ECHO Fleet Builder

Turns governed issues into isolated builds, verified branches, and production-grade pull requests.

This repository is the deployable, auditable runtime for the public ECHO Fleet Builder registration. Its committed manifest is the least-privilege contract: only listed events are processed, and credentials are supplied at runtime from a secret manager.

Governed runtime

• Validates X-Hub-Signature-256 over the original bytes and rejects oversized or malformed requests.
• Claims each GitHub delivery in a durable SQLite queue; retries cannot execute the action twice.
• Maps the committed app manifest to one fixed action. Webhook data cannot select code, commands, capabilities, or credentials.
• Requires repository opt-in in .echo/apps.json, then obtains Sovereign Action Broker authorization for the exact app/action/scope.
• Uses short-lived installation tokens only inside the effect boundary.
• Seals succeeded, failed, ignored, and recovered jobs into an append-only hash-chained receipt ledger.
• Loads webhook, private-key, SDK-key, and HMAC material from protected files only; direct secret environment variables fail startup.

Enable in a repository

{
  "version": 1,
  "apps": {
    "<app-key>": {"enabled": true}
  }
}

Install the GitHub App for the account or selected repositories, commit the opt-in, and inspect the terminal result at https://github.echo-op.com/receipts/<app-key>/<delivery-id>.

Verify locally

python -m venv .venv
. .venv/bin/activate
python -m pip install -e ".[test]"
python -m pytest -q
python -m compileall -q src app.py

A production process also needs the file-mounted secret paths and persistent ledger documented in Operations.

See Architecture, Operations, and Security Policy for the full contract.