Milestones
tailscale2otel
Progress across published tasks.
user-friendliness
13 of 13 completed
TSO-0007Make the default Prometheus listener safe and scrapeableTSO-0008Add an explicit Prometheus-only delivery modeTSO-0009Add a bounded Prometheus first-scrape checkTSO-0010Make first-run onboarding backend-neutralTSO-0011Ship minimal delivery-specific starter configurationsTSO-0012Revalidate and align the Alloy gateway recipeTSO-0013Document dynamic node-metrics discovery as a first-use pathTSO-0014Make optional ingestion paths easier to chooseTSO-0015Add an operator-first alert profile chooserTSO-0016Add a release-independent upgrade and rollback checklistTSO-0017Fix documentation social metadata ownership and asset checksTSO-0018Decide the supported alerting path for Prometheus-only deploymentsTSO-0019Generate public capability counts from the catalog
Wave 1: bugs and guardrail foundations
12 of 12 completed
TSO-0028Fix stale hand-maintained alert-count prose in READMEsTSO-0029Fix stale single-tailnet receiver claim in config.example.yamlTSO-0030WAL replay can double-emit metrics/logs after a crash between apply and commitTSO-0031Headscale custom ip-prefix deployments misclassify tailnet addresses as external and geoip-enrich themTSO-0032Per-runtime shutdown is sequential, contradicting the deliberate parallel-shutdown fixTSO-0051Quiet key-expiry warnings: on-change + daily mode as defaultTSO-0053Cardinality backstop for the posture attribute-namespace wildcardTSO-0054Configurable dedup and seen-set capacities (flow, audit, objectstore)TSO-0066Per-tailnet cardinality limit overridesTSO-0077Headscale HTTP retry/rate-limit config: implement or rejectTSO-0078Document restart-required vs hot-reloadable config keysTSO-0087Classify the three audit enum values the 2026-08-30 spec re-vendor added
Wave 5: HA coordination and validation follow-ups
7 of 7 completed
TSO-0093Investigate high stream flow ingest-event-age p95TSO-0104Persistent flow store fails to open after RC rolloutTSO-0105Grafana alert rules remain unevaluated after publicationTSO-0106Stream flow capture-delay telemetry is absentTSO-0107Lease-based active-passive coordination (HA phase A1)TSO-0108Kubernetes checkpoint store backend (HA phase A2)TSO-0109Helm chart support for coordinated multi-replica deployment
v5 big bang major
1 of 1 completed
Wave 2: Loki state-snapshot family
8 of 8 completed
TSO-0044Policy file snapshots to Loki (full ACL/grants body as log records)TSO-0045Policy diff log records on revision changeTSO-0046Config-state snapshot family: DNS, settings, webhooks, posture integrations to LokiTSO-0047Device inventory change-log to LokiTSO-0048Grafana annotations from audit events on the generated dashboardsTSO-0049ACL risk findings as structured log recordsTSO-0050Key and user-invite lifecycle timeline eventsTSO-0089Retire or wire the orphaned deploy/grafana/gen/tabs/events.py module
Wave 3: API surface expansion
9 of 9 completed
TSO-0034Org auto-discovery of tailnets via the alpha Organizations APITSO-0035Graceful handling of new audit-log event families (PAM_*, BORDER0_API, APERTURE_*)TSO-0037Services collector: displayName, tags rollup and NodeID joinTSO-0038Peer-relay connection dimension on node connectivity metricsTSO-0039Posture attribute values: compliance gauges with cardinality capsTSO-0040Workload Identity Federation as an exporter auth methodTSO-0041Verify flow-log native actor identity fields are decoded, not droppedTSO-0042Adjudicate the 14 unhandled API response fields in the contract ledgerTSO-0043Grants-aware policy parsing and acls-vs-grants adoption metric
Wave 4: collector and ingestion resilience
11 of 11 completed
TSO-0052Bound the N+1 per-device subrequests in the devices/services collectorsTSO-0055Classify nodemetrics scrape failures beyond transient_failureTSO-0058Hot-reload receiver secrets (streaming token, webhook secret)TSO-0059Per-tailnet admission fairness on shared receiversTSO-0060WAL fill-percentage gauge and shipped alertTSO-0061First-class ingest-lag signal per source and signal typeTSO-0062TTL reset for schema-drift warning dedup in long-lived processesTSO-0063Act on device-cache staleness during control-plane outagesTSO-0064rdns warm-start snapshot across restartsTSO-0065Youngest-eviction-age gauge on dedup setsTSO-0091Dedup youngest-eviction-age gauge latches for the process lifetime with no reset path
Wave 5: operator surface and cost controls
11 of 11 completed
