feat: receipt + egress guard — make qmax-local-agent the canonical, auditable source - #7
Merged
Merged
Conversation
Syncs the qmax local agent to the current QualityMax source (was ~1 month behind): adds the Exposure Receipt + egress guard and rewires all internal imports to this repo's module path. - New packages: httpx/ (single egress chokepoint + static guard), policy/ (runtime allow-list), exposure/ (traffic taxonomy). - Imports the shared schema module github.com/Quality-Max/qmax-receipt. - cmd_receipt.go (qmax receipt list|show|verify), cmd_skill_feedback.go. - Agent threads a per-run receipt via context; all egress flows through httpx. - Makefile + release.yml stamp agent_build_sha via -ldflags -X (was "dev"). - Ported this repo's extra tests to the new ctx-threaded / httpx API; no coverage dropped. Part of "Receipts, not promises": develop-in-the-open — this public repo becomes the canonical, auditable source that emits the receipts. ci.yml's go test runs the static egress guard, so un-receipted egress can't merge here. Config/state dir stays ~/.qamax for now; unifying to ~/.qmax with a migration is a separate follow-up PR.
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
✅ QualityMax Pipeline
Powered by QualityMax — AI-Powered Test Automation |
The port overwrote this repo's errcheck-clean files with monorepo versions that don't check some error returns. Restore lint-cleanliness: '_ =' for intentional ignores (fs.Parse on ExitOnError FlagSets, best-effort chromedp.Sleep, Shutdown in shutdown paths, best-effort browser open) and real handling for json.Unmarshal (warn, matching nearby best-effort localStorage capture). No behavior change.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Brings the public
qmax-local-agentup to the current QualityMax agent source (it was ~1 month behind) and adds the Exposure Receipt + egress guard, so this public repo becomes the canonical, auditable source that emits the receipts — the "develop-in-the-open" model (same pattern asqmax-code).Why
The "Receipts, not promises" trust model says "audit the open source that emits the receipts." That only holds if the public source is what builds the customer's binary. Until now this repo lagged the monorepo and didn't contain the receipt code at all — audited ≠ built. This closes that gap.
Changes
httpx/(the single egress chokepoint — a recordingRoundTripper— plus the static guardguard_test.gothat forbids un-instrumented HTTP outsidehttpx),policy/(runtime allow-list, warn/strict),exposure/(traffic taxonomy +Classify).github.com/Quality-Max/qmax-receipt(v0.1.0, MIT) — one versioned, offline-verifiable receipt format.cmd_receipt.go(qmax receipt list|show|verify),cmd_skill_feedback.go.context; all egress now flows throughhttpx.Makefile+release.ymlstampagent_build_shavia-ldflags -X …/qmax-receipt.BuildSHA=$SHA(was always"dev").httpxAPI — no coverage dropped.Verification
go build ./...,go vet ./...,go test ./...all green locally.ci.yml go test, so un-receipted egress can't merge here — the enforcement the trust model depends on.Follow-up (not in this PR)
~/.qamaxhere; unifying to~/.qmaxwith a first-run migration is a separate PR (renaming would orphan existing auth + the agent signing key without a migration).