codex/managed-context-sdk by alain-sv · Pull Request #65 · supervaize/supervaizer

alain-sv · 2026-06-17T13:12:18Z

Add managed context SDK client- Update gitn docs to use run.cjs and paginate list_reChanges- Introduces a new managed SDK client for interacting with contexts- Updates documentation forn to use run.cjs and implements pagination for list_reposRelated issues- N/ANotes- N/A

qodo-code-review · 2026-06-17T13:13:08Z

CI Feedback 🧐

A test triggered by this PR failed. Here is an AI-generated analysis of the failure:

Action: pre-commit
Failed stage: Run pre-commit hooks [❌]
Failed test name: insert-license
Failure summary: The action failed during the pre-commit run because the hook `insert-license` failed with exit code `1`. - The hook reported `files were modified by this hook`, which makes pre-commit fail in CI when changes are needed. - It modified (or would modify) `src/supervaizer/context.py` and `tests/test_context_client.py`, but those changes were not committed/staged, so the job exited with `Process completed with exit code 1`.
Relevant error logs: 1: ##[group]Runner Image Provisioner 2: Hosted Compute Agent ... 348: [INFO] Initializing environment for https://github.com/commitizen-tools/commitizen:cz-conventional-gitmoji. 349: [INFO] Installing environment for https://github.com/pre-commit/pre-commit-hooks. 350: [INFO] Once installed this environment will be reused. 351: [INFO] This may take a few minutes... 352: [INFO] Installing environment for https://github.com/Lucas-C/pre-commit-hooks. 353: [INFO] Once installed this environment will be reused. 354: [INFO] This may take a few minutes... 355: ruff check...............................................................Passed 356: ruff format..............................................................Passed 357: trim trailing whitespace.................................................Passed 358: fix end of files.........................................................Passed 359: check yaml...............................................................Passed 360: check toml...............................................................Passed 361: debug statements (python)................................................Passed 362: mypy.....................................................................Passed 363: Insert license in comments...............................................Failed 364: - hook id: insert-license 365: - exit code: 1 366: - files were modified by this hook 367: Some sources were modified by the hook ['src/supervaizer/context.py'] 368: Now aborting the commit. 369: You should check the changes made. Then simply "git add --update ." and re-commit 370: Some sources were modified by the hook ['tests/test_context_client.py'] 371: Now aborting the commit. 372: You should check the changes made. Then simply "git add --update ." and re-commit 373: ##[error]Process completed with exit code 1. 374: Post job cleanup.

qodo-code-review · 2026-06-17T13:13:34Z

PR Summary by Qodo

Add managed context SDK client and update GitNexus runner/tooling docs
✨ Enhancement 📝 Documentation 🧪 Tests 🕐 20-40 Minutes

Description

• Add a ContextClient SDK for searching/opening Supervaize managed runtime context.
• Expose the context client via Account and the package’s lazy-export surface.
• Update GitNexus skill docs to use repo-local run.cjs and document list_repos pagination.

Diagram

graph TD
  A["SDK consumer"] --> B["Account"] --> C["ContextClient"] --> D["httpx.post"] --> E[("Supervaize API")]
  C --> F["Pydantic models"]

  subgraph Legend
    direction LR
    _usr["Caller"] ~~~ _mod["Module/Class"] ~~~ _db[("Remote API")]
  end

High-Level Assessment

The following are alternative approaches to this PR:

1. Add async variants (httpx.AsyncClient) alongside sync API

➕ Better fit for async applications without blocking
➕ Aligns with existing async patterns elsewhere in the SDK (e.g., Account.send_event)
➖ Larger surface area to support/test
➖ May require shared client lifecycle management guidance (closing clients)

2. Route calls through a shared request helper/client on Account

➕ Centralizes timeouts/retries/error handling and headers
➕ Avoids per-module direct httpx usage and eases future telemetry/instrumentation
➖ More refactor now; touches more existing code paths
➖ Harder to keep minimal/isolated change set for initial feature

3. Expose context operations only as Account methods (no separate client)

➕ Simpler public API surface (account.search_context/open_context)
➕ Less object creation per call
➖ Harder to group/extend context-specific functionality cleanly
➖ Breaks the emerging pattern of domain clients hanging off Account

Recommendation: Current approach (Account.context → ContextClient with typed responses) is a good, extensible SDK shape. Consider a follow-up to standardize HTTP behavior (timeouts/retries) via a shared request helper and/or to add async variants if the SDK targets async-heavy consumers.

Files changed (11) +401 / -79

Enhancement (3) +159 / -0

__init__.pyExpose context client/types via lazy public SDK exports +7/-0

Expose context client/types via lazy public SDK exports
• Adds lazy exports for the new context module, client, and response/result types so consumers can import them from 'supervaizer' without eager loading.
src/supervaizer/init.py

account.pyAdd Account.context accessor for managed context operations +6/-0

Add Account.context accessor for managed context operations
• Imports ContextClient and exposes it via an 'account.context' property to provide a stable, discoverable entry point for context APIs.
src/supervaizer/account.py

context.pyAdd ContextClient with search/open endpoints and typed responses +146/-0

Add ContextClient with search/open endpoints and typed responses

• Introduces Pydantic models for context search/open results and a ContextClient that POSTs to '/context/search/' and '/context/open/' using Account headers/base URL, including a guard against conflicting workspace_id overrides.

src/supervaizer/context.py

Tests (1) +130 / -0

test_context_client.pyAdd unit tests for ContextClient request payloads and workspace guard +130/-0

Add unit tests for ContextClient request payloads and workspace guard
• Adds tests that mock httpx.post to assert correct endpoint URLs/payloads for search/open and verifies conflicting workspace_id values are rejected without performing HTTP calls.
tests/test_context_client.py

Documentation (7) +112 / -79

SKILL.mdSwitch GitNexus CLI examples to repo-local run.cjs runner +8/-6

Switch GitNexus CLI examples to repo-local run.cjs runner
• Replaces npx-based command examples with 'node .gitnexus/run.cjs <cmd>' and documents how to regenerate the runner when missing, including npm 11.x failure workarounds.
.claude/skills/gitnexus/gitnexus-cli/SKILL.md

SKILL.mdUpdate debugging skill to new MCP tool names and run.cjs usage +15/-15

Update debugging skill to new MCP tool names and run.cjs usage
• Renames tool references from 'gitnexus_*' to the shorter forms (query/context/cypher) and updates stale-index instructions to use 'node .gitnexus/run.cjs analyze'.
.claude/skills/gitnexus/gitnexus-debugging/SKILL.md

SKILL.mdUpdate exploring skill to new MCP tool names and run.cjs usage +11/-11

Update exploring skill to new MCP tool names and run.cjs usage
• Switches 'gitnexus_query'/'gitnexus_context' references to 'query'/'context' and updates index refresh guidance to use the local run.cjs runner.
.claude/skills/gitnexus/gitnexus-exploring/SKILL.md

SKILL.mdDocument list_repos pagination and update analyze command +33/-2

Document list_repos pagination and update analyze command
• Updates the stale-index guidance to use run.cjs and adds a detailed section describing 'list_repos' pagination contract (limit/offset) and deterministic paging behavior.
.claude/skills/gitnexus/gitnexus-guide/SKILL.md

SKILL.mdUpdate impact analysis skill to new MCP tool names and run.cjs usage +10/-10

Update impact analysis skill to new MCP tool names and run.cjs usage
• Replaces 'gitnexus_impact'/'gitnexus_detect_changes' references with 'impact'/'detect_changes' and updates stale-index remediation to 'node .gitnexus/run.cjs analyze'.
.claude/skills/gitnexus/gitnexus-impact-analysis/SKILL.md

SKILL.mdUpdate refactoring skill to new MCP tool names and run.cjs usage +25/-25

Update refactoring skill to new MCP tool names and run.cjs usage
• Updates workflows/checklists/tool examples to use 'impact/query/context/rename/detect_changes/cypher' and switches index refresh commands to the local run.cjs runner.
.claude/skills/gitnexus/gitnexus-refactoring/SKILL.md

AGENTS.mdRefresh GitNexus instructions and adopt run.cjs runner + new tool names +10/-10

Refresh GitNexus instructions and adopt run.cjs runner + new tool names

• Updates GitNexus index stats, switches stale-index guidance to the repo-local runner (with regeneration notes), and replaces 'gitnexus_*' tool names with 'impact/query/context/rename/detect_changes' across the agent rules.

