teleo/teleo-infrastructure
8
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions 1
784 commits 38 branches 1 tag 20 MiB
Commit graph

784 commits

This branch
This branch
All branches
Author SHA1 Message Date
fwazb
5c506b6ed1 Revoke default PUBLIC execute on staging function
Some checks are pending
CI / lint-and-test (push) Waiting to run
Details 
PostgreSQL grants EXECUTE to PUBLIC on every new function by default.
The verification block correctly rejects this, so revoke it before
granting the runtime role.
 2026-07-24 12:15:50 -07:00
fwazb
7e1d57ef6f Drop staging function before create instead of replace
Some checks are pending
CI / lint-and-test (push) Waiting to run
Details 
Cloud SQL's postgres (cloudsqlsuperuser) cannot CREATE OR REPLACE a
function owned by another role. Drop both overloads first so a plain
CREATE works regardless of prior ownership state.

Also removes the dynamic ACL normalization block — a freshly created
function has no stale ACLs to scan and revoke.
 2026-07-24 10:25:48 -07:00
Fawaz
15219d7116
Merge pull request #244 from living-ip/fix/cloudsql-staging-function-provision-order
Some checks are pending
CI / lint-and-test (push) Waiting to run
Details 
Fix Cloud SQL staging-function provisioning order
 2026-07-23 22:42:17 -07:00
fwazb
eece69cd70 Fix Cloud SQL staging-function provisioning order 
Cloud SQL's postgres role is cloudsqlsuperuser, not a true superuser.
After ALTER FUNCTION ... OWNER TO leoclean_kb_stage_owner, it can no
longer revoke ACLs on the transferred function:

  ERROR: permission denied for function stage_leoclean_proposal

Reorder so ACL normalization and the runtime GRANT happen while postgres
still owns the function, then transfer ownership. Identical end state.

