Repository navigation
feat(client): publish a batch of revocations in one request - #22
Merged
Merged
Conversation
Hilt rotates a principal-bound key's delegations on every policy change and needs every revocation of one write sent together, so that the write waits on one round trip regardless of how many keys it touches. PublishBatch builds one self-signed /ucan/revoke invocation per revoked delegation and sends them in a single container through ucantone's ExecuteBatch, failing on the first refused receipt. ucantone is bumped to the version that exposes batch execution. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Contributor
Author
|
@codex review |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
Codex Review: Didn't find any major issues. 👍 Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
alanshaw
approved these changes
Oct 8, 2026
fil-forge-bot Bot
added a commit
to fil-forge/infra-central
that referenced
this pull request
Oct 9, 2026
Published from fil-forge/swarf#22 - Digest: `sha256:c3643127f22e47c9ea8f479287ffc1ef01e9d29d2fe9ebe5fc76488501803a74` - Commit: fil-forge/swarf@4b2e2ae - Publish run: https://github.com/fil-forge/swarf/actions/runs/37934029957 Merging applies [`terraform/envs/dev/apps`](https://github.com/fil-forge/infra-central/tree/main/terraform/envs/dev/apps) with no further confirmation. Co-authored-by: fil-forge-bot[bot] <318653112+fil-forge-bot[bot]@users.noreply.github.com>
bajtos
pushed a commit
to fil-forge/infra-central
that referenced
this pull request
Oct 13, 2026
Sets every staging pin in `terraform/envs/staging/apps/terraform.tfvars` to what `terraform/envs/dev/apps/terraform.tfvars` pins at e487d80. Merging this is the promotion: Check and deploy applies `terraform/envs/staging/apps` on the merge commit, with no further confirmation. dev passed its smoke test on that commit in https://github.com/fil-forge/infra-central/actions/runs/38363959867. This pull request is rebuilt each time dev passes its smoke test after a push to `main`, and closed once staging matches dev. To hold a service back, push to `bot/promote-staging` by hand: the bot leaves the branch alone while this pull request is open. ## sprue `sha256:b6a4f84` → `sha256:79eb33d` What fil-forge/sprue brings over staging's pin, `de71035..9b40689`: - build(deps): bump the github-actions group across 1 directory with 6 updates (9531d9d) - build(deps): bump the github-actions group across 1 directory with 6 updates (fil-forge/sprue#83) (ab4a00d) - build(deps): bump the github-actions group with 5 updates (fil-forge/sprue#99) (bc827d0) - build(deps): bump github.com/aws/aws-sdk-go-v2 from 1.46.0 to 1.47.0 (fil-forge/sprue#100) (bb23dbe) - build(deps): bump github.com/aws/aws-sdk-go-v2/service/s3 from 1.112.0 to 1.113.1 (fil-forge/sprue#101) (42f78f7) - build(deps): bump golang.org/x/sync from 0.22.0 to 0.23.0 (fil-forge/sprue#103) (a17d3f4) - build(deps): bump github.com/olekukonko/tablewriter from 1.1.4 to 1.1.5 (fil-forge/sprue#104) (0723a79) - build(deps): bump github.com/aws/aws-sdk-go-v2/credentials from 1.20.3 to 1.20.5 (fil-forge/sprue#102) (b400abe) - build(deps): bump github.com/aws/aws-sdk-go-v2/config from 1.33.3 to 1.33.5 (fil-forge/sprue#105) (506f5f6) - feat: record upload counts (fil-forge/sprue#108) (289704a) - feat: implement metrics handler (fil-forge/sprue#107) (3ecddfd) - feat: add OTEL tracing (fil-forge/sprue#112) (dae68fb) - build(deps): bump the github-actions group with 5 updates (fil-forge/sprue#115) (9196de3) - build(deps): bump github.com/aws/aws-sdk-go-v2/service/s3 from 1.113.1 to 1.113.2 (fil-forge/sprue#116) (d73446d) - feat: concurrent event listeners (fil-forge/sprue#117) (c2cd80b) - Add /forge-perf: benchmark a pull request on forge-perf (fil-forge/sprue#118) (45d5331) - ci: call libforge workspace test workflow at ＠main (fil-forge/sprue#120) (c0f6b49) - Grant forge-perf's pr-run.yml pull-requests: write again (fil-forge/sprue#121) (2f1ec80) - feat: add upload count to metrics (fil-forge/sprue#119) (6b6e727) - feat: allow digest-less blob add (fil-forge/sprue#122) (04ea1db) - build(deps): bump github.com/aws/aws-sdk-go-v2/config from 1.33.5 to 1.33.6 (fil-forge/sprue#124) (67d7ba0) - build(deps): bump github.com/labstack/echo/v4 from 4.15.4 to 4.16.0 (fil-forge/sprue#127) (c99a3e1) - build(deps): bump github.com/aws/aws-sdk-go-v2/service/s3 from 1.113.2 to 1.113.4 (fil-forge/sprue#128) (052f95d) - feat: add timestamp to agent index table (fil-forge/sprue#129) (9b40689) ## hilt `sha256:3992eef` → `sha256:80076f3` What fil-forge/hilt brings over staging's pin, `9815d93..a026d16`: - feat: return error codes from the Tenant API (fil-forge/hilt#76) (14f6d84) - fix: delete bucket grants (fil-forge/hilt#78) (468abb1) - fix: add missing upload remove grant (fil-forge/hilt#79) (d716fd3) - feat: add async overhang (fil-forge/hilt#83) (87afacd) - fix: reject self issued invocations (fil-forge/hilt#81) (969e212) - feat: add OTEL tracing (fil-forge/hilt#88) (cbe41f1) - fix: add `/upload/remove` grant to bucket delete (fil-forge/hilt#90) (4ee3af8) - Add /forge-perf: benchmark a pull request on forge-perf (fil-forge/hilt#92) (22b905f) - Grant forge-perf's pr-run.yml pull-requests: write again (fil-forge/hilt#94) (19be980) - fix: catalog write grants (fil-forge/hilt#93) (d21578e) - feat: implement tenant metrics (fil-forge/hilt#91) (a026d16) ## swarf `sha256:1edd6ed` → `sha256:c364312` What fil-forge/swarf brings over staging's pin, `f286fb0..4b2e2ae`: - fix: bound the event MaxEventBytes names (edfa9a6) - fix: report the service's error events from swarf stream (16cf241) - fix: report a failed firehose stream to the caller of the handler (a033bcc) - fix: bound the event MaxEventBytes names, and report the service's error events (fil-forge/swarf#18) (f796a42) - fix: report a failed firehose stream to the caller of the handler (fil-forge/swarf#19) (1778ec0) - fix: add recovery middleware (fil-forge/swarf#21) (cdba143) - feat(client): publish a batch of revocations in one request (0b2e5b2) - feat(client): publish a batch of revocations in one request (fil-forge/swarf#22) (4b2e2ae) Co-authored-by: fil-forge-bot[bot] <318653112+fil-forge-bot[bot]@users.noreply.github.com>
fil-forge-bot Bot
added a commit
to fil-forge/infra-central
that referenced
this pull request
Oct 13, 2026
Sets every prod pin in `terraform/envs/prod/apps/terraform.tfvars` to what `terraform/envs/staging/apps/terraform.tfvars` pins at 6a4df2a. Merging this is the promotion: Check and deploy applies `terraform/envs/prod/apps` on the merge commit, with no further confirmation. staging passed its smoke test on that commit in https://github.com/fil-forge/infra-central/actions/runs/38399813594. This pull request is rebuilt each time staging passes its smoke test after a push to `main`, and closed once prod matches staging. To hold a service back, push to `bot/promote-prod` by hand: the bot leaves the branch alone while this pull request is open. ## sprue `sha256:b6a4f84` → `sha256:79eb33d` What fil-forge/sprue brings over prod's pin, `de71035..9b40689`: - build(deps): bump the github-actions group across 1 directory with 6 updates (9531d9d) - build(deps): bump the github-actions group across 1 directory with 6 updates (fil-forge/sprue#83) (ab4a00d) - build(deps): bump the github-actions group with 5 updates (fil-forge/sprue#99) (bc827d0) - build(deps): bump github.com/aws/aws-sdk-go-v2 from 1.46.0 to 1.47.0 (fil-forge/sprue#100) (bb23dbe) - build(deps): bump github.com/aws/aws-sdk-go-v2/service/s3 from 1.112.0 to 1.113.1 (fil-forge/sprue#101) (42f78f7) - build(deps): bump golang.org/x/sync from 0.22.0 to 0.23.0 (fil-forge/sprue#103) (a17d3f4) - build(deps): bump github.com/olekukonko/tablewriter from 1.1.4 to 1.1.5 (fil-forge/sprue#104) (0723a79) - build(deps): bump github.com/aws/aws-sdk-go-v2/credentials from 1.20.3 to 1.20.5 (fil-forge/sprue#102) (b400abe) - build(deps): bump github.com/aws/aws-sdk-go-v2/config from 1.33.3 to 1.33.5 (fil-forge/sprue#105) (506f5f6) - feat: record upload counts (fil-forge/sprue#108) (289704a) - feat: implement metrics handler (fil-forge/sprue#107) (3ecddfd) - feat: add OTEL tracing (fil-forge/sprue#112) (dae68fb) - build(deps): bump the github-actions group with 5 updates (fil-forge/sprue#115) (9196de3) - build(deps): bump github.com/aws/aws-sdk-go-v2/service/s3 from 1.113.1 to 1.113.2 (fil-forge/sprue#116) (d73446d) - feat: concurrent event listeners (fil-forge/sprue#117) (c2cd80b) - Add /forge-perf: benchmark a pull request on forge-perf (fil-forge/sprue#118) (45d5331) - ci: call libforge workspace test workflow at ＠main (fil-forge/sprue#120) (c0f6b49) - Grant forge-perf's pr-run.yml pull-requests: write again (fil-forge/sprue#121) (2f1ec80) - feat: add upload count to metrics (fil-forge/sprue#119) (6b6e727) - feat: allow digest-less blob add (fil-forge/sprue#122) (04ea1db) - build(deps): bump github.com/aws/aws-sdk-go-v2/config from 1.33.5 to 1.33.6 (fil-forge/sprue#124) (67d7ba0) - build(deps): bump github.com/labstack/echo/v4 from 4.15.4 to 4.16.0 (fil-forge/sprue#127) (c99a3e1) - build(deps): bump github.com/aws/aws-sdk-go-v2/service/s3 from 1.113.2 to 1.113.4 (fil-forge/sprue#128) (052f95d) - feat: add timestamp to agent index table (fil-forge/sprue#129) (9b40689) ## hilt `sha256:3992eef` → `sha256:80076f3` What fil-forge/hilt brings over prod's pin, `9815d93..a026d16`: - feat: return error codes from the Tenant API (fil-forge/hilt#76) (14f6d84) - fix: delete bucket grants (fil-forge/hilt#78) (468abb1) - fix: add missing upload remove grant (fil-forge/hilt#79) (d716fd3) - feat: add async overhang (fil-forge/hilt#83) (87afacd) - fix: reject self issued invocations (fil-forge/hilt#81) (969e212) - feat: add OTEL tracing (fil-forge/hilt#88) (cbe41f1) - fix: add `/upload/remove` grant to bucket delete (fil-forge/hilt#90) (4ee3af8) - Add /forge-perf: benchmark a pull request on forge-perf (fil-forge/hilt#92) (22b905f) - Grant forge-perf's pr-run.yml pull-requests: write again (fil-forge/hilt#94) (19be980) - fix: catalog write grants (fil-forge/hilt#93) (d21578e) - feat: implement tenant metrics (fil-forge/hilt#91) (a026d16) ## swarf `sha256:1edd6ed` → `sha256:c364312` What fil-forge/swarf brings over prod's pin, `f286fb0..4b2e2ae`: - fix: bound the event MaxEventBytes names (edfa9a6) - fix: report the service's error events from swarf stream (16cf241) - fix: report a failed firehose stream to the caller of the handler (a033bcc) - fix: bound the event MaxEventBytes names, and report the service's error events (fil-forge/swarf#18) (f796a42) - fix: report a failed firehose stream to the caller of the handler (fil-forge/swarf#19) (1778ec0) - fix: add recovery middleware (fil-forge/swarf#21) (cdba143) - feat(client): publish a batch of revocations in one request (0b2e5b2) - feat(client): publish a batch of revocations in one request (fil-forge/swarf#22) (4b2e2ae)
fil-forge-bot Bot
added a commit
to fil-forge/infra-central
that referenced
this pull request
Oct 13, 2026
Sets every prod pin in `terraform/envs/prod/apps/terraform.tfvars` to what `terraform/envs/staging/apps/terraform.tfvars` pins at c8d4687. Merging this is the promotion: Check and deploy applies `terraform/envs/prod/apps` on the merge commit, with no further confirmation. staging passed its smoke test on that commit in https://github.com/fil-forge/infra-central/actions/runs/38400369763. This pull request is rebuilt each time staging passes its smoke test after a push to `main`, and closed once prod matches staging. To hold a service back, push to `bot/promote-prod` by hand: the bot leaves the branch alone while this pull request is open. ## sprue `sha256:b6a4f84` → `sha256:79eb33d` What fil-forge/sprue brings over prod's pin, `de71035..9b40689`: - build(deps): bump the github-actions group across 1 directory with 6 updates (9531d9d) - build(deps): bump the github-actions group across 1 directory with 6 updates (fil-forge/sprue#83) (ab4a00d) - build(deps): bump the github-actions group with 5 updates (fil-forge/sprue#99) (bc827d0) - build(deps): bump github.com/aws/aws-sdk-go-v2 from 1.46.0 to 1.47.0 (fil-forge/sprue#100) (bb23dbe) - build(deps): bump github.com/aws/aws-sdk-go-v2/service/s3 from 1.112.0 to 1.113.1 (fil-forge/sprue#101) (42f78f7) - build(deps): bump golang.org/x/sync from 0.22.0 to 0.23.0 (fil-forge/sprue#103) (a17d3f4) - build(deps): bump github.com/olekukonko/tablewriter from 1.1.4 to 1.1.5 (fil-forge/sprue#104) (0723a79) - build(deps): bump github.com/aws/aws-sdk-go-v2/credentials from 1.20.3 to 1.20.5 (fil-forge/sprue#102) (b400abe) - build(deps): bump github.com/aws/aws-sdk-go-v2/config from 1.33.3 to 1.33.5 (fil-forge/sprue#105) (506f5f6) - feat: record upload counts (fil-forge/sprue#108) (289704a) - feat: implement metrics handler (fil-forge/sprue#107) (3ecddfd) - feat: add OTEL tracing (fil-forge/sprue#112) (dae68fb) - build(deps): bump the github-actions group with 5 updates (fil-forge/sprue#115) (9196de3) - build(deps): bump github.com/aws/aws-sdk-go-v2/service/s3 from 1.113.1 to 1.113.2 (fil-forge/sprue#116) (d73446d) - feat: concurrent event listeners (fil-forge/sprue#117) (c2cd80b) - Add /forge-perf: benchmark a pull request on forge-perf (fil-forge/sprue#118) (45d5331) - ci: call libforge workspace test workflow at ＠main (fil-forge/sprue#120) (c0f6b49) - Grant