Commit graph

90 commits

Author SHA1 Message Date
twentyOne2x
083bd747be Merge final Cloud SQL boundary into source-first V3 integration 2026-07-22 03:21:50 +02:00
twentyOne2x
6e4287987a Pin reviewed Leoclean runtime SQL source 2026-07-22 03:16:58 +02:00
87580c219f Fail closed on leoclean runtime SQL 2026-07-21 17:56:06 -07:00
twentyOne2x
0c275b4bbb Merge current main into source-first V3 integration 2026-07-22 02:47:56 +02:00
a8a1e7958b Merge current main into PR 221 2026-07-21 17:04:38 -07:00
699edb935f Merge current main into PR 219 2026-07-21 16:50:43 -07:00
twentyOne2x
a03c6bc2f5 Harden V3 transition replay across timezones 2026-07-22 01:10:14 +02:00
e850f0e6bd Harden Cloud SQL staging runtime boundary 2026-07-21 13:44:43 -07:00
832f0c3f47 Support Cloud SQL scoped role provisioning
Some checks are pending
CI / lint-and-test (push) Waiting to run
2026-07-21 12:58:07 -07:00
twentyOne2x
5b103285ee Harden staging image push authority on current main 2026-07-21 21:44:54 +02:00
twentyOne2x
0b72b3cbce Integrate hardened source-first V3 rebuild foundation 2026-07-21 21:41:30 +02:00
a0fabc3072 Add fail-closed leoclean staging installer
Some checks are pending
CI / lint-and-test (push) Waiting to run
2026-07-21 10:58:36 -07:00
2f6cfeaaa4 Close staging preflight review gaps 2026-07-20 23:43:10 -07:00
16b32193f7 Harden staging preflight receipt publication 2026-07-20 23:30:14 -07:00
7bafcb4314 Reconcile staging preflight inventory 2026-07-20 23:11:08 -07:00
544b2f615d Add GCP no-send staging preflight 2026-07-20 23:10:25 -07:00
ac4bf5f01f Bind staging image push to a verified receipt 2026-07-20 22:52:13 -07:00
twentyOne2x
d2ad4f7c96 Remove destructive Docker cache cleanup 2026-07-21 07:00:13 +02:00
twentyOne2x
c7b4abc347 Retain inspected digest references in shared Docker caches 2026-07-21 05:47:01 +02:00
e42d635523 Bind no-send releases to inspected images 2026-07-20 19:47:59 -07:00
twentyOne2x
ffe170007d Accept exact qemu PID 1 wrappers 2026-07-21 03:17:36 +02:00
270bc9563e Bind no-send package to reviewed sources 2026-07-20 18:03:55 -07:00
63b09bbacb Harden leoclean no-send package verification 2026-07-20 18:03:55 -07:00
1e5c67738f Package leoclean no-send GCP staging service 2026-07-20 18:03:55 -07:00
Fawaz
77e1336c0f
Restrict leoclean runtime reads to queried columns (#179)
Some checks are pending
CI / lint-and-test (push) Waiting to run
* Restrict leoclean runtime reads to queried columns

* Repair leoclean runtime authority review findings

* Harden leoclean query and CI permission contracts
2026-07-17 06:31:37 -04:00
twentyOne2x
de9696a6e1 fix: partition drift probe failures 2026-07-16 12:56:30 +02:00
twentyOne2x
4ecc38cd7f Merge remote-tracking branch 'origin/main' into codex/leo-vps-gcp-drift-w2-20260715 2026-07-16 12:46:24 +02:00
twentyOne2x
6b3114e95f fix: harden source drift detector receipts 2026-07-16 12:35:45 +02:00
twentyOne2x
78e9ff07a5 Merge remote-tracking branch 'origin/main' into codex/leo-gcp-data-parity-acl-preflight-20260715 2026-07-16 12:32:10 +02:00
twentyOne2x
4c4b3eb82f Replay PostgreSQL role and ACL parity 2026-07-16 12:32:02 +02:00
twentyOne2x
21b2fdfcd1 Merge remote-tracking branch 'origin/main' into codex/pr162-integration-20260716 2026-07-16 12:13:48 +02:00
twentyOne2x
497a2bc798 Merge remote-tracking branch 'origin/main' into codex/pr162-integration-20260716
# Conflicts:
#	tests/test_hermes_leoclean_kb_bridge_source.py
2026-07-16 12:11:52 +02:00
twentyOne2x
7a9d8a178b Merge remote-tracking branch 'origin/main' into codex/leo-vps-gcp-drift-w2-20260715 2026-07-16 12:10:05 +02:00
twentyOne2x
34e91db86d Merge remote-tracking branch 'origin/main' into codex/leo-gcp-data-parity-acl-preflight-20260715 2026-07-16 12:10:04 +02:00
twentyOne2x
9957c61f79 Merge remote-tracking branch 'origin/main' into codex/leo-negative-permissions-t3-w2-20260715 2026-07-16 12:08:06 +02:00
twentyOne2x
e53948781d Harden private Observatory runtime identity 2026-07-15 23:05:24 +02:00
twentyOne2x
5646bd5972 feat: add fail-closed VPS GCP source drift detector 2026-07-15 22:54:50 +02:00
twentyOne2x
de7c139132 Preserve role ACLs in canonical parity preflight 2026-07-15 22:45:39 +02:00
twentyOne2x
0296176355 Fail closed on cross-provider WIF mappings 2026-07-15 22:45:24 +02:00
twentyOne2x
9512dcba77 Prove Leo read role fails closed on mutations 2026-07-15 22:40:36 +02:00
twentyOne2x
1a3c7fa9f4 Harden private Observatory staging preflight 2026-07-15 22:39:31 +02:00
Codex Integration
822438bd2f Merge main and repair GCP runtime integration 2026-07-15 12:51:17 +02:00
twentyOne2x
1c6b7b182e Pin lifecycle receipts to the reviewed parity manifest 2026-07-15 10:59:43 +02:00
twentyOne2x
52fc0a88fe Normalize database authorization parity and validate hashes 2026-07-15 10:49:55 +02:00
twentyOne2x
1a3305ac5d Merge remote-tracking branch 'origin/main' into codex/leo-gcp-data-parity-20260715
# Conflicts:
#	.agents/skills/teleo-gcp-parity-ops/SKILL.md
2026-07-15 10:26:26 +02:00
twentyOne2x
1a043d36a1 Harden GCP parity proof against forged lifecycle claims 2026-07-15 10:20:27 +02:00
twentyOne2x
36fe0d3cc2
Harden Observatory private staging deploy gate (#163)
Some checks are pending
CI / lint-and-test (push) Waiting to run
Merge the T2 readiness and least-privilege staging gate. This does not deploy Cloud Run, mutate Cloud SQL, or change production routing.
2026-07-15 09:55:49 +02:00
twentyOne2x
7b16c6d3cc fix: prove least-privilege GCP Leo runtime context 2026-07-15 07:16:40 +02:00
twentyOne2x
d299f1cdf5 Merge remote-tracking branch 'origin/main' into codex/leo-gcp-runtime-security-20260715 2026-07-15 04:40:36 +02:00
twentyOne2x
b7bdcea46a fix: enforce scoped GCP Leo runtime credentials 2026-07-15 04:40:26 +02:00