Repository navigation
feat: parity batch — Organizations async accounts, Cognito Identity STS creds, ID shapes, IoT MQTT jobs, SSM agent protocol, Backup restores - #2493
Merged
Conversation
CreateAccount and CreateGovCloudAccount return IN_PROGRESS during an opt-in window (--lifecycle-organizations / ORGANIZATIONS_LIFECYCLE_DELAY), then settle to SUCCEEDED or FAILED. The account only appears in ListAccounts/DescribeAccount once SUCCEEDED. Settling is lazy on read. Default delay is 0, so behaviour is unchanged unless opted in. Closes: gopherstack-cefu7.50 Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EFp5KU8QNMfPqXVavWVtMT
GetCredentialsForIdentity now assumes the selected role through STS AssumeRoleWithWebIdentity with a Cognito OpenID token, so the returned credentials pass sts GetCallerIdentity as the assumed role. STS treats cognito-identity.amazonaws.com as a built-in issuer and exposes the amr condition key. Role selection honours RoleMappings (Token and Rules types, Deny vs AuthenticatedRole for ambiguous resolution) before falling back to the pool's roles. Login tokens from emulator-hosted user pools are signature-verified; bad signatures fail with NotAuthorizedException. Closes: gopherstack-cefu7.47 Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EFp5KU8QNMfPqXVavWVtMT
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EFp5KU8QNMfPqXVavWVtMT
…ventory The JSON key is unchanged, so existing snapshots decode the same; no version bump needed. Also syncs bd state. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EFp5KU8QNMfPqXVavWVtMT
Slicing a UUID past 8 characters keeps the hyphen at index 8, so several generators produced IDs with the wrong charset or length: - transfer: web app vpce-/apl- IDs (17/16 hex) - ssm: JIT session AccessKeyId (ASIA + 16 alphanumerics) - ecs: task set Id (ecs-svc/<19 digits>), container RuntimeId (64 hex) - cloudfront: distribution tenant ID (dt_ + 27), tenant invalidation ID - opensearch serverless: policy/config versions (base64 of <ms>_<n>) - mq: configuration ID (c- + full UUID) - mediaconvert: job ID (<13 digits>-<6 alnum>) TestNoUndeclaredUUIDTruncation flags uuid truncation in services/ that isn't allowlisted with a reason. Closes: gopherstack-cefu7.51 Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EFp5KU8QNMfPqXVavWVtMT
…validation
- --iot-mqtt-port / IOT_MQTT_PORT (default 1883, 0 picks a free port).
- The broker answers $aws/things/{thing}/jobs/get, start-next,
{jobId}/get and {jobId}/update with accepted/rejected replies, and
publishes notify / notify-next when job executions change. Replies use
the same backend state as the iot-jobs-data HTTP API.
- CreatePolicy and CreatePolicyVersion reject documents without a
Version and well-formed Statement entries (Effect, Action/NotAction,
Resource/NotResource) with MalformedPolicyException.
