hiveiq-src/hiveops-guide
4
0
Fork 0
Code Issues 8 Pull Requests Actions Packages Projects Releases Wiki Activity

[Guide] fleet.task-permissions module missing — a live customer-facing capability is undocumented #23

New Issue
Closed
opened 2026-07-16 14:17:04 -04:00 by hiveiq · 0 comments
hiveiq commented 2026-07-16 14:17:04 -04:00
Owner
Copy Link
Copy Source

fleet.task-permissions does not exist in the guide (API returns 404). The Task Permissions tab shipped in hiveops-fleet#119 and is live on bcos.dev, but has no guide coverage. fleet.tasks mentions permissions exactly once and does not describe the grant model.

This is the module that decides which commands a customer may push to their own ATMs — deny-by-default, per-institution, per-command. It is the highest-consequence fleet setting we have and the least documented.

Why the reconciler missed it

scripts/coverage-reconcile.py cannot catch this. It checks:

  1. backend services → technical.<svc>
  2. agent modules → agent.<slug>
  3. role-tabs missing from modules already in the guide
  4. product SPAs with no guide content at all

Check 4 is all-or-nothing per app — fleet has 5 modules, so it passes. The script never enumerates SPA nav items, so a new module in an already-documented SPA is invisible to it. The same blind spot will swallow the next new tab in any documented app.

Scope

Add content/fleet/task-permissions/ with the 5 canonical role tabs (Customer / Internal / Architect / Testing / Claude), grounded in hiveops-fleet source:

  • FleetApiController.java:189-220 — 4 endpoints, @PreAuthorize gates
  • FleetTaskPermissionService.java — GRANTABLE set, assertMayPush, grantsForCurrentCaller
  • InstitutionTaskPermission.java + V9__institution_task_permissions.sql — table, deny-by-default
  • FleetApiController.java:179 — the POST /tasks gate call site

Follow-up (separate, hiveops-fleet): once this module exists, add the ⓘ Guide button to TaskPermissions.svelte (pageKey="fleet.task-permissions") — it was left out of hiveops-fleet#100 because it would have opened an empty panel.

Reconciler blind spot tracked separately if wanted.

`fleet.task-permissions` does not exist in the guide (API returns 404). The Task Permissions tab shipped in hiveops-fleet#119 and is live on bcos.dev, but has no guide coverage. `fleet.tasks` mentions permissions exactly once and does not describe the grant model. This is the module that decides **which commands a customer may push to their own ATMs** — deny-by-default, per-institution, per-command. It is the highest-consequence fleet setting we have and the least documented. ### Why the reconciler missed it `scripts/coverage-reconcile.py` cannot catch this. It checks: 1. backend services → `technical.<svc>` 2. agent modules → `agent.<slug>` 3. role-tabs missing from modules **already in the guide** 4. product SPAs with **no** guide content at all Check 4 is all-or-nothing per app — `fleet` has 5 modules, so it passes. The script never enumerates SPA nav items, so a *new module in an already-documented SPA* is invisible to it. The same blind spot will swallow the next new tab in any documented app. ### Scope Add `content/fleet/task-permissions/` with the 5 canonical role tabs (Customer / Internal / Architect / Testing / Claude), grounded in `hiveops-fleet` source: - `FleetApiController.java:189-220` — 4 endpoints, `@PreAuthorize` gates - `FleetTaskPermissionService.java` — `GRANTABLE` set, `assertMayPush`, `grantsForCurrentCaller` - `InstitutionTaskPermission.java` + `V9__institution_task_permissions.sql` — table, deny-by-default - `FleetApiController.java:179` — the `POST /tasks` gate call site Follow-up (separate, hiveops-fleet): once this module exists, add the `ⓘ Guide` button to `TaskPermissions.svelte` (`pageKey="fleet.task-permissions"`) — it was left out of hiveops-fleet#100 because it would have opened an empty panel. Reconciler blind spot tracked separately if wanted.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
Bug
Backend
Service, API, or data-layer work
 Breaking
Breaking change that won't be backward compatible
 Bug
Something is not working
 Dev Verified
Fix verified on bcos.dev by QA — cleared for production release
 Documentation
Documentation changes
 Enhancement
Improve existing functionality
 Feature
New functionality
 Frontend
UI / Svelte SPA work
 Pattern
For changes to our agent Pattern for detecting hardware faults
Priority
Critical
The priority is critical
Priority
High
The priority is high
Priority
Low
The priority is low
Priority
Medium
The priority is medium
Reopen
Fix was verified but the issue persists or regressed. Reopen and reassign for investigation.
Reviewed
Confirmed
Issue has been confirmed
Reviewed
Duplicate
This issue or pull request already exists
Reviewed
Invalid
Invalid issue
Reviewed
Won't Fix
This issue won't be fixed
Security
This is security issue
Status
Abandoned
Somebody has started to work on this but abandoned work
Status
Blocked
Something is blocking this issue or pull request
Status
Need More Info
Feedback is required to reproduce issue or to continue work
TEST
Tested
Not Fixed
Testing
Issue or pull request related to testing
 Verify Fix
Fix has been deployed to production. Verify the issue is resolved before closing.
 Verify/Production
Fix deployed to production — verify before closing
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
hiveiq hiveiq-browser johannes tristan (Tristan Smith)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: hiveiq-src/hiveops-guide#23
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?