Repository navigation

feat(agent): production auth, delivery and tool-plugin integration - #5

Closed

fffonion wants to merge 272 commits into

masterfrom

feat/production-delivery-integration

Closed

feat(agent): production auth, delivery and tool-plugin integration#5
fffonion wants to merge 272 commits into
masterfrom
feat/production-delivery-integration

This pull request is big! We're only showing the most recent 250 commits

Commits on Oct 1, 2026
- test: align HTTP migration lexical scanner
  fffonion
  committed
  c6b17de
- Integrate approved OAuth timing and public JSON primitives
  fffonion
  committed
  25d6ed8
- feat(auth): add bounded secret request body encoder
  fffonion
  committed
  f1bf34c
- auth: capture opaque OAuth exchange pairs natively
  fffonion
  committed
  f5949c3
- Reject raw redirect userinfo delimiters
  fffonion
  committed
  f7f1150
- fix(auth): preserve public JSON number lexemes
  fffonion
  committed
  1104aac
- auth: integrate native device exchange prerequisites
  fffonion
  committed
  810b0eb
- Wire native selected OAuth request payloads
  fffonion
  committed
  01d189c
- fix(auth): reclaim admitted families on selected-body rejection
  fffonion
  committed
  11fef8d
Commits on Oct 2, 2026
- Add native exchange-pair VM resources
  fffonion
  committed
  7c4ab31
- feat(auth): bridge typed selected OAuth payloads
  fffonion
  committed
  e0168a5
- Integrate reviewed Task5 typed OAuth VM prerequisites
  fffonion
  committed
  1da8512
- feat(auth): add typed transport capture bridge
  fffonion
  committed
  53b027b
- test(auth): cover capture rollback and terminal lifecycle failures
  fffonion
  committed
  7b7a648
- feat(auth): admit explicit single-credential enrollment
  fffonion
  committed
  30e59f4
Commits on Oct 3, 2026
- auth: expose fallible RSS results and scoped cleanup
  fffonion
  committed
  9e68b6b
- test(auth): cover native capture and exchange failure rollback
  fffonion
  committed
  41f38db
Commits on Oct 4, 2026
- feat(auth): implement native-backed codex device rss login
  fffonion
  committed
  7d46684
- test(auth): exercise codex rss device login state machine
  fffonion
  committed
  77eaa93
- test(auth): cover device login evidence gaps
  fffonion
  committed
  a9cfbdc
- refactor(auth): remove unused device login helpers
  fffonion
  committed
  5e37a11
- Add native auth command snapshot results
  fffonion
  committed
  cd7986a
- feat(auth): compile closed RSS source bundles
  fffonion
  committed
  f1f3f82
- fix(auth): keep command diagnostics read-only
  fffonion
  committed
  02f99f5
- fix(auth): resolve qualified relative bundle imports
  fffonion
  committed
  0e4aed9
- feat(cli): add independent bounded native shell
  fffonion
  committed
  7baaadf
- feat(auth): add RSS admin command policy
  fffonion
  committed
  7a0fc1f
- fix(cli): respect option value positions
  fffonion
  committed
  cd12813
- Merge RSS admin policy and native CLI shell
  fffonion
  committed
  1671727
- feat(cli): wire RSS admin commands and cancellation
  fffonion
  committed
  34454b9
- fix(cli): fail closed when ctrl-c setup fails
  fffonion
  committed
  753ec51
- feat(auth): add bounded device instruction queue
  fffonion
  committed
  828304b
- fix(auth): observe direct OAuth cancellation tokens
  fffonion
  committed
  39051fd
- test(cli): remove descriptor-only coverage and normalize fixtures
  fffonion
  committed
  365db76
- test(auth): exclude fixture preparation from CPU helper deadline
  fffonion
  committed
  fb0625a
- Add native config-path host foundation
  fffonion
  committed
  ed40f09
Commits on Oct 5, 2026
- Route real config path through typed RSS report and no-store host
  fffonion
  committed
  8d81b81
- test(auth): durable executable config-path acceptance and exact malformed-report rejection
  fffonion
  committed
  6ce2f40
- test(auth): durable S1 executable config-path assertions (round2)
  fffonion
  committed
  b79866b
- fix(auth): sample owner flags once for path admission snapshot consistency
  fffonion
  committed
  5a18751
- Add configured-login auth admission
  fffonion
  committed
  2f4d371
- test(auth): cover configured existing login generation
  fffonion
  committed
  fc383fe
- Preserve legacy Codex callback compatibility
  fffonion
  committed
  ba1ca69
- test: cover RSS login admission and public queue limits
  fffonion
  committed
  67841b7
- test: exercise RSS login through configured auth factory
  fffonion
  committed
  509a3ac
- feat(auth): acknowledge native device output
  fffonion
  committed
  d9e6d6e
- fix(auth): cfg-gate native device output
  fffonion
