didericis/bot-bottle
1
0
Fork 0
Code Issues 26 Pull Requests 9 Actions Packages Projects Releases Wiki Activity

feat(supervise+orchestrator): slice 12 — multi-tenant git-gate hook + supervise server #368

Closed
didericis-claude wants to merge 1 commits from orchestrator-supervise-writers into orchestrator-supervise-multitenant
pull from: orchestrator-supervise-writers
merge into: didericis:orchestrator-supervise-multitenant
Conversation 1 Commits 1 Files Changed 4
+178 -5

1 Commits

Author SHA1 Message Date
didericis 80d75de08a feat(supervise+orchestrator): slice 12 — multi-tenant git-gate hook + supervise server
lint / lint (push) Successful in 2m2s
Details
test / unit (pull_request) Successful in 1m0s
Details
test / integration (pull_request) Successful in 22s
Details
test / coverage (pull_request) Successful in 1m11s
Details 
Finishes the supervise data-plane writers for the shared gateway. Both
still keyed off a single SUPERVISE_BOTTLE_SLUG env; now each proposal is
attributed to the calling bottle, keeping slices 10/11's per-bottle model.

- git_http_backend: in consolidated mode stamp SUPERVISE_BOTTLE_SLUG=
  <bottle_id> into the CGI env. The gitleaks-allow pre-receive hook runs as
  a child of the `git http-backend` we spawn, so it inherits the stamp and
  queues under the right bottle — no change to the (fragile) embedded hook.
  The bottle id is the namespaced root's final component (slice 10), the
  same key egress uses. Single-tenant leaves the container-stamped slug.
- supervise_server: resolve the proposal slug per request by source IP when
  BOT_BOTTLE_ORCHESTRATOR_URL is set (`_attributed_config`), fail-closed —
  an unattributed / unreachable source raises rather than queue under the
  wrong or empty slug. `serve`/`main` build + attach the resolver and make
  the env slug optional in consolidated mode. Single-tenant unchanged.

Tests: a real git push proving the slug reaches the hook's env; the
supervise attribution matrix (single-tenant slug kept, source-IP bottle
bound, unattributed + resolver-error fail closed).

Remaining supervise gap (noted): websocket DLP still self.config-only.

pyright 0 errors; pylint 9.83/10; unit suite green (1705 tests; the 13
test_sidecar_init /bin/sleep errors are pre-existing NixOS-local noise).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WBMWTEtQdJ4W5UrWuLHCck
 2026-07-13 20:04:26 -04:00