Pod

Yes, this is on purpose. Pod is built for agents, so the default page is plain HTML.
Human? View the normal website.
Agent? You probably prefer /mcp/dossier/issues.md or /mcp/dossier/issues.json, or Pod over MCP.

Reported issues for dossier

Pod holds 18 of 49 problems reported by people outside the maintainer team. Issues filed by the project's own owners, members and collaborators are excluded entirely — a maintainer's release checklist is not a warning to a prospective user.

Back to dossier.

Most discussed

docs: link plan-artifact, core-api, capabilities references from root README

Context

The root README's Reference row links only Protocol, Specification, Schema, and the JSON schema. Three reference docs exist but are unreachable from the README: docs/reference/plan-artifact.md (plan:v1 artifacts), docs/reference/core-api.md, and docs/reference/capabilities.md (capability manifest + cap command).

Scope

Requirements / Acceptance Criteria

Read the thread · 2026-08-29 · open · outside contributor · 3 comments

docs: list @ai-dossier/sched among published packages in docs/contributing/workflows.md

Context

docs/contributing/workflows.md "Publish Packages Workflow" motivation says the workflow automates publishing @ai-dossier/core, @ai-dossier/cli, @ai-dossier/mcp-server, and @ai-dossier/worktree-pool — but @ai-dossier/sched is also published to npm (see its README badge) and is missing from the list.

Scope

Requirements / Acceptance Criteria

Read the thread · 2026-08-29 · open · outside contributor · 3 comments

Trust-check bug: checkSignature() never matches PEM-format Ed25519 keys against trusted-keys.txt

Bug

checkSignature() in cli/src/verify-dossier.ts decides whether a signer is trusted by comparing signature.public_key against entries in ~/.dossier/trusted-keys.txt:

const isTrusted =
  (signature.key_id != null && trustedKeys.has(signature.key_id)) ||
  (signature.public_key != null && trustedKeys.has(signature.public_key));

For Ed25519 signatures, Ed25519Signer (packages/core/src/signers/ed25519.ts) stores public_key as the full PEM block (`-----BEGIN PUBLIC

Read the thread · 2026-08-04 · closed · outside contributor · 3 comments

Review: Documentation findings from fix/235-documentation-findings-auth-and-publish

Documentation findings from PR #282

1. registry-api-design.md still references NAMESPACE_FORBIDDEN and VERSION_EXISTS (Medium)

2. Frontmatter format inconsistency across docs (Medium)

Read the thread · 2026-03-06 · closed · outside contributor · 2 comments

Review: Supportability findings from docs/226-documentation-findings-multi-registry

Supportability findings from automated review of #226

The multi-registry documentation additions lack troubleshooting guidance. Found during automated review of #270.

Findings

  1. No error scenarios for invalid registry configuration (HIGH)

    • cli/README.md Registry Configuration section
    • Missing: what happens with unreachable URLs, malformed JSON, wrong registry names

  2. Missing authentication failure scenarios (HIGH)

    • docs/getting-started/installation.md Authent

Read the thread · 2026-03-06 · closed · outside contributor · 4 comments

Review: Security findings from fix/225-docs-cors-security-findings

From automated review of #266.

Findings

1. Case-insensitive origin bypass (High)

2. Trailing slash / port number bypass (Medium)

Read the thread · 2026-03-06 · closed · outside contributor · 2 comments

Review: Documentation findings from fix/174-maintainability-findings

Documentation Review Findings

From PR #200 (fix/174-maintainability-findings).

1. Missing CONTENT_ORG/CONTENT_REPO env vars documentation (Medium)

Read the thread · 2026-03-06 · closed · outside contributor · 2 comments

Debugging & Dry-Run Mode

Summary

Add dry-run mode to preview dossier actions without execution, with risk scoring and detailed impact analysis.

Business Motivation

Users are cautious about running automation they don't fully understand. Dry-run shows what would happen without executing - building confidence and catching issues early.

User Impact

Acceptance Criteria

Read the thread · 2025-11-14 · open · outside contributor · 3 comments

Most recent

bug(sched): opencode dispatch template lacks --auto — headless agents die on external_directory auto-rejects (worktree paths)

Found during #471 (sched fleet-parity validation, W3, hcc2).

