Issues

• Sealed by default, release B: caller default required (Refs #135)

  plan
  macula-io/macula#138 · Filter by author rgfaber opened on Oct 27, 2026

• Sealed by default, release A: provider default required, no clear window, publish needs group|open (Refs #135)

  plan
  macula-io/macula#137 · Filter by author rgfaber opened on Oct 27, 2026

• Sealed by default, release A0: callers reseal to the key in a signed sealed_required (Refs #135)

  plan
  macula-io/macula#136 · Filter by author rgfaber opened on Oct 27, 2026

• End-to-end sealing is on by default

  gate:designplan
  macula-io/macula#135 · Filter by author rgfaber opened on Oct 27, 2026
  5

• Group-key refusals on org_grant groups are not logged

  macula-io/macula#134 · Filter by author rgfaber opened on Oct 27, 2026

• ex_doc: public specs and docs reference hidden types and functions (34 warnings)

  backlog
  macula-io/macula#131 · Filter by author rgfaber opened on Oct 26, 2026

• RBAC read control for sealed topics: the group key distributor admits a restricted group's pull on the realm-issued pubsub/subscribe capability

  work-package
  macula-io/macula#129 · Filter by author rgfaber opened on Oct 26, 2026
  2

• RBAC enforcement: stations count, then refuse, call, serve, publish and subscribe without the realm-issued capability

  crew:neptunuswork-package
  macula-io/macula#128 · Filter by author rgfaber opened on Oct 26, 2026
  2

• macula_ucan: topic grants and prefix wildcards (prep for realm RBAC)

  macula-io/macula#127 · Filter by author rgfaber opened on Oct 26, 2026
  1

• An advertisement carries its 17 KB authorization chain inline on every renewal

  backlogplan
  macula-io/macula#126 · Filter by author rgfaber opened on Oct 23, 2026

• Wire parsers under property tests or fuzzing, not only fixed vectors

  macula-io/macula#125 · Filter by author rgfaber opened on Oct 21, 2026

• build_dial_url brackets an IPv4 station endpoint, and the seed parser refuses it

  macula-io/macula#123 · Filter by author rgfaber opened on Oct 20, 2026

• macula 16.0.0 does not build on OTP 29: catch expression deprecated, warnings_as_errors

  macula-io/macula#122 · Filter by author rgfaber opened on Oct 20, 2026

• Provider-side decision record: a signed trail of served and refused calls

  backlog
  macula-io/macula#119 · Filter by author rgfaber opened on Oct 19, 2026
  1

• A revoked member's realm endorsement stops admitting it within the realm's revocation bound

  plan
  macula-io/macula#118 · Filter by author rgfaber opened on Oct 19, 2026
  3

• Public guide: realm membership, endorsements and how fast a revocation lands

  backlogdocumentation
  macula-io/macula#117 · Filter by author rgfaber opened on Oct 19, 2026

• High availability for edge services: multi-station registration, caller failover, realm availability

  designplan
  macula-io/macula#115 · Filter by author rgfaber opened on Oct 19, 2026
  1

• Mesh service contracts: advertise pub/sub topics and payload shapes, generate docs and SDK bindings

  designplan
  macula-io/macula#114 · Filter by author rgfaber opened on Oct 18, 2026

• seal: the distributor's default realm membership is untestable (no seam); tombstone path has no test

  macula-io/macula#91 · Filter by author rgfaber opened on Oct 11, 2026

• Wire 1.0: what the station contract freezes and how it evolves after

  design
  macula-io/macula#83 · Filter by author rgfaber opened on Oct 6, 2026 · Wire 1.0
  6

• fanned_to on EVENT and PUBLISH, so a station fans only to stations not yet reached

  post-1.0 capability
  macula-io/macula#81 · Filter by author rgfaber opened on Oct 6, 2026 · Wire 1.0
  1

• Load-sensitive tests pass on a CPU-capped runner: explicit timeouts, key pools, no single-shot state reads

  crew:uranuswork-package
  macula-io/macula#74 · Filter by author rgfaber opened on Oct 6, 2026
  1

• The last Hecate names are gone: SDK first, then station and kernel refresh, then consumers

  work-package
  macula-io/macula#73 · Filter by author rgfaber opened on Oct 6, 2026
  3

• Attribution holds for every payload: the caller is bound by the station, never written by the sender

  work-package
  macula-io/macula#72 · Filter by author rgfaber opened on Oct 6, 2026

• A hostile caller cannot exhaust a station's relay: bounded streams, an overload answer instead of silence, leaks closed

  crew:marswork-package
  macula-io/macula#71 · Filter by author rgfaber opened on Oct 6, 2026
  1