didericis/bot-bottle
1
0
Fork 0
Code Issues 33 Pull Requests 9 Actions Packages Releases Wiki Activity

refactor: quality cleanup - egress policy pipeline (chunk 3/11) #523

Closed
didericis-codex wants to merge 2 commits from refactor/egress-policy-pipeline into refactor/orchestrator-fastapi
pull from: refactor/egress-policy-pipeline
merge into: didericis:refactor/orchestrator-fastapi
Conversation 0 Commits 2 Files Changed 5
+378 -89
didericis-codex commented 2026-07-26 22:27:13 -04:00
Collaborator
Copy Link
Copy Source

Stacked on #518. Third quality-cleanup PR tracked by #444.

Extracts request policy and outbound DLP stages from the mitmproxy lifecycle adapter:

  • Git policy stage: HTTPS push denial and fetch opt-in decisions now live in a framework-neutral function.
  • Route policy stage: authorization stripping, matching, gateway credential injection, denial reasons, and request logging return one immutable result.
  • Outbound DLP stage: canonical request scanning and mutable-surface redaction now live outside EgressAddon, with direct tests for detection, safe-token handling, and redaction.
  • Thin adapter: connection identity, mitmproxy lifecycle hooks, response construction, and supervise coordination remain in the adapter.

EgressAddon is reduced from 824 to 781 lines. #524 separates supervisor MCP HTTP transport from tool dispatch and proposal formatting.

Remaining stack

  • #525 — authoritative backend cleanup and destructive revalidation.
  • #526 — bounded gateway HTTP work and strict policy introspection.
  • #527 — gateway shutdown diagnostics.

Final stack extension

  • #528 — authoritative resource identities and bounded artifact transfers.

Validation: The complete eleven-PR stack passes all 2,520 unit tests; full-repository Pyright reports 0 errors; git diff --check passes.

Refs #444.

Final stack extension

  • #530 — cleanup execution and mandatory authenticated-secret integrity.

Final stack extension

  • #531 — bounded heavy Git and cleanup operations.

Final stack extension

  • #532 — fail-closed shared database and gateway credential permissions.
Stacked on #518. Third quality-cleanup PR tracked by #444. Extracts request policy and outbound DLP stages from the mitmproxy lifecycle adapter: - **Git policy stage:** HTTPS push denial and fetch opt-in decisions now live in a framework-neutral function. - **Route policy stage:** authorization stripping, matching, gateway credential injection, denial reasons, and request logging return one immutable result. - **Outbound DLP stage:** canonical request scanning and mutable-surface redaction now live outside `EgressAddon`, with direct tests for detection, safe-token handling, and redaction. - **Thin adapter:** connection identity, mitmproxy lifecycle hooks, response construction, and supervise coordination remain in the adapter. `EgressAddon` is reduced from 824 to 781 lines. #524 separates supervisor MCP HTTP transport from tool dispatch and proposal formatting. **Remaining stack** - #525 — authoritative backend cleanup and destructive revalidation. - #526 — bounded gateway HTTP work and strict policy introspection. - #527 — gateway shutdown diagnostics. **Final stack extension** - #528 — authoritative resource identities and bounded artifact transfers. **Validation:** The complete eleven-PR stack passes all 2,520 unit tests; full-repository Pyright reports 0 errors; `git diff --check` passes. Refs #444. **Final stack extension** - #530 — cleanup execution and mandatory authenticated-secret integrity. **Final stack extension** - #531 — bounded heavy Git and cleanup operations. **Final stack extension** - #532 — fail-closed shared database and gateway credential permissions.
didericis force-pushed refactor/egress-policy-pipeline from 106de8aaa1 to c916f4c1ed 2026-07-26 22:58:32 -04:00 Compare
didericis-codex changed title from refactor: quality cleanup - egress policy pipeline (chunk 2/3) to refactor: quality cleanup - egress policy pipeline (chunk 3/7) 2026-07-26 23:17:24 -04:00
didericis force-pushed refactor/egress-policy-pipeline from c916f4c1ed to 47686273c3 2026-07-26 23:39:49 -04:00 Compare
didericis-codex changed title from refactor: quality cleanup - egress policy pipeline (chunk 3/7) to refactor: quality cleanup - egress policy pipeline (chunk 3/8) 2026-07-26 23:41:15 -04:00
didericis force-pushed refactor/egress-policy-pipeline from 47686273c3 to b791fe4b84 2026-07-26 23:56:13 -04:00 Compare
didericis-codex changed title from refactor: quality cleanup - egress policy pipeline (chunk 3/8) to refactor: quality cleanup - egress policy pipeline (chunk 3/9) 2026-07-27 00:02:29 -04:00
didericis force-pushed refactor/egress-policy-pipeline from b791fe4b84 to af0db71c26 2026-07-27 00:17:42 -04:00 Compare
didericis-codex changed title from refactor: quality cleanup - egress policy pipeline (chunk 3/9) to refactor: quality cleanup - egress policy pipeline (chunk 3/10) 2026-07-27 00:25:53 -04:00
didericis added 2 commits 2026-07-27 00:46:23 -04:00
refactor(egress): extract request policy stages 105538d3a6
refactor(egress): extract outbound DLP request stage
test / integration-docker (pull_request) Has been cancelled
Details
test / image-input-builds (pull_request) Failing after 13m35s
Details
test / unit (pull_request) Failing after 13m41s
Details
test / coverage (pull_request) Has been skipped
Details
tracker-policy-pr / check-pr (pull_request) Failing after 12m43s
Details
a24fe0264d
didericis force-pushed refactor/egress-policy-pipeline from af0db71c26 to a24fe0264d 2026-07-27 00:46:23 -04:00 Compare
didericis-codex changed title from refactor: quality cleanup - egress policy pipeline (chunk 3/10) to refactor: quality cleanup - egress policy pipeline (chunk 3/11) 2026-07-27 00:48:32 -04:00
didericis-codex closed this pull request 2026-07-27 01:35:21 -04:00
Some checks are pending
test / integration-docker (pull_request) Has been cancelled
Details
test / image-input-builds (pull_request) Failing after 13m35s
Details
test / unit (pull_request) Failing after 13m41s
Details
test / coverage (pull_request) Has been skipped
Details
tracker-policy-pr / check-pr (pull_request) Failing after 12m43s
Details

Pull request closed

Please reopen this pull request to perform a merge.
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
Compat/Breaking
Breaking change that won't be backward compatible
 Kind/Bug
Something is not working
 Kind/Documentation
Documentation changes
 Kind/Enhancement
Improve existing functionality
 Kind/Feature
New functionality
 Kind/Security
This is security issue
 Kind/Testing
Issue or pull request related to testing
Priority
Critical
1
The priority is critical
Priority
High
2
The priority is high
Priority
Low
4
The priority is low
Priority
Medium
3
The priority is medium
Status
Abandoned
3
Somebody has started to work on this but abandoned work
Status
Blocked
1
Something is blocking this issue or pull request
Status
Need More Info
2
Feedback is required to reproduce issue or to continue work
Status/Needs Triage
Awaiting initial classification
No Label
Milestone
No items
No Milestone
Assignees
Clear assignees
didericis-claude (didericis (claude)) didericis-codex (didericis (codex)) didericis-gemma (gemma) didericis
No Assignees
2 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: didericis/bot-bottle#523
Delete Branch "refactor/egress-policy-pipeline"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?