TSO-0067Cost forecast for expensive collector knobsTSO-0068Delta-temporality escape hatch for OTLP metrics exportTSO-0069Promote the OTLP-outage diagnostics summary interval to configTSO-0070Warn on gRPC exporter with CA rotation but no reconnection periodTSO-0071Per-tailnet Tailscale API rate-limit utilization gaugeTSO-0072Rate-limit admin authentication failuresTSO-0073Mutual TLS on the admin listenerTSO-0074Include a bounded recent-log tail in the support bundleTSO-0075Consolidated durable-storage health view on the status pageTSO-0081Version-check fail-open visibility and Headscale defaultTSO-0090just verify-deploy reports unreachable when any unrelated gcx context is broken
Wave 6: config ergonomics and performance
6 of 6 completed
TSO-0056Scale the scheduler stagger window with deployment sizeTSO-0057Per-type intervals for logstream status probesTSO-0076Debounce checkpoint writes across collectorsTSO-0079Env-var injection for list-valued credentials (tailnets, routes, targets)TSO-0080Surface zero-traffic receiver misconfiguration without breaking startupTSO-0082Flow store disk reclamation and journal observability
Wave 7: deploy and docs polish
5 of 5 completed
TSO-0083Headscale and multi-tailnet starter configs in examples/configTSO-0084Extend the compose secrets template to objectstore and Headscale credentialsTSO-0085Complete the NetworkPolicy egress guidance (MaxMind, FQDN example, sidecar note)TSO-0086Doc and dashboard polish batchTSO-0092Retire the 35-panel ceiling and re-group the whole dashboard tab structure
Decision-gated
2 of 2 completed
Wave 4: live validation and review follow-ups
9 of 9 completed
TSO-0095Validate Wave 3 live on the lab deploymentTSO-0096Shard the CodeRabbit pre-commit review so a wave-sized diff can be reviewedTSO-0097Decide precedence between env-supplied secrets and their _file siblingsTSO-0098Webhook router caches its tokenless and auth-mix decision across secret rotationTSO-0099Services collector reports a complete host snapshot after cancelled dispatchTSO-0100Keep the docker-compose deployment path validated by CI now camden is retiredTSO-0101Reject an already-cancelled request before it consumes an admission slotTSO-0102Split the shared TS_WIF secret: one name, two incompatible scope requirementsTSO-0103Restyle the embedded console onto design system v2 (family standard-setter)
Unassigned
119 of 147 completed
TSO-0001Upgrade Go toolchain to 1.27TSO-0002Remediate Codex Security scan b3c6de8eTSO-0002.01Harden ingress and local HTTP boundariesTSO-0002.02Bound retained state and protect local persistenceTSO-0002.03Harden outbound credentials transports and TLSTSO-0002.04Close Helm credential and workload identity gapsTSO-0003Cut CI job fan-out per PR to drain the Actions queueTSO-0004prometheus.max_requests_in_flight: 0 now crash-loops every config copied from the old exampleTSO-0005Persistent flow store refuses every pre-hardening database with no way to migrate itTSO-0006Migrate to OpenTelemetry v1.46.0 / log v0.22.0 after the log attribute API removalTSO-0020Rotate credentials exposed in an agent transcriptTSO-0021Update check fails permanently: the 64 KiB body cap truncates the GitHub latest-release responseTSO-0022Fix live Grafana dashboard accuracy and signal coverage gapsTSO-0023Separate durable evidence state from poll cursorsTSO-0024Support per-tag metrics port overrides in node-metrics discoveryTSO-0025Migrate the repo task surface to just and retire Makefiles and ad-hoc scriptsTSO-0026Add config.schema.json to the advertised regenerate-everything pathTSO-0027Make each generated artifact its own just recipe and retire the script's target dispatchTSO-0088Clarify App.Close flow-store ownership outside Run shutdownTSO-0110Shard and compress Kubernetes checkpoint storage to remove the 1 MiB ceilingTSO-0111Reject a Kubernetes checkpoint configuration that cannot fit its ConfigMapTSO-0112Eliminate the load-dependent CI test flakes that make the gate unreliableTSO-0113Default the coordination namespace to the release namespace, not defaultTSO-0114Reconcile rollback-era legacy checkpoint writes on re-upgradeTSO-0115Prove coordinated Kubernetes mode on the lab, then revertTSO-0116Adjudicate the clientlib-drift alert that fires while both matrix legs passTSO-0117Convert the inventoried timeout-only deadlock guards to deterministic barriersTSO-0118Reconcile a legacy checkpoint object whose migration marker an older release removedTSO-0119Standby replicas record coordination telemetry that the Prometheus pull path never servesTSO-0120Ship alert rules for the Lease coordination feature, which has noneTSO-0121Guard