Security, invariant, and test-coverage fixes from a repo gap analysis - #11

Open

thedataengineer wants to merge 10 commits into

open-gitagent:mainfrom

thedataengineer:fix/gap-analysis

Commits on Jul 28, 2026

remote: vet artifact tar members before extraction; the server is untrusted input
thedataengineer
committed
transport: cap WS frames and HTTP bodies; workers refuse path-shaped job ids
thedataengineer
committed
serve: write settings.json and tokens.json owner-only
thedataengineer
committed
serve: throttle /v1/login, validate dataset ids, contain asset paths
thedataengineer
committed
mlx: honor weight_decay and seed; keep the ignored-fields note truthful
thedataengineer
committed
verl: dispatch on the method spec, log unmapped config, finish the surface
thedataengineer
committed
ci: run the CPU test suite, and cover the pure functions it was missing
thedataengineer
committed
docs: point at files that exist, stop calling shipped features unbuilt
thedataengineer
committed
errors: stop swallowing failures the caller needs to see
thedataengineer
committed
protocol: close the client/server gaps in remote.py and api.ts
thedataengineer
committed