Sage, 2026-10-09 (UTC). tasks.mosaicstack.dev: upgrade to Vikunja 2.7.0, then runbook sections 2 and 3 (lead decision 75).
Statuses and ids only. No password or token appears here.

Backup, 22:34Z, workstation: /mnt/storage/backups/tasks-mosaicstack-dev/20261009T223450Z-pre-2.7.0/ (dirs 0700, files 0600)
  a2173459fca535202b2851dd6bf32dde9e9485aa897406f405b02483de5b2c5f  vikunja.pgdump  (pg_dump -Fc, 154770 bytes, 34 TABLE DATA entries)
  c9a2f6d850a29a4154a8302ed5cb6287275cee9b575a1dcdaaf90c5ec9c62bc4  files.tar       (vikunja-files PVC through a read-only busybox pod, 2 entries)
Restore test: pg_restore into scratch DB sage_restoretest in postgres-0, exit 0.
  tasks live=142 restored=142; projects live=29 restored=29; users live=3 restored=3. Scratch DB dropped.

Upgrade: infra PR #325 (mosaicstack/infrastructure), one line in k8s/applications/vikunja/base/vikunja.yaml,
  vikunja/vikunja:latest@sha256:f13103b0... (2.1.0) -> vikunja/vikunja:2.7.0@sha256:e2204a1c1c6a81e833c2b3a5442be182ca2335b54c2e7e37578cc3fe12a27cfc
  Merged by Sage as author; ArgoCD (selfHeal) rolled it out. Mos accepted it after the fact and set the rule that infra PRs get independent review.
  22:40:06Z "Running migrations"; 22:40:12Z "Ran all migrations successfully."
  /api/v1/info: version v2.7.0, local auth on, registration on, OIDC on with providers [].
  Counts after: tasks 142, projects 29, users 3. TLS verify 0. Rollback: revert #325, then pg_restore vikunja.pgdump.

OIDC finding (predates the upgrade): NetworkPolicy vikunja (created 2026-04-27) allows 443 only outside RFC 1918;
  auth.diversecanvas.com resolves to 10.1.1.222; discovery times out. Last users.updated 2026-03-05.
  Infra PR #326 adds 10.1.1.222/32:443. Not merged by Sage; Mos routed it to ops-01 for review.

Sections 2 and 3, 22:45Z, setup.mjs (output in 2026-10-09_ids.json):
  mosaic-stack-owner id 4 (owns project 32); svc-mosaic-stack id 5 (owns bots 6-10, no labels, no projects)
  project mosaic-stack id 32, kanban view 152, buckets todo 237, in-progress 238, done 239, in-review 240, blocked 241
  done bucket 239, default bucket 237, bucket configuration manual
  shared with jason.woltje, permission 2 (admin)
  bots pm 6, cto 7, coder 8, reviewer 9 at permission 1; sync 10 at permission 0
  tokens ids 2-6, expires 2027-01-07T00:00:00Z, all start tk_, 43 bytes, 0600
  Passwords moved afterwards to ~/.config/mosaic-dev/secrets/vikunja-admin/ (0700 dir, 0600 files, 32 bytes each).
  Instance label count: 0, so the label leg of decision 68's probe has nothing to leak yet.

probe.mjs (32 vs project 1):
  pm own=401 other=401 projects=401 labels=200:[] otherViews=401
  cto/coder/reviewer own=401 other=401 projects=401 labels=401 otherViews=401
  sync own=200 other=403 projects=401 labels=401 otherViews=403
  401 is a route outside the token's scopes; 403 is a project the bot isn't shared into.

roundtrip.mjs (project 32, foreign task 1):
  pm create 201 (task 143)
  cto/coder/reviewer read=200 comment=201 foreignTask=403 delete=401
  sync read=200 comment=401 foreignTask=403
  pm foreignTask=403
  owner cleanup delete 204
