Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
493 commits
Select commit Hold shift + click to select a range
6354c23
Show credential broker verbs in stats
ebursztein Jun 12, 2026
8006a47
Balance security stats summaries
ebursztein Jun 12, 2026
8ea8307
Burn legacy user config rail
ebursztein Jun 12, 2026
c55d8a5
Keep VM assets out of installers
ebursztein Jun 12, 2026
6151ae8
Materialize the full profile catalog
ebursztein Jun 12, 2026
de06eeb
Record rule-requested decisions before plugins
ebursztein Jun 12, 2026
bedd891
Split MCP tool stats from raw ledger counts
ebursztein Jun 12, 2026
585a4c7
Make full snapshot changes explicit
ebursztein Jun 12, 2026
80c7bbd
Finish legacy settings reload burn
ebursztein Jun 12, 2026
6ee2473
Expose snapshot opt-in in MCP catalog
ebursztein Jun 12, 2026
89c247e
Capture active release debug hotlist
ebursztein Jun 12, 2026
32e2b0f
Burn legacy user config from live docs
ebursztein Jun 12, 2026
4bdf8b9
Close credential broker ledger verbs
ebursztein Jun 12, 2026
7314b45
Serialize cargo runner codesigning
ebursztein Jun 12, 2026
bebf9cf
Burn benchmark policy side channel
ebursztein Jun 12, 2026
9f46a00
Mark stale rootfs sessions incompatible
ebursztein Jun 12, 2026
5933565
fix: load process runtime from selected profile
ebursztein Jun 12, 2026
c29f73f
fix: expose network facts in security CEL
ebursztein Jun 12, 2026
e550c6d
test: make doctor network gate hermetic
ebursztein Jun 12, 2026
fbd6f2c
test: run doctor session validation hermetically
ebursztein Jun 12, 2026
c2565d5
test: cover hermetic protocol fixtures in doctor
ebursztein Jun 12, 2026
e2b2515
fix: keep dev asset reconciliation local
ebursztein Jun 12, 2026
078b22d
fix: detach dev service from recipe shell
ebursztein Jun 12, 2026
b901784
fix: export guest ca bundle for doctor
ebursztein Jun 12, 2026
1059d11
fix: restore guest root traversal for apt
ebursztein Jun 12, 2026
e16eb5c
test: make doctor package probes hermetic
ebursztein Jun 12, 2026
1da8ab0
docs: record hermetic doctor baseline
ebursztein Jun 12, 2026
5f49478
test: share hermetic debug upstream in benchmarks
ebursztein Jun 12, 2026
08bae71
test: add oauth and mcp debug fixtures
ebursztein Jun 12, 2026
3c2605e
test: add sanitized protocol fixture recorder
ebursztein Jun 12, 2026
4f9125a
test: replay sanitized protocol fixtures
ebursztein Jun 12, 2026
faf78ef
docs: record hermetic ollama and doctor proof
ebursztein Jun 12, 2026
8713d52
test: share hermetic debug upstream launcher
ebursztein Jun 12, 2026
ab19cfd
test: remove live provider escape from integration
ebursztein Jun 12, 2026
cb022ed
test: exercise oauth fixture in doctor
ebursztein Jun 12, 2026
7a3370d
chore: restore shared skills and harden bootstrap
ebursztein Jun 12, 2026
1194c8b
docs: clarify ironbank mcp ledger contract
ebursztein Jun 12, 2026
2c815dd
chore: consolidate mock server fixture
ebursztein Jun 12, 2026
d3d7a09
test: add ironbank package manager ledger proof
ebursztein Jun 12, 2026
121d54f
feat: ship ollama through profile build hooks
ebursztein Jun 12, 2026
6cdab21
docs: record profile build hook contract
ebursztein Jun 12, 2026
d73374b
test: add ironbank doctor ledger proof
ebursztein Jun 12, 2026
9bdc128
docs: sync release correction tracker status
ebursztein Jun 12, 2026
c885a1c
chore: add model SDKs to profile ledgers
ebursztein Jun 12, 2026
fa5b2d4
docs: clarify profile build hook contract
ebursztein Jun 12, 2026
934de72
chore: enforce source profile config layout
ebursztein Jun 12, 2026
52cd0c9
fix: prune ollama profile payload bloat
ebursztein Jun 12, 2026
7b6e540
fix: keep virtiofs doctor pip probe hermetic
ebursztein Jun 12, 2026
6299d24
fix: preapprove claude capsem mcp bootstrap
ebursztein Jun 12, 2026
38889f1
docs: record profile guard gate wiring
ebursztein Jun 12, 2026
80e0649
fix: harden doctor credential ledger probes
ebursztein Jun 12, 2026
11a6152
