Resync fork/main with upstream (2026-07-09, 76 commits)

.gitattributes

@@ -0,0 +1,6 @@
+# The dashboard SPA bundle under internal/api/dashboardspa/dist is emitted by the
+# Vite build and embedded into the gc binary. Treat it as generated output: skip
+# textual diffing and the whitespace lint (`git diff --check`) on the minified
+# assets, and collapse it in review UIs. Drift is still caught by the content-based
+# `git diff --quiet -- internal/api/dashboardspa/dist` gate in the Makefile.
+internal/api/dashboardspa/dist/** -diff linguist-generated

.github/requirements/mcp-agent-mail.in

@@ -25,6 +25,12 @@ idna>=3.15
 # transitive constraint carries the patched version itself.
 litellm>=1.84.0
 
+# Security floor: CVE-2026-49852 (HIGH, HS256/HS384/HS512 verify accepts an
+# empty/nil HMAC key — cross-language sibling of CVE-2026-45363) in joserfc
+# < 1.6.8. joserfc arrives transitively via authlib; pin the floor until
+# authlib's transitive constraint carries the patched version itself.
+joserfc>=1.6.8
+
 # Authlib and FastMCP security floors live in
 # .github/requirements/mcp-agent-mail.overrides.txt because mcp-agent-mail
 # v0.3.2 still caps Authlib below the fixed release.

.github/requirements/mcp-agent-mail.txt

@@ -1211,10 +1211,12 @@ jiter==0.14.0 \
     --hash=sha256:ff3a6465b3a0f54b1a430f45c3c0ba7d61ceb45cbc3e33f9e1a7f638d690baf3 \
     --hash=sha256:ffb2a08a406465bb076b7cc1df41d833106d3cf7905076cc73f0cb90078c7d10
     # via openai
-joserfc==1.6.5 \
-    --hash=sha256:1482a7db78fb4602e44ed89e51b599d052e091288c7c532c5b694e20149dec48 \
-    --hash=sha256:e9878a0f8243fe7b95e11fdda81374ca9f7a689e302751579d3dfdeec559675e
-    # via authlib
+joserfc==1.7.2 \
+    --hash=sha256:537ffb8888b2df039cb5b6d017d7cff6f09d521ce65d89cc9b8ab752b1cff947 \
+    --hash=sha256:ddd818c0ca9b4f17bbc2d72cb3966e6ded7502be089316c62c3cc64ae86132b5
+    # via
+    #   -r .github/requirements/mcp-agent-mail.in
+    #   authlib
 jsonref==1.1.0 \
     --hash=sha256:32fe8e1d85af0fdefbebce950af85590b22b60f9e95443176adbde4e1ecea552 \
     --hash=sha256:590dc7773df6c21cbf948b5dac07a72a251db28b0238ceecce0a2abfa8ec30a9

.github/scripts/install-bd-archive.sh

@@ -57,6 +57,10 @@ version_no_v="${version#v}"
 platform_tuple="${os}_${arch}"
 expected_sha=""
 case "${version}:${platform_tuple}" in
+  v1.1.0:linux_amd64) expected_sha="b0f3dd607c3fb989ee08d0a6854fba80d0402971eb108f9af6170bc14d491a34" ;;
+  v1.1.0:linux_arm64) expected_sha="e64eb6f5f998c9eae3ef9ec786f5f1c907ab3ed04fe220ebf265ca9952e21b2f" ;;
+  v1.1.0:darwin_amd64) expected_sha="5d7d30fdadcf012b7e0c1933a62cdfaef106e2561509b904e50a6733621cf8da" ;;
+  v1.1.0:darwin_arm64) expected_sha="c42e24d83b258f7ba9f52a6d2d5f6b055869dfe7807165055988b12e7ea8c564" ;;
   v1.0.5:linux_amd64) expected_sha="24706f65c7131c7b3261388709ae8781c8db53f0795398f67aa40538750aacf3" ;;
   v1.0.5:linux_arm64) expected_sha="ccae5eb4478876ae224687ba98baef46848e603470b241966b63ccd3e01129a4" ;;
   v1.0.5:darwin_amd64) expected_sha="0b0b017a3f2b23a1a9b53056ff160de318ebbca6a991c3db5924f5f48390e490" ;;