AGENTS.md

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 2874f489d4

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

chatgpt-codex-connector · 2026-06-17T13:16:50Z

+        response = httpx.post(
+            self._url("search"), headers=self.account.api_headers, json=payload
+        )


Use configured retries for context requests

In deployments that rely on SUPERVAIZE_HTTP_MAX_RETRIES, this direct httpx.post bypasses the shared Account HTTP clients in account_service, so managed-context requests do not get the same retry behavior as the rest of the control API. A transient connect failure during context lookup will now fail immediately even though other Account calls would retry; please route these calls through a client/transport configured with the same retry setting.

Useful? React with 👍 / 👎.

Fixed in bcb385d: ContextClient now uses a module-level retry-configured httpx.Client based on SUPERVAIZE_HTTP_MAX_RETRIES, with an atexit close hook. Tests patch the shared client path.

qodo-code-review · 2026-06-17T13:17:19Z

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📜 Skill insights (0)

Context used

✅ Compliance rules (platform): 32 rules

1. _Response._data lacks type ✓ Resolved 📘 Rule violation ≡ Correctness

Description

The new test helper _Response assigns self._data without an explicit attribute annotation, which
violates the requirement to keep changed Python modules mypy-clean. Add an explicit type for _data
on the instance.

Code

tests/test_context_client.py[R16-19]

+class _Response:
+    def __init__(self, data: dict[str, Any]) -> None:
+        self._data = data
+

Evidence

PR Compliance ID 116967 requires instance attributes to have declared types and flags untyped
attributes first assigned in __init__. In the new test file, _Response.__init__ assigns
self._data without an attribute annotation.

Rule 116967: Enforce type hints and mypy-clean Python code
tests/test_context_client.py[16-19]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
`_Response.__init__` assigns `self._data = data` without an explicit attribute annotation. The compliance rule requires typed instance attributes in changed Python files, including tests.

## Issue Context
This is a newly added pytest module.

## Fix Focus Areas
- tests/test_context_client.py[16-19]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

2. ContextClient.account lacks type ✓ Resolved 📘 Rule violation ≡ Correctness

Description

ContextClient assigns self.account in __init__ without an explicit attribute annotation, which
can cause mypy to treat the attribute as implicitly-typed and reduce type safety. Add an explicit
instance attribute type to keep the new module mypy-clean.

Code

src/supervaizer/context.py[R52-55]

+class ContextClient:
+    def __init__(self, account: Account) -> None:
+        self.account = account
+

Evidence

PR Compliance ID 116967 requires instance attributes to have declared types and flags untyped
attributes first assigned in __init__. In ContextClient.__init__, self.account is assigned
without an attribute annotation.

Rule 116967: Enforce type hints and mypy-clean Python code
src/supervaizer/context.py[52-55]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
`ContextClient.__init__` sets `self.account = account` without an explicit attribute annotation. The compliance rule requires typed instance attributes (not first appearing unannotated in `__init__`) to keep code mypy-clean.

## Issue Context
This is new Python code in `src/supervaizer/context.py`.

## Fix Focus Areas
- src/supervaizer/context.py[52-55]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

3. ~~Misleading workspace_id argument~~ ✓ Resolved 🐞 Bug ⚙ Maintainability

Description

ContextClient.search/open accept workspace_id, but it only triggers a mismatch ValueError and
does not influence the request URL or payload, so it cannot actually route requests to a different
workspace. This API surface can mislead callers into thinking workspace_id is a functional
override when it is validation-only.

Code

src/supervaizer/context.py[R56-67]

+    def search(
+        self,
+        *,
+        query: str,
+        mission_id: str | None = None,
+        scope: ContextScope | None = None,
+        tags: list[str] | None = None,
+        limit: int = 5,
+        workspace_id: str | None = None,
+    ) -> ContextSearchResponse:
+        self._reject_conflicting_workspace(workspace_id)
+        payload: dict[str, Any] = {"query": query, "limit": limit}

Evidence
The only use of workspace_id is the mismatch check; URL construction relies on
account.api_url_w_v1 (workspace baked in), and the payload never includes workspace_id.
src/supervaizer/context.py[56-78]
src/supervaizer/context.py[101-109]
tests/test_context_client.py[121-130]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
`workspace_id` is exposed on `ContextClient.search/open` (and module-level wrappers) but does not change request routing; it only guards against mismatch with `account.workspace_id`.

## Issue Context
The URL is built from `account.api_url_w_v1`, which already encodes `account.workspace_id`. The current signature suggests an override capability that does not exist.

## Fix Focus Areas
- src/supervaizer/context.py[56-109]
- tests/test_context_client.py[27-130]

## Suggested change
Pick one (preferable since this is new API):
1) **Remove `workspace_id`** from `ContextClient.search/open` and module-level `search/open` wrappers, and delete `_reject_conflicting_workspace` plus its test.

OR
2) **Make it explicit validation-only** by renaming to something like `expected_workspace_id` and documenting it as a guard parameter (still not used in payload/URL).

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

4. ~~Bypasses shared HTTP retries~~ ✓ Resolved 🐞 Bug ☼ Reliability

Description

ContextClient.search/open use one-off httpx.post(...) calls, bypassing the SDK’s configured HTTP
transport/client that enables retries via SUPERVAIZE_HTTP_MAX_RETRIES. This makes context requests
less reliable and less efficient under transient network failures compared to the rest of the SDK’s
HTTP path.

Code

src/supervaizer/context.py[R74-76]

+        response = httpx.post(
+            self._url("search"), headers=self.account.api_headers, json=payload
+        )

Evidence
ContextClient uses httpx.post directly, while account_service.py shows an established pattern
of a shared client with a retry-configured transport sourced from SUPERVAIZE_HTTP_MAX_RETRIES and
then used for sync requests.
src/supervaizer/context.py[74-99]
src/supervaizer/account_service.py[38-46]
src/supervaizer/account_service.py[164-170]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
`ContextClient` performs HTTP calls via `httpx.post(...)`, which bypasses the repository’s existing retry-enabled transport/client setup used for other outbound HTTP operations.

## Issue Context
The SDK already configures an httpx transport with retries controlled by `SUPERVAIZE_HTTP_MAX_RETRIES` and uses a shared client for requests. Context calls should follow the same approach to avoid inconsistent retry behavior and to enable connection reuse.

## Fix Focus Areas
- src/supervaizer/context.py[56-99]
- src/supervaizer/account_service.py[38-46]

## Suggested change
- Create a module-level `httpx.Client` (and `httpx.HTTPTransport(retries=...)`) in `supervaizer/context.py`, mirroring `account_service.py`, and use that client for `search` and `open`.
- Optionally register an `atexit` hook to close the shared client (as done in `account_service.py`) if you create a long-lived client.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 0e2a01265b

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

chatgpt-codex-connector · 2026-07-02T11:37:14Z

+        if mission_id:
+            payload["mission_id"] = mission_id


Reject empty mission IDs instead of falling back

When a caller relies on mission_id to scope a context request and passes an empty string (for example from a missing job context/env value), this truthiness check drops the field and sends the request without the mission identity, which can fall back to workspace-wide context. AGENTS.md's “No guessing / no implicit fallbacks” rule requires missing context to fail clearly rather than broadening scope; the same pattern exists in open, so reject empty strings or distinguish None from "".

