chore: synchronize current dev into exact profile policy branch - #792
Draft
ORESoftware wants to merge 156 commits into
Draft
chore: synchronize current dev into exact profile policy branch#792ORESoftware wants to merge 156 commits into
ORESoftware wants to merge 156 commits into
Conversation
) Audit finding #1 (GitHub issue #30): remote/argocd/clusters/*/applications.yaml were one-shot `kubectl apply` bootstrap state — later git edits to the Application set never reached clusters and the Application CRs had no drift detection. Add a self-referencing root Application per cluster (dd-root-aws, dd-root-gcp, dd-root-hetzner) that syncs its own remote/argocd/clusters/<cloud> path with automated + prune + selfHeal, wired into each cluster kustomization so it manages itself. The self-source path stays inside k8s-cluster (not a submodule gitlink) so it renders (docs/app-deploy-contract.md render-trap); no app-level cascade finalizer, matching every other Application here, so pruning a removed child deletes only its Application CR (orphaning, never cascade-deleting, its workloads). Verified: `kubectl kustomize` renders all three overlays with the root app + provider label; k8s-cluster-e2e 12/12 (render-trap + application-declaration ratchets green). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…ncy, staleness, and browser auth tests Resolves a contradiction between two committed suites that assert the SAME deployment (remote/argocd/dd-next-runtime/dd-ai-agent-bridge.deployment.yaml): cluster-hardening.test.ts still required the bearer to bind dd-agent-secrets/SERVER_AUTH_SECRET (and doesNotMatch dd-ai-agent-bridge-secrets), while the deployment, its ExternalSecret, the kind fixture, the CI kind script, and the Rust config all moved to the dedicated dd-ai-agent-bridge-secrets/inbox_token. That left repo-checks red. Updates the stale assertions to the dedicated secret and forbids the shared credential from reappearing in the manifest. Augments ai-agent-bridge-k8s-contract.test.mjs with three regression tests: - secret cross-consistency: the deployment, ExternalSecret, kind fixture, and CI script must all name the same secret + key, closing the drift class that shipped a broken merge (deployment pointing at a key nothing provisioned). - staleness guard: locks in the hostPath bin-name/Cargo.toml check and the post-build binary-existence guard that ended the 2026-07-31 CrashLoopBackOff. - OTEL coherence: telemetry exports to the in-cluster otel-collector over http/protobuf. Adds a Playwright + Puppeteer browser auth-enforcement smoke (ai-agent-bridge-auth-smoke.mjs): drives a deployed bridge and asserts an unauthenticated GET /agents is refused (401/403), the live counterpart to the static manifest contract. Gated by AI_BRIDGE_HTTP_URL (skips cleanly when unset), wired into test:all and a new ai-agent-bridge-auth-smoke GitHub Actions workflow (manual + daily). Verified both engines PASS on 401 and FAIL on a simulated 200. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Add a bounded startup-validated repository-to-profile policy for dd-build-server. Canonical GitHub HTTPS and SSH aliases resolve to one exact identity; exact rules override broad prefix fallback and reject profile downgrades, malformed policy, unknown or disabled profiles, duplicate identities, ambiguous URLs, and oversized input. The initial k8s-cluster binding allows only rust-verify. Dedicated exact-head CI passed complete build-server compilation, repository/profile policy tests, fixed-profile and idempotency/NATS suites, continuity Rust/router tests, actionlint, GitOps rendering, deployment contracts, secret scanning, no-PAT propagation, cluster E2E, OpenAPI, catalog, and generated-binding drift checks. Refs DEN-1550, DEN-539, DEN-1606.
Add the independent Rust durable-execution control plane, JetStream-backed state and event contracts, worker lease/fencing protocol, DAG and one-off task scheduling, idempotency recovery, absolute run deadlines, OpenAPI, metrics, tests, documentation, and inert-by-default Kubernetes GitOps resources. Validated with strict Rust linting, complete state-machine tests, deterministic OpenAPI generation, Kustomize rendering, live JetStream protocol and deadline smokes, production container build, secret scanning, and current-dev semantic reconciliation.
Replace runtime source cloning and compilation with reviewed digest-pinned, non-root bridge and Slack-command images. Preserve signed Slack identity, durable idempotency, probes, NetworkPolicies, secrets, observability, and dry-run mode. Exact Kubernetes, ephemeral kind, Slack GitOps, OpenAPI, catalog, no-PAT, E2E, and secret checks passed; remaining live activation evidence stays under DEN-845/DEN-1041.
Add the digest-pinned, non-root provider runner and its bounded network policy at replicas zero. Keep provider secrets required so premature activation fails visibly, preserve the bridge Service boundary, and defer all provider spend until DEN-391/DEN-847 authorize a one-replica canary. Focused smoke, GitOps, continuity, E2E, catalog, and secret checks passed.
Compose the merged zero-replica runner resources from #1115 with the current bridge and Slack-command release pin. Preserve the no-PAT, dry-run, immutable-image boundaries.
Keep the zero-replica provider runner in both the explicit exporter WATCH_APPS configuration and the embedded DEFAULT_WATCH_APPS fallback. Add focused regression coverage for replicas, canonical app identity, and both watch surfaces. The observability/static contract, E2E, overlay rendering, continuity, and secret checks pass; the unrelated private-backend installation-authority gate remains tracked separately. Refs DEN-845, DEN-847.
Semantically reconcile PR #1119 with current dev after #1118: retain dev's exporter fallback and focused observability contract, while preserving only #1119's reviewed runner digest metadata, dedicated release contract, and credential-free CI workflow. No activation, secret, NetworkPolicy, or submodule changes beyond the reviewed feature branch. Refs DEN-845, DEN-391, DEN-847.
Repin the held-zero provider runner to the current reviewed ai-agent-bridge release and add focused GitOps, observability, and immutable-runtime contracts. The unrelated private-backend credential gate remains documented; no PAT fallback or provider activation is introduced.
Compose merged runner PR #1119 and observability coverage with the current bridge/Slack image release. Preserve exact source/digest pins, dry-run Slack dispatch, and no-PAT boundaries.
Repin the bridge and signed Slack command ingress to the current reviewed ai-agent-bridge release, advance the source gitlink, and retain immutable-runtime, no-PAT, dry-run, and held-zero provider activation boundaries. The unrelated private-backend GitHub App credential gate remains documented.
Replace the stale in-pod-build and thirteen-binding instructions with the current immutable bridge, Slack-command, and held-zero runner release, including live-evidence and digest-only rollback gates.
Add a scheduled, credential-free DNS/TLS and unsigned Slack route probe with metadata-only evidence. Preserve signed dry-run, held-zero provider activation, no-PAT behavior, and strict fail-closed status expectations.
Align the dev public-ingress workflow with the default-branch dispatcher and trigger the first registered GitHub-hosted DNS/TLS and fail-closed Slack route measurement. Preserve credential-free, metadata-only, dry-run, held-zero, and no-PAT boundaries.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Temporary synchronization PR used to establish whether current
dev@bcc682d77466ee16b4dd51209778225d6668f039can merge cleanly into the final exact-profile branch. Merge only if GitHub reports a clean semantic union; otherwise close and reconcile the overlapping policy files explicitly.