Issues

• Sandboxed launch: check the base working tree against nono's built-in policy groups too

  tpsdev-ai/cli#662 · Filter by author tps-flint opened on Oct 16, 2026

• Remove a worktree the launch added when the launch fails before recording it

  tpsdev-ai/cli#660 · Filter by author tps-flint opened on Oct 16, 2026

• Resolve a relative workspace against one anchor for parent and sandboxed child

  tpsdev-ai/cli#658 · Filter by author tps-flint opened on Oct 16, 2026

• launch-attestation-real-nono test fixture overlaps nono's default macOS grants (fails 3/4 on macOS)

  tpsdev-ai/cli#650 · Filter by author tps-flint opened on Oct 16, 2026

• Dependency Dashboard

  tpsdev-ai/cli#584 · Filter by author renovate opened on Oct 10, 2026

• openclaw-tps-mail: lifecycle tests against the real OpenClaw host

  enhancement
  tpsdev-ai/cli#521 · Filter by author tps-flint opened on Oct 4, 2026

• Sandboxed agent launch: keep --config, run worktree setup with repo access, scan only real flags

  bug
  tpsdev-ai/cli#516 · Filter by author tps-flint opened on Oct 4, 2026
  

• Reviewer VM cutover: provisioning record, assignment writer, approve evidence and per-repo builds (follow-up to #425)

  P1
  tpsdev-ai/cli#495 · Filter by author tps-flint opened on Oct 3, 2026

• Verify the APPROVE evidence control on the deployed reviewer (real-container check, sandboxMountRoots)

  tpsdev-ai/cli#473 · Filter by author tps-flint opened on Oct 2, 2026
  

• reviewer sandbox: check and enforce the same-user process isolation the launcher's assignment relies on

  P2
  tpsdev-ai/cli#436 · Filter by author tps-flint opened on Sep 29, 2026

• tests: run the suite inside an OS boundary (nono profile or separate user), not only HOME redirection

  P2
  tpsdev-ai/cli#434 · Filter by author tps-flint opened on Sep 28, 2026

• Reviewer sandbox that can build a PR, and a host-side github_review tool so the token never enters the sandbox

  P1
  tpsdev-ai/cli#425 · Filter by author tps-flint opened on Sep 28, 2026
  3

• release: promote latest from CI after the npm approval (no maintainer CLI step)

  enhancementP1
  tpsdev-ai/cli#422 · Filter by author tps-flint opened on Sep 26, 2026

• tps office: per-host software/OS inventory and pending-update watch (provenance + security)

  enhancementP2
  tpsdev-ai/cli#421 · Filter by author tps-flint opened on Sep 26, 2026

• openclaw-tps-mail: widen obligation-lifecycle tests to the paths #406 covers by reasoning

  P2
  tpsdev-ai/cli#408 · Filter by author tps-flint opened on Sep 25, 2026
  1

• One verifier: extract the envelope-decision policy down into @tpsdev-ai/agent (the agent copy has already drifted)

  P2
  tpsdev-ai/cli#388 · Filter by author tps-flint opened on Sep 19, 2026
  2

• Runtime mail: one resolved Flair endpoint, and hand the auto-commit guard its task instead of reading the mailbox

  P2
  tpsdev-ai/cli#387 · Filter by author tps-flint opened on Sep 19, 2026

• RELEASE GATE (post-#377): spokes hold no hub principal keys — hub→spoke mail will dead-letter as forgery once verification is mandatory

  P1
  tpsdev-ai/cli#383 · Filter by author tps-flint opened on Sep 18, 2026
  6

• bootstrap's mailOperational check certifies a path real mail no longer takes (unsigned probe, count-delta only)

  P2
  tpsdev-ai/cli#382 · Filter by author tps-flint opened on Sep 18, 2026

• cur/ record binds to its envelope, but the envelope is not bound to the record's outer id — a swapped envelope misdirects the dispatch session

  P2
  tpsdev-ai/cli#381 · Filter by author tps-flint opened on Sep 18, 2026

• Migrate the ember/reed bespoke mail watcher to the shared promotion path

  P2
  tpsdev-ai/cli#376 · Filter by author tps-anvil opened on Sep 18, 2026

• promote-latest: a SemVer with both a prerelease and build metadata is rejected

  P3
  tpsdev-ai/cli#374 · Filter by author tps-flint opened on Sep 18, 2026

• promote-latest.sh: add a timeout to npm calls

  P3
  tpsdev-ai/cli#373 · Filter by author tps-anvil opened on Sep 18, 2026

• promote-latest.sh: serialize concurrent runs (no lockfile)

  P3
  tpsdev-ai/cli#372 · Filter by author tps-anvil opened on Sep 18, 2026

• Scope OIDC trusted-publisher trust to a release environment (cli has none today)

  P2
  tpsdev-ai/cli#367 · Filter by author tps-flint opened on Sep 17, 2026