chore: replace rust mock server fixture
ebursztein Jun 12, 2026
e313904
docs: add security boundary cleanup sprint
ebursztein Jun 12, 2026
6054763
docs: link security boundary cleanup trackers
ebursztein Jun 12, 2026
2b9dfe3
fix: keep credential plugins on security event rail
ebursztein Jun 12, 2026
e62f5ae
docs: mark security boundary slice pushed
ebursztein Jun 12, 2026
56f2ead
fix: expose all security plugin stages
ebursztein Jun 12, 2026
1a2eba3
fix: prove local model SDK credential ledger
ebursztein Jun 12, 2026
89a18c6
fix: align security plugin stage contract
ebursztein Jun 12, 2026
a9b1fe3
fix: broker credential refs through runtime materialization
ebursztein Jun 12, 2026
cd1534c
test: expand broker credential ironbank matrix
ebursztein Jun 12, 2026
049d0b0
fix: expose plugin execution counters
ebursztein Jun 12, 2026
bdcee19
docs: close security boundary contract
ebursztein Jun 12, 2026
9bcca11
fix: harden integration and install gates
ebursztein Jun 13, 2026
b9b3764
fix: make bootstrap pnpm install noninteractive
ebursztein Jun 13, 2026
b7669b6
fix: snapshot session db when forking vms
ebursztein Jun 13, 2026
82d8494
fix: harden vz lifecycle checkpoints
ebursztein Jun 13, 2026
bfa3a15
fix: pass vz host lock mode through helper
ebursztein Jun 13, 2026
9fa25b1
fix: materialize runtime profile catalogs
ebursztein Jun 13, 2026
53a7fda
fix: route mcp e2e through shared mock server
ebursztein Jun 13, 2026
c580514
fix: make fork package probes hermetic
ebursztein Jun 13, 2026
f89a380
fix: run injection tests against materialized profiles
ebursztein Jun 13, 2026
eda0c55
fix: build doctor assets for every profile
ebursztein Jun 13, 2026
3c6cc5d
fix: load runtime policy from materialized profiles
ebursztein Jun 13, 2026
48d0c76
chore: align release contract fixtures
ebursztein Jun 13, 2026
e8cb496
test: assert local model security rule ledger
ebursztein Jun 13, 2026
e78e2db
chore: archive release benchmark ledger
ebursztein Jun 13, 2026
1ef8a2a
fix: forward profile mcp default routes
ebursztein Jun 13, 2026
619a38f
fix: move session creation onto profile cards
ebursztein Jun 13, 2026
e212900
fix: clarify process stats ledger
ebursztein Jun 13, 2026
6e226e2
fix: render stats payloads by content type
ebursztein Jun 13, 2026
3149897
fix: hide broker refs in profile overview
ebursztein Jun 13, 2026
10659ad
fix: show profile asset checklist
ebursztein Jun 13, 2026
101da54
fix: cap dead session actions
ebursztein Jun 13, 2026
d2e45af
chore: record profile route verification
ebursztein Jun 13, 2026
36149e8
fix: use typed mcp permission options
ebursztein Jun 13, 2026
3a24a64
fix: separate broker stats verbs
ebursztein Jun 13, 2026
d6cc7be
fix: harden profile root bootstrap pins
ebursztein Jun 13, 2026
aad64ad
feat: add dns fixtures to mock server
ebursztein Jun 13, 2026
2670774
feat: record dns protocol fixtures
ebursztein Jun 13, 2026
e7bf994
fix: run local mitm benchmark in release gate
ebursztein Jun 13, 2026
461a304
fix: fail doctor when local mock lab is missing
ebursztein Jun 13, 2026
b308fba
chore: record fresh model ironbank proof
ebursztein Jun 13, 2026
074fe4f
chore: record fresh doctor ironbank proof
ebursztein Jun 13, 2026
33ff393
chore: record fresh package ironbank proof
ebursztein Jun 13, 2026
b0804a2
chore: record combined ironbank proof
ebursztein Jun 13, 2026
3abffd7
feat: add https to mock protocol lab
ebursztein Jun 13, 2026
19151e0
test: strengthen mcp ironbank ledger
ebursztein Jun 13, 2026
20ade9e
fix: propagate mock server https fixture
ebursztein Jun 13, 2026
f249c46
test: remove skipped network doctor proof
ebursztein Jun 13, 2026
9f00829
chore: record doctor denied post proof
ebursztein Jun 13, 2026
3cab1da
test: add npx to ironbank package proof
ebursztein Jun 13, 2026
ef5b2b2
test: record release protocol benchmark
ebursztein Jun 13, 2026
435c84b
fix: harden credential broker ledger verbs
ebursztein Jun 13, 2026