Useful? React with 👍 / 👎.

Fixed in bcb385d: mission_id=None remains omitted, but empty or blank strings now raise ValueError before any HTTP request in search and open.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 18cc23a10d

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

* apply dependabot insights * minor * chore(ci): SHA-pin actions/checkout and actions/setup-python (#43) Pin all uses of actions/checkout@v6 and actions/setup-python@v6 to their commit SHAs across every workflow, closing the remaining floating-tag attack surface. - actions/checkout → de0fac2e (v6) - actions/setup-python → a309ff8b (v6) * docs(changelog): add unreleased dependency security refresh entry (#44) * chore(ci): add uv cache-suffix per Python version + update AGENTS.md facts (#46) Prevents parallel matrix jobs racing on the same Actions cache reservation. Also records two CI tooling facts in AGENTS.md. * supervaizer-v2-mvp-contracts (#47) * feat: add supervaizer v2 contract primitives * feat: add supervaizer v2 a2a action endpoint * feat: expose supervaizer v2 registration in a2a card * feat: add supervaizer v2 action decorator * docs: update supervaizer v2 changelog * precommit fix * refactor: move controller api version to contracts * minor * fix: scope v2 action handlers by agent * feat: guard supervaizer v2 agent identity * feat: include v2 job state in sync result * feat: add v2 resource form fields * feat: add v2 resource option sources * feat: add v2 awaiting form fields * feat: load supervaizer v2 surfaces over a2a * feat: expose local hello world v2 contract * feat: add v2 job source target type * feat: stream v2 action effects over a2a * fix: advertise v2 push notifications as unsupported * refactor: remove legacy dynamic choices * feat: complete local hello world v2 hitl flow * refactor: remove legacy job poll * docs: refresh generated contract docs * test: align v2 prompt editor fixture * test: align v2 contact import fixture * test: align v2 scenario builder fixture * test: align v2 overview fixture * test: align v2 campaign contact fixture * feat: add v2 registration builder * feat: type v2 dataset display metadata * minor * fix: precommit * feat: add comprehensive documentation for SUPERVAIZER API, Admin Interface, CLI, Parameter Validation, Persistence, Protocols, and REST API * minor * chore: change copyright dates from 2024-2025 to 2024-2026 * fix: harden agent model surface and v2 contract hygiene Use modern typing in agent.py, keep server encrypted params internal, document deterministic agent ids, tighten A2A health status rules, drop legacy hello-world v2 input aliases, and clarify v2 contract fields. * feat: enhance agent method validation and improve v2 action safety - Introduced validation to reject agent methods using blocked module roots.- Added checks to ensure declared method paths are used in agent execution.- Enhanced v2 action results with replay safety metadata validation.- Updated changelog and documentation to reflect these changes. * feat: add v2 resource import contracts * test: align v2 contract fixtures * minor * fix: require auth for a2a controller * minor * Minor * chore: update changelog for Supervaizer v2 enhancements and API key validation improvements - Added optional `metadata` field to `V2CaseSnapshot` for case-level context. - Implemented validation for Studio registration handshake to ensure API key consistency. - Enhanced server API key handling for stability during reloads. - Updated tests to cover new functionality and validation paths. * workspace-agent-grants (#50) * docs: plan workspace agent grants * docs: add Studio grant acceptance UX * feat: add workspace agent authorization * feat: add workspace binding protocol * fix: stabilize workspace authorization * ✨feat: add workspace auth helpers and use them in tests * ✨feat: require workspace auth and tighten agent checks * fix: require workspace auth for Studio A2A * fix: harden workspace authorization checks * fix: normalize malformed workspace auth inputs * minor * feat(logging): implement structured logging for Cloud Logging compatibility - Added support for newline-delimited JSON logging when `SUPERVAIZER_LOG_FORMAT=json` is set. - Updated logging configuration to allow structured logs for access-denial events. - Enhanced `log_access_denied_api` and `log_access_denied_tailscale` functions to include structured fields. - Added tests to verify structured logging outputs in `tests/test_common.py`. * Minor * codex/supervaizer-lifespan-cleanup (#54) * Clean up Supervaizer lifespan shutdown * Document Supervaizer import placement rule * Fix lifespan cleanup test determinism * Address lifespan shutdown review feedback * ✨feat: rename test and assert scheduled step task * ✨ feat: update GitNexus index counts in AGENTS.md * codex/refactor-server-modules (#55) * Refactor Supervaizer server modules * ✨ feat: update GitNexus index stats in AGENTS.md * ✨docs update changelog AGENTS guidance * ✨feat: add v2 methods, tests and license header * minor * codex/agent-interviewer-workspace-jobs-refresh (#56) * Clean up Supervaizer lifespan shutdown * Document Supervaizer import placement rule * Fix lifespan cleanup test determinism * Address lifespan shutdown review feedback * ✨feat: rename test and assert scheduled step task * ✨ feat: update GitNexus index counts in AGENTS.md * feat(v2): add agent action methods * Refactor pre-commit configuration and enhance agent validation - Updated mypy hook to use project-specific configuration for consistency with uv.lock. - Improved validation for v2_registration and v2_method_declarations in Agent class to ensure proper type handling. - Enhanced logging configuration to cast message records for structured logging compatibility. * chore(deps): bump uv from 0.11.14 to 0.11.15 (#58) Bumps [uv](https://github.com/astral-sh/uv) from 0.11.14 to 0.11.15. - [Release notes](https://github.com/astral-sh/uv/releases) - [Changelog](https://github.com/astral-sh/uv/blob/main/CHANGELOG.md) - [Commits](astral-sh/uv@0.11.14...0.11.15) --- updated-dependencies: - dependency-name: uv dependency-version: 0.11.15 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump starlette from 0.50.0 to 1.0.1 (#60) Bumps [starlette](https://github.com/Kludex/starlette) from 0.50.0 to 1.0.1. - [Release notes](https://github.com/Kludex/starlette/releases) - [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md) - [Commits](Kludex/starlette@0.50.0...1.0.1) --- updated-dependencies: - dependency-name: starlette dependency-version: 1.0.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump trufflesecurity/trufflehog from 3.95.3 to 3.95.5 (#61) Bumps [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog) from 3.95.3 to 3.95.5. - [Release notes](https://github.com/trufflesecurity/trufflehog/releases) - [Commits](trufflesecurity/trufflehog@37b7700...d411fff) --- updated-dependencies: - dependency-name: trufflesecurity/trufflehog dependency-version: 3.95.5 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * feat(.agents): add skill symlinks from runwaize skills cookbook Add 21 skill symlinks under .agents/skills/ pointing to the local runwaize_skills_cookbook installation, covering cloud-run basics, Pulumi migration/tooling skills (terraform, CDK, ARM, ESC, component, automation-api, upgrade-provider, best-practices, neo-handoff), Google Cloud WAF pillars (security, reliability, performance, cost-optimization, operational-excellence), google-cloud-recipe-auth, google-cloud-networking-observability, cloudformation-to-pulumi, package-usage, provider-upgrade, and upstream-patches. Update AGENTS.md GitNexus index stats to reflect the current index (6273 symbols, 11483 relationships, 281 execution flows). * chore(deps): bump astral-sh/setup-uv from 8.1.0 to 8.2.0 (#62) Bumps [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) from 8.1.0 to 8.2.0. - [Release notes](https://github.com/astral-sh/setup-uv/releases) - [Commits](astral-sh/setup-uv@0880764...fac544c) --- updated-dependencies: - dependency-name: astral-sh/setup-uv dependency-version: 8.2.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump actions/checkout from 6.0.2 to 6.0.3 (#63) Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.2 to 6.0.3. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@de0fac2...df4cb1c) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 6.0.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump starlette from 1.0.1 to 1.3.1 (#66) Bumps [starlette](https://github.com/Kludex/starlette) from 1.0.1 to 1.3.1. - [Release notes](https://github.com/Kludex/starlette/releases) - [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md) - [Commits](Kludex/starlette@1.0.1...1.3.1) --- updated-dependencies: - dependency-name: starlette dependency-version: 1.3.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump cryptography from 48.0.0 to 48.0.1 (#67) Bumps [cryptography](https://github.com/pyca/cryptography) from 48.0.0 to 48.0.1. - [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst) - [Commits](pyca/cryptography@48.0.0...48.0.1) --- updated-dependencies: - dependency-name: cryptography dependency-version: 48.0.1 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump actions/checkout from 6.0.3 to 7.0.0 (#68) Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.3 to 7.0.0. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@df4cb1c...9c091bb) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump softprops/action-gh-release from 3.0.0 to 3.0.1 (#69) Bumps [softprops/action-gh-release](https://github.com/softprops/action-gh-release) from 3.0.0 to 3.0.1. - [Release notes](https://github.com/softprops/action-gh-release/releases) - [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md) - [Commits](softprops/action-gh-release@b430933...718ea10) --- updated-dependencies: - dependency-name: softprops/action-gh-release dependency-version: 3.0.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump trufflesecurity/trufflehog from 3.95.5 to 3.95.6 (#70) Bumps [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog) from 3.95.5 to 3.95.6. - [Release notes](https://github.com/trufflesecurity/trufflehog/releases) - [Commits](trufflesecurity/trufflehog@d411fff...30d5bb9) --- updated-dependencies: - dependency-name: trufflesecurity/trufflehog dependency-version: 3.95.6 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * codex/managed-context-sdk (#65) * feat: add managed context SDK client * ✨ feat: update gitn docs to use local run.cjs and paginate list_repos * ✨ feat: add MPLv2 license headers to module and test files * fix: address managed context review feedback * ✨ feat(contracts): add V2ContextAssignment for context.assign (#71) * ✨ feat(contracts): add V2ContextAssignment for context.assign * ✨ feat(contracts): constrain context scope and document assignment semantics Address PR #71 review: V2ContextAssignmentItem.scope is now Literal["workspace", "mission"] (matching other closed v2 vocabularies) with a ValidationError regression test, and the v2 doc gains explicit context.assign semantics: refs-not-content payload, freeze-on-pull with provenance, mandatory fetched-vs-assigned version check that fails the assignment on mismatch, and no live context reads during execution. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * 🐛 fix(contracts): require mission_id for mission-scoped context assignments Address PR #71 follow-up review: a V2ContextAssignment containing scope="mission" items but no mission_id passed validation while the agent-side ContextClient.open() would have no mission context to fetch with. A model_validator now rejects that combination; workspace-only assignments still allow a null mission_id. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * 🐛 fix(contracts): reject whitespace-only mission_id for mission-scoped assignments Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

