Repository navigation
qol-sweep: remaining follow-up items after third pass (2026-05-19) #730
Description
After three passes of the 2026-05-19 QoL sweep (86 PRs + 22 tracking issues + 48 GitHub topic tags + 25 third-pass PRs), the following items remain open. None are user-blocking; this is the canonical "next-session" pickup list.
Examples (27 P2 plugins remaining)
10 top-interest plugins shipped examples/minimal/config.yaml in the third pass (admin, authz, bento, github, gitlab, slack, okta, salesforce, monday, datadog).
Remaining 27 P2 plugins still need examples:
approval, audit, broker, cicd, crm, data-engineering, discord, erp, infra, launchdarkly, marketplace, mcp, messaging-core, migrations, openlms, platform, rooms, security-scanner, steam, sso, teams, template, turnio, vectorstore, websocket, ws-auth, analytics
Recipe: read each plugin's workflow-registry/plugins/<name>/manifest.json capabilities, generate examples/minimal/config.yaml referencing first moduleType + first stepType. Branch docs/example-<TS>-<plugin>, one PR per repo.
Registry-manifest capability enrichment (10 stub manifests)
workflow-registry#68 shipped STUB manifests with empty capabilities for: broker, infra, marketplace, mcp, messaging-core, rooms, security-scanner, steam, template, ws-auth. Each needs per-plugin source-code introspection to populate moduleTypes / stepTypes / triggerTypes / iacProvider. One PR per plugin in workflow-registry.
Live-deployment CI matrix execution (operator-gated)
Design merged at workflow#727. Execution gated on operator provisioning:
- AWS staging account + IAM role + OIDC trust
- GCP staging project + Workload Identity Federation
- Azure staging subscription + federated credential
- DigitalOcean staging token (or OIDC if available)
Once secrets are in repo settings, wfctl plugin marketplace-verify (shipped at workflow#725) + the CI matrix can drive automatic promotion/demotion of registry status.
Archived repos (5)
workflow-plugin-actors,workflow-plugin-deployment,workflow-plugin-waf,workflow-plugin-sandbox,workflow-plugin-data-protection— currently archived on GitHub (read-only). Operator decision: unarchive + maintain, or formally retire + remove from registry.
Non-IaC plugin live validation (per-category designs)
Live-deploy design (workflow#727) covers IaC plugins only. Separate designs needed for:
- eventbus → NATS / pgchannel test surface
- payments → Stripe test API
- twilio → sandbox account
- auth → JWT-only smoke (no external dependency)
Each is its own design pass + CI matrix.
wfctl plugin marketplace-verify --explain flag
Shipped subcommand (workflow#725) reports only org-usage status. Future --explain flag would read live-deploy artifact history from #6 and display alongside. Depends on the live-deploy matrix execution.
analytics → verified promotion
BMW has analytics-plugin pin in 4 unmerged worktrees. When BMW merges the pin to main, file a one-line manifest PR flipping workflow-registry/plugins/analytics/manifest.json status from experimental → verified.
Modular sub-module CHANGELOG.md propagation (deferred)
modular#111 added CONTRIBUTING.md to 7 sub-modules. Per-sub-module CHANGELOG.md (backfilled from each sub-module's own tag stream) is a follow-up.
Manifest URL audit (informational)
Audited 2026-05-19: 4 private-repo 404s for unauthenticated curl (authz-ui, cloud-ui, security, workflow-plugin-supply-chain) — expected; operator auth required. Public manifest URLs all reachable. No action.
Cumulative status:
- 111 PRs merged across workflow + workflow-registry + ~45 plugin repos + modular
- 23 tracking issues filed (10 registry-manifest + 9 deferred-items + 4 misc)
- 48 GitHub topic tags applied
statusfield shipped end-to-end (schema → manifest population → Go struct → CLI surface)wfctl plugin marketplace-verifysubcommand shipped- Live-deploy CI design merged
- All 12 priority items from the 2026-05-19 next-up list shipped or filed
Activity
intel352 commentedon May 20, 2026
Update 2026-05-19: 5 archived repos deleted
Operator deleted (with delete_repo scope grant):
workflow-plugin-actors— empty scaffold, no releasesworkflow-plugin-deployment— empty scaffold, no releasesworkflow-plugin-wafv0.2.1 — logic absorbed intoworkflow-plugin-security(verified: 12-30 hits per public type)workflow-plugin-sandboxv0.2.1 — logic absorbed intoworkflow-plugin-security(verified: 15-24 hits per public type)workflow-plugin-data-protectionv0.2.1 — logic absorbed intoworkflow-plugin-security(verified: 12-24 hits per public type)Verified zero stale references in:
Local clones removed.
Remaining operator-blocked items in this issue:
intel352 commentedon May 20, 2026
Update: analytics state corrected
Verified BMW main:
wfctl.yamlpins 6 plugins (auth, payments, digitalocean, twilio, eventbus, audit-chain).analyticsis not pinned. The.wfctl-lock.yamlhas a stale analytics entry from a prior experiment that was reverted from the source manifest but not from the lockfile. Only 1 open BMW PR (#298 docs) and it's unrelated.Therefore: analytics has zero active production usage anywhere in GoCodeAlone. Its manifest status of
experimentalis correct, and there is no pending promotion path. The earlier memory entry framing this as 'waits on BMW pin merge' was based on stale worktree references.Real remaining operator-blocked items:
Optional follow-up (BMW maintainer's call):
.wfctl-lock.yaml.intel352 commentedon May 20, 2026
Update: analytics PROMOTED to verified
User pointed out my earlier grep was truncated and missed line 25 of BMW main
wfctl.yamlwhich pins workflow-plugin-analytics. Verified active production usage.Shipped:
experimental→verifiedVerified set is now 8 plugins (was 7):
agent, analytics, audit-chain, auth, digitalocean, eventbus, payments, twilio
Only 1 real operator-blocker remains: live-deploy CI execution (#731).
intel352 commentedon Jun 1, 2026
Audit result: still relevant as the newer umbrella tracker.
Verified current state: archived-repo cleanup and analytics promotion were resolved in comments, while live-deploy remains tracked by #731 and registry-manifest child issues remain open in
workflow-registry(#56-#67). Keeping this open is appropriate until the remaining child/operator items are either completed or explicitly closed as superseded.intel352 commentedon Jun 2, 2026
Update 2026-06-02: registry-manifest child issues verified and cleared.
Closed workflow-registry#56, #57, #59, #60, #61, #62, #63, #64, #65, #66, and #67 as completed after verifying current manifests/CI. workflow-registry#58 was closed as not planned because
workflow-plugin-deploymentwas deleted during the archived-repo cleanup.The template/scaffold manifest gap closed through workflow-registry#199, merged after CI was green and Copilot review threads were resolved.
Remaining from this umbrella: operator-gated live-deploy execution (#731) plus the separate registry index projection issue still open in workflow-registry#80.
intel352 commentedon Jun 2, 2026
Closing this umbrella after the follow-up queue was reduced to separately tracked issues.
Completed/cleared under this umbrella:
serverAppgod object into domain-scoped sub-structs with minimal interfaces; move admin wiring to config+primitives #56-Scan step stubs should return ErrNotImplemented (pipeline_step_scan_*.go) #67 and Multi-workflow applications: composable, reusable workflow configs that call each other #80 are now closed.Remaining work is not lost:
Those two issue-specific trackers are cleaner than keeping this broad umbrella open.