  committed
  1dcd129
- fix(auth): select bundle entry from root export
  fffonion
  committed
  7254bfb
- feat(auth): integrate acknowledged output and bundled login
  fffonion
  committed
  47b06fa
- feat(cli): wire native OAuth into auth login
  fffonion
  committed
  81b5337
- test(auth): cover native HTTPS login composition
  fffonion
  committed
  61a67ca
- test: fix cfgtest clippy warnings
  fffonion
  committed
  4e923a9
- feat(auth): add owned native callback sessions
  fffonion
  committed
  48429ed
- feat(auth): project configured public OAuth data
  fffonion
  committed
  9f3206d
- fix(auth): zeroize native callback read buffer
  fffonion
  committed
  cc90afe
- merge: integrate native callbacks and public OAuth config
  fffonion
  committed
  c94a739
- feat(auth): admit native callback bridge
  fffonion
  committed
  951ca84
- auth: add owned Linux browser launcher
  fffonion
  committed
  e336785
- Add bounded private native callback input
  fffonion
  committed
  3f74a3a
- merge: compose accepted native browser mechanism
  fffonion
  committed
  c806b32
- merge: compose accepted private manual mechanism
  fffonion
  committed
  f3e832a
- feat(auth): add typed callback result APIs
  fffonion
  committed
  6e85baf
- Add native composite OAuth callback inputs
  fffonion
  committed
  aa5301e
- feat(auth): queue capability-derived OAuth instructions
  fffonion
  committed
  63215c4
Commits on Oct 6, 2026
- merge: compose accepted typed callback results and native inputs
  fffonion
  committed
  b9c0120
- test(auth): cover RSS instruction failure branches
  fffonion
  committed
  f2e2b4e
- test(auth): verify native callback result composition
  fffonion
  committed
  1399913
- Add RSS PKCE session consumer tests
  fffonion
  committed
  c6d2dbb
- Merge commit 'c6d2dbb31923ba393d3200f72640676c553c4629' into HEAD
  fffonion
  committed
  cff702f
- Merge commit 'f2e2b4e7dd5f43016c114077290ef96cef3a6903' into HEAD
  fffonion
  committed
  c6ef5af
- test(auth): prepare owner-independent catalog before short deadline
  fffonion
  committed
  ad21c03
- Fix strict parsing of native OAuth responses
  fffonion
  committed
  ff3078b
- Add typed RSS token metadata transport parsing
  fffonion
  committed
  76a8b5a
- Add PKCE authorization instruction session
  fffonion
  committed
  18cb99b
- test(auth): qualify native PKCE cancellation cleanup
  fffonion
  committed
  2da0c49
- Add Linux bounded native authorization-instruction output and queue worker
  fffonion
  committed
  eb05e23
- Fix native authorization output signal and cancellation handling
  fffonion
  committed
  ce9c85f
- Add captured OAuth code generation bridge
  fffonion
  committed
  bacd051
- Add RSS token save result validation
  fffonion
  committed
  988eedc
- test(auth): cover native secret slot kind rejection
  fffonion
  committed
  9c18593
Commits on Oct 7, 2026
- Complete configured RSS PKCE login and native CLI delivery
  fffonion
  committed
  a903e16
- build: optimize pinned compiler in development profiles
  fffonion
  committed
  f1dbba4
- Preserve canonical request model in public profiles
  fffonion
  committed
  29bd99b
- Bind native auth hosts per RSS invocation
  fffonion
  committed
  53f085a
- test: verify native auth binding lifecycle
  fffonion
  committed
  7fd82b3
- Add bounded native HTTPS streaming API
  fffonion
  committed
  ab3febe
- test(auth): verify native stream socket closure
  fffonion
  committed
  ee4ae66
- Guard live auth resources at provider JSON boundary
  fffonion
  committed
  0d0d45c
- Implement RSS opaque buffered auth bridge
  fffonion
  committed
  d3c976d
- test: prove provider guard preserves native auth resources
  fffonion
  committed
  a66f7a3
- Merge commit 'a66f7a32c21a228fcea93d144b9463a43b5fa20f' into subagent/task7-buffered-guard-composition-1432c541
  fffonion
  committed
  535ea5f
- fix(provider): preserve public native metadata failures
  fffonion
  committed
  896d485
- feat: add opaque OpenAI Chat buffered adapter
  fffonion
  committed
  a134462
- fix(llm): preserve absent opaque metadata failure response
  fffonion
  committed
  06c0a3f
- Compose authenticated streaming, fallible access and RSS default dispatch
  fffonion
  committed
  9424ca8
- feat(auth): compose accepted access refresh and sanitized stream prerequisites
  fffonion
  committed
  41f7cae
Commits on Oct 8, 2026
- feat(auth): complete RSS opaque refresh transaction
  fffonion
  committed
  ccc70d1
- fix(auth): reject explicit null refresh token type
  fffonion
  committed
  8a1e2b1
- Task7: pure RSS OpenAI Chat public stream body and delta/DONE/EOF codec
  