Closes: gopherstack-cefu7.49
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EFp5KU8QNMfPqXVavWVtMT
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EFp5KU8QNMfPqXVavWVtMT
…ync-create-account
The SSM handler now also answers EC2WindowsMessageDeliveryService.* (GetEndpoint, GetMessages, AcknowledgeMessage, DeleteMessage, FailMessage, SendReply), so an external amazon-ssm-agent can receive and run commands. Once an instance has polled, SendCommand queues an aws.ssm.sendCommand message for it instead of synthesising output; GetMessages long-polls up to 20s and honours VisibilityTimeout, and SendReply maps plugin runtime status, stdout/stderr and exit code onto the command invocation. CancelCommand queues aws.ssm.cancelCommand for agent-run invocations. Docker-backed instances keep direct execution. Refs: gopherstack-cefu7.35 Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EFp5KU8QNMfPqXVavWVtMT
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EFp5KU8QNMfPqXVavWVtMT
…feat/parity-batch-2026-10-17
…rity-batch-2026-10-17 # Conflicts: # .beads/issues.jsonl
…into feat/parity-batch-2026-10-17 # Conflicts: # .beads/issues.jsonl
… feat/parity-batch-2026-10-17 # Conflicts: # .beads/issues.jsonl
…y jobs - StartReportJob writes CSV/JSON report files to the plan's S3 delivery channel and returns ReportDestination; S3 write failure fails the job. - Backup jobs snapshot DynamoDB tables (schema + items), S3 buckets and EBS volume shape into the recovery point; StartRestoreJob recreates the resource through the owning backend and sets CreatedResourceArn. - Restore (PENDING/RUNNING/COMPLETED) and copy (CREATED/RUNNING/COMPLETED) jobs settle lazily after an opt-in BACKUP_LIFECYCLE_DELAY; default 0 keeps them synchronous. Closes: gopherstack-cefu7.48 Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EFp5KU8QNMfPqXVavWVtMT
…h-2026-10-17 # Conflicts: # cli_lifecycle.go
This was referenced Oct 17, 2026
|
Important Review skippedToo many files! This PR contains 988 files, which is 888 over the limit of 100. To get a review, reduce the PR to 100 files or fewer by splitting it into smaller PRs or changing its base branch. Upgrade to a paid plan to raise the limit. Usage-priced reviews support at most 300 files. ⚙️ Run configuration
📒 Files selected for processing: 988
You can disable this status message by setting the ✨ Finishing Touches
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
…ack instances ImportStacksToStackSet only queues the operation; the instance is applied by the stack-set queue goroutine. On a loaded -race runner the test listed before that ran and saw 0 instances. Wait for the operation to reach SUCCEEDED, as a real client does. Closes: gopherstack-l1oo4 Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EFp5KU8QNMfPqXVavWVtMT
Codecov Report❌ Patch coverage is 📢 Thoughts on this report? Let us know! |
… developer login check - GetCredentialsForIdentity honours CustomRoleArn when it is a role the identity can map to (pool role for its auth state, or a Token/Rules mapping match); otherwise NotAuthorizedException. - The pool's principal tag attribute map (and UseDefaults) is applied to the OpenID token's session-tag claim, so the STS session carries the tags. - GetOpenIdTokenForDeveloperIdentity rejects Logins keys other than the pool's DeveloperProviderName with InvalidParameterException. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EFp5KU8QNMfPqXVavWVtMT
…nishes Stack-set mutations only queue an operation. TestStackSetAsyncReadsWaitForOperation flags test functions that read stack instances or operation results after a mutating call without waiting, unless they use an auto-waiting harness. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EFp5KU8QNMfPqXVavWVtMT
The census resolves op tables by following package-wide assignments to `ops`, so the agent table was counted as six SSM API operations. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EFp5KU8QNMfPqXVavWVtMT