Sequence

W3's first opencode dispatch round (openrouter glm) had three agents exit abruptly mid-phase:

Read the thread · 2026-08-30 · open · outside contributor · 0 comments

feat: Deterministic TypeScript markdown security scanner in core

Summary

Implement a deterministic TypeScript security scanner in packages/core/ that mirrors the AI-driven scanning methodology defined in the scan-markdown-security dossier (main/examples/security/scan-markdown-security.ds.md). This provides programmatic, repeatable analysis without requiring an LLM.

Motivation

The dossier-based scanner relies on an AI agent to perform pattern matching. A deterministic TypeScript implementation enables:

Read the thread · 2026-03-07 · closed · outside contributor · 0 comments

fix: config-cmd.ts help text describes DOSSIER_REGISTRY_TOKEN incorrectly

Source: PR #305, found during review of fix/215-doc-findings-security-registry-config File: cli/src/commands/config-cmd.ts:34 Issue: Help text says "Auth token for the default registry" but the token actually creates credentials for the virtual "env" registry, not the default registry. Why escalated: This is a code change to CLI help text, not a documentation file. Out of scope for the docs-only issue #215.

Read the thread · 2026-03-06 · closed · outside contributor · 0 comments

dx: add "ai-dossier doctor" diagnostic command

Problem

No diagnostic tool when setup fails. Common issues: MCP not configured, wrong Node version, hook not installed, registry unreachable. We need a safety net for our multi-component setup.

Solution

New ai-dossier doctor command checking:

Read the thread · 2026-03-06 · closed · outside contributor · 0 comments

docs: complete onboarding tutorial suite

Problem

Only 1/5 tutorials completed. 4 are "coming soon". Current tutorial requires many manual steps before user sees value.

Supersedes

Consolidated with concrete deliverables.

Solution

Create 3 new tutorials:

  1. "MCP in 60 Seconds" — single command install, ask Claude to list/run dossiers (the critical missing piece)
  2. "Author and Publish" — create → validate → sign → publish → run lifecycle
  3. **"Rec

Read the thread · 2026-03-06 · closed · outside contributor · 0 comments

docs: replace "Try it Now" section with progressive-friction setup

Problem

README "Try it Now" recommends MCP (Option A) but shows the hardest path (manual JSON editing). The simpler claude mcp add one-liner from mcp-server/README.md is not mentioned. Option B requires git clone.

Solution

Restructure to lowest-friction-first:

Read the thread · 2026-03-06 · closed · outside contributor · 0 comments

dx: make "ai-dossier init" configure Claude Code MCP server automatically

Problem

ai-dossier init creates ~/.dossier/ and installs the discovery hook but does NOT configure the MCP server. Users must separately edit JSON or know claude mcp add. Two disconnected steps.

Solution

Enhance init to:

Read the thread · 2026-03-06 · closed · outside contributor · 0 comments

feat: submit to Claude Code Plugin Marketplace

Problem

Our MCP server works but requires manual JSON config editing or knowing claude mcp add. It's not discoverable from within Claude Code. Projects like token-optimizer use /plugin marketplace add for single-command install with auto-updates.

Solution

Read the thread · 2026-03-06 · closed · outside contributor · 1 comment

Review: Documentation findings from feat/216-external-reference-declaration

Documentation gaps identified in review of #216

1. docs/reference/schema.md — Missing external reference fields

The schema reference doc does not document content_scope and external_references fields.

2. docs/guides/dossier-guide.md — Missing from schema overview

The guide mentions security fields but doesn't cover external references.

3. mcp-server/README.md — read_dossier tool description

Doesn't mention security_notices output for undeclared external URLs.

4. Root

Read the thread · 2026-03-06 · closed · outside contributor · 2 comments

Review: Documentation findings from fix/179-supportability-findings-manifest

Documentation findings from automated review of PR #217

1. MVP0 implementation docs lack error response documentation (Low)

2. Registry README API table missing error documentation (Low)

Read the thread · 2026-03-06 · closed · outside contributor · 2 comments

The remaining reports are on the project's issue tracker.