  subagent
  authored and
  fffonion
  committed
  f3b2eaa
- style(llm): use edition 2024 codec test import ordering
  fffonion
  committed
  6d35d6d
- task7: guest sanitized authenticated stream binding + finish coverage
  fffonion
  committed
  f66f08d
- test(auth): prove foreign stream handle rejection
  fffonion
  committed
  48dc0e0
- rss: opaque OpenAI Chat streaming with counted stream regression suites
  fffonion
  committed
  546bc87
- task7: retire legacy RSS raw transport, migrate provider regressions to native auth
  fffonion
  committed
  d6f3d92
- test(rss): compile discovered corpus with exact host catalogs
  fffonion
  committed
  011e0a2
- task7: forward public credential_id in serial-loop provider requests
  fffonion
  committed
  63ec182
- task7: refresh expired OAuth before provider transport
  fffonion
  committed
  f610b2c
- test(task7): strengthen authenticated tool follow-up history and per-send model assertions
  fffonion
  committed
  2425326
Commits on Oct 9, 2026
- Integrate native auth with durable service provider
  fffonion
  committed
  4a15154
- fix(service): preserve provider timestamps across durable reopen
  fffonion
  committed
  290d409
- test(provider): compose accepted service durable and refresh scopes
  fffonion
  committed
  a18c7bd
- runtime: prepare default provider dispatcher
  fffonion
  committed
  947fb8c
- Prepare default provider dispatcher in service host
  fffonion
  committed
  2589e73
- Separate auth-only default provider construction
  fffonion
  committed
  47e7440
- build(agent): optimize embedded compiler in development
  fffonion
  committed
  a72f522
- feat(agent): add rss source selection policy
  fffonion
  committed
  2aa51fd
- test(agent): cover unicode source policy boundaries
  fffonion
  committed
  ed91101
- task9: compile-time embedded RSS resource catalog primitive
  hermes-agent
  committed
  7a4b48f
- style(packaging): trim embedded source catalog commentary
  fffonion
  committed
  d8b97dd
- test(auth): supply complete login import closure in bundle fixture
  fffonion
  committed
  2e73c1e
- runtime: extract generic closed-bundle compiler primitive
  fffonion
  committed
  54bb609
- Prove supplied closed bundle catalog native binding
  fffonion
  committed
  3f1b1c1
- task9: bundle embedded RSS runtime consumers over existing compiler
  fffonion
  committed
  9c3230d
- Bind admitted bundled callable and remove formal resource probes
  fffonion
  committed
  fd8a3e5
- task9: consume native bundled agent source through the RSS policy
  fffonion
  committed
  faa72e2
- task9: bound native policy replies and exercise bundled cache admission
  fffonion
  committed
  1906624
- task9: admit non-UTF8 selected source tokens through the RSS policy
  task9-subagent
  committed
  40241fe
- test(gateway): guard encoded-source child cleanup and privacy
  fffonion
  committed
  a0a7dc3
- task9: correct inherited default-gateway SSE auth contract expectations
  fffonion
  committed
  179a2f9
- storage: capture a coherent load.all snapshot via bounded TEMP staging
  
