806 Commits

Author	SHA1	Message	Date
didericis-codex	aaf1e60abe	fix: close consolidated quality review findings	2026-07-27 05:33:44 +00:00
didericis-codex	38a67d2767	fix: enforce shared storage permissions	2026-07-27 04:59:50 +00:00
didericis-codex	95cbd0e1c8	fix: enforce cleanup and secret integrity	2026-07-27 04:46:00 +00:00
didericis-codex	f242733d15	fix(cleanup): use authoritative resource identities	2026-07-27 04:46:00 +00:00
didericis-codex	fd295d4c14	fix(gateway): contain output pump shutdown races	2026-07-27 04:46:00 +00:00
didericis-codex	f33566941b	fix(gateway): bound stdlib HTTP request work	2026-07-27 04:46:00 +00:00
didericis-codex	c7c3a79028	fix(cleanup): revalidate destructive backend plans	2026-07-27 04:45:59 +00:00
didericis-codex	bb1776a858	refactor(supervisor): separate MCP dispatch from transport	2026-07-27 04:45:59 +00:00
didericis-codex	a24fe0264d	refactor(egress): extract outbound DLP request stage	2026-07-27 04:45:59 +00:00
didericis-codex	105538d3a6	refactor(egress): extract request policy stages	2026-07-27 04:45:59 +00:00
didericis-codex	ffda40abae	fix(orchestrator): bound streamed request bodies	2026-07-27 04:45:59 +00:00
didericis-codex	a25ea7c188	build(orchestrator): pin FastAPI runtime dependencies	2026-07-27 04:45:59 +00:00
didericis-codex	6e46a9b191	fix(orchestrator): satisfy adapter type contracts	2026-07-27 02:19:11 +00:00
didericis-codex	b8818948a0	feat(firecracker): enumerate running bottles	2026-07-27 02:19:11 +00:00
didericis-codex	b09952045a	fix(orchestrator): bound unauthenticated HTTP requests	2026-07-27 02:19:11 +00:00
didericis-codex	de192359ee	fix(security): authenticate persisted egress secrets	2026-07-27 02:19:11 +00:00
didericis-codex	7d9933edc0	fix(docker): fail closed on network address scan errors	2026-07-27 02:19:11 +00:00
didericis-codex	2bc9ef8ec0	fix(firecracker): abort cleanup on scan errors	2026-07-27 02:19:11 +00:00
didericis-codex	47b6bead69	refactor(backend): type enumeration failures	2026-07-27 02:19:11 +00:00
didericis-codex	15ecada022	fix(docker): surface enumeration failures	2026-07-27 02:19:11 +00:00
didericis-codex	e2222bd96b	fix(security): prohibit unauthenticated orchestrator	2026-07-27 02:19:11 +00:00
didericis-claude	ed9fc76f97	fix(docker): only heal on the ParseAddr poison signature, not any inspect error ... Address review: the self-heal classified every non-absence `network inspect` failure as a poisoned network and force-removed the shared gateway. But inspect also fails on transient daemon/API errors, permission failures, timeouts, or a bad context — destroying a healthy gateway on that guess would tear the network out from under every live bottle. Now the destructive path runs only for the known poison signature (docker's `ParseAddr` error from the malformed `::1/64` IPv6 gateway). The absent case (`No such network`) still just creates; any other inspect failure raises a clear GatewayError without mutating shared state. Adds a regression test asserting a generic inspect error issues neither `docker rm --force` nor `docker network rm` and surfaces the error. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-27 01:41:09 +00:00
didericis-claude	bd8a146a46	fix(docker): heal a poisoned IPv6 gateway network, not just avoid creating one ... PR #515 stopped bot-bottle from *creating* a gateway network with a malformed IPv6 subnet (--ipv6=false), but it can't recover a network that is *already* poisoned. On a daemon that default-enables IPv6, the fixed-name `bot-bottle-gateway` network gets an `fdd0::/64` subnet whose `::1/64` gateway trips docker's own netip.ParseAddr, so `docker network inspect`/`ls` exit non-zero — poisoning every command that reads networks. Such a network can survive on a shared runner from a pre-fix or concurrent launch. `_ensure_network` never healed it: its migrate/recreate branch only ran when `network inspect` *succeeded*, but a poisoned network makes inspect *fail*, so the code fell through to `network create`, which no-ops on "already exists" — leaving the poison in place. The next subnet read then failed with ConsolidatedLaunchError (test_multitenant_isolation), and a bare `docker network ls` failed too (test_orphan_cleanup). Fix, two parts: - gateway.py: when `network inspect` fails for a reason other than "no such network", treat the network as poisoned and force-remove + recreate it IPv4-only. Absent-vs-poisoned is distinguished by the inspect stderr. - test.yml: add an integration-docker preflight that drops the leftover gateway network (and its container) before the suite, so direct `network ls`/`inspect` calls in tests are clean even on a daemon where the in-code heal can't run because inspect itself is what's broken. Adds unit coverage for the poisoned-heal and the absent-create split. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-27 01:23:25 +00:00
