bmottin/claude_mac
1
0
Fork 0
forked from bchanot/claude
Code Pull Requests Activity

chore(memory): case 5 OmniRoute rejected — TODO + journal, review complete

Browse Source
This commit is contained in:
bastien
2026-09-27 21:34:10 +02:00
parent da35cdee2d
commit 197225ab46
2 changed files with 14 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.claude/memory/journal.md
+1
View File
@@ -519,3 +519,4 @@ rules:
## 2026-09-27
- bugfix/gitignore-diagram-allowlist merged into develop on user go, `gitflow finish` → facd26d, pushed, copies removed by the lib. Day 2026-09-25 lot fully on develop: BDR-101 default profile, full +4 gstack skills, gitignore allowlist. No working branch anywhere; `skills/diagram` ignored.
- Case 4 (reticle 898 stars, 3 months, FSL server): only repo of the six with a capability nothing local has (store state, verdict with file:line, replayable flows, CI gate). User go: parked with a 4-step pilot recipe in TODO (opt-in external, pinned, wrapper skill that never runs `init`, telemetry off, staging only). chore/six-repo-review-notes UNMERGED.
- Case 5 (OmniRoute 70.6k stars, 1 GB, 96 deps): rejected. Subscription cannot pass through a keyed gateway; fail-open guardrails, default JWT secret admin bypass, Socket.dev block on 3.8.5, TLS fingerprint spoofing + free-tier key pools. Zero gap for a Claude-only subscription workflow. 6-repo review complete: 4 branches UNMERGED (yagni-ladder, agent-skills-borrow, web-building-microrules, six-repo-review-notes).
.claude/tasks/TODO.md
+13
View File
@@ -1,5 +1,18 @@
# TODO
## 2026-09-27 — case 5 of the 6-repo review: OmniRoute rejected (chore/six-repo-review-notes)
Gateway to 357 providers via `ANTHROPIC_BASE_URL` → localhost:20128; needs provider
API keys, a Claude Pro/Max subscription cannot go through it. No gap here: Claude-only
workflow on subscription, codex second opinion already via gstack `codex` CLI, rtk
native, caveman purged. Against: sits in the path of every prompt with 96 deps and
a fail-open guardrail design (doctrine says fail closed); default JWT secret
`omniroute-default-secret-change-me` = admin bypass if unchanged; npm 3.8.5 blocked
by Socket.dev (May 2026, malware indicators), two real vulns closed in 3.8.6; JA3/JA4
TLS fingerprint impersonation + 40 pooled free-tier keys = provider-ToS risk; no
audit, SBOM or signing. Stars 70.6k in 7 months. Not to be re-evaluated unless a
multi-provider need appears, and then a keyed gateway is still not the answer.
- [x] R1 verdict recorded, nothing installed, nothing built.
## 2026-09-27 — case 4 of the 6-repo review: reticle parked with a pilot recipe (chore/six-repo-review-notes)
User go "parquer avec la recette". Real gap (runtime store state, structured
verdicts with file:line, replayable flows, CI `gate --since`), no current project