg, and the leg reveals nothing until it ends Open

ci

Difficulty 5/5 Over a week Newbie friendliness 45/100

picatz/flowstate#2012 · Opened Sep 13, 2026
examples: "an example is something to paste and watch work" is false for about twenty of them, and the corpus already has both answers Open

documentation

Difficulty 5/5 Over a week Newbie friendliness 38/100

picatz/flowstate#2001 · Opened Sep 13, 2026
tests: benchmark fixture comments claim a superlative that silently rots — `approval-gate` is documented as "the largest example (366 lines)" and is 106 lines and not the largest Open

Difficulty 4/5 3-5 days Newbie friendliness 52/100

picatz/flowstate#1999 · 3 comments · Opened Sep 13, 2026
lsp: three follow-ups from the #1983 reviews — one inaccurate log, one duplicated predicate, two comments claiming more than they prove Open

Difficulty 3/5 1-2 days Newbie friendliness 58/100

picatz/flowstate#1997 · Opened Sep 13, 2026
docs: the per-run evaluation table is hand-measured, nothing pins it, and its stated counting point is not one a run reaches Open

documentation

Difficulty 4/5 3-5 days Newbie friendliness 52/100

picatz/flowstate#1996 · Opened Sep 13, 2026
architecture: invariant 1's line between "adds behavior" and "duplicates schema-owned shape" is a judgement, not a check — decide the criterion and hold it Open

documentation

Difficulty 5/5 Over a week Newbie friendliness 45/100

picatz/flowstate#1995 · Opened Sep 13, 2026
agents: work an agent does is posted and merged under the maintainer's identity, not its own Open

Difficulty 5/5 Over a week Newbie friendliness 35/100

picatz/flowstate#1994 · 1 comment · Opened Sep 13, 2026
Seven comments name errors.As where the code now calls errors.AsType, plus formatting litter from the modernizer sweep Open

Difficulty 3/5 1-2 days Newbie friendliness 78/100

picatz/flowstate#1987 · Opened Sep 13, 2026
lsp: a didClose reordered behind a didOpen deletes the reopened document, leaving the buffer absent Open

Difficulty 5/5 Over a week Newbie friendliness 45/100

picatz/flowstate#1986 · Opened Sep 13, 2026
proto: evaluate protobuf-go's opaque API — the 5,334 getter reads already port for free, the cost is 1,554 composite literals, and `API_HYBRID` makes the step reversible Open

enhancement

Difficulty 5/5 Over a week Newbie friendliness 38/100

picatz/flowstate#1982 · 1 comment · Opened Sep 13, 2026
Two tests fail under full-tree parallel load and pass in isolation: engine progress query and the LSP change-storm settle Open

Difficulty 4/5 3-5 days Newbie friendliness 52/100

picatz/flowstate#1980 · Opened Sep 13, 2026
tools/hooks/mergeguard: two merge shapes reach the tool unblocked — `merge` before `gh`, and `gh api` wrapped in `eval` Open

Difficulty 3/5 1-2 days Newbie friendliness 72/100

picatz/flowstate#1973 · 2 comments · Opened Sep 13, 2026
tools/hooks/mergeguard: a read-only `gh api` command is denied when the word "merge" appears anywhere else in it Open

Difficulty 4/5 3-5 days Newbie friendliness 72/100

picatz/flowstate#1972 · 1 comment · Opened Sep 13, 2026
engine: make "every workflow-side CEL evaluation is charged" a check rather than a claim — three review rounds each found another uncharged path Open

bug

Difficulty 5/5 Over a week Newbie friendliness 35/100

picatz/flowstate#1970 · Opened Sep 12, 2026
docs, engine: three comments claim more than the code supports — pinning's coverage, a redaction cost bound, and a fast path's precondition Open

documentation

Difficulty 2/5 1-3 hours Newbie friendliness 88/100

picatz/flowstate#1969 · 2 comments · Opened Sep 12, 2026
engine: a held failure refuses every suspension seam — an authenticated author can hold a workflow-task slot and cost a run its compensation log — and a continuation still strands unjoined `async:` work Open

bug

Difficulty 5/5 Over a week Newbie friendliness 35/100

picatz/flowstate#1968 · 2 comments · Opened Sep 12, 2026
Claude hook launcher: bounded follow-ups from the #1942 review rounds Open

Difficulty 5/5 Over a week Newbie friendliness 25/100

picatz/flowstate#1967 · 4 comments · Opened Sep 12, 2026
server: two identical `request_id` submissions racing under `terminate_other` can each terminate the other's run, so one request id answers with two run ids Open

bug

Difficulty 5/5 Over a week Newbie friendliness 38/100

picatz/flowstate#1966 · Opened Sep 12, 2026
.claude/hooks: a removed guard package denies every guarded tool, and three smaller gaps in the identity Open

Difficulty 4/5 3-5 days Newbie friendliness 48/100

picatz/flowstate#1964 · Opened Sep 12, 2026
tools/agentconfig: the required-substring pin for `.claude/claude-security-guidance.md` does not lock the claim it was added to protect Open

Difficulty 2/5 1-3 hours Newbie friendliness 88/100

picatz/flowstate#1963 · Opened Sep 12, 2026
tools/shipcheck, tools/hooks/mergeguard: the shipping gate cannot run without a `gh` binary, which Claude Code cloud sessions do not have Open

Difficulty 4/5 3-5 days Newbie friendliness 55/100

picatz/flowstate#1961 · 1 comment · Opened Sep 12, 2026
.claude/hooks: the build's currency check ignores the binary set, so adding a fifth hook denies until .bin is removed by hand Open

Difficulty 3/5 1-2 days Newbie friendliness 68/100

picatz/flowstate#1959 · Opened Sep 12, 2026
tools/shipcheck: a pre-head comment edited to carry a review request escapes the per-head count Open

Difficulty 3/5 1-2 days Newbie friendliness 72/100

picatz/flowstate#1958 · Opened Sep 12, 2026
tools/shipcheck: the request window's floor is the first reported check start, which a delayed or re-rolled run can move Open

Difficulty 5/5 Over a week Newbie friendliness 35/100

picatz/flowstate#1957 · Opened Sep 12, 2026
pkg/flowstate/v1/server: the audit-seam guard sees calls, not references, so an indirect call evades it Open

Difficulty 3/5 1-2 days Newbie friendliness 76/100

picatz/flowstate#1956 · Opened Sep 12, 2026
pkg/flowstate/v1/server: extend the memo-less provenance test to every verb and assert the deny code Open

Difficulty 2/5 1-3 hours Newbie friendliness 78/100

picatz/flowstate#1955 · Opened Sep 12, 2026
pkg/flowstate/v1: the task-output element bound skips Structure-kind, which is safe only while CEL refuses to read it Open

Difficulty 4/5 3-5 days Newbie friendliness 55/100

picatz/flowstate#1954 · Opened Sep 12, 2026

A short digest of beginner-friendly GitHub issues.