didericis-claude	85fb6b0c98	fix(docker): disable IPv6 on the gateway network ... On a docker daemon that default-enables IPv6 (default-address-pools), creating the gateway network with only `--subnet` lets the daemon also attach an fdd0::/64 IPv6 subnet. Its gateway is stored as `::1/64`, which trips docker's own netip.ParseAddr in `network inspect`/`ls`: ParseAddr("fdd0:0:0:6::1/64"): unexpected character, want colon That poisons every `_network_cidr`/`network ls` read and fails the docker integration suite intermittently (whichever run the runner's IPv6 pool index lands on a broken network). bot-bottle attribution pins IPv4 source IPs and has no IPv6 support, so pass `--ipv6=false` explicitly at network create to keep the gateway network IPv4-only regardless of the daemon default. Note: an already-poisoned runner still needs a one-time `docker network rm bot-bottle-gateway` (and possibly a daemon restart) to clear the malformed network. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-26 18:33:48 -04:00
didericis-codex	902286dbc0	fix(build): key nested images by base content	2026-07-26 17:30:36 -04:00
didericis-codex	73c566f3ff	fix(build): close remaining mutable image inputs	2026-07-26 17:30:36 -04:00
didericis-codex	33b7bcd082	build: centralize pinned base image arguments	2026-07-26 17:30:36 -04:00
didericis-codex	9e83ff1992	test: cover image input policy failure paths	2026-07-26 17:30:36 -04:00
didericis-codex	1d10595e5c	build: make pinned image inputs portable	2026-07-26 17:30:36 -04:00
didericis-codex	ff355f81de	test: narrow pinned base match for type checking	2026-07-26 17:30:36 -04:00
didericis-codex	e607af73ab	test: assert reproducible provider image inputs	2026-07-26 17:30:36 -04:00
didericis-codex	5083b45f42	ci: reject mutable image build inputs	2026-07-26 17:30:36 -04:00
didericis-codex	24aeba9676	build: freeze operating system package inputs	2026-07-26 17:30:36 -04:00
didericis-codex	10d295eaf6	build: pin and verify image inputs	2026-07-26 17:30:36 -04:00
didericis-claude	72165b5db5	fix(git-gate): reject AGit review refs in pre-receive ... Gitea AGit accepts pushes to refs/for/*, refs/draft/*, and refs/for-review/* and opens pull requests backed by server-managed refs/pull/<n>/head refs rather than ordinary refs/heads/* branches. That breaks the git-gate branch workflow: follow-up commits can't be pushed back through the branch, and Gitea rejects later direct updates to the generated review ref, so recovery means recreating the PR. Add a Phase 0 guard to the shared pre-receive hook that rejects creation or update of those AGit review refs before any gitleaks scan or upstream forward, with a message pointing callers at the branch-backed PR workflow. Deletions (new == zero) stay allowed so legacy AGit refs can still be cleaned up; normal branches and tags are untouched. Closes #506 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-26 17:59:21 +00:00
didericis-codex	1827593b89	test(docker): authenticate multitenant egress probes	2026-07-26 08:41:00 +00:00
didericis-codex	73e70e326c	test(docker): wait for multitenant probe readiness	2026-07-26 08:38:16 +00:00
didericis-codex	d744bec7b1	fix(docker): configure the attributed gateway subnet	2026-07-26 08:35:37 +00:00
didericis-codex	f3fbfb3cc3	fix(ci): join control planes to the runner network	2026-07-26 08:30:57 +00:00
didericis-codex	b2245ae1f3	test(orchestrator): make wrong-key coverage deterministic	2026-07-26 08:30:57 +00:00
didericis-codex	1022247ce5	test(ci): cover assurance gate entry points	2026-07-26 08:14:00 +00:00
didericis-codex	671d91070e	docs(ci): document the assurance topology	2026-07-26 08:02:12 +00:00
didericis-codex	1c6d30ffd8	test(canary): verify the pinned gitleaks release	2026-07-26 08:01:07 +00:00
didericis-codex	583ff98b27	ci(docker): require the full integration suite	2026-07-26 08:00:15 +00:00
didericis-codex	fafb828bb7	ci(coverage): enforce the critical core contract	2026-07-26 07:50:44 +00:00
didericis-codex	7488110e71	chore: tighten upkeep boundaries and static checks	2026-07-26 06:55:49 +00:00
didericis-codex	22dde95561	fix(diagnostics): make optional failures observable and safe	2026-07-26 06:55:49 +00:00
didericis-codex	e29b79d517	refactor(backend): extract shared bottle preparation planner	2026-07-26 06:55:49 +00:00
didericis-codex	1d85acfd99	refactor(egress): make addon core a compatibility facade	2026-07-26 06:55:49 +00:00
didericis-codex	90defdc9cd	refactor(egress): separate matching, DLP, and context concerns	2026-07-26 06:55:49 +00:00