the unsuffixed OpenTelemetry instrumentation scope against a future majorTSO-0122Keep alert policy counts and recommended-profile prose truthfulTSO-0123Allow deployment verification to select a gcx context explicitlyTSO-0124Alert when an enabled receiver is fail-closed by missing credentialsTSO-0125Alert on Prometheus gather errors that silently omit seriesTSO-0126Alert on sustained processor queue dropsTSO-0127Alert on consecutive profiling upload failuresTSO-0128Alert on Kubernetes audit schema driftTSO-0129Reject coordination timings that client-go cannot runTSO-0130Self-fence promptly when a live coordination Lease is deleted or replacedTSO-0131Emit a coordination handover counter so leadership flapping can be alerted truthfullyTSO-0132Prove the coordinated Kubernetes surface live: standby scrapes, demotion, Lease loss, clock skewTSO-0133Review the coordination alert firing history and decide paging, due 2026-09-11TSO-0134PAM config changes never reach the audit-changes metricTSO-0135Assert the pinned golangci-lint and govulncheck versions at run time, the way the helm generators doTSO-0136Attribute PAM telemetry to an operator-named tailnet via pam.tailnetTSO-0137Opt-in per-session PAM log record, off by default and pii_filter-gatedTSO-0138Discovery sweep: inventory uncollected API surfaces and dead shipped signals to refill the boardTSO-0139Expose safe log-stream destination configuration alongside delivery healthTSO-0140Give the lab deployment a rollout trigger so it tracks releases instead of a stale main digestTSO-0141Bring the lab configuration up to the shipped feature set and adjudicate the zero-sample signal familiesTSO-0142Emit the modeled capability scope preflight metric at runtimeTSO-0143Give coordinated replicas per-replica persistent state so the lab can run two replicasTSO-0144Route receiver and admin traffic by a leader pod label so standbys can be ReadyTSO-0145Audit v5 documentation against shipped features and remove AI proseTSO-0146Promotion-time ingress WAL replay blacks out the leaderTSO-0147Resolve recurring readiness failures and ingress WAL drain backlogTSO-0148Decouple ingress WAL completion from metric collection to preserve configured DPMTSO-0149Build local WAL throughput and configuration comparison harnessTSO-0150Diversify Grafana dashboard visualisationsTSO-0151CI hygiene: reusable Go build cache key and main-only smoke-build cacheTSO-0152Prune change-detector unit testsTSO-0153Sanitize exporter first-failure diagnostics before logging backend responsesTSO-0154Raise the Go floor to 1.27.2 so the vulnerability gate passes on a patched toolchainTSO-0155Restore Go 1.27.2 gate compatibility and clear reachable x/net vulnerabilitiesTSO-0156Correct sharded CodeRabbit recipe examples to positional just argumentsTSO-0157Report CodeRabbit finding counts in the sharded review summary instead of CLEANTSO-0158Wire delivery-health diagnostics so export outage and recovery lines actually logTSO-0159Fix nondeterministic TestIngressWALScheduledCadence_CommitRequiresMetricsAndLogs failure in CITSO-0160Sharded CodeRabbit runner: a shard is clean only when counted findings match the complete event's totalTSO-0161Classify a malformed HTTP status line as class other, never by its free-text wordTSO-0162Ingress delivery reports retrying when an export attempt hangs past the reader timeoutTSO-0163Drop an ingress snapshot after N consecutive permanent 4xx rejections and count the lossTSO-0164OTLP ACK probe recipe: record what a gateway returns on a successful HTTP exportTSO-0165Run the OTLP ACK probe against the Grafana Cloud gateway and decide whether the ACK guard is safeTSO-0166Discovery sweep 2: inventory uncollected API surfaces and dead shipped signals to refill the boardTSO-0167Make Headscale limiter timeout proof deterministic instead of a 5ms network raceTSO-0168Curate sampled Tailscale Service throughput from node metricsTSO-0169Diagnose and clear the composed gate tsapi process termination after PASSTSO-0170Scope the node-metrics dashboard tab by tailnet and providerTSO-0171Fix the README overview log-event count and gate itTSO-0172Comprehensive audit of both Grafana dashboards against the live stackTSO-0173Re-vendor the 2026-10 API spec and classify its new enum valuesTSO-0174Move to the tailscale.com/client/tailscale/v2 Go client and repoint the client-lib laneTSO-0175Emit the tailnet route-selection mode and stop regional_routing misreporting the newer modesTSO-0176Per-device posture status gauges from postureStatusTSO-0177Make the