  task9-storage
  authored and
  fffonion
  committed
  ae6cc0d
- fix(storage): guard bounded snapshot regression process lifecycle
  fffonion
  committed
  de816cd
Commits on Oct 10, 2026
- docs: source-ground packaged setup and migration documentation
  fffonion
  committed
  c468ffd
- docs: use bundled source in gateway examples
  fffonion
  committed
  07aa274
- Complete scoped Codex Responses access path
  fffonion
  committed
  b59da88
- Keep strict depth bounds for Responses SSE
  fffonion
  committed
  63057b9
- Bound SSE JSON containers and assert canonical access output
  fffonion
  committed
  ee89a3b
- test: verify canonical Responses persistence
  fffonion
  committed
  a879d17
- fix: reject empty Responses completions
  fffonion
  committed
  eb857c9
- Fix Responses refusal text extraction and regressions
  fffonion
  committed
  be0cc07
- Add bounded live Responses shape diagnostics
  fffonion
  committed
  9d81cf1
- fix(rss): reconstruct compact completed outputs
  fffonion
  committed
  8650c7a
- Merge validated access-only Responses provider
  fffonion
  committed
  19603db
- Complete workspace session binding integration
  fffonion
  committed
  b8d46bd
- test: authorize lifecycle effects in private workspace
  fffonion
  committed
  6a68f4c
- Fix RSS workspace replay identity and transactional admission; verify consumers and bootstrap
  fffonion
  committed
  77f5ceb
- Fix documentation fixture compatibility with typed workspace config
  fffonion
  committed
  c7e931e
- style(workspace): align named-root validation formatting
  fffonion
  committed
  1d48f40
Commits on Oct 11, 2026
- feat: add RSS-owned session compaction
  fffonion
  committed
  6d8aa4f
- fix: address production compaction review findings
  Hermes Agent
  committed
  1ec4e4f
- fix: reserve sessions during explicit compaction
  Hermes Agent
  committed
  1bfdb8a
- fix: replay durable admissions before maintenance gate
  Hermes Agent
  committed
  e36adee
- feat: migrate gateway source selection to rss config policy
  Hermes Agent
  committed
  1840b9c
- fix: preserve rss-admitted source fact paths
  Hermes Agent
  committed
  d497d91
- fix(auth): simplify terminal classifier guard
  