Observed on teleo-pgvector-standby during M2 Step 4 provisioning
(BOOTSTRAP_EXIT=3 at SQL line 800).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-07-23 22:41:24 -07:00
Fawaz
5d9eefb8a0
Merge pull request #243 from living-ip/fix/cloudsql-identity-address-normalization
Some checks are pending
CI / lint-and-test (push) Waiting to run
Details
2026-07-23 19:19:52 -07:00
fwazb
5a945ac4ec Refresh reviewed runtime source bindings 2026-07-23 19:09:30 -07:00
fwazb
75ee585814 Normalize Cloud SQL identity addresses 2026-07-23 18:56:39 -07:00
Fawaz
f3a7650a2d
Merge pull request #242 from living-ip/fix/leoclean-install-convergence
Some checks are pending
CI / lint-and-test (push) Waiting to run
Details 
Converge leoclean no-send installation state
 2026-07-23 16:44:10 -07:00
fwazb
e5a5cc0ca2 Converge leoclean no-send installation state 2026-07-23 16:25:17 -07:00
Fawaz
6696f3adc0
Merge pull request #241 from living-ip/fix/iap-missing-receipt
Some checks are pending
CI / lint-and-test (push) Waiting to run
Details 
Preserve no-send IAP failure receipts
 2026-07-23 15:07:13 -07:00
fwazb
445ffdc9fc Preserve no-send IAP failure receipts 2026-07-23 14:29:47 -07:00
Fawaz
0312209c2d
Merge pull request #240 from living-ip/fix/docker-capability-readback
Some checks are pending
CI / lint-and-test (push) Waiting to run
Details 
Handle canonical Docker capability readback
 2026-07-23 13:43:20 -07:00
fwazb
d0e8286636 Handle canonical Docker capability names 2026-07-23 13:27:38 -07:00
Fawaz
2d0f10bb56
Merge pull request #239 from living-ip/fix/nosend-container-contract-receipt
Some checks are pending
CI / lint-and-test (push) Waiting to run
Details 
Expose bounded container contract failures
 2026-07-23 13:17:24 -07:00
fwazb
4df77c7c6e Expose bounded container contract failures 2026-07-23 13:01:55 -07:00
Fawaz
ac6a4d25cf
Merge pull request #238 from living-ip/fix/nosend-verifier-failure-receipt
Some checks are pending
CI / lint-and-test (push) Waiting to run
Details 
Report and defer early no-send verifier failures
 2026-07-23 12:33:10 -07:00
fwazb
d6d4844421 Restore verifier test process umask 2026-07-23 12:24:49 -07:00
fwazb
a1a1aea16f Report no-send verifier startup failures 2026-07-23 12:06:35 -07:00
Fawaz
4911c4e726
Merge pull request #237 from living-ip/fix/leoclean-first-start-readiness
Some checks are pending
CI / lint-and-test (push) Waiting to run
Details 
Harden leoclean first-start readiness
 2026-07-23 11:01:48 -07:00
fwazb
f0719613b6 Harden leoclean first-start readiness 2026-07-23 10:41:40 -07:00
Fawaz
0701db4aa5
Merge pull request #236 from living-ip/fix/systemd-252-first-install
Some checks are pending
CI / lint-and-test (push) Waiting to run
Details 
Handle systemd 252 first-install omissions
 2026-07-23 09:04:28 -07:00
fwazb
73d0e30175 Handle systemd 252 absent command properties 2026-07-23 00:52:00 -07:00
Fawaz
eee1e90a89
Merge pull request #235 from living-ip/fix/systemd252-environmentfiles-readback
Some checks are pending
CI / lint-and-test (push) Waiting to run
Details 
Handle systemd 252 EnvironmentFiles readback
 2026-07-23 00:15:18 -07:00
fwazb
77ab46b956 Handle systemd 252 EnvironmentFiles readback 2026-07-22 23:19:13 -07:00
Fawaz
508e60edfb
Merge pull request #234 from living-ip/fix/iap-extracted-member-modes
Some checks are pending
CI / lint-and-test (push) Waiting to run
Details 
Preserve IAP request member modes
 2026-07-22 22:37:28 -07:00
fwazb
605aa6c36d Preserve IAP request member modes 2026-07-22 22:26:45 -07:00
Fawaz
5ba6c56aba
Merge pull request #233 from living-ip/fix/leoclean-runtime-authority-guard
Some checks are pending
CI / lint-and-test (push) Waiting to run
Details 
Harden leoclean runtime authority checks
 2026-07-22 21:01:43 -07:00
fwazb
963ab34584 Harden leoclean runtime authority checks 2026-07-22 20:15:53 -07:00
Fawaz
ce559253bd
Merge pull request #232 from living-ip/feat/leoclean-iap-installer-runner
Some checks are pending
CI / lint-and-test (push) Waiting to run
Details 
Add fail-closed GCP no-send IAP runner
 2026-07-22 19:17:56 -07:00
fwazb
b9081a537c Add fail-closed GCP no-send IAP runner 2026-07-22 18:24:17 -07:00
Fawaz
3d35a7fafb
Merge pull request #231 from living-ip/feat/leoclean-container-db-proof
Some checks are pending
CI / lint-and-test (push) Waiting to run
Details 
Owner security review completed for exact head 6d7ea14bfb. I reviewed and accept the scoped credential, Secret Manager, container identity, fail-closed database verification, and non-production boundaries. Authorized to merge with a merge commit.
 2026-07-22 16:23:21 -07:00
fwazb
6d7ea14bfb Bind no-send database proof to container identity 2026-07-22 15:24:54 -07:00
Fawaz
3f09bb2b6c
Merge pull request #230 from living-ip/fix/nosend-empty-directory-normalization
Some checks are pending
CI / lint-and-test (push) Waiting to run
Details 
Normalize empty no-send release directories
 2026-07-22 14:36:14 -07:00
fwazb
be002d67b0 Normalize empty release context directories 2026-07-22 14:06:38 -07:00
Fawaz
f04956ce7c
Merge pull request #229 from living-ip/fix/cloudsql-prereq-composability
Some checks are pending
CI / lint-and-test (push) Waiting to run
Details 
Preserve scoped runtime ACLs across prerequisite reruns
 2026-07-22 13:17:17 -07:00
fwazb
e03488ba0b Preserve scoped runtime ACLs across prerequisite reruns 2026-07-22 12:52:52 -07:00
twentyOne2x
3569f4f2fb
Merge pull request #228 from living-ip/codex/gcp-nosend-wif-publish-20260722
Some checks are pending
CI / lint-and-test (push) Waiting to run
Details 
Publish exact Leoclean no-send release through WIF
 2026-07-22 06:17:43 +02:00
twentyOne2x
7aabfa4ab8 fix: make no-send release publication repeatable 2026-07-22 06:07:24 +02:00
twentyOne2x
d36a6d8cc1 ci: publish exact no-send candidate through WIF 2026-07-22 04:51:57 +02:00
Fawaz
fda8ab1e6d
Merge pull request #227 from living-ip/fix/cloudsql-provider-database-residual
Some checks are pending
CI / lint-and-test (push) Waiting to run
Details 
Handle Cloud SQL provider database residuals
 2026-07-21 19:41:12 -07:00
twentyOne2x
86c42b5702
Merge pull request #226 from living-ip/codex/observatory-apply-prereq-repair-20260722
Some checks are pending
CI / lint-and-test (push) Waiting to run
Details 
fix(kb): preserve bounded Observatory read grants
 2026-07-22 04:21:50 +02:00
twentyOne2x
023782893e fix(kb): preserve bounded Observatory read grants 2026-07-22 04:16:23 +02:00
fwazb
508e1bdb28 Handle Cloud SQL provider database residuals 2026-07-21 19:01:34 -07:00
twentyOne2x
487c2a6599
Merge pull request #225 from living-ip/codex/fix-gcp-hermes-interpreter-pin-20260722
Some checks are pending
CI / lint-and-test (push) Waiting to run
Details 
Pin GCP preflight to the live Hermes interpreter
 2026-07-22 03:50:21 +02:00
twentyOne2x
40d76592f5 Pin GCP preflight to live Hermes interpreter 2026-07-22 03:44:33 +02:00
twentyOne2x
fab6c17805
Merge pull request #220 from living-ip/codex/source-first-v3-foundation-integration-20260721
Some checks are pending
CI / lint-and-test (push) Waiting to run
Details 
Integrate hardened source-first V3 rebuild foundation
 2026-07-22 03:31:39 +02:00
twentyOne2x
083bd747be Merge final Cloud SQL boundary into source-first V3 integration 2026-07-22 03:21:50 +02:00
twentyOne2x
6ff6afadb2
Merge pull request #224 from living-ip/fix/cloudsql-large-object-boundary
Some checks are pending
CI / lint-and-test (push) Waiting to run
Details 
Pin the reviewed Leoclean runtime SQL source
 2026-07-22 03:21:35 +02:00
twentyOne2x
f90ab9b665 Merge current main after Cloud SQL boundary landing 2026-07-22 03:17:47 +02:00
twentyOne2x
6e4287987a Pin reviewed Leoclean runtime SQL source 2026-07-22 03:16:58 +02:00