{
  "items": [
    {
      "blocked_by": [],
      "description": "Finalize Cedar policy definitions for Control Center and wire to live auth evaluation.",
      "id": "control-center-cedar-policies",
      "priority": "High",
      "related_nodes": [
        "solid-boundaries",
        "control-center-maturity"
      ]
    },
    {
      "blocked_by": [
        "control-center-cedar-policies"
      ],
      "description": "Connect Control Center WebSocket task status streaming to NATS push consumers.",
      "id": "websocket-nats-streaming",
      "priority": "High",
      "related_nodes": [
        "platform-dispatch",
        "control-center-maturity"
      ]
    },
    {
      "blocked_by": [],
      "description": "Add Nickel schemas for extension metadata currently using raw TOML.",
      "id": "extension-metadata-schemas",
      "priority": "Medium",
      "related_nodes": [
        "type-safety-nickel",
        "schema-coverage"
      ]
    },
    {
      "blocked_by": [
        "extension-metadata-schemas"
      ],
      "description": "Validate provider capabilities against workspace requirements at config-load time.",
      "id": "provider-capability-validation",
      "priority": "Medium",
      "related_nodes": [
        "provider-abstraction",
        "workspace-contract"
      ]
    },
    {
      "blocked_by": [],
      "description": "Ensure all taskservs declare dependencies.ncl with typed contracts for inter-taskserv dependencies.",
      "id": "taskserv-dependency-contracts",
      "priority": "Medium",
      "related_nodes": [
        "taskserv-pattern",
        "workspace-certification"
      ]
    },
    {
      "blocked_by": [],
      "description": "ingressClassName is hardcoded to 'cilium' in all L4 cluster extension install scripts. Should be driven by a field in the cluster extension NCL config (e.g. ingress_class_name) so different clusters can declare different ingress controllers without modifying install scripts. Relevant for wuji where Istio replaces Cilium ingress.",
      "id": "cluster-ext-ingress-class-from-config",
      "priority": "Medium",
      "related_nodes": [
        "cluster-extension-pattern",
        "type-safety-nickel"
      ]
    },
    {
      "blocked_by": [
        "cluster-ext-ingress-class-from-config"
      ],
      "description": "FIP key names in cluster-deploy.nu (cd-load-fip-env) and bootstrap.nu are derived by stripping a hardcoded workspace prefix ('librecloud-fip-') and assuming fixed role keys (smtp, sgoyol_ingress, wuji). Should be driven by an explicit role field in floating_ips.ncl so the mapping is data-driven and reusable across workspaces.",
      "id": "fip-role-driven-state-mapping",
      "priority": "Low",
      "related_nodes": [
        "provider-abstraction",
        "workspace-contract"
      ]
    },
    {
      "blocked_by": [],
      "description": "cluster-deploy.nu processes extensions sequentially even when parallel=true in the DAG. Extensions with no shared depends_on (e.g. hcloud_floater and cert_manager both after metallb) could run concurrently. Requires structured concurrency in Nushell or delegating to background jobs.",
      "id": "cluster-deploy-parallel-extension-execution",
      "priority": "Low",
      "related_nodes": [
        "platform-dispatch",
        "cluster-extension-pattern"
      ]
    },
    {
      "blocked_by": [
        "control-center-cedar-policies"
      ],
      "description": "The Live Pods section in the component detail view (workspace_component_detail.html) is rendered for all component modes unconditionally. Fetching live pod status requires SSH access to the cluster control plane — this capability must be gated behind explicit RBAC permissions (can_operate or higher) so read-only (can_view) users cannot trigger SSH sessions or see raw infrastructure state. Implement a Cedar policy check in the /pods and /pods/{ns}/{pod}/describe handlers, and conditionally hide the live button in the template when the session lacks the required permission.",
      "id": "ui-live-mode-credential-gate",
      "priority": "High",
      "related_nodes": [
        "solid-boundaries",
        "control-center-maturity",
        "ui-component-detail"
      ]
    }
  ]
}