9fed218
test: prove unknown model shape detection
ebursztein Jun 13, 2026
620087a
test: prove unknown mcp activity routing
ebursztein Jun 13, 2026
5283e1d
test: prove model tool declarations are not calls
ebursztein Jun 13, 2026
e3dd374
test: tighten tool call ledger invariants
ebursztein Jun 13, 2026
c4b4c3d
test: prove streaming model ledger paths
ebursztein Jun 13, 2026
6f0540e
test: prove agent bootstrap profile state
ebursztein Jun 13, 2026
446db13
test: prove real model sdk ledger paths
ebursztein Jun 13, 2026
c909999
test: tighten doctor security ledger proof
ebursztein Jun 13, 2026
ac2e8cd
fix: expose profile status in gateway health
ebursztein Jun 13, 2026
4ae0636
fix: include manifest provenance in support bundle
ebursztein Jun 13, 2026
f0ca19f
test: prove package manifest override provenance
ebursztein Jun 13, 2026
5baa2d2
fix: log installed manifest provenance
ebursztein Jun 13, 2026
fc6f3cb
fix: expose profile obom in support diagnostics
ebursztein Jun 13, 2026
829a270
fix: include supply chain refs in support bundle
ebursztein Jun 13, 2026
c7b3c2b
docs: close status debug release proof
ebursztein Jun 13, 2026
91a78d2
docs: close doctor protocol coverage gate
ebursztein Jun 13, 2026
f18b27c
fix: enforce file boundary plugin decisions
ebursztein Jun 13, 2026
ec3b252
fix: make credential broker memory first
ebursztein Jun 13, 2026
29085b1
test: guard single db writer rail
ebursztein Jun 13, 2026
c22e92a
fix: route profile mcp calls through security ledger
ebursztein Jun 13, 2026
7e65198
test: add ironbank profile mcp ledger proof
ebursztein Jun 13, 2026
c9d0dbd
fix: satisfy clippy in logged mcp dispatch
ebursztein Jun 13, 2026
79b59e1
fix: clear full-gate rust drift
ebursztein Jun 13, 2026
412ad4a
test: align credential broker ledger assertions
ebursztein Jun 13, 2026
87d868c
test: clarify plugin route rewrite semantics
ebursztein Jun 13, 2026
ffcc648
fix: keep file previews out of rewrite data
ebursztein Jun 13, 2026
47d5100
fix: scope keychain index to macos
ebursztein Jun 13, 2026
81e0907
docs: record final gate proof
ebursztein Jun 13, 2026
aae1968
bench: refresh release gate baselines
ebursztein Jun 13, 2026
0d1c0a3
ci: align release gates with live rails
ebursztein Jun 13, 2026
74bcda4
ci: gate kvm checkpoint tests by architecture
ebursztein Jun 13, 2026
32712a8
ci: harden app and agent release tests
ebursztein Jun 13, 2026
785dd80
ci: materialize config before package repack
ebursztein Jun 13, 2026
3bd7826
ci: share config materialization in install tests
ebursztein Jun 13, 2026
36522cc
ci: prepare install test assets before materializing
ebursztein Jun 13, 2026
2f38acf
ci: let coverage report before release gates
ebursztein Jun 13, 2026
34bc1b0
ci: generate frontend settings before checks
ebursztein Jun 13, 2026
04e1fbc
ci: bound python coverage to contract tests
ebursztein Jun 13, 2026
5a8d7e2
test: harden skill contract coverage
ebursztein Jun 13, 2026
0b998e8
ci: prepare non-vm integration fixtures
ebursztein Jun 13, 2026
03c5319
fix: burn stale config authoring rails
ebursztein Jun 13, 2026
e1b3a76
docs: codify profile config authority
ebursztein Jun 13, 2026
019c78d
chore: burn backend builder authoring rail
ebursztein Jun 13, 2026
adebb38
docs: clarify config authority contract
ebursztein Jun 13, 2026
7065fdb
fix: route credential broker reload through gateway
ebursztein Jun 13, 2026
e9f1af0
test: prove profile overview routes through gateway
ebursztein Jun 13, 2026
e90ad6c
test: close ironbank plugin action matrix
ebursztein Jun 13, 2026
90a7e9a
docs: close release benchmark proof ledger
ebursztein Jun 13, 2026
1fd5619
docs: reconcile completed doctor benchmark sprint
ebursztein Jun 13, 2026
bc86d9d
docs: clarify config authority contract
ebursztein Jun 13, 2026
27ee87f
docs: pin config authority contract
ebursztein Jun 13, 2026
a589d42
fix: burn builder mcp escape hatch
ebursztein Jun 14, 2026