documented API spec refresh failure-atomicTSO-0178Anchor fleet summary zeros to observed source presenceTSO-0179Separate absent exporter telemetry from zero health counters in summary tilesTSO-0180Make absent runtime summary data visually distinct from healthy process telemetryTSO-0181Merge redundant current-utilization and overflowing-family dashboard inventoryTSO-0182Count distinct metric families rather than reporter series in the family-count tileTSO-0183Remove fixed historical cap and live-population claims from cardinality panel descriptionsTSO-0184Emit tailnet ownership on runtime traces before offering tailnet-scoped trace panelsTSO-0185Bind the anti-forensics log-read investigation to recorder identity, not a fixed namespaceTSO-0186Add retained browser evidence for every dashboard tab and selector stateTSO-0187Make automatic rule publication explicit in dashboard-only loop authorityTSO-0188Document and prove optional single-tailnet profile selector behaviorTSO-0189Keep device OS pie-chart labels readable at panel snapshot dimensionsTSO-0190Restore exporter availability when deployed image rejects the configured ingress WAL keyTSO-0191Land the dashboard selector-scope guard from the retained audit candidateTSO-0192Diagnose exporter OOM restarts after availability restorationTSO-0193Make route-selection dashboard mode display distinguish prior observations from current stateTSO-0194Repair dashboard-generator reference path in deploy instructionsTSO-0195Harden fleet-summary listing prerequisite regression guardTSO-0196Distinguish absent cardinality telemetry from unlimited capacity and zero overflowTSO-0197Bound expanded startup replay memory without stranding accepted ingress workTSO-0197.01Freeze the bounded replay-memory design and implementation proof packetTSO-0197.02Preserve required delta first-cover effects across failed scheduled collectionTSO-0198Keep connectivity ratio populations consistent under OS filteringTSO-0199Finish dependency sweep and stable release after external review checks recoverTSO-0200Stop restart and failover replay from sending log records Loki rejects as too oldTSO-0201Clamp log catch-up windows to a shared log-acceptance horizonTSO-0202Baseline PAM sessions older than the log horizon on cold startTSO-0203Alert when ingress WAL entries are retired as expiredTSO-0204Alert on sustained per-entity subrequest coverage below 1TSO-0205Alert on a stale persistent flow-store checkpointTSO-0206Export the Go memory limit and alert when heap nears itTSO-0207Replace archived gopkg.in/yaml.v3 with go.yaml.in/yaml/v3TSO-0208Unit-test internal/httpretry and merge the duplicate Retry-After parserTSO-0209Guard tests against runtime.Caller repo-root discoveryTSO-0210Define a freshness contract for bounded scans of large flat object archivesTSO-0211Keep dense entity and category labels readable in dashboard panelsTSO-0212Keep table measurements visible ahead of metadataTSO-0213Distinguish absent telemetry from healthy states in generated panelsTSO-0214Keep the organization-tailnet card legible when data is absentTSO-0215Keep metadata free of numeric and duration formattingTSO-0216Restore meaningful category names in distribution chartsTSO-0217Use a comparable scale and explicit measures for observed flow bytesTSO-0218Join related measurements into coherent per-entity table rowsTSO-0219Align health and inventory colors with documented semanticsTSO-0220Keep default annotations and time axes from obscuring tracesTSO-0221Make topology panels interpretable in populated and empty statesTSO-0222Restore Active series by metric family rendering on Grafana 13TSO-0223Use the correct ratio scale for delivery failure chartsTSO-0224Make ingestion and export cost comparisons dimensionally consistentTSO-0225Render device-country markers for a populated valid-code frameTSO-0226Keep rolling audit-log counts distinct from per-second ratesTSO-0227Name used scrape budget consistently with the displayed fractionTSO-0228Expose truthful receiver batch trace observations on the durable WAL pathTSO-0229Name active-series cap utilization as a ratio rather than a countTSO-0230Keep whole-panel absence explanations out of nullable table cellsTSO-0231Show top node-pair talkers as an identifiable rankingTSO-0232Keep default log rows scannable while retaining metadata detailsTSO-0233Render duration rates as dimensionless quantitiesTSO-0234Label histogram heatmap intensity as observation frequencyTSO-0235Render actionable trace results when the dashboard search returns data