reset-caches does the whole-box reset (kill servers, test binaries and test containers, clear Go/lint/Docker caches and stale scratch). Scratch root follows TMPDIR, not GOTMPDIR, since GOTMPDIR now lives on /mnt/nvme while Claude scratch stays under TMPDIR. Closes gopherstack-cu4g: Option A is built (awsmeta.Principal wired via principalMiddleware). Unconverted consumers filed as gopherstack-tnqy.6. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
# Conflicts: # .beads/issues.jsonl # .claude/skills/reset-caches/SKILL.md # .claude/skills/reset-caches/reset.sh
gotest-fail.sh runs go test -json -race and prints only failures: failed tests, build-output/build-fail events, package-level failures (TestMain/init panics, setup failures, races outside tests), stray stderr, and a summary line. Exit code is go test's. svcops.sh compares a service's SDK operations (api_op_*.go at the go.mod-pinned version) against what services/<svc> routes, using cmd/opcensus over GetSupportedOperations plus handler evidence, so REST-XML/REST-JSON services don't report false "missing" ops. Refs: gopherstack-gtouu Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FGWXecoauvZN2AYe1vkvgM
gates: gotest-fail.sh for fix loops. map: svcops.sh before claiming an op exists or is missing. service-op: hard rule to read sdk-shape output before writing wire structs/error codes, and run svcops.sh before/after. sdk-shape: cross-reference svcops.sh. Refs: gopherstack-gtouu Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FGWXecoauvZN2AYe1vkvgM
CHECKPOINT.md, PARITY_PHASE4_KICKOFF.md and parity.md are campaign history; nothing reads them by path. References in kms/PARITY.md, dax/DATAPLANE.md and the gopherstack-map skill are updated. GEMINI.md and AGENTS.md stay at root (tool conventions); cli_route_path_gates.txt is go:embed'd and moves with cli_route_gates.go. Refs: gopherstack-h4b67 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FGWXecoauvZN2AYe1vkvgM
The request ring buffer now records Query (presign secrets redacted), Service (router context tag, SigV4 scope fallback), and ErrorCode / ErrorMessage extracted from JSON or XML error bodies for status >= 400. GET /_gopherstack/requests returns recent entries newest-first with n, status (exact, Nxx, failed) and service filters. Add, GetAll, Recent and subscribers all hand out clones, so readers never alias buffer state under concurrent requests. Fixes resolveResponseStatus, which looked for Status()/StatusCode() methods that echo.Response does not have, so every response was logged as 200. Refs: gopherstack-gtouu Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FGWXecoauvZN2AYe1vkvgM
Wraps /_gopherstack/requests (failed-request table with error codes), snapshot (per-service state, case-insensitive), reset and health. Endpoint from GOPHERSTACK_ENDPOINT, default http://localhost:8123. Refs: gopherstack-gtouu Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FGWXecoauvZN2AYe1vkvgM
agbishop
enabled auto-merge (squash)
October 17, 2026 19:18
Root now holds only main.go (a thin app.Run() call) and default.pgo. The other 265 Go files and the go:embed'd cli_route_path_gates.txt move unchanged into internal/app as package app; splitting it into wiring, cliconfig and routegates packages follows separately. internal/app's TestMain chdirs to the module root so guard tests that walk services/, pkgs/, docs/ by relative path keep working. cmd/routecollisions and the registration test read internal/app/cli.go. Comments citing root parity.md now point at docs/history/parity.md. Refs: gopherstack-h4b67 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FGWXecoauvZN2AYe1vkvgM
…names Sec-WebSocket-Accept is SHA-1 by RFC 6455. The docdb/neptune/redshift uuid[:12] values are Docker container names, same as the existing rds/engine.go entry, not AWS IDs. Refs: gopherstack-h4b67 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FGWXecoauvZN2AYe1vkvgM
Tier 3 collected every map-literal key in the package whenever a
dynamic source was assigned a composite literal, so an unrelated local
dispatch table (SSM agentOps) counted as API operations. chaseExpr now
resolves composite literals (and &T{...}) directly, chaseCall chases
call arguments, and tier 3 only matches index assignments whose target
names a dynamic source. Census output is byte-identical.