* apply dependabot insights * minor * chore(ci): SHA-pin actions/checkout and actions/setup-python (#43) Pin all uses of actions/checkout@v6 and actions/setup-python@v6 to their commit SHAs across every workflow, closing the remaining floating-tag attack surface. - actions/checkout → de0fac2e (v6) - actions/setup-python → a309ff8b (v6) * docs(changelog): add unreleased dependency security refresh entry (#44) * chore(ci): add uv cache-suffix per Python version + update AGENTS.md facts (#46) Prevents parallel matrix jobs racing on the same Actions cache reservation. Also records two CI tooling facts in AGENTS.md. * supervaizer-v2-mvp-contracts (#47) * feat: add supervaizer v2 contract primitives * feat: add supervaizer v2 a2a action endpoint * feat: expose supervaizer v2 registration in a2a card * feat: add supervaizer v2 action decorator * docs: update supervaizer v2 changelog * precommit fix * refactor: move controller api version to contracts * minor * fix: scope v2 action handlers by agent * feat: guard supervaizer v2 agent identity * feat: include v2 job state in sync result * feat: add v2 resource form fields * feat: add v2 resource option sources * feat: add v2 awaiting form fields * feat: load supervaizer v2 surfaces over a2a * feat: expose local hello world v2 contract * feat: add v2 job source target type * feat: stream v2 action effects over a2a * fix: advertise v2 push notifications as unsupported * refactor: remove legacy dynamic choices * feat: complete local hello world v2 hitl flow * refactor: remove legacy job poll * docs: refresh generated contract docs * test: align v2 prompt editor fixture * test: align v2 contact import fixture * test: align v2 scenario builder fixture * test: align v2 overview fixture * test: align v2 campaign contact fixture * feat: add v2 registration builder * feat: type v2 dataset display metadata * minor * fix: precommit * feat: add comprehensive documentation for SUPERVAIZER API, Admin Interface, CLI, Parameter Validation, Persistence, Protocols, and REST API * minor * chore: change copyright dates from 2024-2025 to 2024-2026 * fix: harden agent model surface and v2 contract hygiene Use modern typing in agent.py, keep server encrypted params internal, document deterministic agent ids, tighten A2A health status rules, drop legacy hello-world v2 input aliases, and clarify v2 contract fields. * feat: enhance agent method validation and improve v2 action safety - Introduced validation to reject agent methods using blocked module roots.- Added checks to ensure declared method paths are used in agent execution.- Enhanced v2 action results with replay safety metadata validation.- Updated changelog and documentation to reflect these changes. * feat: add v2 resource import contracts * test: align v2 contract fixtures * minor * fix: require auth for a2a controller * minor * Minor * chore: update changelog for Supervaizer v2 enhancements and API key validation improvements - Added optional `metadata` field to `V2CaseSnapshot` for case-level context. - Implemented validation for Studio registration handshake to ensure API key consistency. - Enhanced server API key handling for stability during reloads. - Updated tests to cover new functionality and validation paths. * workspace-agent-grants (#50) * docs: plan workspace agent grants * docs: add Studio grant acceptance UX * feat: add workspace agent authorization * feat: add workspace binding protocol * fix: stabilize workspace authorization * ✨feat: add workspace auth helpers and use them in tests * ✨feat: require workspace auth and tighten agent checks * fix: require workspace auth for Studio A2A * fix: harden workspace authorization checks * fix: normalize malformed workspace auth inputs * minor * feat(logging): implement structured logging for Cloud Logging compatibility - Added support for newline-delimited JSON logging when `SUPERVAIZER_LOG_FORMAT=json` is set. - Updated logging configuration to allow structured logs for access-denial events. - Enhanced `log_access_denied_api` and `log_access_denied_tailscale` functions to include structured fields. - Added tests to verify structured logging outputs in `tests/test_common.py`. * Minor * codex/supervaizer-lifespan-cleanup (#54) * Clean up Supervaizer lifespan shutdown * Document Supervaizer import placement rule * Fix lifespan cleanup test determinism * Address lifespan shutdown review feedback * ✨feat: rename test and assert scheduled step task * ✨ feat: update GitNexus index counts in AGENTS.md * codex/refactor-server-modules (#55) * Refactor Supervaizer server modules * ✨ feat: update GitNexus index stats in AGENTS.md * ✨docs update changelog AGENTS guidance * ✨feat: add v2 methods, tests and license header * minor * codex/agent-interviewer-workspace-jobs-refresh (#56) * Clean up Supervaizer lifespan shutdown * Document Supervaizer import placement rule * Fix lifespan cleanup test determinism * Address lifespan shutdown review feedback * ✨feat: rename test and assert scheduled step task * ✨ feat: update GitNexus index counts in AGENTS.md * feat(v2): add agent action methods * Refactor pre-commit configuration and enhance agent validation - Updated mypy hook to use project-specific configuration for consistency with uv.lock. - Improved validation for v2_registration and v2_method_declarations in Agent class to ensure proper type handling. - Enhanced logging configuration to cast message records for structured logging compatibility. * chore(deps): bump uv from 0.11.14 to 0.11.15 (#58) Bumps [uv](https://github.com/astral-sh/uv) from 0.11.14 to 0.11.15. - [Release notes](https://github.com/astral-sh/uv/releases) - [Changelog](https://github.com/astral-sh/uv/blob/main/CHANGELOG.md) - [Commits](astral-sh/uv@0.11.14...0.11.15) --- updated-dependencies: - dependency-name: uv dependency-version: 0.11.15 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump starlette from 0.50.0 to 1.0.1 (#60) Bumps [starlette](https://github.com/Kludex/starlette) from 0.50.0 to 1.0.1. - [Release notes](https://github.com/Kludex/starlette/releases) - [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md) - [Commits](Kludex/starlette@0.50.0...1.0.1) --- updated-dependencies: - dependency-name: starlette dependency-version: 1.0.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump trufflesecurity/trufflehog from 3.95.3 to 3.95.5 (#61) Bumps [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog) from 3.95.3 to 3.95.5. - [Release notes](https://github.com/trufflesecurity/trufflehog/releases) - [Commits](trufflesecurity/trufflehog@37b7700...d411fff) --- updated-dependencies: - dependency-name: trufflesecurity/trufflehog dependency-version: 3.95.5 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * feat(.agents): add skill symlinks from runwaize skills cookbook Add 21 skill symlinks under .agents/skills/ pointing to the local runwaize_skills_cookbook installation, covering cloud-run basics, Pulumi migration/tooling skills (terraform, CDK, ARM, ESC, component, automation-api, upgrade-provider, best-practices, neo-handoff), Google Cloud WAF pillars (security, reliability, performance, cost-optimization, operational-excellence), google-cloud-recipe-auth, google-cloud-networking-observability, cloudformation-to-pulumi, package-usage, provider-upgrade, and upstream-patches. Update AGENTS.md GitNexus index stats to reflect the current index (6273 symbols, 11483 relationships, 281 execution flows). * chore(deps): bump astral-sh/setup-uv from 8.1.0 to 8.2.0 (#62) Bumps [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) from 8.1.0 to 8.2.0. - [Release notes](https://github.com/astral-sh/setup-uv/releases) - [Commits](astral-sh/setup-uv@0880764...fac544c) --- updated-dependencies: - dependency-name: astral-sh/setup-uv dependency-version: 8.2.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump actions/checkout from 6.0.2 to 6.0.3 (#63) Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.2 to 6.0.3. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@de0fac2...df4cb1c) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 6.0.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump starlette from 1.0.1 to 1.3.1 (#66) Bumps [starlette](https://github.com/Kludex/starlette) from 1.0.1 to 1.3.1. - [Release notes](https://github.com/Kludex/starlette/releases) - [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md) - [Commits](Kludex/starlette@1.0.1...1.3.1) --- updated-dependencies: - dependency-name: starlette dependency-version: 1.3.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump cryptography from 48.0.0 to 48.0.1 (#67) Bumps [cryptography](https://github.com/pyca/cryptography) from 48.0.0 to 48.0.1. - [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst) - [Commits](pyca/cryptography@48.0.0...48.0.1) --- updated-dependencies: - dependency-name: cryptography dependency-version: 48.0.1 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump actions/checkout from 6.0.3 to 7.0.0 (#68) Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.3 to 7.0.0. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@df4cb1c...9c091bb) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump softprops/action-gh-release from 3.0.0 to 3.0.1 (#69) Bumps [softprops/action-gh-release](https://github.com/softprops/action-gh-release) from 3.0.0 to 3.0.1. - [Release notes](https://github.com/softprops/action-gh-release/releases) - [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md) - [Commits](softprops/action-gh-release@b430933...718ea10) --- updated-dependencies: - dependency-name: softprops/action-gh-release dependency-version: 3.0.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump trufflesecurity/trufflehog from 3.95.5 to 3.95.6 (#70) Bumps [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog) from 3.95.5 to 3.95.6. - [Release notes](https://github.com/trufflesecurity/trufflehog/releases) - [Commits](trufflesecurity/trufflehog@d411fff...30d5bb9) --- updated-dependencies: - dependency-name: trufflesecurity/trufflehog dependency-version: 3.95.6 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * codex/managed-context-sdk (#65) * feat: add managed context SDK client * ✨ feat: update gitn docs to use local run.cjs and paginate list_repos * ✨ feat: add MPLv2 license headers to module and test files * fix: address managed context review feedback * ✨ feat(contracts): add V2ContextAssignment for context.assign (#71) * ✨ feat(contracts): add V2ContextAssignment for context.assign * ✨ feat(contracts): constrain context scope and document assignment semantics Address PR #71 review: V2ContextAssignmentItem.scope is now Literal["workspace", "mission"] (matching other closed v2 vocabularies) with a ValidationError regression test, and the v2 doc gains explicit context.assign semantics: refs-not-content payload, freeze-on-pull with provenance, mandatory fetched-vs-assigned version check that fails the assignment on mismatch, and no live context reads during execution. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * 🐛 fix(contracts): require mission_id for mission-scoped context assignments Address PR #71 follow-up review: a V2ContextAssignment containing scope="mission" items but no mission_id passed validation while the agent-side ContextClient.open() would have no mission context to fetch with. A model_validator now rejects that combination; workspace-only assignments still allow a null mission_id. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * 🐛 fix(contracts): reject whitespace-only mission_id for mission-scoped assignments Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com> * feat: bump version to1.3.0 and update deps; iterate nested (#73) * fix versions --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

* apply dependabot insights * minor * chore(ci): SHA-pin actions/checkout and actions/setup-python (#43) Pin all uses of actions/checkout@v6 and actions/setup-python@v6 to their commit SHAs across every workflow, closing the remaining floating-tag attack surface. - actions/checkout → de0fac2e (v6) - actions/setup-python → a309ff8b (v6) * docs(changelog): add unreleased dependency security refresh entry (#44) * chore(ci): add uv cache-suffix per Python version + update AGENTS.md facts (#46) Prevents parallel matrix jobs racing on the same Actions cache reservation. Also records two CI tooling facts in AGENTS.md. * supervaizer-v2-mvp-contracts (#47) * feat: add supervaizer v2 contract primitives * feat: add supervaizer v2 a2a action endpoint * feat: expose supervaizer v2 registration in a2a card * feat: add supervaizer v2 action decorator * docs: update supervaizer v2 changelog * precommit fix * refactor: move controller api version to contracts * minor * fix: scope v2 action handlers by agent * feat: guard supervaizer v2 agent identity * feat: include v2 job state in sync result * feat: add v2 resource form fields * feat: add v2 resource option sources * feat: add v2 awaiting form fields * feat: load supervaizer v2 surfaces over a2a * feat: expose local hello world v2 contract * feat: add v2 job source target type * feat: stream v2 action effects over a2a * fix: advertise v2 push notifications as unsupported * refactor: remove legacy dynamic choices * feat: complete local hello world v2 hitl flow * refactor: remove legacy job poll * docs: refresh generated contract docs * test: align v2 prompt editor fixture * test: align v2 contact import fixture * test: align v2 scenario builder fixture * test: align v2 overview fixture * test: align v2 campaign contact fixture * feat: add v2 registration builder * feat: type v2 dataset display metadata * minor * fix: precommit * feat: add comprehensive documentation for SUPERVAIZER API, Admin Interface, CLI, Parameter Validation, Persistence, Protocols, and REST API * minor * chore: change copyright dates from 2024-2025 to 2024-2026 * fix: harden agent model surface and v2 contract hygiene Use modern typing in agent.py, keep server encrypted params internal, document deterministic agent ids, tighten A2A health status rules, drop legacy hello-world v2 input aliases, and clarify v2 contract fields. * feat: enhance agent method validation and improve v2 action safety - Introduced validation to reject agent methods using blocked module roots.- Added checks to ensure declared method paths are used in agent execution.- Enhanced v2 action results with replay safety metadata validation.- Updated changelog and documentation to reflect these changes. * feat: add v2 resource import contracts * test: align v2 contract fixtures * minor * fix: require auth for a2a controller * minor * Minor * chore: update changelog for Supervaizer v2 enhancements and API key validation improvements - Added optional `metadata` field to `V2CaseSnapshot` for case-level context. - Implemented validation for Studio registration handshake to ensure API key consistency. - Enhanced server API key handling for stability during reloads. - Updated tests to cover new functionality and validation paths. * workspace-agent-grants (#50) * docs: plan workspace agent grants * docs: add Studio grant acceptance UX * feat: add workspace agent authorization * feat: add workspace binding protocol * fix: stabilize workspace authorization * ✨feat: add workspace auth helpers and use them in tests * ✨feat: require workspace auth and tighten agent checks * fix: require workspace auth for Studio A2A * fix: harden workspace authorization checks * fix: normalize malformed workspace auth inputs * minor * feat(logging): implement structured logging for Cloud Logging compatibility - Added support for newline-delimited JSON logging when `SUPERVAIZER_LOG_FORMAT=json` is set. - Updated logging configuration to allow structured logs for access-denial events. - Enhanced `log_access_denied_api` and `log_access_denied_tailscale` functions to include structured fields. - Added tests to verify structured logging outputs in `tests/test_common.py`. * Minor * codex/supervaizer-lifespan-cleanup (#54) * Clean up Supervaizer lifespan shutdown * Document Supervaizer import placement rule * Fix lifespan cleanup test determinism * Address lifespan shutdown review feedback * ✨feat: rename test and assert scheduled step task * ✨ feat: update GitNexus index counts in AGENTS.md * codex/refactor-server-modules (#55) * Refactor Supervaizer server modules * ✨ feat: update GitNexus index stats in AGENTS.md * ✨docs update changelog AGENTS guidance * ✨feat: add v2 methods, tests and license header * minor * codex/agent-interviewer-workspace-jobs-refresh (#56) * Clean up Supervaizer lifespan shutdown * Document Supervaizer import placement rule * Fix lifespan cleanup test determinism * Address lifespan shutdown review feedback * ✨feat: rename test and assert scheduled step task * ✨ feat: update GitNexus index counts in AGENTS.md * feat(v2): add agent action methods * Refactor pre-commit configuration and enhance agent validation - Updated mypy hook to use project-specific configuration for consistency with uv.lock. - Improved validation for v2_registration and v2_method_declarations in Agent class to ensure proper type handling. - Enhanced logging configuration to cast message records for structured logging compatibility. * chore(deps): bump uv from 0.11.14 to 0.11.15 (#58) Bumps [uv](https://github.com/astral-sh/uv) from 0.11.14 to 0.11.15. - [Release notes](https://github.com/astral-sh/uv/releases) - [Changelog](https://github.com/astral-sh/uv/blob/main/CHANGELOG.md) - [Commits](astral-sh/uv@0.11.14...0.11.15) --- updated-dependencies: - dependency-name: uv dependency-version: 0.11.15 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump starlette from 0.50.0 to 1.0.1 (#60) Bumps [starlette](https://github.com/Kludex/starlette) from 0.50.0 to 1.0.1. - [Release notes](https://github.com/Kludex/starlette/releases) - [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md) - [Commits](Kludex/starlette@0.50.0...1.0.1) --- updated-dependencies: - dependency-name: starlette dependency-version: 1.0.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump trufflesecurity/trufflehog from 3.95.3 to 3.95.5 (#61) Bumps [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog) from 3.95.3 to 3.95.5. - [Release notes](https://github.com/trufflesecurity/trufflehog/releases) - [Commits](trufflesecurity/trufflehog@37b7700...d411fff) --- updated-dependencies: - dependency-name: trufflesecurity/trufflehog dependency-version: 3.95.5 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * feat(.agents): add skill symlinks from runwaize skills cookbook Add 21 skill symlinks under .agents/skills/ pointing to the local runwaize_skills_cookbook installation, covering cloud-run basics, Pulumi migration/tooling skills (terraform, CDK, ARM, ESC, component, automation-api, upgrade-provider, best-practices, neo-handoff), Google Cloud WAF pillars (security, reliability, performance, cost-optimization, operational-excellence), google-cloud-recipe-auth, google-cloud-networking-observability, cloudformation-to-pulumi, package-usage, provider-upgrade, and upstream-patches. Update AGENTS.md GitNexus index stats to reflect the current index (6273 symbols, 11483 relationships, 281 execution flows). * chore(deps): bump astral-sh/setup-uv from 8.1.0 to 8.2.0 (#62) Bumps [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) from 8.1.0 to 8.2.0. - [Release notes](https://github.com/astral-sh/setup-uv/releases) - [Commits](astral-sh/setup-uv@0880764...fac544c) --- updated-dependencies: - dependency-name: astral-sh/setup-uv dependency-version: 8.2.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump actions/checkout from 6.0.2 to 6.0.3 (#63) Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.2 to 6.0.3. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@de0fac2...df4cb1c) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 6.0.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump starlette from 1.0.1 to 1.3.1 (#66) Bumps [starlette](https://github.com/Kludex/starlette) from 1.0.1 to 1.3.1. - [Release notes](https://github.com/Kludex/starlette/releases) - [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md) - [Commits](Kludex/starlette@1.0.1...1.3.1) --- updated-dependencies: - dependency-name: starlette dependency-version: 1.3.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump cryptography from 48.0.0 to 48.0.1 (#67) Bumps [cryptography](https://github.com/pyca/cryptography) from 48.0.0 to 48.0.1. - [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst) - [Commits](pyca/cryptography@48.0.0...48.0.1) --- updated-dependencies: - dependency-name: cryptography dependency-version: 48.0.1 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump actions/checkout from 6.0.3 to 7.0.0 (#68) Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.3 to 7.0.0. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@df4cb1c...9c091bb) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump softprops/action-gh-release from 3.0.0 to 3.0.1 (#69) Bumps [softprops/action-gh-release](https://github.com/softprops/action-gh-release) from 3.0.0 to 3.0.1. - [Release notes](https://github.com/softprops/action-gh-release/releases) - [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md) - [Commits](softprops/action-gh-release@b430933...718ea10) --- updated-dependencies: - dependency-name: softprops/action-gh-release dependency-version: 3.0.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump trufflesecurity/trufflehog from 3.95.5 to 3.95.6 (#70) Bumps [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog) from 3.95.5 to 3.95.6. - [Release notes](https://github.com/trufflesecurity/trufflehog/releases) - [Commits](trufflesecurity/trufflehog@d411fff...30d5bb9) --- updated-dependencies: - dependency-name: trufflesecurity/trufflehog dependency-version: 3.95.6 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * codex/managed-context-sdk (#65) * feat: add managed context SDK client * ✨ feat: update gitn docs to use local run.cjs and paginate list_repos * ✨ feat: add MPLv2 license headers to module and test files * fix: address managed context review feedback * ✨ feat(contracts): add V2ContextAssignment for context.assign (#71) * ✨ feat(contracts): add V2ContextAssignment for context.assign * ✨ feat(contracts): constrain context scope and document assignment semantics Address PR #71 review: V2ContextAssignmentItem.scope is now Literal["workspace", "mission"] (matching other closed v2 vocabularies) with a ValidationError regression test, and the v2 doc gains explicit context.assign semantics: refs-not-content payload, freeze-on-pull with provenance, mandatory fetched-vs-assigned version check that fails the assignment on mismatch, and no live context reads during execution. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * 🐛 fix(contracts): require mission_id for mission-scoped context assignments Address PR #71 follow-up review: a V2ContextAssignment containing scope="mission" items but no mission_id passed validation while the agent-side ContextClient.open() would have no mission context to fetch with. A model_validator now rejects that combination; workspace-only assignments still allow a null mission_id. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * 🐛 fix(contracts): reject whitespace-only mission_id for mission-scoped assignments Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com> * feat: bump version to1.3.0 and update deps; iterate nested (#73) * changelog * chore(deps): bump actions/setup-python from 6.2.0 to 6.3.0 (#75) Bumps [actions/setup-python](https://github.com/actions/setup-python) from 6.2.0 to 6.3.0. - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](actions/setup-python@a309ff8...ece7cb0) --- updated-dependencies: - dependency-name: actions/setup-python dependency-version: 6.3.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump trufflesecurity/trufflehog from 3.95.6 to 3.95.7 (#76) Bumps [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog) from 3.95.6 to 3.95.7. - [Release notes](https://github.com/trufflesecurity/trufflehog/releases) - [Commits](trufflesecurity/trufflehog@30d5bb9...f446421) --- updated-dependencies: - dependency-name: trufflesecurity/trufflehog dependency-version: 3.95.7 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * security: review summary (redacted) + safe P0/P1 hardening (#77) * docs: add redacted security & performance review summary Adds a non-actionable high-level summary of a full-source security and performance/scalability review of the SDK (posture, verified-sound controls, severity counts, and remediation themes) and a CHANGELOG entry. Per SECURITY.md, detailed vulnerability findings (exact locations, attack scenarios, remediation specifics) are intentionally kept out of the public repository and handled through the private vulnerability channel. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F8GY2d3HJgCKwgCyRgNFMt * fix(security): harden API-key compare, local-mode bind, headers, logging, scheduler Safe P0/P1 remediations from the security review (no wire-format or auth-model breaking changes): - Constant-time API-key comparison (hmac.compare_digest) in require_api_key and Server.verify_api_key (CWE-208). - Local mode binds 127.0.0.1 instead of 0.0.0.0 unless an explicit non-wildcard host is set, so the default 'local-dev' key is not network-exposed (CWE-798). - Baseline security headers (nosniff, X-Frame-Options DENY, Referrer-Policy, HSTS) via a pure-ASGI middleware that is SSE-safe (CWE-693/1021). - Stop logging decrypted agent-parameter values and full result payloads in validate-agent-parameters (CWE-532). - Allow-list scheduled_method against the agent's declared method paths in the scheduler and workbench execute-now path (CWE-470). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F8GY2d3HJgCKwgCyRgNFMt * fix(security): compare API keys as bytes to avoid TypeError on non-ASCII hmac.compare_digest rejects non-ASCII str inputs, so a malformed X-API-Key with non-ASCII characters raised TypeError (500) instead of failing closed (401/403). Encode both operands to UTF-8 bytes in require_api_key and Server.verify_api_key so malformed credentials are rejected. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F8GY2d3HJgCKwgCyRgNFMt * refactor(security): address review feedback on hardening changes - Scope scheduled-step allow-list to the owning job's agent instead of the union of all agents, so a tampered step cannot invoke another agent's declared methods (per-agent isolation). - Move MutableHeaders import to module scope (repo convention: no function-local imports without a concrete circular/optional/startup reason). - Reword CHANGELOG security bullets to high-level, non-actionable descriptions consistent with the private-advisory disclosure policy. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F8GY2d3HJgCKwgCyRgNFMt * refactor(security): tighten scheduled-step allow-list resolution Address review follow-ups on per-agent method scoping: - Scheduler: if a due step's owning job cannot be resolved, mark the step failed instead of falling back to the union of all agents' methods, so an orphaned/tampered step cannot invoke another agent's method. - Workbench execute-now: verify the job is owned by the request's agent (Jobs().get_job(job_id, agent_name=agent.name)) before using that agent's allow-list, preventing a slug/job-owner mismatch from widening the list. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F8GY2d3HJgCKwgCyRgNFMt * fix(security): use SAMEORIGIN and hoist Jobs import - X-Frame-Options: SAMEORIGIN instead of DENY so the admin instructions iframe (same-origin) still renders, while cross-origin framing stays blocked. - Move the Jobs import in scheduled_steps to module scope (no circular dependency; matches the repo's module-level-imports convention). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F8GY2d3HJgCKwgCyRgNFMt * refactor(admin): hoist scheduled step helper import * fix(security): scope scheduled step ownership checks * ✨ docs: add test summary table to changelog (docs/CHANGELOG.md) * ✨ feat(ci): skip unit tests for docs-only changes in workflow --------- Co-authored-by: Claude <noreply@anthropic.com> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

