Issues

• design: Proposal for an Amber Logo - Seeking Community Feedback

  needs triage
  darnitdevorg/darnit#686 · Filter by author jd869 opened on Oct 26, 2026
  1

• Comply leaves remediated documents PENDING: judge and confirm after remediation

  needs triage
  darnitdevorg/darnit#681 · Filter by author mlieberman85 opened on Oct 25, 2026
  

• Publishing policy for darnit modules: one matrix publish job, darnit-mcp as the curated bundle

  needs triage
  darnitdevorg/darnit#680 · Filter by author mlieberman85 opened on Oct 24, 2026
  

• gittuf: GT-02.01 FAIL message omits commits whose signatures could not be checked

  needs triage
  darnitdevorg/darnit#679 · Filter by author mlieberman85 opened on Oct 24, 2026
  

• Amber run bundles: flow 2 of the attestation design, scoped to what runs today

  needs triage
  darnitdevorg/darnit#677 · Filter by author Marc-cn opened on Oct 23, 2026
  4

• Threat model remediation: previewable output, and report kept files in outcomes

  needs triage
  darnitdevorg/darnit#673 · Filter by author mlieberman85 opened on Oct 23, 2026
  

• A missing document no longer fails, so remediation never creates it

  module-baselineneeds triage
  darnitdevorg/darnit#665 · Filter by author mlieberman85 opened on Oct 23, 2026
  

• Audit "Next Steps" asks for project data that was already confirmed operator-side

  module-coreneeds triage
  darnitdevorg/darnit#664 · Filter by author mlieberman85 opened on Oct 23, 2026
  

• OSPS-QA-03.01 remediation is manual although enable_branch_protection can require status checks

  module-baselineneeds triage
  darnitdevorg/darnit#663 · Filter by author mlieberman85 opened on Oct 23, 2026
  

• Remediation cannot act on model findings; documents need drafted content, not templates

  module-baselinemodule-coreneeds triage
  darnitdevorg/darnit#662 · Filter by author mlieberman85 opened on Oct 23, 2026
  

• Triage the 10 controls that went from PASS to WARN in #552: promote, rewrite, or remap

  module-baselineneeds triagequality
  darnitdevorg/darnit#661 · Filter by author mlieberman85 opened on Oct 23, 2026
  

• Comply and audit leave PASS candidates unconfirmed; offer them for confirmation in one step

  module-coreneeds triageux
  darnitdevorg/darnit#660 · Filter by author mlieberman85 opened on Oct 23, 2026
  

• Plan: get darnit working end to end again (speed, questions, deterministic results, merge gates)

  module-baselinemodule-coreneeds triagequalitytesting
  darnitdevorg/darnit#655 · Filter by author mlieberman85 opened on Oct 21, 2026
  2

• darnit-comply improvises the data and judgment steps; put the procedure in the tool results

  interface-mcpmodule-coreneeds triagequality
  darnitdevorg/darnit#654 · Filter by author mlieberman85 opened on Oct 21, 2026

• submit_judgment and confirm_pass_candidate re-run the full audit on every call

  interface-mcpmodule-coreneeds triagequality
  darnitdevorg/darnit#653 · Filter by author mlieberman85 opened on Oct 21, 2026

• OSPS-SA-03.02 judgment prompt assumes a darnit-generated threat model with code snippets

  module-baselineneeds triagequality
  darnitdevorg/darnit#651 · Filter by author mlieberman85 opened on Oct 20, 2026

• get_pending_data asks questions whose answers cannot change any result

  module-baselineneeds triageux
  darnitdevorg/darnit#649 · Filter by author mlieberman85 opened on Oct 20, 2026

• Every WARN reads "Could not automatically verify - manual verification required"; the evidence is only in pass_history

  module-coreneeds triageux
  darnitdevorg/darnit#648 · Filter by author mlieberman85 opened on Oct 20, 2026

• OSPS-BR-01.02 reports a grep match as unexpected_exit

  module-baselineneeds triagequality
  darnitdevorg/darnit#647 · Filter by author mlieberman85 opened on Oct 20, 2026

• Suggestive FAIL judgments are not kept, and summary output does not distinguish PASS candidates from unjudged controls

  interface-mcpmodule-coreneeds triagequality
  darnitdevorg/darnit#646 · Filter by author mlieberman85 opened on Oct 20, 2026
  1

• On a case-insensitive filesystem, file probes duplicate evidence and cite paths that are not in the repository

  module-baselinemodule-coreneeds triagequality
  darnitdevorg/darnit#645 · Filter by author mlieberman85 opened on Oct 20, 2026

• audit_openssf_baseline JSON output is about 1 MB and exceeds the MCP client's result limit

  interface-mcpmodule-baselineneeds triagequality
  darnitdevorg/darnit#644 · Filter by author mlieberman85 opened on Oct 20, 2026

• Run darnit end to end through the person's own Claude Code: one-command run and a real-repository test loop

  needs triage
  darnitdevorg/darnit#639 · Filter by author mlieberman85 opened on Oct 20, 2026
  1

• Attestation signing: use ambient CI credentials, the browser when interactive, or a local key

  module-baselineneeds triagesecurity
  darnitdevorg/darnit#631 · Filter by author mlieberman85 opened on Oct 18, 2026
  

• Make darnit harness the primary entry point

  interface-climodule-coreneeds triage
  darnitdevorg/darnit#627 · Filter by author mlieberman85 opened on Oct 17, 2026