f390eb3
fix: keep image builds under capsem-admin
ebursztein Jun 14, 2026
c36a8ca
test: prove codex model tool ledger path
ebursztein Jun 14, 2026
c67f924
test: randomize codex tool ledger proof
ebursztein Jun 14, 2026
49127c4
fix: prove model and credential ledger truth
ebursztein Jun 14, 2026
9251683
fix: prove active profile model ledger truth
ebursztein Jun 14, 2026
14cb91c
fix: preserve http security event transport ledger
ebursztein Jun 14, 2026
3270443
fix: account for denied http request ledger
ebursztein Jun 14, 2026
fc9548f
fix: expose pending http ask decisions
ebursztein Jun 14, 2026
4346d11
fix: prove brokered http rewrite ledger
ebursztein Jun 14, 2026
67ec1c6
test: refactor openai ironbank client proof
ebursztein Jun 14, 2026
f161d33
test: require broker proof for ai clients
ebursztein Jun 14, 2026
4c6e957
fix: split model provider identity from protocol
ebursztein Jun 15, 2026
a369906
chore: format ledger write paths
ebursztein Jun 15, 2026
00d5f89
fix: keep local model fixtures on the security rail
ebursztein Jun 15, 2026
5c27a27
docs: mark unknown provider ironbank proof
ebursztein Jun 15, 2026
1ac8dd6
test: prove claude ollama launcher ledger
ebursztein Jun 15, 2026
ed46360
feat: support corp upstream routing overrides
ebursztein Jun 15, 2026
08fdbed
docs: record agy ironbank blocker
ebursztein Jun 15, 2026
939ca63
docs: record unknown provider ironbank proof
ebursztein Jun 15, 2026
dbf4bcf
docs: record local network rule proof
ebursztein Jun 15, 2026
aff7879
test: add agy code assist replay fixtures
ebursztein Jun 15, 2026
d62b309
test: align agy replay fixtures
ebursztein Jun 15, 2026
a89e106
test: align settings conformance with profile split
ebursztein Jun 15, 2026
8df3450
refactor: remove legacy MCP server merge rail
ebursztein Jun 15, 2026
6df73a1
fix: require explicit profile assets
ebursztein Jun 15, 2026
01962fe
refactor: rename MCP profile config contract
ebursztein Jun 15, 2026
967a92f
refactor: remove settings mcp rail
ebursztein Jun 15, 2026
c0a33ad
test: tighten agy fixture contract
ebursztein Jun 15, 2026
abf2185
fix: parse gpt5 responses through mitm
ebursztein Jun 15, 2026
c15c4b9
test: refresh ironbank model pricing ledger
ebursztein Jun 15, 2026
f237710
fix: use compact upstream pricing ledger
ebursztein Jun 15, 2026
1eedf72
test: extend ironbank http body ledger proof
ebursztein Jun 15, 2026
851112b
test: add ironbank dns ledger proof
ebursztein Jun 15, 2026
50faa6f
test: add ironbank mcp ledger proof
ebursztein Jun 15, 2026
1213d59
test: add ironbank file process package ledger proof
ebursztein Jun 15, 2026
c5467b3
test: add ironbank credential plugin ledger proof
ebursztein Jun 15, 2026
eda249e
fix: burn network security side rail
ebursztein Jun 15, 2026
48f8bbb
test: add ironbank two-turn ledger helper
ebursztein Jun 15, 2026
139239e
test: add ironbank capsem mcp proof
ebursztein Jun 15, 2026
850e9d7
test: prove openai model ledger paths
ebursztein Jun 15, 2026
67e8f12
test: prove claude streaming ledger path
ebursztein Jun 15, 2026
ada1675
fix: store full event body evidence
ebursztein Jun 15, 2026
cd59d27
fix: store broker credentials in single keychain vault
ebursztein Jun 15, 2026
742a450
fix(service): keep profile status off asset hash hot path
ebursztein Jun 16, 2026
828277c
test(ironbank): gate route latency and CPU health
ebursztein Jun 16, 2026
328d741
test(ironbank): assert route enforcement decisions
ebursztein Jun 16, 2026
c83876b
fix(cli): stop launchagent without keepalive restart
ebursztein Jun 16, 2026
b76341a
fix(service): classify stale boot sessions as defunct
ebursztein Jun 16, 2026
959f5b3
fix(cli): keep service control commands local
ebursztein Jun 16, 2026
83c483b
fix(service): return lifecycle state from provision routes
ebursztein Jun 16, 2026
6fd4eb0
fix(cli): honor explicit service stops
ebursztein Jun 16, 2026
5f9e1dc
