b2f4cfb4bd
test(opax-mcp): add Emma import bootstrap to auth tests
2026-09-21 08:59:03 +00:00
a83ed83b5e
feat(opax-mcp): encrypt pending Gitea plan payloads
...
Encrypt proposal content with Cloud KMS before persistence, store a versioned Base64 envelope, and bind plan metadata to an approval-subject hash.
2026-09-21 08:42:58 +00:00
cac7dd6e8a
Harden Gitea change proposals
2026-09-21 05:30:06 +00:00
7d98df7055
feat(opax-mcp): add guarded gitea change proposals
2026-09-21 01:44:47 +00:00
b519871a48
Add normalized Gitea source metadata tool
2026-09-20 22:32:11 +00:00
33a414c095
Add deterministic deployment source normalization
2026-09-20 19:47:31 +00:00
07626c83f4
feat(opax-mcp): add safe Gitea repository catalog
2026-09-20 18:20:56 +00:00
b802a29482
feat(opax-mcp): add validated Gitea source archive helpers
2026-09-20 16:10:04 +00:00
395aad5d70
fix(opax-mcp): authenticate internal agent calls with Cloud Run identity token
2026-09-20 15:34:35 +00:00
8e8952ce20
feat(opax-mcp): add safe read-only Gitea repository listing
2026-09-19 23:28:01 +00:00
8aa533eecc
feat(identity): add static workspace authority foundation
2026-09-19 17:18:38 +00:00
aee859b3ba
feat(emma): add conversation history and release tooling
2026-09-19 00:38:43 +00:00
97421374c2
feat(emma): bridge capability status into runtime
2026-09-18 15:58:04 +00:00
4eacc756b0
feat(emma): add canonical capability registry
2026-09-18 15:34:46 +00:00
e48f8390ed
fix(emma): enforce user-facing capability boundaries
2026-09-18 14:46:32 +00:00
d1864f1f55
feat(opax-mcp): add local gated call_emma integration
...
Phase 2C adds a local Firestore-emulator-only call_emma path with server-injected test identity, deterministic local Emma execution, conversation/message persistence, and append-only audit logging.
The integration test verifies feature gating, persistence, audit correlation, client identity isolation, and controlled local process cleanup.
2026-09-17 15:45:42 +00:00
362fb9a7b4
fix(opax): restore persistence store compatibility
2026-09-16 18:35:06 +00:00
f49cbc4612
fix(opax): restore literal tool risk policy
2026-09-16 17:38:39 +00:00
3a2aae98aa
feat(opax): add Firestore persistence foundation
2026-09-16 16:46:24 +00:00
a777e4abaf
feat(opax-mcp): add master hub contracts and policy foundation
2026-09-16 16:22:32 +00:00
e66b1a328e
refactor(opax-mcp): introduce canonical Emma identity
2026-09-16 15:27:48 +00:00
004267689c
feat(a2h2a): auth, CSRF, logging fixes + test updates
Check Python Version Consistency / Check Python Version (push) Waiting to run
2026-09-04 20:38:37 +00:00
3e296673b2
test(a2h2a): add end-to-end test for approval flow
...
Adds a test script that validates the entire A2H2A approval process, from ticket creation to final verification in Firestore.
- The server now supports a `test_mode` flag to facilitate testing.
- The test verifies ticket creation, review page access, approval, final ticket status, and audit log creation.
2026-09-04 12:43:55 +00:00
310dca2db5
feat(a2h2a): implement phase 1 approval flow
...
Implements a secure, state-only approval workflow for A2H2A tickets.
- Adds single-use token generation and validation.
- Implements an IAP-gated HTML review page.
- Adds state-changing approve/reject endpoints with full validation.
- Introduces audit logging for ticket events.
- Execution of tools remains disabled.
2026-09-04 12:23:59 +00:00
3b6e4e4890
docs/code: clarify A2H2A prototype status and disable execution
...
- Add Implementation Status section to A2H2A spec
- Clarify Google Chat is notification-only
- Add target approval architecture requirements
- Add critical A2H2A safety principle to RUNBOOK.md
- Remove unsafe approval/rejection endpoints from server.py
- Enforce server-side parameter_hash calculation
- Disable execution for all tools in A2H2A_TOOL_ALLOW_LIST
2026-09-04 12:00:07 +00:00
79b100caff
docs(security): komplett sikkerhetsdokumentasjon med 7 manifestfiler
...
Check Python Version Consistency / Check Python Version (push) Waiting to run
- SECURITY.md: Overordnet visjon med lenker til alle manifestfiler
- SECURITY_AUDITS.md: Historikk og To-Do liste
- RUNBOOK.md: 6 operasjonelle scenarier (ukjent bruker, eksponert secret, 401/403, 50x, VPC-SC, BinAuthz)
- INCIDENT_RESPONSE.md: PICERL-modell med eskaleringsmatrise
- SECRET_MANAGEMENT.md: Policy + lokal utvikling
- ACCESS_CONTROL.md: IAM-policy med service account-oversikt
- COMPLIANCE.md: TYR, Binary Auth, KMS-attestasjon
Opprydding:
- Slettet sensitive filer (test_secret.txt, final-secret-test.txt, tyr/certs/ca_password.txt)
- Slettet engangsskript og midlertidige filer
- Oppdatert .gitignore med *.txt
2026-09-04 08:25:57 +00:00
1ba991f582
feat(core): Fresh initialization - Deploy v3.6.1 Singularity Architecture
2026-09-03 04:03:09 +00:00