.github/workflows/ci.yml

@@ -175,7 +175,7 @@ jobs:
     runs-on: ${{ needs.runner-policy.outputs.runner_16vcpu }}
     env:
       DOLT_VERSION: "2.1.7"
-      BD_VERSION: "v1.0.4"
+      BD_VERSION: "v1.1.0"
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       - uses: ./.github/actions/setup-gascity-ubuntu
@@ -191,20 +191,28 @@ jobs:
         run: make check-native-dependency-surface
       - name: Event-export isolation guard
         run: make check-eventexport-isolation
+      - name: Open-core boundary guard
+        run: make check-core-boundary
       - name: Native DoltLite beads tests
         run: make test-native-doltlite-beads
-      - name: Get golangci-lint version for cache key
+      - name: Get golangci-lint + Go toolchain versions for cache key
         id: glint-version
         run: |
           version=$(grep -m1 '^GOLANGCI_LINT_VERSION := ' Makefile | awk '{print $3}')
           echo "version=${version}" >> "$GITHUB_OUTPUT"
+          # staticcheck (bundled in golangci-lint) caches type/CFG facts whose
+          # validity depends on the Go toolchain it was built with. Keying the
+          # cache on GOVERSION prevents a cache populated under one Go toolchain
+          # from being replayed under another, which produced a stale-fact
+          # SA5011 false-positive flood on main (ga-v7x9vk).
+          echo "goversion=$(go env GOVERSION)" >> "$GITHUB_OUTPUT"
       - name: Restore golangci-lint cache
         uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         with:
           path: .cache/golangci-lint
-          key: ${{ runner.os }}-golangci-lint-${{ steps.glint-version.outputs.version }}-${{ hashFiles('go.sum', '.golangci.yml') }}
+          key: ${{ runner.os }}-golangci-lint-${{ steps.glint-version.outputs.version }}-${{ steps.glint-version.outputs.goversion }}-${{ hashFiles('go.sum', '.golangci.yml') }}
           restore-keys: |
-            ${{ runner.os }}-golangci-lint-${{ steps.glint-version.outputs.version }}-
+            ${{ runner.os }}-golangci-lint-${{ steps.glint-version.outputs.version }}-${{ steps.glint-version.outputs.goversion }}-
       - name: Lint
         env:
           GOLANGCI_LINT_CACHE: ${{ github.workspace }}/.cache/golangci-lint
@@ -229,7 +237,7 @@ jobs:
     runs-on: ${{ needs.runner-policy.outputs.runner_32vcpu }}
     env:
       DOLT_VERSION: "2.1.7"
-      BD_VERSION: "v1.0.4"
+      BD_VERSION: "v1.1.0"
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       - uses: ./.github/actions/setup-gascity-ubuntu
@@ -258,7 +266,7 @@ jobs:
     runs-on: ${{ needs.runner-policy.outputs.runner_32vcpu }}
     env:
       DOLT_VERSION: "2.1.7"
-      BD_VERSION: "v1.0.4"
+      BD_VERSION: "v1.1.0"
     strategy:
       fail-fast: false
       matrix:
@@ -290,7 +298,7 @@ jobs:
     runs-on: ${{ needs.runner-policy.outputs.runner_32vcpu }}
     env:
       DOLT_VERSION: "2.1.7"
-      BD_VERSION: "v1.0.4"
+      BD_VERSION: "v1.1.0"
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       - uses: ./.github/actions/setup-gascity-ubuntu
@@ -490,7 +498,7 @@ jobs:
         shard: [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12]
     env:
       DOLT_VERSION: "2.1.7"
-      BD_VERSION: "v1.0.4"
+      BD_VERSION: "v1.1.0"
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       - uses: ./.github/actions/setup-gascity-ubuntu
@@ -622,7 +630,7 @@ jobs:
             command: ./scripts/test-integration-shard rest-full-16-of-16
     env:
       DOLT_VERSION: "2.1.7"
-      BD_VERSION: "v1.0.4"
+      BD_VERSION: "v1.1.0"
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       - uses: ./.github/actions/setup-gascity-ubuntu
@@ -1123,7 +1131,7 @@ jobs:
           GC_TEST_GASCITY_PACKS_REGISTRY: main
     env:
       DOLT_VERSION: "2.1.7"
-      BD_VERSION: "v1.0.4"
+      BD_VERSION: "v1.1.0"
 
   # Dashboard SPA typecheck + tests + build. Runs on every push/PR
   # so TS drift against the spec (e.g. a query param tightening from
@@ -1150,6 +1158,9 @@ jobs:
       - name: Typecheck (tsc --noEmit)
         run: npm run typecheck
         working-directory: internal/api/dashboardspa/web
+      - name: Typecheck test files (tsc -p tsconfig.test.json)
+        run: npm run --workspace gas-city-dashboard-frontend typecheck:test
+        working-directory: internal/api/dashboardspa/web
       - name: Vitest
         run: npm run --workspace gas-city-dashboard-frontend test
         working-directory: internal/api/dashboardspa/web

.github/workflows/fork-verify.yml

@@ -23,7 +23,7 @@ jobs:
     runs-on: ubuntu-latest
     env:
       DOLT_VERSION: "2.1.7"
-      BD_VERSION: "v1.0.4"
+      BD_VERSION: "v1.1.0"
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       - uses: ./.github/actions/setup-gascity-ubuntu

.github/workflows/mac-regression.yml

@@ -75,7 +75,7 @@ concurrency:
 
 env:
   DOLT_VERSION: "2.1.7"
-  BD_VERSION: "v1.0.4"
+  BD_VERSION: "v1.1.0"
 
