[MINOR] chore: merge develop to main - #51
Conversation
Pin all uses of actions/checkout@v6 and actions/setup-python@v6 to their commit SHAs across every workflow, closing the remaining floating-tag attack surface. - actions/checkout → de0fac2e (v6) - actions/setup-python → a309ff8b (v6)
…facts (#46) Prevents parallel matrix jobs racing on the same Actions cache reservation. Also records two CI tooling facts in AGENTS.md.
* feat: add supervaizer v2 contract primitives * feat: add supervaizer v2 a2a action endpoint * feat: expose supervaizer v2 registration in a2a card * feat: add supervaizer v2 action decorator * docs: update supervaizer v2 changelog * precommit fix * refactor: move controller api version to contracts * minor * fix: scope v2 action handlers by agent * feat: guard supervaizer v2 agent identity * feat: include v2 job state in sync result * feat: add v2 resource form fields * feat: add v2 resource option sources * feat: add v2 awaiting form fields * feat: load supervaizer v2 surfaces over a2a * feat: expose local hello world v2 contract * feat: add v2 job source target type * feat: stream v2 action effects over a2a * fix: advertise v2 push notifications as unsupported * refactor: remove legacy dynamic choices * feat: complete local hello world v2 hitl flow * refactor: remove legacy job poll * docs: refresh generated contract docs * test: align v2 prompt editor fixture * test: align v2 contact import fixture * test: align v2 scenario builder fixture * test: align v2 overview fixture * test: align v2 campaign contact fixture * feat: add v2 registration builder * feat: type v2 dataset display metadata * minor * fix: precommit * feat: add comprehensive documentation for SUPERVAIZER API, Admin Interface, CLI, Parameter Validation, Persistence, Protocols, and REST API * minor * chore: change copyright dates from 2024-2025 to 2024-2026 * fix: harden agent model surface and v2 contract hygiene Use modern typing in agent.py, keep server encrypted params internal, document deterministic agent ids, tighten A2A health status rules, drop legacy hello-world v2 input aliases, and clarify v2 contract fields. * feat: enhance agent method validation and improve v2 action safety - Introduced validation to reject agent methods using blocked module roots.- Added checks to ensure declared method paths are used in agent execution.- Enhanced v2 action results with replay safety metadata validation.- Updated changelog and documentation to reflect these changes. * feat: add v2 resource import contracts * test: align v2 contract fixtures * minor * fix: require auth for a2a controller * minor
…alidation improvements - Added optional `metadata` field to `V2CaseSnapshot` for case-level context. - Implemented validation for Studio registration handshake to ensure API key consistency. - Enhanced server API key handling for stability during reloads. - Updated tests to cover new functionality and validation paths.
* docs: plan workspace agent grants * docs: add Studio grant acceptance UX * feat: add workspace agent authorization * feat: add workspace binding protocol * fix: stabilize workspace authorization * ✨feat: add workspace auth helpers and use them in tests * ✨feat: require workspace auth and tighten agent checks * fix: require workspace auth for Studio A2A * fix: harden workspace authorization checks * fix: normalize malformed workspace auth inputs
Qodo reviews are paused for this user.Troubleshooting steps vary by plan Learn more → On a Teams plan? Using GitHub Enterprise Server, GitLab Self-Managed, or Bitbucket Data Center? |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: bdd1a1cd62
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| verified_workspace = verify_workspace_authorization_for_request( | ||
| server=server, |
There was a problem hiding this comment.
_context_from_request is called from async FastAPI handlers but invokes the synchronous verify_workspace_authorization_for_request, which can perform a blocking httpx.get(..., timeout=5) JWKS fetch on cache miss. In deployments using jwks_url, a slow/unavailable JWKS endpoint will block the event loop thread for up to the timeout, stalling unrelated concurrent requests. The A2A path already avoids this with verify_workspace_authorization_for_request_async; data-resource routes need the same offloading behavior.
Useful? React with 👍 / 👎.
1 participant
Release PR created by
just ship minor. Merge this PR after required checks pass; the publish workflow will bump the minor version from the merge commit token.