* apply dependabot insights * minor * chore(ci): SHA-pin actions/checkout and actions/setup-python (#43) Pin all uses of actions/checkout@v6 and actions/setup-python@v6 to their commit SHAs across every workflow, closing the remaining floating-tag attack surface. - actions/checkout → de0fac2e (v6) - actions/setup-python → a309ff8b (v6) * docs(changelog): add unreleased dependency security refresh entry (#44) * chore(ci): add uv cache-suffix per Python version + update AGENTS.md facts (#46) Prevents parallel matrix jobs racing on the same Actions cache reservation. Also records two CI tooling facts in AGENTS.md. * supervaizer-v2-mvp-contracts (#47) * feat: add supervaizer v2 contract primitives * feat: add supervaizer v2 a2a action endpoint * feat: expose supervaizer v2 registration in a2a card * feat: add supervaizer v2 action decorator * docs: update supervaizer v2 changelog * precommit fix * refactor: move controller api version to contracts * minor * fix: scope v2 action handlers by agent * feat: guard supervaizer v2 agent identity * feat: include v2 job state in sync result * feat: add v2 resource form fields * feat: add v2 resource option sources * feat: add v2 awaiting form fields * feat: load supervaizer v2 surfaces over a2a * feat: expose local hello world v2 contract * feat: add v2 job source target type * feat: stream v2 action effects over a2a * fix: advertise v2 push notifications as unsupported * refactor: remove legacy dynamic choices * feat: complete local hello world v2 hitl flow * refactor: remove legacy job poll * docs: refresh generated contract docs * test: align v2 prompt editor fixture * test: align v2 contact import fixture * test: align v2 scenario builder fixture * test: align v2 overview fixture * test: align v2 campaign contact fixture * feat: add v2 registration builder * feat: type v2 dataset display metadata * minor * fix: precommit * feat: add comprehensive documentation for SUPERVAIZER API, Admin Interface, CLI, Parameter Validation, Persistence, Protocols, and REST API * minor * chore: change copyright dates from 2024-2025 to 2024-2026 * fix: harden agent model surface and v2 contract hygiene Use modern typing in agent.py, keep server encrypted params internal, document deterministic agent ids, tighten A2A health status rules, drop legacy hello-world v2 input aliases, and clarify v2 contract fields. * feat: enhance agent method validation and improve v2 action safety - Introduced validation to reject agent methods using blocked module roots.- Added checks to ensure declared method paths are used in agent execution.- Enhanced v2 action results with replay safety metadata validation.- Updated changelog and documentation to reflect these changes. * feat: add v2 resource import contracts * test: align v2 contract fixtures * minor * fix: require auth for a2a controller * minor * Minor * chore: update changelog for Supervaizer v2 enhancements and API key validation improvements - Added optional `metadata` field to `V2CaseSnapshot` for case-level context. - Implemented validation for Studio registration handshake to ensure API key consistency. - Enhanced server API key handling for stability during reloads. - Updated tests to cover new functionality and validation paths. * workspace-agent-grants (#50) * docs: plan workspace agent grants * docs: add Studio grant acceptance UX * feat: add workspace agent authorization * feat: add workspace binding protocol * fix: stabilize workspace authorization * ✨feat: add workspace auth helpers and use them in tests * ✨feat: require workspace auth and tighten agent checks * fix: require workspace auth for Studio A2A * fix: harden workspace authorization checks * fix: normalize malformed workspace auth inputs * minor * feat(logging): implement structured logging for Cloud Logging compatibility - Added support for newline-delimited JSON logging when `SUPERVAIZER_LOG_FORMAT=json` is set. - Updated logging configuration to allow structured logs for access-denial events. - Enhanced `log_access_denied_api` and `log_access_denied_tailscale` functions to include structured fields. - Added tests to verify structured logging outputs in `tests/test_common.py`. * Minor * codex/supervaizer-lifespan-cleanup (#54) * Clean up Supervaizer lifespan shutdown * Document Supervaizer import placement rule * Fix lifespan cleanup test determinism * Address lifespan shutdown review feedback * ✨feat: rename test and assert scheduled step task * ✨ feat: update GitNexus index counts in AGENTS.md * codex/refactor-server-modules (#55) * Refactor Supervaizer server modules * ✨ feat: update GitNexus index stats in AGENTS.md * ✨docs update changelog AGENTS guidance * ✨feat: add v2 methods, tests and license header * minor * codex/agent-interviewer-workspace-jobs-refresh (#56) * Clean up Supervaizer lifespan shutdown * Document Supervaizer import placement rule * Fix lifespan cleanup test determinism * Address lifespan shutdown review feedback * ✨feat: rename test and assert scheduled step task * ✨ feat: update GitNexus index counts in AGENTS.md * feat(v2): add agent action methods * Refactor pre-commit configuration and enhance agent validation - Updated mypy hook to use project-specific configuration for consistency with uv.lock. - Improved validation for v2_registration and v2_method_declarations in Agent class to ensure proper type handling. - Enhanced logging configuration to cast message records for structured logging compatibility. * chore(deps): bump uv from 0.11.14 to 0.11.15 (#58) Bumps [uv](https://github.com/astral-sh/uv) from 0.11.14 to 0.11.15. - [Release notes](https://github.com/astral-sh/uv/releases) - [Changelog](https://github.com/astral-sh/uv/blob/main/CHANGELOG.md) - [Commits](astral-sh/uv@0.11.14...0.11.15) --- updated-dependencies: - dependency-name: uv dependency-version: 0.11.15 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump starlette from 0.50.0 to 1.0.1 (#60) Bumps [starlette](https://github.com/Kludex/starlette) from 0.50.0 to 1.0.1. - [Release notes](https://github.com/Kludex/starlette/releases) - [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md) - [Commits](Kludex/starlette@0.50.0...1.0.1) --- updated-dependencies: - dependency-name: starlette dependency-version: 1.0.