Closes: gopherstack-zjylp
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FGWXecoauvZN2AYe1vkvgM
internal/routegates owns the target/path route gates and the embedded path_gates.txt; internal/cliconfig owns LifecycleSettings and PersistableConfig. internal/app files drop the redundant cli_ prefix (cli.go and cli_test.go stay). The CLI struct stays in app: its config fields share ~200 methods with runtime handler state. Moving the cross-service wiring out of app is deferred: it needs the region/ARN/tag helpers and ~100 adapter types in cli.go exported first. Refs: gopherstack-h4b67 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FGWXecoauvZN2AYe1vkvgM
A handshake-terminating proxy in front of MySQL/MariaDB units offers mysql_clear_password over TLS, switches clients that offered another plugin via AuthSwitchRequest, validates the token with the same check as Postgres, then logs in to the engine and splices bytes. Bad tokens get ERR 1045 / SQLSTATE 28000. MySQL/MariaDB units always sit behind the forwarder so IAM can be enabled later by ModifyDBInstance. Verified with fake-backend wire tests and the docker-gated test against real mysql and mariadb containers. Closes: gopherstack-cefu7.59 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FGWXecoauvZN2AYe1vkvgM
Service PARITY/README notes, route-collision docs, examples, ui doc comments and skills now cite internal/app/cli.go, internal/app/<name>.go and internal/routegates. task leak-test runs ./internal/app/. Dated PARITY.md history entries and docs/history keep their original paths. Refs: gopherstack-h4b67 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FGWXecoauvZN2AYe1vkvgM
The plain-scalar run: line contained ': ' inside the sed pattern, which YAML reads as a mapping, so GitHub rejected ci.yml and copilot-setup-steps.yml and no jobs ran. Use a block scalar. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FGWXecoauvZN2AYe1vkvgM
exhaustive flags empty map literals keyed by enum-like types (token.Pos, SDK enums, bodyclass class) as missing every key. make(map[K]V) is equivalent and not a literal. Renames eks/wf8f_test.go to argocd_role_mappings_test.go. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FGWXecoauvZN2AYe1vkvgM
…error Extracts helpers from six gocognit offenders (athena ListTableMetadata, autoscaling TerminateInstanceInAutoScalingGroup and DescribePolicies, ecs enrichContainerInstance, fsx DescribeS3AccessPointAttachments and DescribeSnapshots) without behaviour change. Header.Set keys use canonical form (wire output unchanged). Drops two unused staticcheck nolints in sagemaker. ecs watchContainerExit logs a container wait error unless shutdown cancelled it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FGWXecoauvZN2AYe1vkvgM
Weak-hash, uuid-truncation, default-transport, stackset-wait, provider-init, lifecycle-docs and repo-hygiene guards scan the tree and need nothing from internal/app, so they live in their own package with a module-root TestMain. error_wire_guards stays in app (uses wiredServices). Closes: gopherstack-h4b67 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FGWXecoauvZN2AYe1vkvgM
…to feat/parity-batch-2026-10-17
…u7.67, v4ls9 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FGWXecoauvZN2AYe1vkvgM
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FGWXecoauvZN2AYe1vkvgM
No API attaches a lineage group policy, so the backend can only report not-found. Returning (string, error) left the handler with an err != nil check that staticcheck SA4023 flags as always true in CI (local lint did not), so the method now returns just the error and the handler passes it through. Wire errors are unchanged. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FGWXecoauvZN2AYe1vkvgM
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
The fake runtime starts instantly, so under -race -shuffle the restored cluster could reach available before the test read "creating". Gate the probe with the fixture's existing probeErr hook, assert creating, then release it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FGWXecoauvZN2AYe1vkvgM
…in frame errorCaptureWriter no longer calls ResponseWriter.Write itself: writes go through io.MultiWriter(response, capped error-body buffer), clearing go/reflected-xss on the pass-through. The neptune gremlin probe frame is built with slices.Concat instead of len arithmetic in make, clearing go/allocation-size-overflow. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FGWXecoauvZN2AYe1vkvgM
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FGWXecoauvZN2AYe1vkvgM
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
One PR for the current parity batch. Replaces #2487, #2488, #2490, #2491, #2492, plus the Backup work.