 # Trigger gate re-used by every job below via `if:`.
 # We want each job to run when EITHER:
@@ -137,18 +137,24 @@ jobs:
           install-claude-cli: "false"
       - name: Install tools
         run: make install-tools
-      - name: Get golangci-lint version for cache key
+      - name: Get golangci-lint + Go toolchain versions for cache key
         id: glint-version
         run: |
           version=$(grep -m1 '^GOLANGCI_LINT_VERSION := ' Makefile | awk '{print $3}')
           echo "version=${version}" >> "$GITHUB_OUTPUT"
+          # staticcheck (bundled in golangci-lint) caches type/CFG facts whose
+          # validity depends on the Go toolchain it was built with. Keying the
+          # cache on GOVERSION prevents a cache populated under one Go toolchain
+          # from being replayed under another, which produced a stale-fact
+          # SA5011 false-positive flood on main (ga-v7x9vk).
+          echo "goversion=$(go env GOVERSION)" >> "$GITHUB_OUTPUT"
       - name: Restore golangci-lint cache
         uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         with:
           path: .cache/golangci-lint
-          key: ${{ runner.os }}-golangci-lint-${{ steps.glint-version.outputs.version }}-${{ hashFiles('go.sum', '.golangci.yml') }}
+          key: ${{ runner.os }}-golangci-lint-${{ steps.glint-version.outputs.version }}-${{ steps.glint-version.outputs.goversion }}-${{ hashFiles('go.sum', '.golangci.yml') }}
           restore-keys: |
-            ${{ runner.os }}-golangci-lint-${{ steps.glint-version.outputs.version }}-
+            ${{ runner.os }}-golangci-lint-${{ steps.glint-version.outputs.version }}-${{ steps.glint-version.outputs.goversion }}-
       - name: Lint
         env:
           GOLANGCI_LINT_CACHE: ${{ github.workspace }}/.cache/golangci-lint

.github/workflows/nightly.yml

@@ -10,7 +10,7 @@ permissions:
 
 env:
   DOLT_VERSION: "2.1.7"
-  BD_VERSION: "v1.0.4"
+  BD_VERSION: "v1.1.0"
 
 jobs:
   tier-b:
@@ -89,7 +89,7 @@ jobs:
     timeout-minutes: 30
     env:
       DOLT_VERSION: "2.1.7"
-      BD_VERSION: "v1.0.4"
+      BD_VERSION: "v1.1.0"
       GC_BEADS: sqlite
       GC_ACCEPTANCE_BEADS_PROVIDER: sqlite
     steps:

.github/workflows/notify-image-build.yaml

@@ -1,10 +1,12 @@
-# Notify gasworks-internal to rebuild the gc-runtime image when Go source changes.
+# Notify gasworks-control-plane to rebuild the gc-runtime image when Go source
+# changes.
 #
 # gascity provides the gc binary embedded in runtime images.
 # When source code changes, images need rebuilding.
 #
-# Required secret: GASCITY_HOSTED_TOKEN — PAT with repo scope for
-# gascity/gasworks-internal (needed for repository_dispatch).
+# Required secret: GASCITY_HOSTED_TOKEN — a token with contents:write on
+# gascity/gasworks-control-plane (needed for repository_dispatch). A
+# fine-grained PAT scoped to that repo, or a classic PAT with repo scope.
 
 name: Notify Image Rebuilds
 
@@ -33,5 +35,5 @@ jobs:
         run: |
           gh api \
             --method POST \
-            repos/gascity/gasworks-internal/dispatches \
+            repos/gascity/gasworks-control-plane/dispatches \
             -f event_type=runtime-dep-updated

.github/workflows/ollama-acceptance-c.yml

@@ -8,7 +8,7 @@ permissions:
 
 env:
   DOLT_VERSION: "2.1.7"
-  BD_VERSION: "v1.0.4"
+  BD_VERSION: "v1.1.0"
   ANTHROPIC_BASE_URL: https://ollama.com
   ANTHROPIC_API_KEY: ""
   ANTHROPIC_AUTH_TOKEN: ${{ secrets.OLLAMA_API_KEY }}

.github/workflows/rc-gate.yml

@@ -8,7 +8,7 @@ permissions:
 
 env:
   DOLT_VERSION: "2.1.7"
-  BD_VERSION: "v1.0.4"
+  BD_VERSION: "v1.1.0"
   # Bypass the systemd gascity-test.slice re-exec on CI runners. The Blacksmith
   # runners' user systemd cannot reliably create a transient --scope for the
   # heavy acceptance workloads; gc_test_slice_reexec then exec's

.github/workflows/review-formulas.yml

@@ -37,7 +37,7 @@ concurrency:
 
 env:
   DOLT_VERSION: "2.1.7"
-  BD_VERSION: "v1.0.4"
+  BD_VERSION: "v1.1.0"
 
 jobs:
   runner-policy: