supervaizer-v2-mvp-contracts - #47
Merged
Merged
Conversation
Qodo reviews are paused for this user.Troubleshooting steps vary by plan Learn more → On a Teams plan? Using GitHub Enterprise Server, GitLab Self-Managed, or Bitbucket Data Center? |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: ca2f4fd2c7
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
Comment on lines
+98
to
+99
| handler = _get_action_handlers(server).get(action_request.action) | ||
| if handler is None: |
There was a problem hiding this comment.
_dispatch_action resolves handlers only by action_request.action, so two agents on the same server that both expose common verbs like job.start will collide and the later registration overwrites the earlier one. Because V2ActionRequest includes agent_slug, dispatch should key by (agent_slug, action) (or equivalent per-agent namespace); otherwise multi-agent deployments can execute the wrong agent logic.
Useful? React with 👍 / 👎.
| data={"action": action_request.action, "error": str(exc)}, | ||
| ) | ||
|
|
||
| return JsonRpcResponse(id=request.id, result=result.model_dump(mode="json")) |
There was a problem hiding this comment.
The dispatcher always returns a JsonRpcResponse, including when request id is absent (None). In JSON-RPC 2.0, requests without id are notifications and must not receive a response body; returning one can break strict clients or intermediaries that treat notification replies as protocol violations. Add a notification path that executes handlers but returns no response payload.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 2eeeda728d
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
Comment on lines
72
to
+74
| if server.a2a_endpoints: | ||
| router.include_router(create_a2a_routes(server)) | ||
| router.include_router(create_controller_routes(server)) |
There was a problem hiding this comment.
create_public_router mounts create_controller_routes(server) on the public (unauthenticated) router, so POST /a2a is reachable without any API-key or scope checks even when /api endpoints are protected. Because this endpoint dispatches arbitrary registered v2 action handlers, unauthenticated callers can trigger job starts and other side effects that were previously gated behind write-scoped auth.
Useful? React with 👍 / 👎.
Comment on lines
+45
to
+46
| for queue in tuple(_event_subscribers(server)): | ||
| _enqueue_event(queue, payload) |
There was a problem hiding this comment.
publish_v2_event pushes each payload to every active subscriber queue, and there is no agent/workspace/request filtering in the stream path. In a multi-client server, any connected /a2a/events consumer can receive effects produced by other users' actions, which leaks cross-session job data and action outputs.
Useful? React with 👍 / 👎.
…rface, CLI, Parameter Validation, Persistence, Protocols, and REST API
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 00fd4479c0
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
Comment on lines
+114
to
115
| if isinstance(data, dict) and "dynamic_choices" in data: | ||
| raise ValueError( |
There was a problem hiding this comment.
This validator now raises whenever the dynamic_choices key exists, even if the value is null. Older agent payloads commonly serialized this field as dynamic_choices: null, so those persisted configs will now fail model validation despite not using dynamic choices anymore. Treating only non-null values as an error would preserve backward compatibility while still blocking the removed feature.
Useful? React with 👍 / 👎.
| response_model=Dict[str, Any], | ||
| ) | ||
| @handle_route_errors() | ||
| async def post_a2a_controller(body: Dict[str, Any]) -> Dict[str, Any]: |
There was a problem hiding this comment.
Typing the controller payload as Dict[str, Any] causes FastAPI to return HTTP 422 for any non-object JSON-RPC input (for example batch arrays), so those requests never reach dispatch_json_rpc and do not receive a JSON-RPC error response. Since this endpoint is advertised as JSON-RPC, request-shape errors should be handled in the dispatcher path rather than short-circuiting at framework validation.
Useful? React with 👍 / 👎.
from 2024-2025 to 2024-2026
Use modern typing in agent.py, keep server encrypted params internal, document deterministic agent ids, tighten A2A health status rules, drop legacy hello-world v2 input aliases, and clarify v2 contract fields.
- Introduced validation to reject agent methods using blocked module roots.- Added checks to ensure declared method paths are used in agent execution.- Enhanced v2 action results with replay safety metadata validation.- Updated changelog and documentation to reflect these changes.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 831d50d8de
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
Comment on lines
+106
to
+107
| code=JSON_RPC_INVALID_PARAMS, | ||
| message="Invalid JSON-RPC request", |
There was a problem hiding this comment.
Map request-envelope validation failures to JSON-RPC -32600 instead of -32602. The JsonRpcRequest.model_validate(...) branch handles malformed request objects (missing/invalid method, bad jsonrpc, etc.), which are protocol-level invalid requests; returning Invalid params can cause strict JSON-RPC clients to misclassify transport/protocol errors as method-parameter errors and apply incorrect retry/error handling.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: fc665097ef
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
Comment on lines
+742
to
+743
| if "dynamic_choices_callback" in kwargs: | ||
| raise ValueError( |
There was a problem hiding this comment.
This rejects any payload that includes a dynamic_choices_callback key, even when the value is explicitly None. Older controller factories and config-merging code often pass optional keys with null values, so these agents will now fail at startup despite not using dynamic choices at all. To preserve migration compatibility while still blocking the removed feature, this check should only raise when the provided value is non-null.
Useful? React with 👍 / 👎.
alain-sv
commented
May 17, 2026
alain-sv
left a comment
alain-sv
left a comment
Contributor
Author
There was a problem hiding this comment.
PR review: Supervaizer v2 MVP contracts
Risk: HIGH (large wire + transport surface) — mitigated by tests/docs; treat merge to develop as a Studio coordination event, not a silent additive release.
CI: All checks green on head fc66509.
Recommendation
OK to merge into develop with follow-ups documented below. Before main/PyPI, address auth on /a2a, PR description, and cross-repo consumer work.
Required follow-ups (before main/PyPI)
- Auth / trust model for
POST /a2a— JSON-RPC is on the public router with no API key; SSE requiresreadscope. Document network-trusted deployment or enforce the same auth as other write surfaces. - PR description — Breaking changes table, Studio dependency, rollout order.
- Cross-repo — Studio must consume
supervaizer/action.invoke,supervaizer/surface.load, SSE effects, andregistration_info["supervaizer_v2"]before agents ship v2-only payloads.
Breaking v1 contract changes (coordinate Studio + agents)
| Change | Impact |
|---|---|
AGENT_SEND_ANOMALY → agent.send_anomaly |
Event consumers keyed on the old duplicate value break |
Removed dynamic_choices + /start/dynamic_choices |
v1 dynamic-choice flows break |
Removed job_poll (validator rejects if present) |
Agents still registering job_poll fail at validation |
PR hygiene (non-blocking for develop)
- Squash 38 commits for reviewability before
main. - Remove duplicate MPL copyright headers (
agent.py,protocol/a2a/routes.py,tests/test_a2a.py,routers/public.py). - Large copyright-only churn in
deploy/*inflates diff stat.
Done well
- Contract-first, import-light
contracts.py+build_v2_agent_registration(). - Agent slug ↔ v2 registration guard; multi-agent
(agent_slug, action)handler keys. - Handler error sanitization;
job_state/replay_safetyvalidation; method-path allowlist. test_a2a.py+ contract fixtures;push_notifications: falsehonesty;docs/2026_05_SUPERVAIZER_v2.md.
Track for post-MVP
- SSE bus is in-process, lossy on queue overflow — document for Studio replay.
_execute_scheduled_methodstill bypassesAgent._executepath allowlist (pre-existing).- Version still
0.20.1.dev0— bump minor when advertising v2 on PyPI.
|
|
||
| if server.a2a_endpoints: | ||
| router.include_router(create_a2a_routes(server)) | ||
| router.include_router(create_controller_routes(server)) |
Contributor
Author
There was a problem hiding this comment.
[HIGH] Unauthenticated v2 controller surface
create_controller_routes is mounted on public_router, which is explicitly open (no X-API-Key / scopes). Anyone who can reach this URL can call POST /a2a and invoke registered v2 action handlers if they know the JSON-RPC payload shape.
GET /a2a/events is scoped (require_scope("read")), so auth is asymmetric.
For MVP on Tailscale/local: document as network-trusted only. Before internet-exposed controllers or PyPI release: add API-key (or equivalent) on POST /a2a, or move controller routes behind the authenticated API surface.
| response_model=dict[str, Any], | ||
| ) | ||
| @handle_route_errors() | ||
| async def post_a2a_controller(body: dict[str, Any]) -> dict[str, Any]: |
Contributor
Author
There was a problem hiding this comment.
[HIGH] Auth asymmetry
This endpoint has no Depends(require_scope(...)) while get_a2a_events below requires read. Studio may assume both transports share the same trust boundary — they do not today.
Consider aligning: either protect JSON-RPC the same way as SSE, or document that action invocation is intentionally public and must rely on network policy.
| AGENT_WAKEUP = "agent.wakeup" | ||
| AGENT_ANOMALY = "agent.anomaly" | ||
| AGENT_SEND_ANOMALY = "agent.anomaly" | ||
| AGENT_SEND_ANOMALY = "agent.send_anomaly" |
Contributor
Author
There was a problem hiding this comment.
[MEDIUM] Breaking event wire value
Previously AGENT_SEND_ANOMALY duplicated agent.anomaly; it is now agent.send_anomaly. Studio / webhook consumers matching the old string will miss events.
Call out in PR description and Studio migration notes.
|
|
||
| @model_validator(mode="before") | ||
| @classmethod | ||
| def reject_job_poll(cls, value: Any) -> Any: |
Contributor
Author
There was a problem hiding this comment.
[MEDIUM] Breaking v1 registration
Agents or Studio payloads that still include job_poll will fail validation. v2 status convergence is job.sync via A2A instead.
Ensure changelog + agent migration path is visible in the PR body (not only Unreleased changelog).
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 7d6dca7993
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| request = JsonRpcRequest.model_validate(body) | ||
| except ValidationError as exc: | ||
| return _json_rpc_error( | ||
| request_id=body.get("id"), |
There was a problem hiding this comment.
When request-envelope validation fails, this branch forwards body.get("id") directly into _json_rpc_error. If a client sends an invalid id type (for example an object/array), constructing JsonRpcResponse fails validation (id only allows str | int | None), so the endpoint raises and returns a server error instead of a JSON-RPC error. Coerce non-primitive ids to None before building the error response so malformed requests cannot crash dispatch.
Useful? React with 👍 / 👎.
| async def post_a2a_controller(body: dict[str, Any]) -> dict[str, Any]: | ||
| log.info("[A2A] POST /a2a [JSON-RPC controller]") | ||
| response = await dispatch_json_rpc(server, body) | ||
| return response.model_dump(mode="json", exclude_none=True) |
There was a problem hiding this comment.
id: null in JSON-RPC error envelopes
Serializing controller responses with exclude_none=True removes id when it is None. For invalid JSON-RPC requests (where the response id must be null), this emits an error object without an id member, which breaks strict JSON-RPC 2.0 clients that rely on the required id: null shape for protocol errors. Return the dumped response without stripping None for the top-level JSON-RPC envelope.
Useful? React with 👍 / 👎.
alain-sv
added a commit
that referenced
this pull request
May 17, 2026
* apply dependabot insights * minor * chore(ci): SHA-pin actions/checkout and actions/setup-python (#43) Pin all uses of actions/checkout@v6 and actions/setup-python@v6 to their commit SHAs across every workflow, closing the remaining floating-tag attack surface. - actions/checkout → de0fac2e (v6) - actions/setup-python → a309ff8b (v6) * docs(changelog): add unreleased dependency security refresh entry (#44) * chore(ci): add uv cache-suffix per Python version + update AGENTS.md facts (#46) Prevents parallel matrix jobs racing on the same Actions cache reservation. Also records two CI tooling facts in AGENTS.md. * supervaizer-v2-mvp-contracts (#47) * feat: add supervaizer v2 contract primitives * feat: add supervaizer v2 a2a action endpoint * feat: expose supervaizer v2 registration in a2a card * feat: add supervaizer v2 action decorator * docs: update supervaizer v2 changelog * precommit fix * refactor: move controller api version to contracts * minor * fix: scope v2 action handlers by agent * feat: guard supervaizer v2 agent identity * feat: include v2 job state in sync result * feat: add v2 resource form fields * feat: add v2 resource option sources * feat: add v2 awaiting form fields * feat: load supervaizer v2 surfaces over a2a * feat: expose local hello world v2 contract * feat: add v2 job source target type * feat: stream v2 action effects over a2a * fix: advertise v2 push notifications as unsupported * refactor: remove legacy dynamic choices * feat: complete local hello world v2 hitl flow * refactor: remove legacy job poll * docs: refresh generated contract docs * test: align v2 prompt editor fixture * test: align v2 contact import fixture * test: align v2 scenario builder fixture * test: align v2 overview fixture * test: align v2 campaign contact fixture * feat: add v2 registration builder * feat: type v2 dataset display metadata * minor * fix: precommit * feat: add comprehensive documentation for SUPERVAIZER API, Admin Interface, CLI, Parameter Validation, Persistence, Protocols, and REST API * minor * chore: change copyright dates from 2024-2025 to 2024-2026 * fix: harden agent model surface and v2 contract hygiene Use modern typing in agent.py, keep server encrypted params internal, document deterministic agent ids, tighten A2A health status rules, drop legacy hello-world v2 input aliases, and clarify v2 contract fields. * feat: enhance agent method validation and improve v2 action safety - Introduced validation to reject agent methods using blocked module roots.- Added checks to ensure declared method paths are used in agent execution.- Enhanced v2 action results with replay safety metadata validation.- Updated changelog and documentation to reflect these changes. * feat: add v2 resource import contracts * test: align v2 contract fixtures * minor * fix: require auth for a2a controller * minor * Minor
alain-sv
added a commit
that referenced
this pull request
May 17, 2026
* apply dependabot insights * minor * chore(ci): SHA-pin actions/checkout and actions/setup-python (#43) Pin all uses of actions/checkout@v6 and actions/setup-python@v6 to their commit SHAs across every workflow, closing the remaining floating-tag attack surface. - actions/checkout → de0fac2e (v6) - actions/setup-python → a309ff8b (v6) * docs(changelog): add unreleased dependency security refresh entry (#44) * chore(ci): add uv cache-suffix per Python version + update AGENTS.md facts (#46) Prevents parallel matrix jobs racing on the same Actions cache reservation. Also records two CI tooling facts in AGENTS.md. * supervaizer-v2-mvp-contracts (#47) * feat: add supervaizer v2 contract primitives * feat: add supervaizer v2 a2a action endpoint * feat: expose supervaizer v2 registration in a2a card * feat: add supervaizer v2 action decorator * docs: update supervaizer v2 changelog * precommit fix * refactor: move controller api version to contracts * minor * fix: scope v2 action handlers by agent * feat: guard supervaizer v2 agent identity * feat: include v2 job state in sync result * feat: add v2 resource form fields * feat: add v2 resource option sources * feat: add v2 awaiting form fields * feat: load supervaizer v2 surfaces over a2a * feat: expose local hello world v2 contract * feat: add v2 job source target type * feat: stream v2 action effects over a2a * fix: advertise v2 push notifications as unsupported * refactor: remove legacy dynamic choices * feat: complete local hello world v2 hitl flow * refactor: remove legacy job poll * docs: refresh generated contract docs * test: align v2 prompt editor fixture * test: align v2 contact import fixture * test: align v2 scenario builder fixture * test: align v2 overview fixture * test: align v2 campaign contact fixture * feat: add v2 registration builder * feat: type v2 dataset display metadata * minor * fix: precommit * feat: add comprehensive documentation for SUPERVAIZER API, Admin Interface, CLI, Parameter Validation, Persistence, Protocols, and REST API * minor * chore: change copyright dates from 2024-2025 to 2024-2026 * fix: harden agent model surface and v2 contract hygiene Use modern typing in agent.py, keep server encrypted params internal, document deterministic agent ids, tighten A2A health status rules, drop legacy hello-world v2 input aliases, and clarify v2 contract fields. * feat: enhance agent method validation and improve v2 action safety - Introduced validation to reject agent methods using blocked module roots.- Added checks to ensure declared method paths are used in agent execution.- Enhanced v2 action results with replay safety metadata validation.- Updated changelog and documentation to reflect these changes. * feat: add v2 resource import contracts * test: align v2 contract fixtures * minor * fix: require auth for a2a controller * minor * Minor * chore: update changelog for Supervaizer v2 enhancements and API key validation improvements - Added optional `metadata` field to `V2CaseSnapshot` for case-level context. - Implemented validation for Studio registration handshake to ensure API key consistency. - Enhanced server API key handling for stability during reloads. - Updated tests to cover new functionality and validation paths.
alain-sv
added a commit
that referenced
this pull request
May 19, 2026
* apply dependabot insights * minor * chore(ci): SHA-pin actions/checkout and actions/setup-python (#43) Pin all uses of actions/checkout@v6 and actions/setup-python@v6 to their commit SHAs across every workflow, closing the remaining floating-tag attack surface. - actions/checkout → de0fac2e (v6) - actions/setup-python → a309ff8b (v6) * docs(changelog): add unreleased dependency security refresh entry (#44) * chore(ci): add uv cache-suffix per Python version + update AGENTS.md facts (#46) Prevents parallel matrix jobs racing on the same Actions cache reservation. Also records two CI tooling facts in AGENTS.md. * supervaizer-v2-mvp-contracts (#47) * feat: add supervaizer v2 contract primitives * feat: add supervaizer v2 a2a action endpoint * feat: expose supervaizer v2 registration in a2a card * feat: add supervaizer v2 action decorator * docs: update supervaizer v2 changelog * precommit fix * refactor: move controller api version to contracts * minor * fix: scope v2 action handlers by agent * feat: guard supervaizer v2 agent identity * feat: include v2 job state in sync result * feat: add v2 resource form fields * feat: add v2 resource option sources * feat: add v2 awaiting form fields * feat: load supervaizer v2 surfaces over a2a * feat: expose local hello world v2 contract * feat: add v2 job source target type * feat: stream v2 action effects over a2a * fix: advertise v2 push notifications as unsupported * refactor: remove legacy dynamic choices * feat: complete local hello world v2 hitl flow * refactor: remove legacy job poll * docs: refresh generated contract docs * test: align v2 prompt editor fixture * test: align v2 contact import fixture * test: align v2 scenario builder fixture * test: align v2 overview fixture * test: align v2 campaign contact fixture * feat: add v2 registration builder * feat: type v2 dataset display metadata * minor * fix: precommit * feat: add comprehensive documentation for SUPERVAIZER API, Admin Interface, CLI, Parameter Validation, Persistence, Protocols, and REST API * minor * chore: change copyright dates from 2024-2025 to 2024-2026 * fix: harden agent model surface and v2 contract hygiene Use modern typing in agent.py, keep server encrypted params internal, document deterministic agent ids, tighten A2A health status rules, drop legacy hello-world v2 input aliases, and clarify v2 contract fields. * feat: enhance agent method validation and improve v2 action safety - Introduced validation to reject agent methods using blocked module roots.- Added checks to ensure declared method paths are used in agent execution.- Enhanced v2 action results with replay safety metadata validation.- Updated changelog and documentation to reflect these changes. * feat: add v2 resource import contracts * test: align v2 contract fixtures * minor * fix: require auth for a2a controller * minor * Minor * chore: update changelog for Supervaizer v2 enhancements and API key validation improvements - Added optional `metadata` field to `V2CaseSnapshot` for case-level context. - Implemented validation for Studio registration handshake to ensure API key consistency. - Enhanced server API key handling for stability during reloads. - Updated tests to cover new functionality and validation paths. * workspace-agent-grants (#50) * docs: plan workspace agent grants * docs: add Studio grant acceptance UX * feat: add workspace agent authorization * feat: add workspace binding protocol * fix: stabilize workspace authorization * ✨feat: add workspace auth helpers and use them in tests * ✨feat: require workspace auth and tighten agent checks * fix: require workspace auth for Studio A2A * fix: harden workspace authorization checks * fix: normalize malformed workspace auth inputs * minor
alain-sv
added a commit
that referenced
this pull request
May 20, 2026
* apply dependabot insights * minor * chore(ci): SHA-pin actions/checkout and actions/setup-python (#43) Pin all uses of actions/checkout@v6 and actions/setup-python@v6 to their commit SHAs across every workflow, closing the remaining floating-tag attack surface. - actions/checkout → de0fac2e (v6) - actions/setup-python → a309ff8b (v6) * docs(changelog): add unreleased dependency security refresh entry (#44) * chore(ci): add uv cache-suffix per Python version + update AGENTS.md facts (#46) Prevents parallel matrix jobs racing on the same Actions cache reservation. Also records two CI tooling facts in AGENTS.md. * supervaizer-v2-mvp-contracts (#47) * feat: add supervaizer v2 contract primitives * feat: add supervaizer v2 a2a action endpoint * feat: expose supervaizer v2 registration in a2a card * feat: add supervaizer v2 action decorator * docs: update supervaizer v2 changelog * precommit fix * refactor: move controller api version to contracts * minor * fix: scope v2 action handlers by agent * feat: guard supervaizer v2 agent identity * feat: include v2 job state in sync result * feat: add v2 resource form fields * feat: add v2 resource option sources * feat: add v2 awaiting form fields * feat: load supervaizer v2 surfaces over a2a * feat: expose local hello world v2 contract * feat: add v2 job source target type * feat: stream v2 action effects over a2a * fix: advertise v2 push notifications as unsupported * refactor: remove legacy dynamic choices * feat: complete local hello world v2 hitl flow * refactor: remove legacy job poll * docs: refresh generated contract docs * test: align v2 prompt editor fixture * test: align v2 contact import fixture * test: align v2 scenario builder fixture * test: align v2 overview fixture * test: align v2 campaign contact fixture * feat: add v2 registration builder * feat: type v2 dataset display metadata * minor * fix: precommit * feat: add comprehensive documentation for SUPERVAIZER API, Admin Interface, CLI, Parameter Validation, Persistence, Protocols, and REST API * minor * chore: change copyright dates from 2024-2025 to 2024-2026 * fix: harden agent model surface and v2 contract hygiene Use modern typing in agent.py, keep server encrypted params internal, document deterministic agent ids, tighten A2A health status rules, drop legacy hello-world v2 input aliases, and clarify v2 contract fields. * feat: enhance agent method validation and improve v2 action safety - Introduced validation to reject agent methods using blocked module roots.- Added checks to ensure declared method paths are used in agent execution.- Enhanced v2 action results with replay safety metadata validation.- Updated changelog and documentation to reflect these changes. * feat: add v2 resource import contracts * test: align v2 contract fixtures * minor * fix: require auth for a2a controller * minor * Minor * chore: update changelog for Supervaizer v2 enhancements and API key validation improvements - Added optional `metadata` field to `V2CaseSnapshot` for case-level context. - Implemented validation for Studio registration handshake to ensure API key consistency. - Enhanced server API key handling for stability during reloads. - Updated tests to cover new functionality and validation paths. * workspace-agent-grants (#50) * docs: plan workspace agent grants * docs: add Studio grant acceptance UX * feat: add workspace agent authorization * feat: add workspace binding protocol * fix: stabilize workspace authorization * ✨feat: add workspace auth helpers and use them in tests * ✨feat: require workspace auth and tighten agent checks * fix: require workspace auth for Studio A2A * fix: harden workspace authorization checks * fix: normalize malformed workspace auth inputs * minor * feat(logging): implement structured logging for Cloud Logging compatibility - Added support for newline-delimited JSON logging when `SUPERVAIZER_LOG_FORMAT=json` is set. - Updated logging configuration to allow structured logs for access-denial events. - Enhanced `log_access_denied_api` and `log_access_denied_tailscale` functions to include structured fields. - Added tests to verify structured logging outputs in `tests/test_common.py`.
alain-sv
added a commit
that referenced
this pull request
May 26, 2026
* apply dependabot insights * minor * chore(ci): SHA-pin actions/checkout and actions/setup-python (#43) Pin all uses of actions/checkout@v6 and actions/setup-python@v6 to their commit SHAs across every workflow, closing the remaining floating-tag attack surface. - actions/checkout → de0fac2e (v6) - actions/setup-python → a309ff8b (v6) * docs(changelog): add unreleased dependency security refresh entry (#44) * chore(ci): add uv cache-suffix per Python version + update AGENTS.md facts (#46) Prevents parallel matrix jobs racing on the same Actions cache reservation. Also records two CI tooling facts in AGENTS.md. * supervaizer-v2-mvp-contracts (#47) * feat: add supervaizer v2 contract primitives * feat: add supervaizer v2 a2a action endpoint * feat: expose supervaizer v2 registration in a2a card * feat: add supervaizer v2 action decorator * docs: update supervaizer v2 changelog * precommit fix * refactor: move controller api version to contracts * minor * fix: scope v2 action handlers by agent * feat: guard supervaizer v2 agent identity * feat: include v2 job state in sync result * feat: add v2 resource form fields * feat: add v2 resource option sources * feat: add v2 awaiting form fields * feat: load supervaizer v2 surfaces over a2a * feat: expose local hello world v2 contract * feat: add v2 job source target type * feat: stream v2 action effects over a2a * fix: advertise v2 push notifications as unsupported * refactor: remove legacy dynamic choices * feat: complete local hello world v2 hitl flow * refactor: remove legacy job poll * docs: refresh generated contract docs * test: align v2 prompt editor fixture * test: align v2 contact import fixture * test: align v2 scenario builder fixture * test: align v2 overview fixture * test: align v2 campaign contact fixture * feat: add v2 registration builder * feat: type v2 dataset display metadata * minor * fix: precommit * feat: add comprehensive documentation for SUPERVAIZER API, Admin Interface, CLI, Parameter Validation, Persistence, Protocols, and REST API * minor * chore: change copyright dates from 2024-2025 to 2024-2026 * fix: harden agent model surface and v2 contract hygiene Use modern typing in agent.py, keep server encrypted params internal, document deterministic agent ids, tighten A2A health status rules, drop legacy hello-world v2 input aliases, and clarify v2 contract fields. * feat: enhance agent method validation and improve v2 action safety - Introduced validation to reject agent methods using blocked module roots.- Added checks to ensure declared method paths are used in agent execution.- Enhanced v2 action results with replay safety metadata validation.- Updated changelog and documentation to reflect these changes. * feat: add v2 resource import contracts * test: align v2 contract fixtures * minor * fix: require auth for a2a controller * minor * Minor * chore: update changelog for Supervaizer v2 enhancements and API key validation improvements - Added optional `metadata` field to `V2CaseSnapshot` for case-level context. - Implemented validation for Studio registration handshake to ensure API key consistency. - Enhanced server API key handling for stability during reloads. - Updated tests to cover new functionality and validation paths. * workspace-agent-grants (#50) * docs: plan workspace agent grants * docs: add Studio grant acceptance UX * feat: add workspace agent authorization * feat: add workspace binding protocol * fix: stabilize workspace authorization * ✨feat: add workspace auth helpers and use them in tests * ✨feat: require workspace auth and tighten agent checks * fix: require workspace auth for Studio A2A * fix: harden workspace authorization checks * fix: normalize malformed workspace auth inputs * minor * feat(logging): implement structured logging for Cloud Logging compatibility - Added support for newline-delimited JSON logging when `SUPERVAIZER_LOG_FORMAT=json` is set. - Updated logging configuration to allow structured logs for access-denial events. - Enhanced `log_access_denied_api` and `log_access_denied_tailscale` functions to include structured fields. - Added tests to verify structured logging outputs in `tests/test_common.py`. * Minor * codex/supervaizer-lifespan-cleanup (#54) * Clean up Supervaizer lifespan shutdown * Document Supervaizer import placement rule * Fix lifespan cleanup test determinism * Address lifespan shutdown review feedback * ✨feat: rename test and assert scheduled step task * ✨ feat: update GitNexus index counts in AGENTS.md * codex/refactor-server-modules (#55) * Refactor Supervaizer server modules * ✨ feat: update GitNexus index stats in AGENTS.md * ✨docs update changelog AGENTS guidance * ✨feat: add v2 methods, tests and license header * minor * codex/agent-interviewer-workspace-jobs-refresh (#56) * Clean up Supervaizer lifespan shutdown * Document Supervaizer import placement rule * Fix lifespan cleanup test determinism * Address lifespan shutdown review feedback * ✨feat: rename test and assert scheduled step task * ✨ feat: update GitNexus index counts in AGENTS.md * feat(v2): add agent action methods * Refactor pre-commit configuration and enhance agent validation - Updated mypy hook to use project-specific configuration for consistency with uv.lock. - Improved validation for v2_registration and v2_method_declarations in Agent class to ensure proper type handling. - Enhanced logging configuration to cast message records for structured logging compatibility.
alain-sv
added a commit
that referenced
this pull request
Jul 2, 2026
* apply dependabot insights * minor * chore(ci): SHA-pin actions/checkout and actions/setup-python (#43) Pin all uses of actions/checkout@v6 and actions/setup-python@v6 to their commit SHAs across every workflow, closing the remaining floating-tag attack surface. - actions/checkout → de0fac2e (v6) - actions/setup-python → a309ff8b (v6) * docs(changelog): add unreleased dependency security refresh entry (#44) * chore(ci): add uv cache-suffix per Python version + update AGENTS.md facts (#46) Prevents parallel matrix jobs racing on the same Actions cache reservation. Also records two CI tooling facts in AGENTS.md. * supervaizer-v2-mvp-contracts (#47) * feat: add supervaizer v2 contract primitives * feat: add supervaizer v2 a2a action endpoint * feat: expose supervaizer v2 registration in a2a card * feat: add supervaizer v2 action decorator * docs: update supervaizer v2 changelog * precommit fix * refactor: move controller api version to contracts * minor * fix: scope v2 action handlers by agent * feat: guard supervaizer v2 agent identity * feat: include v2 job state in sync result * feat: add v2 resource form fields * feat: add v2 resource option sources * feat: add v2 awaiting form fields * feat: load supervaizer v2 surfaces over a2a * feat: expose local hello world v2 contract * feat: add v2 job source target type * feat: stream v2 action effects over a2a * fix: advertise v2 push notifications as unsupported * refactor: remove legacy dynamic choices * feat: complete local hello world v2 hitl flow * refactor: remove legacy job poll * docs: refresh generated contract docs * test: align v2 prompt editor fixture * test: align v2 contact import fixture * test: align v2 scenario builder fixture * test: align v2 overview fixture * test: align v2 campaign contact fixture * feat: add v2 registration builder * feat: type v2 dataset display metadata * minor * fix: precommit * feat: add comprehensive documentation for SUPERVAIZER API, Admin Interface, CLI, Parameter Validation, Persistence, Protocols, and REST API * minor * chore: change copyright dates from 2024-2025 to 2024-2026 * fix: harden agent model surface and v2 contract hygiene Use modern typing in agent.py, keep server encrypted params internal, document deterministic agent ids, tighten A2A health status rules, drop legacy hello-world v2 input aliases, and clarify v2 contract fields. * feat: enhance agent method validation and improve v2 action safety - Introduced validation to reject agent methods using blocked module roots.- Added checks to ensure declared method paths are used in agent execution.- Enhanced v2 action results with replay safety metadata validation.- Updated changelog and documentation to reflect these changes. * feat: add v2 resource import contracts * test: align v2 contract fixtures * minor * fix: require auth for a2a controller * minor * Minor * chore: update changelog for Supervaizer v2 enhancements and API key validation improvements - Added optional `metadata` field to `V2CaseSnapshot` for case-level context. - Implemented validation for Studio registration handshake to ensure API key consistency. - Enhanced server API key handling for stability during reloads. - Updated tests to cover new functionality and validation paths. * workspace-agent-grants (#50) * docs: plan workspace agent grants * docs: add Studio grant acceptance UX * feat: add workspace agent authorization * feat: add workspace binding protocol * fix: stabilize workspace authorization * ✨feat: add workspace auth helpers and use them in tests * ✨feat: require workspace auth and tighten agent checks * fix: require workspace auth for Studio A2A * fix: harden workspace authorization checks * fix: normalize malformed workspace auth inputs * minor * feat(logging): implement structured logging for Cloud Logging compatibility - Added support for newline-delimited JSON logging when `SUPERVAIZER_LOG_FORMAT=json` is set. - Updated logging configuration to allow structured logs for access-denial events. - Enhanced `log_access_denied_api` and `log_access_denied_tailscale` functions to include structured fields. - Added tests to verify structured logging outputs in `tests/test_common.py`. * Minor * codex/supervaizer-lifespan-cleanup (#54) * Clean up Supervaizer lifespan shutdown * Document Supervaizer import placement rule * Fix lifespan cleanup test determinism * Address lifespan shutdown review feedback * ✨feat: rename test and assert scheduled step task * ✨ feat: update GitNexus index counts in AGENTS.md * codex/refactor-server-modules (#55) * Refactor Supervaizer server modules * ✨ feat: update GitNexus index stats in AGENTS.md * ✨docs update changelog AGENTS guidance * ✨feat: add v2 methods, tests and license header * minor * codex/agent-interviewer-workspace-jobs-refresh (#56) * Clean up Supervaizer lifespan shutdown * Document Supervaizer import placement rule * Fix lifespan cleanup test determinism * Address lifespan shutdown review feedback * ✨feat: rename test and assert scheduled step task * ✨ feat: update GitNexus index counts in AGENTS.md * feat(v2): add agent action methods * Refactor pre-commit configuration and enhance agent validation - Updated mypy hook to use project-specific configuration for consistency with uv.lock. - Improved validation for v2_registration and v2_method_declarations in Agent class to ensure proper type handling. - Enhanced logging configuration to cast message records for structured logging compatibility. * chore(deps): bump uv from 0.11.14 to 0.11.15 (#58) Bumps [uv](https://github.com/astral-sh/uv) from 0.11.14 to 0.11.15. - [Release notes](https://github.com/astral-sh/uv/releases) - [Changelog](https://github.com/astral-sh/uv/blob/main/CHANGELOG.md) - [Commits](astral-sh/uv@0.11.14...0.11.15) --- updated-dependencies: - dependency-name: uv dependency-version: 0.11.15 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump starlette from 0.50.0 to 1.0.1 (#60) Bumps [starlette](https://github.com/Kludex/starlette) from 0.50.0 to 1.0.1. - [Release notes](https://github.com/Kludex/starlette/releases) - [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md) - [Commits](Kludex/starlette@0.50.0...1.0.1) --- updated-dependencies: - dependency-name: starlette dependency-version: 1.0.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump trufflesecurity/trufflehog from 3.95.3 to 3.95.5 (#61) Bumps [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog) from 3.95.3 to 3.95.5. - [Release notes](https://github.com/trufflesecurity/trufflehog/releases) - [Commits](trufflesecurity/trufflehog@37b7700...d411fff) --- updated-dependencies: - dependency-name: trufflesecurity/trufflehog dependency-version: 3.95.5 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * feat(.agents): add skill symlinks from runwaize skills cookbook Add 21 skill symlinks under .agents/skills/ pointing to the local runwaize_skills_cookbook installation, covering cloud-run basics, Pulumi migration/tooling skills (terraform, CDK, ARM, ESC, component, automation-api, upgrade-provider, best-practices, neo-handoff), Google Cloud WAF pillars (security, reliability, performance, cost-optimization, operational-excellence), google-cloud-recipe-auth, google-cloud-networking-observability, cloudformation-to-pulumi, package-usage, provider-upgrade, and upstream-patches. Update AGENTS.md GitNexus index stats to reflect the current index (6273 symbols, 11483 relationships, 281 execution flows). * chore(deps): bump astral-sh/setup-uv from 8.1.0 to 8.2.0 (#62) Bumps [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) from 8.1.0 to 8.2.0. - [Release notes](https://github.com/astral-sh/setup-uv/releases) - [Commits](astral-sh/setup-uv@0880764...fac544c) --- updated-dependencies: - dependency-name: astral-sh/setup-uv dependency-version: 8.2.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump actions/checkout from 6.0.2 to 6.0.3 (#63) Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.2 to 6.0.3. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@de0fac2...df4cb1c) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 6.0.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump starlette from 1.0.1 to 1.3.1 (#66) Bumps [starlette](https://github.com/Kludex/starlette) from 1.0.1 to 1.3.1. - [Release notes](https://github.com/Kludex/starlette/releases) - [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md) - [Commits](Kludex/starlette@1.0.1...1.3.1) --- updated-dependencies: - dependency-name: starlette dependency-version: 1.3.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump cryptography from 48.0.0 to 48.0.1 (#67) Bumps [cryptography](https://github.com/pyca/cryptography) from 48.0.0 to 48.0.1. - [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst) - [Commits](pyca/cryptography@48.0.0...48.0.1) --- updated-dependencies: - dependency-name: cryptography dependency-version: 48.0.1 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump actions/checkout from 6.0.3 to 7.0.0 (#68) Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.3 to 7.0.0. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@df4cb1c...9c091bb) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump softprops/action-gh-release from 3.0.0 to 3.0.1 (#69) Bumps [softprops/action-gh-release](https://github.com/softprops/action-gh-release) from 3.0.0 to 3.0.1. - [Release notes](https://github.com/softprops/action-gh-release/releases) - [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md) - [Commits](softprops/action-gh-release@b430933...718ea10) --- updated-dependencies: - dependency-name: softprops/action-gh-release dependency-version: 3.0.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump trufflesecurity/trufflehog from 3.95.5 to 3.95.6 (#70) Bumps [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog) from 3.95.5 to 3.95.6. - [Release notes](https://github.com/trufflesecurity/trufflehog/releases) - [Commits](trufflesecurity/trufflehog@d411fff...30d5bb9) --- updated-dependencies: - dependency-name: trufflesecurity/trufflehog dependency-version: 3.95.6 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * codex/managed-context-sdk (#65) * feat: add managed context SDK client * ✨ feat: update gitn docs to use local run.cjs and paginate list_repos * ✨ feat: add MPLv2 license headers to module and test files * fix: address managed context review feedback * ✨ feat(contracts): add V2ContextAssignment for context.assign (#71) * ✨ feat(contracts): add V2ContextAssignment for context.assign * ✨ feat(contracts): constrain context scope and document assignment semantics Address PR #71 review: V2ContextAssignmentItem.scope is now Literal["workspace", "mission"] (matching other closed v2 vocabularies) with a ValidationError regression test, and the v2 doc gains explicit context.assign semantics: refs-not-content payload, freeze-on-pull with provenance, mandatory fetched-vs-assigned version check that fails the assignment on mismatch, and no live context reads during execution. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * 🐛 fix(contracts): require mission_id for mission-scoped context assignments Address PR #71 follow-up review: a V2ContextAssignment containing scope="mission" items but no mission_id passed validation while the agent-side ContextClient.open() would have no mission context to fetch with. A model_validator now rejects that combination; workspace-only assignments still allow a null mission_id. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * 🐛 fix(contracts): reject whitespace-only mission_id for mission-scoped assignments Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
alain-sv
added a commit
that referenced
this pull request
Jul 2, 2026
* apply dependabot insights * minor * chore(ci): SHA-pin actions/checkout and actions/setup-python (#43) Pin all uses of actions/checkout@v6 and actions/setup-python@v6 to their commit SHAs across every workflow, closing the remaining floating-tag attack surface. - actions/checkout → de0fac2e (v6) - actions/setup-python → a309ff8b (v6) * docs(changelog): add unreleased dependency security refresh entry (#44) * chore(ci): add uv cache-suffix per Python version + update AGENTS.md facts (#46) Prevents parallel matrix jobs racing on the same Actions cache reservation. Also records two CI tooling facts in AGENTS.md. * supervaizer-v2-mvp-contracts (#47) * feat: add supervaizer v2 contract primitives * feat: add supervaizer v2 a2a action endpoint * feat: expose supervaizer v2 registration in a2a card * feat: add supervaizer v2 action decorator * docs: update supervaizer v2 changelog * precommit fix * refactor: move controller api version to contracts * minor * fix: scope v2 action handlers by agent * feat: guard supervaizer v2 agent identity * feat: include v2 job state in sync result * feat: add v2 resource form fields * feat: add v2 resource option sources * feat: add v2 awaiting form fields * feat: load supervaizer v2 surfaces over a2a * feat: expose local hello world v2 contract * feat: add v2 job source target type * feat: stream v2 action effects over a2a * fix: advertise v2 push notifications as unsupported * refactor: remove legacy dynamic choices * feat: complete local hello world v2 hitl flow * refactor: remove legacy job poll * docs: refresh generated contract docs * test: align v2 prompt editor fixture * test: align v2 contact import fixture * test: align v2 scenario builder fixture * test: align v2 overview fixture * test: align v2 campaign contact fixture * feat: add v2 registration builder * feat: type v2 dataset display metadata * minor * fix: precommit * feat: add comprehensive documentation for SUPERVAIZER API, Admin Interface, CLI, Parameter Validation, Persistence, Protocols, and REST API * minor * chore: change copyright dates from 2024-2025 to 2024-2026 * fix: harden agent model surface and v2 contract hygiene Use modern typing in agent.py, keep server encrypted params internal, document deterministic agent ids, tighten A2A health status rules, drop legacy hello-world v2 input aliases, and clarify v2 contract fields. * feat: enhance agent method validation and improve v2 action safety - Introduced validation to reject agent methods using blocked module roots.- Added checks to ensure declared method paths are used in agent execution.- Enhanced v2 action results with replay safety metadata validation.- Updated changelog and documentation to reflect these changes. * feat: add v2 resource import contracts * test: align v2 contract fixtures * minor * fix: require auth for a2a controller * minor * Minor * chore: update changelog for Supervaizer v2 enhancements and API key validation improvements - Added optional `metadata` field to `V2CaseSnapshot` for case-level context. - Implemented validation for Studio registration handshake to ensure API key consistency. - Enhanced server API key handling for stability during reloads. - Updated tests to cover new functionality and validation paths. * workspace-agent-grants (#50) * docs: plan workspace agent grants * docs: add Studio grant acceptance UX * feat: add workspace agent authorization * feat: add workspace binding protocol * fix: stabilize workspace authorization * ✨feat: add workspace auth helpers and use them in tests * ✨feat: require workspace auth and tighten agent checks * fix: require workspace auth for Studio A2A * fix: harden workspace authorization checks * fix: normalize malformed workspace auth inputs * minor * feat(logging): implement structured logging for Cloud Logging compatibility - Added support for newline-delimited JSON logging when `SUPERVAIZER_LOG_FORMAT=json` is set. - Updated logging configuration to allow structured logs for access-denial events. - Enhanced `log_access_denied_api` and `log_access_denied_tailscale` functions to include structured fields. - Added tests to verify structured logging outputs in `tests/test_common.py`. * Minor * codex/supervaizer-lifespan-cleanup (#54) * Clean up Supervaizer lifespan shutdown * Document Supervaizer import placement rule * Fix lifespan cleanup test determinism * Address lifespan shutdown review feedback * ✨feat: rename test and assert scheduled step task * ✨ feat: update GitNexus index counts in AGENTS.md * codex/refactor-server-modules (#55) * Refactor Supervaizer server modules * ✨ feat: update GitNexus index stats in AGENTS.md * ✨docs update changelog AGENTS guidance * ✨feat: add v2 methods, tests and license header * minor * codex/agent-interviewer-workspace-jobs-refresh (#56) * Clean up Supervaizer lifespan shutdown * Document Supervaizer import placement rule * Fix lifespan cleanup test determinism * Address lifespan shutdown review feedback * ✨feat: rename test and assert scheduled step task * ✨ feat: update GitNexus index counts in AGENTS.md * feat(v2): add agent action methods * Refactor pre-commit configuration and enhance agent validation - Updated mypy hook to use project-specific configuration for consistency with uv.lock. - Improved validation for v2_registration and v2_method_declarations in Agent class to ensure proper type handling. - Enhanced logging configuration to cast message records for structured logging compatibility. * chore(deps): bump uv from 0.11.14 to 0.11.15 (#58) Bumps [uv](https://github.com/astral-sh/uv) from 0.11.14 to 0.11.15. - [Release notes](https://github.com/astral-sh/uv/releases) - [Changelog](https://github.com/astral-sh/uv/blob/main/CHANGELOG.md) - [Commits](astral-sh/uv@0.11.14...0.11.15) --- updated-dependencies: - dependency-name: uv dependency-version: 0.11.15 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump starlette from 0.50.0 to 1.0.1 (#60) Bumps [starlette](https://github.com/Kludex/starlette) from 0.50.0 to 1.0.1. - [Release notes](https://github.com/Kludex/starlette/releases) - [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md) - [Commits](Kludex/starlette@0.50.0...1.0.1) --- updated-dependencies: - dependency-name: starlette dependency-version: 1.0.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump trufflesecurity/trufflehog from 3.95.3 to 3.95.5 (#61) Bumps [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog) from 3.95.3 to 3.95.5. - [Release notes](https://github.com/trufflesecurity/trufflehog/releases) - [Commits](trufflesecurity/trufflehog@37b7700...d411fff) --- updated-dependencies: - dependency-name: trufflesecurity/trufflehog dependency-version: 3.95.5 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * feat(.agents): add skill symlinks from runwaize skills cookbook Add 21 skill symlinks under .agents/skills/ pointing to the local runwaize_skills_cookbook installation, covering cloud-run basics, Pulumi migration/tooling skills (terraform, CDK, ARM, ESC, component, automation-api, upgrade-provider, best-practices, neo-handoff), Google Cloud WAF pillars (security, reliability, performance, cost-optimization, operational-excellence), google-cloud-recipe-auth, google-cloud-networking-observability, cloudformation-to-pulumi, package-usage, provider-upgrade, and upstream-patches. Update AGENTS.md GitNexus index stats to reflect the current index (6273 symbols, 11483 relationships, 281 execution flows). * chore(deps): bump astral-sh/setup-uv from 8.1.0 to 8.2.0 (#62) Bumps [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) from 8.1.0 to 8.2.0. - [Release notes](https://github.com/astral-sh/setup-uv/releases) - [Commits](astral-sh/setup-uv@0880764...fac544c) --- updated-dependencies: - dependency-name: astral-sh/setup-uv dependency-version: 8.2.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump actions/checkout from 6.0.2 to 6.0.3 (#63) Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.2 to 6.0.3. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@de0fac2...df4cb1c) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 6.0.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump starlette from 1.0.1 to 1.3.1 (#66) Bumps [starlette](https://github.com/Kludex/starlette) from 1.0.1 to 1.3.1. - [Release notes](https://github.com/Kludex/starlette/releases) - [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md) - [Commits](Kludex/starlette@1.0.1...1.3.1) --- updated-dependencies: - dependency-name: starlette dependency-version: 1.3.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump cryptography from 48.0.0 to 48.0.1 (#67) Bumps [cryptography](https://github.com/pyca/cryptography) from 48.0.0 to 48.0.1. - [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst) - [Commits](pyca/cryptography@48.0.0...48.0.1) --- updated-dependencies: - dependency-name: cryptography dependency-version: 48.0.1 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump actions/checkout from 6.0.3 to 7.0.0 (#68) Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.3 to 7.0.0. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@df4cb1c...9c091bb) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump softprops/action-gh-release from 3.0.0 to 3.0.1 (#69) Bumps [softprops/action-gh-release](https://github.com/softprops/action-gh-release) from 3.0.0 to 3.0.1. - [Release notes](https://github.com/softprops/action-gh-release/releases) - [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md) - [Commits](softprops/action-gh-release@b430933...718ea10) --- updated-dependencies: - dependency-name: softprops/action-gh-release dependency-version: 3.0.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump trufflesecurity/trufflehog from 3.95.5 to 3.95.6 (#70) Bumps [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog) from 3.95.5 to 3.95.6. - [Release notes](https://github.com/trufflesecurity/trufflehog/releases) - [Commits](trufflesecurity/trufflehog@d411fff...30d5bb9) --- updated-dependencies: - dependency-name: trufflesecurity/trufflehog dependency-version: 3.95.6 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * codex/managed-context-sdk (#65) * feat: add managed context SDK client * ✨ feat: update gitn docs to use local run.cjs and paginate list_repos * ✨ feat: add MPLv2 license headers to module and test files * fix: address managed context review feedback * ✨ feat(contracts): add V2ContextAssignment for context.assign (#71) * ✨ feat(contracts): add V2ContextAssignment for context.assign * ✨ feat(contracts): constrain context scope and document assignment semantics Address PR #71 review: V2ContextAssignmentItem.scope is now Literal["workspace", "mission"] (matching other closed v2 vocabularies) with a ValidationError regression test, and the v2 doc gains explicit context.assign semantics: refs-not-content payload, freeze-on-pull with provenance, mandatory fetched-vs-assigned version check that fails the assignment on mismatch, and no live context reads during execution. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * 🐛 fix(contracts): require mission_id for mission-scoped context assignments Address PR #71 follow-up review: a V2ContextAssignment containing scope="mission" items but no mission_id passed validation while the agent-side ContextClient.open() would have no mission context to fetch with. A model_validator now rejects that combination; workspace-only assignments still allow a null mission_id. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * 🐛 fix(contracts): reject whitespace-only mission_id for mission-scoped assignments Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com> * feat: bump version to1.3.0 and update deps; iterate nested (#73) * fix versions --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
alain-sv
added a commit
that referenced
this pull request
Jul 7, 2026
* apply dependabot insights * minor * chore(ci): SHA-pin actions/checkout and actions/setup-python (#43) Pin all uses of actions/checkout@v6 and actions/setup-python@v6 to their commit SHAs across every workflow, closing the remaining floating-tag attack surface. - actions/checkout → de0fac2e (v6) - actions/setup-python → a309ff8b (v6) * docs(changelog): add unreleased dependency security refresh entry (#44) * chore(ci): add uv cache-suffix per Python version + update AGENTS.md facts (#46) Prevents parallel matrix jobs racing on the same Actions cache reservation. Also records two CI tooling facts in AGENTS.md. * supervaizer-v2-mvp-contracts (#47) * feat: add supervaizer v2 contract primitives * feat: add supervaizer v2 a2a action endpoint * feat: expose supervaizer v2 registration in a2a card * feat: add supervaizer v2 action decorator * docs: update supervaizer v2 changelog * precommit fix * refactor: move controller api version to contracts * minor * fix: scope v2 action handlers by agent * feat: guard supervaizer v2 agent identity * feat: include v2 job state in sync result * feat: add v2 resource form fields * feat: add v2 resource option sources * feat: add v2 awaiting form fields * feat: load supervaizer v2 surfaces over a2a * feat: expose local hello world v2 contract * feat: add v2 job source target type * feat: stream v2 action effects over a2a * fix: advertise v2 push notifications as unsupported * refactor: remove legacy dynamic choices * feat: complete local hello world v2 hitl flow * refactor: remove legacy job poll * docs: refresh generated contract docs * test: align v2 prompt editor fixture * test: align v2 contact import fixture * test: align v2 scenario builder fixture * test: align v2 overview fixture * test: align v2 campaign contact fixture * feat: add v2 registration builder * feat: type v2 dataset display metadata * minor * fix: precommit * feat: add comprehensive documentation for SUPERVAIZER API, Admin Interface, CLI, Parameter Validation, Persistence, Protocols, and REST API * minor * chore: change copyright dates from 2024-2025 to 2024-2026 * fix: harden agent model surface and v2 contract hygiene Use modern typing in agent.py, keep server encrypted params internal, document deterministic agent ids, tighten A2A health status rules, drop legacy hello-world v2 input aliases, and clarify v2 contract fields. * feat: enhance agent method validation and improve v2 action safety - Introduced validation to reject agent methods using blocked module roots.- Added checks to ensure declared method paths are used in agent execution.- Enhanced v2 action results with replay safety metadata validation.- Updated changelog and documentation to reflect these changes. * feat: add v2 resource import contracts * test: align v2 contract fixtures * minor * fix: require auth for a2a controller * minor * Minor * chore: update changelog for Supervaizer v2 enhancements and API key validation improvements - Added optional `metadata` field to `V2CaseSnapshot` for case-level context. - Implemented validation for Studio registration handshake to ensure API key consistency. - Enhanced server API key handling for stability during reloads. - Updated tests to cover new functionality and validation paths. * workspace-agent-grants (#50) * docs: plan workspace agent grants * docs: add Studio grant acceptance UX * feat: add workspace agent authorization * feat: add workspace binding protocol * fix: stabilize workspace authorization * ✨feat: add workspace auth helpers and use them in tests * ✨feat: require workspace auth and tighten agent checks * fix: require workspace auth for Studio A2A * fix: harden workspace authorization checks * fix: normalize malformed workspace auth inputs * minor * feat(logging): implement structured logging for Cloud Logging compatibility - Added support for newline-delimited JSON logging when `SUPERVAIZER_LOG_FORMAT=json` is set. - Updated logging configuration to allow structured logs for access-denial events. - Enhanced `log_access_denied_api` and `log_access_denied_tailscale` functions to include structured fields. - Added tests to verify structured logging outputs in `tests/test_common.py`. * Minor * codex/supervaizer-lifespan-cleanup (#54) * Clean up Supervaizer lifespan shutdown * Document Supervaizer import placement rule * Fix lifespan cleanup test determinism * Address lifespan shutdown review feedback * ✨feat: rename test and assert scheduled step task * ✨ feat: update GitNexus index counts in AGENTS.md * codex/refactor-server-modules (#55) * Refactor Supervaizer server modules * ✨ feat: update GitNexus index stats in AGENTS.md * ✨docs update changelog AGENTS guidance * ✨feat: add v2 methods, tests and license header * minor * codex/agent-interviewer-workspace-jobs-refresh (#56) * Clean up Supervaizer lifespan shutdown * Document Supervaizer import placement rule * Fix lifespan cleanup test determinism * Address lifespan shutdown review feedback * ✨feat: rename test and assert scheduled step task * ✨ feat: update GitNexus index counts in AGENTS.md * feat(v2): add agent action methods * Refactor pre-commit configuration and enhance agent validation - Updated mypy hook to use project-specific configuration for consistency with uv.lock. - Improved validation for v2_registration and v2_method_declarations in Agent class to ensure proper type handling. - Enhanced logging configuration to cast message records for structured logging compatibility. * chore(deps): bump uv from 0.11.14 to 0.11.15 (#58) Bumps [uv](https://github.com/astral-sh/uv) from 0.11.14 to 0.11.15. - [Release notes](https://github.com/astral-sh/uv/releases) - [Changelog](https://github.com/astral-sh/uv/blob/main/CHANGELOG.md) - [Commits](astral-sh/uv@0.11.14...0.11.15) --- updated-dependencies: - dependency-name: uv dependency-version: 0.11.15 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump starlette from 0.50.0 to 1.0.1 (#60) Bumps [starlette](https://github.com/Kludex/starlette) from 0.50.0 to 1.0.1. - [Release notes](https://github.com/Kludex/starlette/releases) - [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md) - [Commits](Kludex/starlette@0.50.0...1.0.1) --- updated-dependencies: - dependency-name: starlette dependency-version: 1.0.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump trufflesecurity/trufflehog from 3.95.3 to 3.95.5 (#61) Bumps [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog) from 3.95.3 to 3.95.5. - [Release notes](https://github.com/trufflesecurity/trufflehog/releases) - [Commits](trufflesecurity/trufflehog@37b7700...d411fff) --- updated-dependencies: - dependency-name: trufflesecurity/trufflehog dependency-version: 3.95.5 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * feat(.agents): add skill symlinks from runwaize skills cookbook Add 21 skill symlinks under .agents/skills/ pointing to the local runwaize_skills_cookbook installation, covering cloud-run basics, Pulumi migration/tooling skills (terraform, CDK, ARM, ESC, component, automation-api, upgrade-provider, best-practices, neo-handoff), Google Cloud WAF pillars (security, reliability, performance, cost-optimization, operational-excellence), google-cloud-recipe-auth, google-cloud-networking-observability, cloudformation-to-pulumi, package-usage, provider-upgrade, and upstream-patches. Update AGENTS.md GitNexus index stats to reflect the current index (6273 symbols, 11483 relationships, 281 execution flows). * chore(deps): bump astral-sh/setup-uv from 8.1.0 to 8.2.0 (#62) Bumps [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) from 8.1.0 to 8.2.0. - [Release notes](https://github.com/astral-sh/setup-uv/releases) - [Commits](astral-sh/setup-uv@0880764...fac544c) --- updated-dependencies: - dependency-name: astral-sh/setup-uv dependency-version: 8.2.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump actions/checkout from 6.0.2 to 6.0.3 (#63) Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.2 to 6.0.3. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@de0fac2...df4cb1c) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 6.0.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump starlette from 1.0.1 to 1.3.1 (#66) Bumps [starlette](https://github.com/Kludex/starlette) from 1.0.1 to 1.3.1. - [Release notes](https://github.com/Kludex/starlette/releases) - [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md) - [Commits](Kludex/starlette@1.0.1...1.3.1) --- updated-dependencies: - dependency-name: starlette dependency-version: 1.3.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump cryptography from 48.0.0 to 48.0.1 (#67) Bumps [cryptography](https://github.com/pyca/cryptography) from 48.0.0 to 48.0.1. - [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst) - [Commits](pyca/cryptography@48.0.0...48.0.1) --- updated-dependencies: - dependency-name: cryptography dependency-version: 48.0.1 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump actions/checkout from 6.0.3 to 7.0.0 (#68) Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.3 to 7.0.0. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@df4cb1c...9c091bb) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump softprops/action-gh-release from 3.0.0 to 3.0.1 (#69) Bumps [softprops/action-gh-release](https://github.com/softprops/action-gh-release) from 3.0.0 to 3.0.1. - [Release notes](https://github.com/softprops/action-gh-release/releases) - [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md) - [Commits](softprops/action-gh-release@b430933...718ea10) --- updated-dependencies: - dependency-name: softprops/action-gh-release dependency-version: 3.0.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump trufflesecurity/trufflehog from 3.95.5 to 3.95.6 (#70) Bumps [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog) from 3.95.5 to 3.95.6. - [Release notes](https://github.com/trufflesecurity/trufflehog/releases) - [Commits](trufflesecurity/trufflehog@d411fff...30d5bb9) --- updated-dependencies: - dependency-name: trufflesecurity/trufflehog dependency-version: 3.95.6 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * codex/managed-context-sdk (#65) * feat: add managed context SDK client * ✨ feat: update gitn docs to use local run.cjs and paginate list_repos * ✨ feat: add MPLv2 license headers to module and test files * fix: address managed context review feedback * ✨ feat(contracts): add V2ContextAssignment for context.assign (#71) * ✨ feat(contracts): add V2ContextAssignment for context.assign * ✨ feat(contracts): constrain context scope and document assignment semantics Address PR #71 review: V2ContextAssignmentItem.scope is now Literal["workspace", "mission"] (matching other closed v2 vocabularies) with a ValidationError regression test, and the v2 doc gains explicit context.assign semantics: refs-not-content payload, freeze-on-pull with provenance, mandatory fetched-vs-assigned version check that fails the assignment on mismatch, and no live context reads during execution. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * 🐛 fix(contracts): require mission_id for mission-scoped context assignments Address PR #71 follow-up review: a V2ContextAssignment containing scope="mission" items but no mission_id passed validation while the agent-side ContextClient.open() would have no mission context to fetch with. A model_validator now rejects that combination; workspace-only assignments still allow a null mission_id. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * 🐛 fix(contracts): reject whitespace-only mission_id for mission-scoped assignments Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com> * feat: bump version to1.3.0 and update deps; iterate nested (#73) * changelog * chore(deps): bump actions/setup-python from 6.2.0 to 6.3.0 (#75) Bumps [actions/setup-python](https://github.com/actions/setup-python) from 6.2.0 to 6.3.0. - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](actions/setup-python@a309ff8...ece7cb0) --- updated-dependencies: - dependency-name: actions/setup-python dependency-version: 6.3.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump trufflesecurity/trufflehog from 3.95.6 to 3.95.7 (#76) Bumps [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog) from 3.95.6 to 3.95.7. - [Release notes](https://github.com/trufflesecurity/trufflehog/releases) - [Commits](trufflesecurity/trufflehog@30d5bb9...f446421) --- updated-dependencies: - dependency-name: trufflesecurity/trufflehog dependency-version: 3.95.7 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * security: review summary (redacted) + safe P0/P1 hardening (#77) * docs: add redacted security & performance review summary Adds a non-actionable high-level summary of a full-source security and performance/scalability review of the SDK (posture, verified-sound controls, severity counts, and remediation themes) and a CHANGELOG entry. Per SECURITY.md, detailed vulnerability findings (exact locations, attack scenarios, remediation specifics) are intentionally kept out of the public repository and handled through the private vulnerability channel. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F8GY2d3HJgCKwgCyRgNFMt * fix(security): harden API-key compare, local-mode bind, headers, logging, scheduler Safe P0/P1 remediations from the security review (no wire-format or auth-model breaking changes): - Constant-time API-key comparison (hmac.compare_digest) in require_api_key and Server.verify_api_key (CWE-208). - Local mode binds 127.0.0.1 instead of 0.0.0.0 unless an explicit non-wildcard host is set, so the default 'local-dev' key is not network-exposed (CWE-798). - Baseline security headers (nosniff, X-Frame-Options DENY, Referrer-Policy, HSTS) via a pure-ASGI middleware that is SSE-safe (CWE-693/1021). - Stop logging decrypted agent-parameter values and full result payloads in validate-agent-parameters (CWE-532). - Allow-list scheduled_method against the agent's declared method paths in the scheduler and workbench execute-now path (CWE-470). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F8GY2d3HJgCKwgCyRgNFMt * fix(security): compare API keys as bytes to avoid TypeError on non-ASCII hmac.compare_digest rejects non-ASCII str inputs, so a malformed X-API-Key with non-ASCII characters raised TypeError (500) instead of failing closed (401/403). Encode both operands to UTF-8 bytes in require_api_key and Server.verify_api_key so malformed credentials are rejected. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F8GY2d3HJgCKwgCyRgNFMt * refactor(security): address review feedback on hardening changes - Scope scheduled-step allow-list to the owning job's agent instead of the union of all agents, so a tampered step cannot invoke another agent's declared methods (per-agent isolation). - Move MutableHeaders import to module scope (repo convention: no function-local imports without a concrete circular/optional/startup reason). - Reword CHANGELOG security bullets to high-level, non-actionable descriptions consistent with the private-advisory disclosure policy. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F8GY2d3HJgCKwgCyRgNFMt * refactor(security): tighten scheduled-step allow-list resolution Address review follow-ups on per-agent method scoping: - Scheduler: if a due step's owning job cannot be resolved, mark the step failed instead of falling back to the union of all agents' methods, so an orphaned/tampered step cannot invoke another agent's method. - Workbench execute-now: verify the job is owned by the request's agent (Jobs().get_job(job_id, agent_name=agent.name)) before using that agent's allow-list, preventing a slug/job-owner mismatch from widening the list. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F8GY2d3HJgCKwgCyRgNFMt * fix(security): use SAMEORIGIN and hoist Jobs import - X-Frame-Options: SAMEORIGIN instead of DENY so the admin instructions iframe (same-origin) still renders, while cross-origin framing stays blocked. - Move the Jobs import in scheduled_steps to module scope (no circular dependency; matches the repo's module-level-imports convention). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F8GY2d3HJgCKwgCyRgNFMt * refactor(admin): hoist scheduled step helper import * fix(security): scope scheduled step ownership checks * ✨ docs: add test summary table to changelog (docs/CHANGELOG.md) * ✨ feat(ci): skip unit tests for docs-only changes in workflow --------- Co-authored-by: Claude <noreply@anthropic.com> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
alain-sv
added a commit
that referenced
this pull request
Aug 28, 2026
* apply dependabot insights * minor * chore(ci): SHA-pin actions/checkout and actions/setup-python (#43) Pin all uses of actions/checkout@v6 and actions/setup-python@v6 to their commit SHAs across every workflow, closing the remaining floating-tag attack surface. - actions/checkout → de0fac2e (v6) - actions/setup-python → a309ff8b (v6) * docs(changelog): add unreleased dependency security refresh entry (#44) * chore(ci): add uv cache-suffix per Python version + update AGENTS.md facts (#46) Prevents parallel matrix jobs racing on the same Actions cache reservation. Also records two CI tooling facts in AGENTS.md. * supervaizer-v2-mvp-contracts (#47) * feat: add supervaizer v2 contract primitives * feat: add supervaizer v2 a2a action endpoint * feat: expose supervaizer v2 registration in a2a card * feat: add supervaizer v2 action decorator * docs: update supervaizer v2 changelog * precommit fix * refactor: move controller api version to contracts * minor * fix: scope v2 action handlers by agent * feat: guard supervaizer v2 agent identity * feat: include v2 job state in sync result * feat: add v2 resource form fields * feat: add v2 resource option sources * feat: add v2 awaiting form fields * feat: load supervaizer v2 surfaces over a2a * feat: expose local hello world v2 contract * feat: add v2 job source target type * feat: stream v2 action effects over a2a * fix: advertise v2 push notifications as unsupported * refactor: remove legacy dynamic choices * feat: complete local hello world v2 hitl flow * refactor: remove legacy job poll * docs: refresh generated contract docs * test: align v2 prompt editor fixture * test: align v2 contact import fixture * test: align v2 scenario builder fixture * test: align v2 overview fixture * test: align v2 campaign contact fixture * feat: add v2 registration builder * feat: type v2 dataset display metadata * minor * fix: precommit * feat: add comprehensive documentation for SUPERVAIZER API, Admin Interface, CLI, Parameter Validation, Persistence, Protocols, and REST API * minor * chore: change copyright dates from 2024-2025 to 2024-2026 * fix: harden agent model surface and v2 contract hygiene Use modern typing in agent.py, keep server encrypted params internal, document deterministic agent ids, tighten A2A health status rules, drop legacy hello-world v2 input aliases, and clarify v2 contract fields. * feat: enhance agent method validation and improve v2 action safety - Introduced validation to reject agent methods using blocked module roots.- Added checks to ensure declared method paths are used in agent execution.- Enhanced v2 action results with replay safety metadata validation.- Updated changelog and documentation to reflect these changes. * feat: add v2 resource import contracts * test: align v2 contract fixtures * minor * fix: require auth for a2a controller * minor * Minor * chore: update changelog for Supervaizer v2 enhancements and API key validation improvements - Added optional `metadata` field to `V2CaseSnapshot` for case-level context. - Implemented validation for Studio registration handshake to ensure API key consistency. - Enhanced server API key handling for stability during reloads. - Updated tests to cover new functionality and validation paths. * workspace-agent-grants (#50) * docs: plan workspace agent grants * docs: add Studio grant acceptance UX * feat: add workspace agent authorization * feat: add workspace binding protocol * fix: stabilize workspace authorization * ✨feat: add workspace auth helpers and use them in tests * ✨feat: require workspace auth and tighten agent checks * fix: require workspace auth for Studio A2A * fix: harden workspace authorization checks * fix: normalize malformed workspace auth inputs * minor * feat(logging): implement structured logging for Cloud Logging compatibility - Added support for newline-delimited JSON logging when `SUPERVAIZER_LOG_FORMAT=json` is set. - Updated logging configuration to allow structured logs for access-denial events. - Enhanced `log_access_denied_api` and `log_access_denied_tailscale` functions to include structured fields. - Added tests to verify structured logging outputs in `tests/test_common.py`. * Minor * codex/supervaizer-lifespan-cleanup (#54) * Clean up Supervaizer lifespan shutdown * Document Supervaizer import placement rule * Fix lifespan cleanup test determinism * Address lifespan shutdown review feedback * ✨feat: rename test and assert scheduled step task * ✨ feat: update GitNexus index counts in AGENTS.md * codex/refactor-server-modules (#55) * Refactor Supervaizer server modules * ✨ feat: update GitNexus index stats in AGENTS.md * ✨docs update changelog AGENTS guidance * ✨feat: add v2 methods, tests and license header * minor * codex/agent-interviewer-workspace-jobs-refresh (#56) * Clean up Supervaizer lifespan shutdown * Document Supervaizer import placement rule * Fix lifespan cleanup test determinism * Address lifespan shutdown review feedback * ✨feat: rename test and assert scheduled step task * ✨ feat: update GitNexus index counts in AGENTS.md * feat(v2): add agent action methods * Refactor pre-commit configuration and enhance agent validation - Updated mypy hook to use project-specific configuration for consistency with uv.lock. - Improved validation for v2_registration and v2_method_declarations in Agent class to ensure proper type handling. - Enhanced logging configuration to cast message records for structured logging compatibility. * chore(deps): bump uv from 0.11.14 to 0.11.15 (#58) Bumps [uv](https://github.com/astral-sh/uv) from 0.11.14 to 0.11.15. - [Release notes](https://github.com/astral-sh/uv/releases) - [Changelog](https://github.com/astral-sh/uv/blob/main/CHANGELOG.md) - [Commits](astral-sh/uv@0.11.14...0.11.15) --- updated-dependencies: - dependency-name: uv dependency-version: 0.11.15 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump starlette from 0.50.0 to 1.0.1 (#60) Bumps [starlette](https://github.com/Kludex/starlette) from 0.50.0 to 1.0.1. - [Release notes](https://github.com/Kludex/starlette/releases) - [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md) - [Commits](Kludex/starlette@0.50.0...1.0.1) --- updated-dependencies: - dependency-name: starlette dependency-version: 1.0.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump trufflesecurity/trufflehog from 3.95.3 to 3.95.5 (#61) Bumps [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog) from 3.95.3 to 3.95.5. - [Release notes](https://github.com/trufflesecurity/trufflehog/releases) - [Commits](trufflesecurity/trufflehog@37b7700...d411fff) --- updated-dependencies: - dependency-name: trufflesecurity/trufflehog dependency-version: 3.95.5 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * feat(.agents): add skill symlinks from runwaize skills cookbook Add 21 skill symlinks under .agents/skills/ pointing to the local runwaize_skills_cookbook installation, covering cloud-run basics, Pulumi migration/tooling skills (terraform, CDK, ARM, ESC, component, automation-api, upgrade-provider, best-practices, neo-handoff), Google Cloud WAF pillars (security, reliability, performance, cost-optimization, operational-excellence), google-cloud-recipe-auth, google-cloud-networking-observability, cloudformation-to-pulumi, package-usage, provider-upgrade, and upstream-patches. Update AGENTS.md GitNexus index stats to reflect the current index (6273 symbols, 11483 relationships, 281 execution flows). * chore(deps): bump astral-sh/setup-uv from 8.1.0 to 8.2.0 (#62) Bumps [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) from 8.1.0 to 8.2.0. - [Release notes](https://github.com/astral-sh/setup-uv/releases) - [Commits](astral-sh/setup-uv@0880764...fac544c) --- updated-dependencies: - dependency-name: astral-sh/setup-uv dependency-version: 8.2.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump actions/checkout from 6.0.2 to 6.0.3 (#63) Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.2 to 6.0.3. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@de0fac2...df4cb1c) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 6.0.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump starlette from 1.0.1 to 1.3.1 (#66) Bumps [starlette](https://github.com/Kludex/starlette) from 1.0.1 to 1.3.1. - [Release notes](https://github.com/Kludex/starlette/releases) - [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md) - [Commits](Kludex/starlette@1.0.1...1.3.1) --- updated-dependencies: - dependency-name: starlette dependency-version: 1.3.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump cryptography from 48.0.0 to 48.0.1 (#67) Bumps [cryptography](https://github.com/pyca/cryptography) from 48.0.0 to 48.0.1. - [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst) - [Commits](pyca/cryptography@48.0.0...48.0.1) --- updated-dependencies: - dependency-name: cryptography dependency-version: 48.0.1 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump actions/checkout from 6.0.3 to 7.0.0 (#68) Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.3 to 7.0.0. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@df4cb1c...9c091bb) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump softprops/action-gh-release from 3.0.0 to 3.0.1 (#69) Bumps [softprops/action-gh-release](https://github.com/softprops/action-gh-release) from 3.0.0 to 3.0.1. - [Release notes](https://github.com/softprops/action-gh-release/releases) - [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md) - [Commits](softprops/action-gh-release@b430933...718ea10) --- updated-dependencies: - dependency-name: softprops/action-gh-release dependency-version: 3.0.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump trufflesecurity/trufflehog from 3.95.5 to 3.95.6 (#70) Bumps [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog) from 3.95.5 to 3.95.6. - [Release notes](https://github.com/trufflesecurity/trufflehog/releases) - [Commits](trufflesecurity/trufflehog@d411fff...30d5bb9) --- updated-dependencies: - dependency-name: trufflesecurity/trufflehog dependency-version: 3.95.6 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * codex/managed-context-sdk (#65) * feat: add managed context SDK client * ✨ feat: update gitn docs to use local run.cjs and paginate list_repos * ✨ feat: add MPLv2 license headers to module and test files * fix: address managed context review feedback * ✨ feat(contracts): add V2ContextAssignment for context.assign (#71) * ✨ feat(contracts): add V2ContextAssignment for context.assign * ✨ feat(contracts): constrain context scope and document assignment semantics Address PR #71 review: V2ContextAssignmentItem.scope is now Literal["workspace", "mission"] (matching other closed v2 vocabularies) with a ValidationError regression test, and the v2 doc gains explicit context.assign semantics: refs-not-content payload, freeze-on-pull with provenance, mandatory fetched-vs-assigned version check that fails the assignment on mismatch, and no live context reads during execution. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * 🐛 fix(contracts): require mission_id for mission-scoped context assignments Address PR #71 follow-up review: a V2ContextAssignment containing scope="mission" items but no mission_id passed validation while the agent-side ContextClient.open() would have no mission context to fetch with. A model_validator now rejects that combination; workspace-only assignments still allow a null mission_id. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * 🐛 fix(contracts): reject whitespace-only mission_id for mission-scoped assignments Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com> * feat: bump version to1.3.0 and update deps; iterate nested (#73) * changelog * chore(deps): bump actions/setup-python from 6.2.0 to 6.3.0 (#75) Bumps [actions/setup-python](https://github.com/actions/setup-python) from 6.2.0 to 6.3.0. - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](actions/setup-python@a309ff8...ece7cb0) --- updated-dependencies: - dependency-name: actions/setup-python dependency-version: 6.3.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump trufflesecurity/trufflehog from 3.95.6 to 3.95.7 (#76) Bumps [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog) from 3.95.6 to 3.95.7. - [Release notes](https://github.com/trufflesecurity/trufflehog/releases) - [Commits](trufflesecurity/trufflehog@30d5bb9...f446421) --- updated-dependencies: - dependency-name: trufflesecurity/trufflehog dependency-version: 3.95.7 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * security: review summary (redacted) + safe P0/P1 hardening (#77) * docs: add redacted security & performance review summary Adds a non-actionable high-level summary of a full-source security and performance/scalability review of the SDK (posture, verified-sound controls, severity counts, and remediation themes) and a CHANGELOG entry. Per SECURITY.md, detailed vulnerability findings (exact locations, attack scenarios, remediation specifics) are intentionally kept out of the public repository and handled through the private vulnerability channel. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F8GY2d3HJgCKwgCyRgNFMt * fix(security): harden API-key compare, local-mode bind, headers, logging, scheduler Safe P0/P1 remediations from the security review (no wire-format or auth-model breaking changes): - Constant-time API-key comparison (hmac.compare_digest) in require_api_key and Server.verify_api_key (CWE-208). - Local mode binds 127.0.0.1 instead of 0.0.0.0 unless an explicit non-wildcard host is set, so the default 'local-dev' key is not network-exposed (CWE-798). - Baseline security headers (nosniff, X-Frame-Options DENY, Referrer-Policy, HSTS) via a pure-ASGI middleware that is SSE-safe (CWE-693/1021). - Stop logging decrypted agent-parameter values and full result payloads in validate-agent-parameters (CWE-532). - Allow-list scheduled_method against the agent's declared method paths in the scheduler and workbench execute-now path (CWE-470). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F8GY2d3HJgCKwgCyRgNFMt * fix(security): compare API keys as bytes to avoid TypeError on non-ASCII hmac.compare_digest rejects non-ASCII str inputs, so a malformed X-API-Key with non-ASCII characters raised TypeError (500) instead of failing closed (401/403). Encode both operands to UTF-8 bytes in require_api_key and Server.verify_api_key so malformed credentials are rejected. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F8GY2d3HJgCKwgCyRgNFMt * refactor(security): address review feedback on hardening changes - Scope scheduled-step allow-list to the owning job's agent instead of the union of all agents, so a tampered step cannot invoke another agent's declared methods (per-agent isolation). - Move MutableHeaders import to module scope (repo convention: no function-local imports without a concrete circular/optional/startup reason). - Reword CHANGELOG security bullets to high-level, non-actionable descriptions consistent with the private-advisory disclosure policy. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F8GY2d3HJgCKwgCyRgNFMt * refactor(security): tighten scheduled-step allow-list resolution Address review follow-ups on per-agent method scoping: - Scheduler: if a due step's owning job cannot be resolved, mark the step failed instead of falling back to the union of all agents' methods, so an orphaned/tampered step cannot invoke another agent's method. - Workbench execute-now: verify the job is owned by the request's agent (Jobs().get_job(job_id, agent_name=agent.name)) before using that agent's allow-list, preventing a slug/job-owner mismatch from widening the list. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F8GY2d3HJgCKwgCyRgNFMt * fix(security): use SAMEORIGIN and hoist Jobs import - X-Frame-Options: SAMEORIGIN instead of DENY so the admin instructions iframe (same-origin) still renders, while cross-origin framing stays blocked. - Move the Jobs import in scheduled_steps to module scope (no circular dependency; matches the repo's module-level-imports convention). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F8GY2d3HJgCKwgCyRgNFMt * refactor(admin): hoist scheduled step helper import * fix(security): scope scheduled step ownership checks * ✨ docs: add test summary table to changelog (docs/CHANGELOG.md) * ✨ feat(ci): skip unit tests for docs-only changes in workflow --------- Co-authored-by: Claude <noreply@anthropic.com> * chore(deps): bump trufflesecurity/trufflehog from 3.95.7 to 3.95.9 (#81) Bumps [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog) from 3.95.7 to 3.95.9. - [Release notes](https://github.com/trufflesecurity/trufflehog/releases) - [Commits](trufflesecurity/trufflehog@f446421...27b0417) --- updated-dependencies: - dependency-name: trufflesecurity/trufflehog dependency-version: 3.95.9 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump softprops/action-gh-release from 3.0.1 to 3.0.2 (#82) Bumps [softprops/action-gh-release](https://github.com/softprops/action-gh-release) from 3.0.1 to 3.0.2. - [Release notes](https://github.com/softprops/action-gh-release/releases) - [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md) - [Commits](softprops/action-gh-release@718ea10...3d0d988) --- updated-dependencies: - dependency-name: softprops/action-gh-release dependency-version: 3.0.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump astral-sh/setup-uv from 8.2.0 to 8.3.2 (#83) Bumps [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) from 8.2.0 to 8.3.2. - [Release notes](https://github.com/astral-sh/setup-uv/releases) - [Commits](astral-sh/setup-uv@fac544c...11f9893) --- updated-dependencies: - dependency-name: astral-sh/setup-uv dependency-version: 8.3.2 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump pyasn1 from 0.6.3 to 0.6.4 (#84) Bumps [pyasn1](https://github.com/pyasn1/pyasn1) from 0.6.3 to 0.6.4. - [Release notes](https://github.com/pyasn1/pyasn1/releases) - [Changelog](https://github.com/pyasn1/pyasn1/blob/main/CHANGES.rst) - [Commits](pyasn1/pyasn1@v0.6.3...v0.6.4) --- updated-dependencies: - dependency-name: pyasn1 dependency-version: 0.6.4 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump actions/setup-python from 6.3.0 to 7.0.0 (#85) Bumps [actions/setup-python](https://github.com/actions/setup-python) from 6.3.0 to 7.0.0. - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](actions/setup-python@ece7cb0...5fda3b9) --- updated-dependencies: - dependency-name: actions/setup-python dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump pypa/gh-action-pypi-publish from 1.14.0 to 1.14.1 (#86) Bumps [pypa/gh-action-pypi-publish](https://github.com/pypa/gh-action-pypi-publish) from 1.14.0 to 1.14.1. - [Release notes](https://github.com/pypa/gh-action-pypi-publish/releases) - [Commits](pypa/gh-action-pypi-publish@cef2210...ba38be9) --- updated-dependencies: - dependency-name: pypa/gh-action-pypi-publish dependency-version: 1.14.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump cryptography from 49.0.0 to 50.0.0 (#87) Bumps [cryptography](https://github.com/pyca/cryptography) from 49.0.0 to 50.0.0. - [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst) - [Commits](pyca/cryptography@49.0.0...50.0.0) --- updated-dependencies: - dependency-name: cryptography dependency-version: 50.0.0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * feat: add generic job setup contract (#89) * feat: add generic job setup contract * 🐛 fix(contracts): stop V2JobSetupPolicy defaulting to every action scope An agent opting in with job_policy={"setup": {}} advertised support for the workspace, job, case and step scopes without declaring any, which broadens the contract Studio sees. Default to an empty list, matching V2JobSyncPolicy.supported_statuses. Also declare V2JobSetupPolicy before V2JobPolicy so the generated model reference renders the real type instead of a ForwardRef. * 📝 docs: regenerate model reference and OpenAPI Picks up the job setup contract (V2JobPolicy.setup, V2JobSetupPolicy, V2ActionResult.setup_plan) plus accumulated drift since 0.20.1. * 📝 docs: log generic job setup contract in CHANGELOG Records the V2JobSetupPolicy contract, the empty action_scopes default, and the model reference regeneration under Unreleased. * 🐛 fix(contracts): reject blank job setup and sync action ids An empty preview_action/start_action/submit_action was accepted, then dropped from capabilities.actions by _unique_strings while still being serialized under job_policy.setup, so Studio saw an action it could never invoke. Validate all three as non-blank, plus V2JobSyncPolicy.action, which had the same gap. * doc --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com> Co-authored-by: Cursor <cursoragent@cursor.com>
alain-sv
added a commit
that referenced
this pull request
Aug 30, 2026
* apply dependabot insights * minor * chore(ci): SHA-pin actions/checkout and actions/setup-python (#43) Pin all uses of actions/checkout@v6 and actions/setup-python@v6 to their commit SHAs across every workflow, closing the remaining floating-tag attack surface. - actions/checkout → de0fac2e (v6) - actions/setup-python → a309ff8b (v6) * docs(changelog): add unreleased dependency security refresh entry (#44) * chore(ci): add uv cache-suffix per Python version + update AGENTS.md facts (#46) Prevents parallel matrix jobs racing on the same Actions cache reservation. Also records two CI tooling facts in AGENTS.md. * supervaizer-v2-mvp-contracts (#47) * feat: add supervaizer v2 contract primitives * feat: add supervaizer v2 a2a action endpoint * feat: expose supervaizer v2 registration in a2a card * feat: add supervaizer v2 action decorator * docs: update supervaizer v2 changelog * precommit fix * refactor: move controller api version to contracts * minor * fix: scope v2 action handlers by agent * feat: guard supervaizer v2 agent identity * feat: include v2 job state in sync result * feat: add v2 resource form fields * feat: add v2 resource option sources * feat: add v2 awaiting form fields * feat: load supervaizer v2 surfaces over a2a * feat: expose local hello world v2 contract * feat: add v2 job source target type * feat: stream v2 action effects over a2a * fix: advertise v2 push notifications as unsupported * refactor: remove legacy dynamic choices * feat: complete local hello world v2 hitl flow * refactor: remove legacy job poll * docs: refresh generated contract docs * test: align v2 prompt editor fixture * test: align v2 contact import fixture * test: align v2 scenario builder fixture * test: align v2 overview fixture * test: align v2 campaign contact fixture * feat: add v2 registration builder * feat: type v2 dataset display metadata * minor * fix: precommit * feat: add comprehensive documentation for SUPERVAIZER API, Admin Interface, CLI, Parameter Validation, Persistence, Protocols, and REST API * minor * chore: change copyright dates from 2024-2025 to 2024-2026 * fix: harden agent model surface and v2 contract hygiene Use modern typing in agent.py, keep server encrypted params internal, document deterministic agent ids, tighten A2A health status rules, drop legacy hello-world v2 input aliases, and clarify v2 contract fields. * feat: enhance agent method validation and improve v2 action safety - Introduced validation to reject agent methods using blocked module roots.- Added checks to ensure declared method paths are used in agent execution.- Enhanced v2 action results with replay safety metadata validation.- Updated changelog and documentation to reflect these changes. * feat: add v2 resource import contracts * test: align v2 contract fixtures * minor * fix: require auth for a2a controller * minor * Minor * chore: update changelog for Supervaizer v2 enhancements and API key validation improvements - Added optional `metadata` field to `V2CaseSnapshot` for case-level context. - Implemented validation for Studio registration handshake to ensure API key consistency. - Enhanced server API key handling for stability during reloads. - Updated tests to cover new functionality and validation paths. * workspace-agent-grants (#50) * docs: plan workspace agent grants * docs: add Studio grant acceptance UX * feat: add workspace agent authorization * feat: add workspace binding protocol * fix: stabilize workspace authorization * ✨feat: add workspace auth helpers and use them in tests * ✨feat: require workspace auth and tighten agent checks * fix: require workspace auth for Studio A2A * fix: harden workspace authorization checks * fix: normalize malformed workspace auth inputs * minor * feat(logging): implement structured logging for Cloud Logging compatibility - Added support for newline-delimited JSON logging when `SUPERVAIZER_LOG_FORMAT=json` is set. - Updated logging configuration to allow structured logs for access-denial events. - Enhanced `log_access_denied_api` and `log_access_denied_tailscale` functions to include structured fields. - Added tests to verify structured logging outputs in `tests/test_common.py`. * Minor * codex/supervaizer-lifespan-cleanup (#54) * Clean up Supervaizer lifespan shutdown * Document Supervaizer import placement rule * Fix lifespan cleanup test determinism * Address lifespan shutdown review feedback * ✨feat: rename test and assert scheduled step task * ✨ feat: update GitNexus index counts in AGENTS.md * codex/refactor-server-modules (#55) * Refactor Supervaizer server modules * ✨ feat: update GitNexus index stats in AGENTS.md * ✨docs update changelog AGENTS guidance * ✨feat: add v2 methods, tests and license header * minor * codex/agent-interviewer-workspace-jobs-refresh (#56) * Clean up Supervaizer lifespan shutdown * Document Supervaizer import placement rule * Fix lifespan cleanup test determinism * Address lifespan shutdown review feedback * ✨feat: rename test and assert scheduled step task * ✨ feat: update GitNexus index counts in AGENTS.md * feat(v2): add agent action methods * Refactor pre-commit configuration and enhance agent validation - Updated mypy hook to use project-specific configuration for consistency with uv.lock. - Improved validation for v2_registration and v2_method_declarations in Agent class to ensure proper type handling. - Enhanced logging configuration to cast message records for structured logging compatibility. * chore(deps): bump uv from 0.11.14 to 0.11.15 (#58) Bumps [uv](https://github.com/astral-sh/uv) from 0.11.14 to 0.11.15. - [Release notes](https://github.com/astral-sh/uv/releases) - [Changelog](https://github.com/astral-sh/uv/blob/main/CHANGELOG.md) - [Commits](astral-sh/uv@0.11.14...0.11.15) --- updated-dependencies: - dependency-name: uv dependency-version: 0.11.15 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump starlette from 0.50.0 to 1.0.1 (#60) Bumps [starlette](https://github.com/Kludex/starlette) from 0.50.0 to 1.0.1. - [Release notes](https://github.com/Kludex/starlette/releases) - [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md) - [Commits](Kludex/starlette@0.50.0...1.0.1) --- updated-dependencies: - dependency-name: starlette dependency-version: 1.0.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump trufflesecurity/trufflehog from 3.95.3 to 3.95.5 (#61) Bumps [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog) from 3.95.3 to 3.95.5. - [Release notes](https://github.com/trufflesecurity/trufflehog/releases) - [Commits](trufflesecurity/trufflehog@37b7700...d411fff) --- updated-dependencies: - dependency-name: trufflesecurity/trufflehog dependency-version: 3.95.5 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * feat(.agents): add skill symlinks from runwaize skills cookbook Add 21 skill symlinks under .agents/skills/ pointing to the local runwaize_skills_cookbook installation, covering cloud-run basics, Pulumi migration/tooling skills (terraform, CDK, ARM, ESC, component, automation-api, upgrade-provider, best-practices, neo-handoff), Google Cloud WAF pillars (security, reliability, performance, cost-optimization, operational-excellence), google-cloud-recipe-auth, google-cloud-networking-observability, cloudformation-to-pulumi, package-usage, provider-upgrade, and upstream-patches. Update AGENTS.md GitNexus index stats to reflect the current index (6273 symbols, 11483 relationships, 281 execution flows). * chore(deps): bump astral-sh/setup-uv from 8.1.0 to 8.2.0 (#62) Bumps [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) from 8.1.0 to 8.2.0. - [Release notes](https://github.com/astral-sh/setup-uv/releases) - [Commits](astral-sh/setup-uv@0880764...fac544c) --- updated-dependencies: - dependency-name: astral-sh/setup-uv dependency-version: 8.2.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump actions/checkout from 6.0.2 to 6.0.3 (#63) Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.2 to 6.0.3. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@de0fac2...df4cb1c) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 6.0.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump starlette from 1.0.1 to 1.3.1 (#66) Bumps [starlette](https://github.com/Kludex/starlette) from 1.0.1 to 1.3.1. - [Release notes](https://github.com/Kludex/starlette/releases) - [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md) - [Commits](Kludex/starlette@1.0.1...1.3.1) --- updated-dependencies: - dependency-name: starlette dependency-version: 1.3.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump cryptography from 48.0.0 to 48.0.1 (#67) Bumps [cryptography](https://github.com/pyca/cryptography) from 48.0.0 to 48.0.1. - [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst) - [Commits](pyca/cryptography@48.0.0...48.0.1) --- updated-dependencies: - dependency-name: cryptography dependency-version: 48.0.1 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump actions/checkout from 6.0.3 to 7.0.0 (#68) Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.3 to 7.0.0. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@df4cb1c...9c091bb) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump softprops/action-gh-release from 3.0.0 to 3.0.1 (#69) Bumps [softprops/action-gh-release](https://github.com/softprops/action-gh-release) from 3.0.0 to 3.0.1. - [Release notes](https://github.com/softprops/action-gh-release/releases) - [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md) - [Commits](softprops/action-gh-release@b430933...718ea10) --- updated-dependencies: - dependency-name: softprops/action-gh-release dependency-version: 3.0.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump trufflesecurity/trufflehog from 3.95.5 to 3.95.6 (#70) Bumps [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog) from 3.95.5 to 3.95.6. - [Release notes](https://github.com/trufflesecurity/trufflehog/releases) - [Commits](trufflesecurity/trufflehog@d411fff...30d5bb9) --- updated-dependencies: - dependency-name: trufflesecurity/trufflehog dependency-version: 3.95.6 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * codex/managed-context-sdk (#65) * feat: add managed context SDK client * ✨ feat: update gitn docs to use local run.cjs and paginate list_repos * ✨ feat: add MPLv2 license headers to module and test files * fix: address managed context review feedback * ✨ feat(contracts): add V2ContextAssignment for context.assign (#71) * ✨ feat(contracts): add V2ContextAssignment for context.assign * ✨ feat(contracts): constrain context scope and document assignment semantics Address PR #71 review: V2ContextAssignmentItem.scope is now Literal["workspace", "mission"] (matching other closed v2 vocabularies) with a ValidationError regression test, and the v2 doc gains explicit context.assign semantics: refs-not-content payload, freeze-on-pull with provenance, mandatory fetched-vs-assigned version check that fails the assignment on mismatch, and no live context reads during execution. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * 🐛 fix(contracts): require mission_id for mission-scoped context assignments Address PR #71 follow-up review: a V2ContextAssignment containing scope="mission" items but no mission_id passed validation while the agent-side ContextClient.open() would have no mission context to fetch with. A model_validator now rejects that combination; workspace-only assignments still allow a null mission_id. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * 🐛 fix(contracts): reject whitespace-only mission_id for mission-scoped assignments Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com> * feat: bump version to1.3.0 and update deps; iterate nested (#73) * changelog * chore(deps): bump actions/setup-python from 6.2.0 to 6.3.0 (#75) Bumps [actions/setup-python](https://github.com/actions/setup-python) from 6.2.0 to 6.3.0. - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](actions/setup-python@a309ff8...ece7cb0) --- updated-dependencies: - dependency-name: actions/setup-python dependency-version: 6.3.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump trufflesecurity/trufflehog from 3.95.6 to 3.95.7 (#76) Bumps [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog) from 3.95.6 to 3.95.7. - [Release notes](https://github.com/trufflesecurity/trufflehog/releases) - [Commits](trufflesecurity/trufflehog@30d5bb9...f446421) --- updated-dependencies: - dependency-name: trufflesecurity/trufflehog dependency-version: 3.95.7 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * security: review summary (redacted) + safe P0/P1 hardening (#77) * docs: add redacted security & performance review summary Adds a non-actionable high-level summary of a full-source security and performance/scalability review of the SDK (posture, verified-sound controls, severity counts, and remediation themes) and a CHANGELOG entry. Per SECURITY.md, detailed vulnerability findings (exact locations, attack scenarios, remediation specifics) are intentionally kept out of the public repository and handled through the private vulnerability channel. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F8GY2d3HJgCKwgCyRgNFMt * fix(security): harden API-key compare, local-mode bind, headers, logging, scheduler Safe P0/P1 remediations from the security review (no wire-format or auth-model breaking changes): - Constant-time API-key comparison (hmac.compare_digest) in require_api_key and Server.verify_api_key (CWE-208). - Local mode binds 127.0.0.1 instead of 0.0.0.0 unless an explicit non-wildcard host is set, so the default 'local-dev' key is not network-exposed (CWE-798). - Baseline security headers (nosniff, X-Frame-Options DENY, Referrer-Policy, HSTS) via a pure-ASGI middleware that is SSE-safe (CWE-693/1021). - Stop logging decrypted agent-parameter values and full result payloads in validate-agent-parameters (CWE-532). - Allow-list scheduled_method against the agent's declared method paths in the scheduler and workbench execute-now path (CWE-470). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F8GY2d3HJgCKwgCyRgNFMt * fix(security): compare API keys as bytes to avoid TypeError on non-ASCII hmac.compare_digest rejects non-ASCII str inputs, so a malformed X-API-Key with non-ASCII characters raised TypeError (500) instead of failing closed (401/403). Encode both operands to UTF-8 bytes in require_api_key and Server.verify_api_key so malformed credentials are rejected. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F8GY2d3HJgCKwgCyRgNFMt * refactor(security): address review feedback on hardening changes - Scope scheduled-step allow-list to the owning job's agent instead of the union of all agents, so a tampered step cannot invoke another agent's declared methods (per-agent isolation). - Move MutableHeaders import to module scope (repo convention: no function-local imports without a concrete circular/optional/startup reason). - Reword CHANGELOG security bullets to high-level, non-actionable descriptions consistent with the private-advisory disclosure policy. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F8GY2d3HJgCKwgCyRgNFMt * refactor(security): tighten scheduled-step allow-list resolution Address review follow-ups on per-agent method scoping: - Scheduler: if a due step's owning job cannot be resolved, mark the step failed instead of falling back to the union of all agents' methods, so an orphaned/tampered step cannot invoke another agent's method. - Workbench execute-now: verify the job is owned by the request's agent (Jobs().get_job(job_id, agent_name=agent.name)) before using that agent's allow-list, preventing a slug/job-owner mismatch from widening the list. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F8GY2d3HJgCKwgCyRgNFMt * fix(security): use SAMEORIGIN and hoist Jobs import - X-Frame-Options: SAMEORIGIN instead of DENY so the admin instructions iframe (same-origin) still renders, while cross-origin framing stays blocked. - Move the Jobs import in scheduled_steps to module scope (no circular dependency; matches the repo's module-level-imports convention). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F8GY2d3HJgCKwgCyRgNFMt * refactor(admin): hoist scheduled step helper import * fix(security): scope scheduled step ownership checks * ✨ docs: add test summary table to changelog (docs/CHANGELOG.md) * ✨ feat(ci): skip unit tests for docs-only changes in workflow --------- Co-authored-by: Claude <noreply@anthropic.com> * chore(deps): bump trufflesecurity/trufflehog from 3.95.7 to 3.95.9 (#81) Bumps [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog) from 3.95.7 to 3.95.9. - [Release notes](https://github.com/trufflesecurity/trufflehog/releases) - [Commits](trufflesecurity/trufflehog@f446421...27b0417) --- updated-dependencies: - dependency-name: trufflesecurity/trufflehog dependency-version: 3.95.9 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump softprops/action-gh-release from 3.0.1 to 3.0.2 (#82) Bumps [softprops/action-gh-release](https://github.com/softprops/action-gh-release) from 3.0.1 to 3.0.2. - [Release notes](https://github.com/softprops/action-gh-release/releases) - [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md) - [Commits](softprops/action-gh-release@718ea10...3d0d988) --- updated-dependencies: - dependency-name: softprops/action-gh-release dependency-version: 3.0.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump astral-sh/setup-uv from 8.2.0 to 8.3.2 (#83) Bumps [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) from 8.2.0 to 8.3.2. - [Release notes](https://github.com/astral-sh/setup-uv/releases) - [Commits](astral-sh/setup-uv@fac544c...11f9893) --- updated-dependencies: - dependency-name: astral-sh/setup-uv dependency-version: 8.3.2 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump pyasn1 from 0.6.3 to 0.6.4 (#84) Bumps [pyasn1](https://github.com/pyasn1/pyasn1) from 0.6.3 to 0.6.4. - [Release notes](https://github.com/pyasn1/pyasn1/releases) - [Changelog](https://github.com/pyasn1/pyasn1/blob/main/CHANGES.rst) - [Commits](pyasn1/pyasn1@v0.6.3...v0.6.4) --- updated-dependencies: - dependency-name: pyasn1 dependency-version: 0.6.4 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump actions/setup-python from 6.3.0 to 7.0.0 (#85) Bumps [actions/setup-python](https://github.com/actions/setup-python) from 6.3.0 to 7.0.0. - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](actions/setup-python@ece7cb0...5fda3b9) --- updated-dependencies: - dependency-name: actions/setup-python dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump pypa/gh-action-pypi-publish from 1.14.0 to 1.14.1 (#86) Bumps [pypa/gh-action-pypi-publish](https://github.com/pypa/gh-action-pypi-publish) from 1.14.0 to 1.14.1. - [Release notes](https://github.com/pypa/gh-action-pypi-publish/releases) - [Commits](pypa/gh-action-pypi-publish@cef2210...ba38be9) --- updated-dependencies: - dependency-name: pypa/gh-action-pypi-publish dependency-version: 1.14.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump cryptography from 49.0.0 to 50.0.0 (#87) Bumps [cryptography](https://github.com/pyca/cryptography) from 49.0.0 to 50.0.0. - [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst) - [Commits](pyca/cryptography@49.0.0...50.0.0) --- updated-dependencies: - dependency-name: cryptography dependency-version: 50.0.0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * feat: add generic job setup contract (#89) * feat: add generic job setup contract * 🐛 fix(contracts): stop V2JobSetupPolicy defaulting to every action scope An agent opting in with job_policy={"setup": {}} advertised support for the workspace, job, case and step scopes without declaring any, which broadens the contract Studio sees. Default to an empty list, matching V2JobSyncPolicy.supported_statuses. Also declare V2JobSetupPolicy before V2JobPolicy so the generated model reference renders the real type instead of a ForwardRef. * 📝 docs: regenerate model reference and OpenAPI Picks up the job setup contract (V2JobPolicy.setup, V2JobSetupPolicy, V2ActionResult.setup_plan) plus accumulated drift since 0.20.1. * 📝 docs: log generic job setup contract in CHANGELOG Records the V2JobSetupPolicy contract, the empty action_scopes default, and the model reference regeneration under Unreleased. * 🐛 fix(contracts): reject blank job setup and sync action ids An empty preview_action/start_action/submit_action was accepted, then dropped from capabilities.actions by _unique_strings while still being serialized under job_policy.setup, so Studio saw an action it could never invoke. Validate all three as non-blank, plus V2JobSyncPolicy.action, which had the same gap. * doc * changelog update * ✨ feat(contracts): declare action scope and mutability (#92) (#93) * ✨ feat(contracts): declare action scope and mutability (#92) V2AgentCapabilities.actions becomes list[V2ActionDefinition] carrying id, mutating and scope, so consumers authorize and group actions from declared metadata instead of pattern-matching the caller-supplied id. Bare strings still validate and coerce to mutating=True, scope=job. The builder derives metadata from each action's parent definition; precedence is explicit > derived > bare. Also adds V2DatasetDefinition.scope and V2AwaitingState.reopenable. * 📝 chore: update documentation * 🐛 fix(contracts): keep explicit action metadata when an id is declared twice An id given both as a V2ActionDefinition and as a bare string in actions= marked the id bare regardless of which declaration was retained, so the derived entry then overwrote the explicit metadata. Bareness is now tracked per retained declaration and an explicit definition wins wherever the two appear. * Changelog --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com> Co-authored-by: Cursor <cursoragent@cursor.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.