fix(security): keep default rules out of effective decisions
ebursztein Jun 16, 2026
84a3c35
test(ironbank): ignore non-http transcript rows
ebursztein Jun 16, 2026
8381355
style(logger): apply rustfmt to body blob tests
ebursztein Jun 16, 2026
e00a5ea
fix(sessions): use profile scoped session names
ebursztein Jun 16, 2026
375daed
test(service): gate profile scoped session naming
ebursztein Jun 16, 2026
30f965b
fix(tui): refresh gateway state off input thread
ebursztein Jun 16, 2026
b4e5e7b
fix(tui): preserve agent terminal screens
ebursztein Jun 16, 2026
eab94b8
fix(service): inspect incompatible session ledgers
ebursztein Jun 16, 2026
543a614
fix(bench): run release benchmark through mock server
ebursztein Jun 16, 2026
f3154c5
test(bench): align release benchmark gate name
ebursztein Jun 16, 2026
64917bd
chore(bench): refresh release benchmark evidence
ebursztein Jun 16, 2026
b99f276
fix(frontend): coalesce terminal io
ebursztein Jun 16, 2026
b3cf15f
fix(logger): record model wire protocol
ebursztein Jun 16, 2026
a64e2ee
test(ironbank): assert dynamic codex tool calls
ebursztein Jun 16, 2026
2aa5ab2
fix(profiles): expose route-owned profile metadata
ebursztein Jun 16, 2026
d75a7dc
test(bench): rename local protocol benchmark rail
ebursztein Jun 16, 2026
541f8a4
fix(gateway): coalesce terminal relay bursts
ebursztein Jun 16, 2026
c061631
test(routes): guard profile UI route matrix
ebursztein Jun 16, 2026
c5fe801
test(sessions): guard dashboard session state
ebursztein Jun 16, 2026
614a1a4
fix(frontend): clean stats detail ledger vocabulary
ebursztein Jun 17, 2026
70ddfae
fix(profile): remove retired mcp approval route field
ebursztein Jun 17, 2026
a3af171
fix(tui): keep profile session contract route-owned
ebursztein Jun 17, 2026
299ff4a
fix(gateway): forward snapshot route contract
ebursztein Jun 17, 2026
fe72cb9
test(service): cover plugin route contract
ebursztein Jun 17, 2026
11046b8
test(service): prove credential store lifecycle routes
ebursztein Jun 17, 2026
d8ba5a6
test(frontend): lock profile plugin route contract
ebursztein Jun 17, 2026
2524255
test(service): prove snapshot routes ignore session db
ebursztein Jun 17, 2026
34480e3
test(security): prove first-party CEL fact contract
ebursztein Jun 17, 2026
3a9346d
test(ironbank): align route ledger contracts
ebursztein Jun 17, 2026
808fb40
test(install): expose package payload contract gate
ebursztein Jun 17, 2026
4351d63
test(admin): prove profile materialization contract
ebursztein Jun 17, 2026
9a5942c
fix(assets): preserve manifest hydration provenance
ebursztein Jun 17, 2026
fd06626
test(ironbank): prove gemini api ledger contract
ebursztein Jun 17, 2026
5de261e
test(config): gate source layout contract
ebursztein Jun 17, 2026
20717b1
refactor(config): derive image workspace from profiles
ebursztein Jun 17, 2026
fafdc39
test(ironbank): add claude cli ledger gate
ebursztein Jun 17, 2026
03dd773
test(release): gate obom and sbom evidence
ebursztein Jun 17, 2026
7fd6030
fix(frontend): burn retired policy vocabulary
ebursztein Jun 17, 2026
082ca7c
fix(frontend): hide toolbar build stamp
ebursztein Jun 17, 2026
835663b
fix(frontend): use semantic status colors
ebursztein Jun 17, 2026
73c0ca1
test(ironbank): gate profile asset readiness
ebursztein Jun 17, 2026
26791c6
test(frontend): restore route contract gates
ebursztein Jun 17, 2026
2860d9d
fix service file control frame contract
ebursztein Jun 17, 2026
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
The table of contents is too big for display.
Diff view
Diff view
  •  
  •  
  •  
199 changes: 91 additions & 108 deletions .github/workflows/ci.yaml

Large diffs are not rendered by default.

1 change: 0 additions & 1 deletion .github/workflows/docs.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,6 @@ jobs:
deployments: write

env:
FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
steps:
Expand Down
Loading
Loading