  fffonion
  authored and
  Hermes Agent
  committed
  8d37812
- test: isolate native FD observer assertions
  Hermes Agent
  committed
  a08959d
- docs: correct production setup and credential storage docs
  Hermes Agent
  committed
  e52fb1e
- docs: qualify legacy chat route availability
  Hermes Agent
  committed
  c02e1da
Commits on Oct 12, 2026
- feat: implement rss guardian approval path
  Hermes Agent
  committed
  0c148e9
- test: align telegram compact command with implemented contract
  HermesAgent
  committed
  85c9bf5
- fix: scope test locks and complete transport fixtures
  Hermes Agent
  committed
  6dcf0e8
- test: expose shared provider fixture api in test crates
  fffonion
  committed
  0f71a12
- fix(guardian): bind context and approval previews
  fffonion
  committed
  e329101
- fix: align ci scratch and admission schema guards
  fffonion
  committed
  9b80d54
- test: complete closed login bundle fixtures
  HermesAgent
  committed
  5ea233d
- fix(guardian): withhold unrecognized terminal preview values
  fffonion
  committed
  bea0200
- feat: combine accepted production auth and guardian components
  HermesAgent
  committed
  0665a10
- test: isolate callback descriptor lifecycle probes
  Hermes Agent
  committed
  978286e
- test: isolate manual callback descriptor probes
  Hermes Agent
  committed
  7426ed9
- Fix auth watcher observer visibility check
  Hermes Agent
  committed
  a592e27
- Add native operator provider auth bootstrap
  fffonion
  committed
  1ba966c
- test: align workspace fixtures with Guardian reviews
  Hermes Agent
  committed
  6212a02
- test: reconcile native browser transport fixture
  Hermes Agent
  committed
  3cb2d0c
- test: exercise default HTTP provider cancellation lifecycle
  Hermes Agent
  committed
  3ea63b7
- Merge accepted callback and watcher test isolation
  HermesAgent
  committed
  6caab3d
- test: isolate auth bundle watcher observers
  Hermes Agent
  committed
  0dd8895
- test: reap owned TLS fixture on failure
  Hermes Agent
  committed
  7b4a04d
- test: isolate auth bundle watcher observers
  Hermes Agent
  committed
  18245a0
- test: lexically own TLS fixture future
  Hermes Agent
  committed
  cdc6a66
- Merge accepted lifecycle TLS fixture ownership
  HermesAgent
  committed
  c7bb668
- test: fix native child lifecycle fixtures
  Hermes Agent
  committed
  025c3ca
Commits on Oct 13, 2026
- test(telegram): align workspace fixture with Guardian reviews
  fffonion
  committed
  8f13e34
- perf: reuse service compaction runner
  Hermes Agent
  committed
  70de7e2
- test(auth): isolate device output fd ownership checks
  Hermes Agent
  committed
  cc5396b
- perf: reuse unbound workspace runner templates
  Hermes Agent
  committed
  bb2ff1e
- perf: reuse validated module import metadata
  Hermes Agent
  committed
  3a04a3e
- perf(runtime): reuse successful snapshot metadata
  fffonion
  committed
  1c18221
- test(lifecycle): verify native ownership and exact Guardian intent
  fffonion
  committed
  2da1f6d
Commits on Oct 14, 2026
Commits on Oct 15, 2026
- fix(service): prepare admissions outside the commit gate
  fffonion
  committed
  8bc6cf9
- test(auth): align access fixtures with preflight refresh
  fffonion
  committed
  d5945d7
- test(provider): isolate API-key HTTP error classification
  fffonion
  committed
  00adc18
- fix(runtime): wake invocation pump on native readiness
  fffonion
  committed
  b8bbf98
- test: synchronize durable replay accounting and clean up on panic
  fffonion
  committed
  36d5d7e
- fix: align external admission and isolate binary gateway fixtures
  fffonion
  committed
  c36d91f
- test: use path slice in external admission regressions
  fffonion
  committed
  d82b4e1
- test: isolate copied CLI executable staging
  fffonion
  committed
  295ef4e
- test: isolate native descriptor observer fixtures
  fffonion
  committed
  eb6b00f
- test: retain bounded deadline failure diagnostics
  fffonion
  committed
  c6252c4
- fix: reject stdin writes after observed process exit
  fffonion
  committed
  eea3a66
- feat(storage): append tool preparation events as one atomic pair
  fffonion
  committed
  51d48c3
- test(auth): observe owned thread exit within the original deadline
  fffonion
  committed
  2f9678b
Commits on Oct 17, 2026
Commits on Oct 18, 2026

Commits

Commits on Oct 1, 2026

Commits on Oct 2, 2026

Commits on Oct 3, 2026

Commits on Oct 4, 2026

Commits on Oct 5, 2026

Commits on Oct 6, 2026

Commits on Oct 7, 2026

Commits on Oct 8, 2026

Commits on Oct 9, 2026

Commits on Oct 10, 2026