Organizations (gopherstack-cefu7.50)
CreateAccount/CreateGovCloudAccountreturnIN_PROGRESSduring an opt-in window (--lifecycle-organizations/ORGANIZATIONS_LIFECYCLE_DELAY), thenSUCCEEDEDorFAILED. Account hidden fromListAccountsuntil it succeeds. Default 0 keeps instant behaviour.Cognito Identity (gopherstack-cefu7.47)
GetCredentialsForIdentityreturns real STS sessions viaAssumeRoleWithWebIdentity, sosts GetCallerIdentityaccepts them (wasInvalidClientTokenId).cognito-identity.amazonaws.comas a built-in issuer and adds the:amrcondition key.RoleMappingsapplied: Token and Rules types,AmbiguousRoleResolutionDeny vs AuthenticatedRole.NotAuthorizedException.Generated ID shapes (gopherstack-cefu7.51)
vpce-/apl-, SSM JIT AccessKeyId, ECS task set Id and container RuntimeId, CloudFront tenant and tenant invalidation IDs, OpenSearch Serverless policy versions, MQ configuration ID, MediaConvert job ID.TestNoUndeclaredUUIDTruncationguards the bug class repo-wide.IoT (gopherstack-cefu7.49)
--iot-mqtt-port/IOT_MQTT_PORT(default 1883, 0 = free port).$aws/things/{thing}/jobs/get,start-next,{jobId}/get,{jobId}/update, plusnotify/notify-next.CreatePolicy/CreatePolicyVersionreject malformed policy documents withMalformedPolicyException.SSM Run Command agent protocol (gopherstack-cefu7.35, partial)
GetEndpoint,GetMessages,AcknowledgeMessage,DeleteMessage,FailMessage,SendReply) so an external SSM agent can receive and run commands; replies update command invocations. Docker-backed instances keep direct execution.Backup (gopherstack-cefu7.48)
ReportDestination.StartRestoreJobrecreates the resource and setsCreatedResourceArn.BACKUP_LIFECYCLE_DELAY.Added since opening
SSM Session Manager data channel:
StartSessionreturns a StreamUrl on this server;/ssmmessages/v1/data-channel/<id>serves the plugin protocol (handshake, acks, ordering) and pipes to a TTY shell in docker-backed instances. Closes gopherstack-cefu7.35.Cognito Identity:
CustomRoleArn, pool principal tags as STS session tags, developer-provider check onGetOpenIdTokenForDeveloperIdentity.IoT: opt-in
--iot-mqtt-auth: TLS client certificates (registered, ACTIVE) and IoT policy checks on connect/publish/subscribe/receive with${iot:ClientId}and${iot:Connection.Thing.ThingName}.IDs: EC2, EFS and Route 53 Resolver mint prefix + 17 hex via new
pkgs/awsid; resolver endpoint and query-log prefixes corrected.Test reliability: CloudFormation import test waits for the stack-set operation; new guard
TestStackSetAsyncReadsWaitForOperation.opcensus: bare identifiers resolve only within the reading function.
Repo tooling:
CLAUDE.mdis now tracked and states thepkgs/and AWS parity rules directly; the session-close skill no longer runsbd dolt push, which did nothing.Codebase graph:
.ua/holds an Understand-Anything knowledge graph: 8,251 files, 55,230 nodes, 146,056 edges, 11 layers, 13-step tour. Azure, cosmosdb,_test.go, testdata and generated code are excluded. Fingerprints and scan result are included so later/understandruns only reanalyze changed files..ua/**is markedlinguist-generated -diff, and scratch folders are gitignored.reset-caches skill: scratch cleanup follows
TMPDIRinstead ofGOTMPDIR, which now lives on a separate disk.Issue tracking: caller-identity decision gopherstack-cu4g closed because Option A is already built (
awsmeta.PrincipalviaprincipalMiddleware). Services that still ignore the caller (kms grants, organizations handshakes, rds shared snapshots, ec2 launch permissions) are filed as gopherstack-tnqy.6.Tests
Every change ships with tests red before the fix, table-driven, parallel, synctest for timing. End-to-end wiring tests for Cognito Identity → STS, SSM agent flow, and Backup DDB/S3 restore and report delivery.
Known gaps
Listed per service in each PARITY.md: Cognito
CustomRoleArnand external-IdP signature checks; SSMssmmessagesdata channel; IoT per-thing MQTT authorisation; Backup restores for EC2 instances/EFS/RDS; EFS/EC2/route53resolver 8-hex IDs.Closes gopherstack-cefu7.35, gopherstack-cefu7.47, gopherstack-cefu7.48, gopherstack-cefu7.49, gopherstack-cefu7.50, gopherstack-cefu7.51, gopherstack-5tmft, gopherstack-cu4g
🤖 Generated with Claude Code
https://claude.ai/code/session_01EFp5KU8QNMfPqXVavWVtMT