forge-perf's pr-run.yml pull-requests: write again (fil-forge/sprue#121) (2f1ec80) - feat: add upload count to metrics (fil-forge/sprue#119) (6b6e727) - feat: allow digest-less blob add (fil-forge/sprue#122) (04ea1db) - build(deps): bump github.com/aws/aws-sdk-go-v2/config from 1.33.5 to 1.33.6 (fil-forge/sprue#124) (67d7ba0) - build(deps): bump github.com/labstack/echo/v4 from 4.15.4 to 4.16.0 (fil-forge/sprue#127) (c99a3e1) - build(deps): bump github.com/aws/aws-sdk-go-v2/service/s3 from 1.113.2 to 1.113.4 (fil-forge/sprue#128) (052f95d) - feat: add timestamp to agent index table (fil-forge/sprue#129) (9b40689) ## hilt `sha256:3992eef` → `sha256:80076f3` What fil-forge/hilt brings over prod's pin, `9815d93..a026d16`: - feat: return error codes from the Tenant API (fil-forge/hilt#76) (14f6d84) - fix: delete bucket grants (fil-forge/hilt#78) (468abb1) - fix: add missing upload remove grant (fil-forge/hilt#79) (d716fd3) - feat: add async overhang (fil-forge/hilt#83) (87afacd) - fix: reject self issued invocations (fil-forge/hilt#81) (969e212) - feat: add OTEL tracing (fil-forge/hilt#88) (cbe41f1) - fix: add `/upload/remove` grant to bucket delete (fil-forge/hilt#90) (4ee3af8) - Add /forge-perf: benchmark a pull request on forge-perf (fil-forge/hilt#92) (22b905f) - Grant forge-perf's pr-run.yml pull-requests: write again (fil-forge/hilt#94) (19be980) - fix: catalog write grants (fil-forge/hilt#93) (d21578e) - feat: implement tenant metrics (fil-forge/hilt#91) (a026d16) ## swarf `sha256:1edd6ed` → `sha256:c364312` What fil-forge/swarf brings over prod's pin, `f286fb0..4b2e2ae`: - fix: bound the event MaxEventBytes names (edfa9a6) - fix: report the service's error events from swarf stream (16cf241) - fix: report a failed firehose stream to the caller of the handler (a033bcc) - fix: bound the event MaxEventBytes names, and report the service's error events (fil-forge/swarf#18) (f796a42) - fix: report a failed firehose stream to the caller of the handler (fil-forge/swarf#19) (1778ec0) - fix: add recovery middleware (fil-forge/swarf#21) (cdba143) - feat(client): publish a batch of revocations in one request (0b2e5b2) - feat(client): publish a batch of revocations in one request (fil-forge/swarf#22) (4b2e2ae)
fil-forge-bot Bot
added a commit
to fil-forge/infra-central
that referenced
this pull request
Oct 13, 2026
Sets every prod pin in `terraform/envs/prod/apps/terraform.tfvars` to what `terraform/envs/staging/apps/terraform.tfvars` pins at 14c562f. Merging this is the promotion: Check and deploy applies `terraform/envs/prod/apps` on the merge commit, with no further confirmation. staging passed its smoke test on that commit in https://github.com/fil-forge/infra-central/actions/runs/38400903396. This pull request is rebuilt each time staging passes its smoke test after a push to `main`, and closed once prod matches staging. To hold a service back, push to `bot/promote-prod` by hand: the bot leaves the branch alone while this pull request is open. ## sprue `sha256:b6a4f84` → `sha256:79eb33d` What fil-forge/sprue brings over prod's pin, `de71035..9b40689`: - build(deps): bump the github-actions group across 1 directory with 6 updates (9531d9d) - build(deps): bump the github-actions group across 1 directory with 6 updates (fil-forge/sprue#83) (ab4a00d) - build(deps): bump the github-actions group with 5 updates (fil-forge/sprue#99) (bc827d0) - build(deps): bump github.com/aws/aws-sdk-go-v2 from 1.46.0 to 1.47.0 (fil-forge/sprue#100) (bb23dbe) - build(deps): bump github.com/aws/aws-sdk-go-v2/service/s3 from 1.112.0 to 1.113.1 (fil-forge/sprue#101) (42f78f7) - build(deps): bump golang.org/x/sync from 0.22.0 to 0.23.0 (fil-forge/sprue#103) (a17d3f4) - build(deps): bump github.com/olekukonko/tablewriter from 1.1.4 to 1.1.5 (fil-forge/sprue#104) (0723a79) - build(deps): bump github.com/aws/aws-sdk-go-v2/credentials from 1.20.3 to 1.20.5 (fil-forge/sprue#102) (b400abe) - build(deps): bump github.com/aws/aws-sdk-go-v2/config from 1.33.3 to 1.33.5 (fil-forge/sprue#105) (506f5f6) - feat: record upload counts (fil-forge/sprue#108) (289704a) - feat: implement metrics handler (fil-forge/sprue#107) (3ecddfd) - feat: add OTEL tracing (fil-forge/sprue#112) (dae68fb) - build(deps): bump the github-actions group with 5 updates (fil-forge/sprue#115) (9196de3) - build(deps): bump github.com/aws/aws-sdk-go-v2/service/s3 from 1.113.1 to 1.113.2 (fil-forge/sprue#116) (d73446d) - feat: concurrent event listeners (fil-forge/sprue#117) (c2cd80b) - Add /forge-perf: benchmark a pull request on forge-perf (fil-forge/sprue#118) (45d5331) - ci: call libforge workspace test workflow at ＠main (fil-forge/sprue#120) (c0f6b49) - Grant forge-perf's pr-run.yml pull-requests: write again (fil-forge/sprue#121) (2f1ec80) - feat: add upload count to metrics (fil-forge/sprue#119) (6b6e727) - feat: allow digest-less blob add (fil-forge/sprue#122) (04ea1db) - build(deps): bump github.com/aws/aws-sdk-go-v2/config from 1.33.5 to 1.33.6 (fil-forge/sprue#124) (67d7ba0) - build(deps): bump github.com/labstack/echo/v4 from 4.15.4 to 4.16.0 (fil-forge/sprue#127) (c99a3e1) - build(deps): bump github.com/aws/aws-sdk-go-v2/service/s3 from 1.113.2 to 1.113.4 (fil-forge/sprue#128) (052f95d) - feat: add timestamp to agent index table (fil-forge/sprue#129) (9b40689) ## hilt `sha256:3992eef` → `sha256:80076f3` What fil-forge/hilt brings over prod's pin, `9815d93..a026d16`: - feat: return error codes from the Tenant API (fil-forge/hilt#76) (14f6d84) - fix: delete bucket grants (fil-forge/hilt#78) (468abb1) - fix: add missing upload remove grant (fil-forge/hilt#79) (d716fd3) - feat: add async overhang (fil-forge/hilt#83) (87afacd) - fix: reject self issued invocations (fil-forge/hilt#81) (969e212) - feat: add OTEL tracing (fil-forge/hilt#88) (cbe41f1) - fix: add `/upload/remove` grant to bucket delete (fil-forge/hilt#90) (4ee3af8) - Add /forge-perf: benchmark a pull request on forge-perf (fil-forge/hilt#92) (22b905f) - Grant forge-perf's pr-run.yml pull-requests: write again (fil-forge/hilt#94) (19be980) - fix: catalog write grants (fil-forge/hilt#93) (d21578e) - feat: implement tenant metrics (fil-forge/hilt#91) (a026d16) ## swarf `sha256:1edd6ed` → `sha256:c364312` What fil-forge/swarf brings over prod's pin, `f286fb0..4b2e2ae`: - fix: bound the event MaxEventBytes names (edfa9a6) - fix: report the service's error events from swarf stream (16cf241) - fix: report a failed firehose stream to the caller of the handler (a033bcc) - fix: bound the event MaxEventBytes names, and report the service's error events (fil-forge/swarf#18) (f796a42) - fix: report a failed firehose stream to the caller of the handler (fil-forge/swarf#19) (1778ec0) - fix: add recovery middleware (fil-forge/swarf#21) (cdba143) - feat(client): publish a batch of revocations in one request (0b2e5b2) - feat(client): publish a batch of revocations in one request (fil-forge/swarf#22) (4b2e2ae)
bajtos
pushed a commit
to fil-forge/infra-central
that referenced
this pull request
Oct 13, 2026
Sets every prod pin in `terraform/envs/prod/apps/terraform.tfvars` to what `terraform/envs/staging/apps/terraform.tfvars` pins at 14c562f. Merging this is the promotion: Check and deploy applies `terraform/envs/prod/apps` on the merge commit, with no further confirmation. staging passed its smoke test on that commit in https://github.com/fil-forge/infra-central/actions/runs/38400903396. This pull request is rebuilt each time staging passes its smoke test after a push to `main`, and closed once prod matches staging. To hold a service back, push to `bot/promote-prod` by hand: the bot leaves the branch alone while this pull request is open. ## sprue `sha256:b6a4f84` → `sha256:79eb33d` What fil-forge/sprue brings over prod's pin, `de71035..9b40689`: - build(deps): bump the github-actions group across 1 directory with 6 updates (9531d9d) - build(deps): bump the github-actions group across 1 directory with 6 updates (fil-forge/sprue#83) (ab4a00d) - build(deps): bump the github-actions group with 5 updates (fil-forge/sprue#99) (bc827d0) - build(deps): bump github.com/aws/aws-sdk-go-v2 from 1.46.0 to 1.47.0 (fil-forge/sprue#100) (bb23dbe) - build(deps): bump github.com/aws/aws-sdk-go-v2/service/s3 from 1.112.0 to 1.113.1 (fil-forge/sprue#101) (42f78f7) - build(deps): bump golang.org/x/sync from 0.22.0 to 0.23.0 (fil-forge/sprue#103) (a17d3f4) - build(deps): bump github.com/olekukonko/tablewriter from 1.1.4 to 1.1.5 (fil-forge/sprue#104) (0723a79) - build(deps): bump github.com/aws/aws-sdk-go-v2/credentials from 1.20.3 to 1.20.5 (fil-forge/sprue#102) (b400abe) - build(deps): bump github.com/aws/aws-sdk-go-v2/config from 1.33.3 to 1.33.5 (fil-forge/sprue#105) (506f5f6) - feat: record upload counts (fil-forge/sprue#108) (289704a) - feat: implement metrics handler (fil-forge/sprue#107) (3ecddfd) - feat: add OTEL tracing (fil-forge/sprue#112) (dae68fb) - build(deps): bump the github-actions group with 5 updates (fil-forge/sprue#115) (9196de3) - build(deps): bump github.com/aws/aws-sdk-go-v2/service/s3 from 1.113.1 to 1.113.2 (fil-forge/sprue#116) (d73446d) - feat: concurrent event listeners (fil-forge/sprue#117) (c2cd80b) - Add /forge-perf: benchmark a pull request on forge-perf (fil-forge/sprue#118) (45d5331) - ci: call libforge workspace test workflow at ＠main (fil-forge/sprue#120) (c0f6b49) - Grant forge-perf's pr-run.yml pull-requests: write again (fil-forge/sprue#121) (2f1ec80) - feat: add upload count to metrics (fil-forge/sprue#119) (6b6e727) - feat: allow digest-less blob add (fil-forge/sprue#122) (04ea1db) - build(deps): bump github.com/aws/aws-sdk-go-v2/config from 1.33.5 to 1.33.6 (fil-forge/sprue#124) (67d7ba0) - build(deps): bump github.com/labstack/echo/v4 from 4.15.4 to 4.16.0 (fil-forge/sprue#127) (c99a3e1) - build(deps): bump github.com/aws/aws-sdk-go-v2/service/s3 from 1.113.2 to 1.113.4 (fil-forge/sprue#128) (052f95d) - feat: add timestamp to agent index table (fil-forge/sprue#129) (9b40689) ## hilt `sha256:3992eef` → `sha256:80076f3` What fil-forge/hilt brings over prod's pin, `9815d93..a026d16`: - feat: return error codes from the Tenant API (fil-forge/hilt#76) (14f6d84) - fix: delete bucket grants (fil-forge/hilt#78) (468abb1) - fix: add missing upload remove grant (fil-forge/hilt#79) (d716fd3) - feat: add async overhang (fil-forge/hilt#83) (87afacd) - fix: reject self issued invocations (fil-forge/hilt#81) (969e212) - feat: add OTEL tracing (fil-forge/hilt#88) (cbe41f1) - fix: add `/upload/remove` grant to bucket delete (fil-forge/hilt#90) (4ee3af8) - Add /forge-perf: benchmark a pull request on forge-perf (fil-forge/hilt#92) (22b905f) - Grant forge-perf's pr-run.yml pull-requests: write again (fil-forge/hilt#94) (19be980) - fix: catalog write grants (fil-forge/hilt#93) (d21578e) - feat: implement tenant metrics (fil-forge/hilt#91) (a026d16) ## swarf `sha256:1edd6ed` → `sha256:c364312` What fil-forge/swarf brings over prod's pin, `f286fb0..4b2e2ae`: - fix: bound the event MaxEventBytes names (edfa9a6) - fix: report the service's error events from swarf stream (16cf241) - fix: report a failed firehose stream to the caller of the handler (a033bcc) - fix: bound the event MaxEventBytes names, and report the service's error events (fil-forge/swarf#18) (f796a42) - fix: report a failed firehose stream to the caller of the handler (fil-forge/swarf#19) (1778ec0) - fix: add recovery middleware (fil-forge/swarf#21) (cdba143) - feat(client): publish a batch of revocations in one request (0b2e5b2) - feat(client): publish a batch of revocations in one request (fil-forge/swarf#22) (4b2e2ae) Co-authored-by: fil-forge-bot[bot] <318653112+fil-forge-bot[bot]@users.noreply.github.com>
pyropy
added a commit
to fil-forge/hilt
that referenced
this pull request
Oct 14, 2026
Rotates a principal-bound key's delegations when its policies change and revokes them when the principal goes. Revocations go to Swarf in one request per write, and the gateway should drop its delagations from caches. - `grant.Rotator` (`Rotate`, `Revoke`), `PublishRevocations`, `BatchTimeout` - Delegation store `Replace` swaps several keys' sets in one transaction - One `RevocationPublisher` shared by key, bucket and policy writes - `testutil.FakeSwarf` - Temporary pin: swarf to fil-forge/swarf#22 (`PublishBatch`); re-pin before merge 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
RFC 30 (fil-one/RFC#30) has Hilt rotate a principal-bound key's delegations on every policy change and send every revocation produced by one write to Swarf in a single request, so a write waits on one round trip however many keys it touches. The client gains
PublishBatch, which builds one self-signed/ucan/revokeinvocation per revoked delegation and sends them in one container through ucantone'sExecuteBatch. Every receipt is checked; the first refused one fails the call. The service needs no change: a ucantone server already executes every invocation in a request container.Change log
pkg/client:PublishBatch(ctx, revoker, revoked []ucan.Delegation); the executor is the ucantone HTTP client so bothExecuteandExecuteBatchare available.go.mod: ucantone bumped tob59f1d1fcbb6forexecution/batch.TestPublishBatch(one request for two delegations, an empty batch publishes nothing, a refused revocation fails the call).🤖 Generated with Claude Code