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump trufflesecurity/trufflehog from 3.95.3 to 3.95.5 (#61) Bumps [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog) from 3.95.3 to 3.95.5. - [Release notes](https://github.com/trufflesecurity/trufflehog/releases) - [Commits](trufflesecurity/trufflehog@37b7700...d411fff) --- updated-dependencies: - dependency-name: trufflesecurity/trufflehog dependency-version: 3.95.5 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * feat(.agents): add skill symlinks from runwaize skills cookbook Add 21 skill symlinks under .agents/skills/ pointing to the local runwaize_skills_cookbook installation, covering cloud-run basics, Pulumi migration/tooling skills (terraform, CDK, ARM, ESC, component, automation-api, upgrade-provider, best-practices, neo-handoff), Google Cloud WAF pillars (security, reliability, performance, cost-optimization, operational-excellence), google-cloud-recipe-auth, google-cloud-networking-observability, cloudformation-to-pulumi, package-usage, provider-upgrade, and upstream-patches. Update AGENTS.md GitNexus index stats to reflect the current index (6273 symbols, 11483 relationships, 281 execution flows). * chore(deps): bump astral-sh/setup-uv from 8.1.0 to 8.2.0 (#62) Bumps [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) from 8.1.0 to 8.2.0. - [Release notes](https://github.com/astral-sh/setup-uv/releases) - [Commits](astral-sh/setup-uv@0880764...fac544c) --- updated-dependencies: - dependency-name: astral-sh/setup-uv dependency-version: 8.2.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump actions/checkout from 6.0.2 to 6.0.3 (#63) Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.2 to 6.0.3. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@de0fac2...df4cb1c) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 6.0.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump starlette from 1.0.1 to 1.3.1 (#66) Bumps [starlette](https://github.com/Kludex/starlette) from 1.0.1 to 1.3.1. - [Release notes](https://github.com/Kludex/starlette/releases) - [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md) - [Commits](Kludex/starlette@1.0.1...1.3.1) --- updated-dependencies: - dependency-name: starlette dependency-version: 1.3.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump cryptography from 48.0.0 to 48.0.1 (#67) Bumps [cryptography](https://github.com/pyca/cryptography) from 48.0.0 to 48.0.1. - [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst) - [Commits](pyca/cryptography@48.0.0...48.0.1) --- updated-dependencies: - dependency-name: cryptography dependency-version: 48.0.1 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump actions/checkout from 6.0.3 to 7.0.0 (#68) Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.3 to 7.0.0. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@df4cb1c...9c091bb) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump softprops/action-gh-release from 3.0.0 to 3.0.1 (#69) Bumps [softprops/action-gh-release](https://github.com/softprops/action-gh-release) from 3.0.0 to 3.0.1. - [Release notes](https://github.com/softprops/action-gh-release/releases) - [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md) - [Commits](softprops/action-gh-release@b430933...718ea10) --- updated-dependencies: - dependency-name: softprops/action-gh-release dependency-version: 3.0.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump trufflesecurity/trufflehog from 3.95.5 to 3.95.6 (#70) Bumps [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog) from 3.95.5 to 3.95.6. - [Release notes](https://github.com/trufflesecurity/trufflehog/releases) - [Commits](trufflesecurity/trufflehog@d411fff...30d5bb9) --- updated-dependencies: - dependency-name: trufflesecurity/trufflehog dependency-version: 3.95.6 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * codex/managed-context-sdk (#65) * feat: add managed context SDK client * ✨ feat: update gitn docs to use local run.cjs and paginate list_repos * ✨ feat: add MPLv2 license headers to module and test files * fix: address managed context review feedback * ✨ feat(contracts): add V2ContextAssignment for context.assign (#71) * ✨ feat(contracts): add V2ContextAssignment for context.assign * ✨ feat(contracts): constrain context scope and document assignment semantics Address PR #71 review: V2ContextAssignmentItem.scope is now Literal["workspace", "mission"] (matching other closed v2 vocabularies) with a ValidationError regression test, and the v2 doc gains explicit context.assign semantics: refs-not-content payload, freeze-on-pull with provenance, mandatory fetched-vs-assigned version check that fails the assignment on mismatch, and no live context reads during execution. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * 🐛 fix(contracts): require mission_id for mission-scoped context assignments Address PR #71 follow-up review: a V2ContextAssignment containing scope="mission" items but no mission_id passed validation while the agent-side ContextClient.open() would have no mission context to fetch with. A model_validator now rejects that combination; workspace-only assignments still allow a null mission_id. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * 🐛 fix(contracts): reject whitespace-only mission_id for mission-scoped assignments Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com> * feat: bump version to1.3.0 and update deps; iterate nested (#73) * changelog * chore(deps): bump actions/setup-python from 6.2.0 to 6.3.0 (#75) Bumps [actions/setup-python](https://github.com/actions/setup-python) from 6.2.0 to 6.3.0. - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](actions/setup-python@a309ff8...ece7cb0) --- updated-dependencies: - dependency-name: actions/setup-python dependency-version: 6.3.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump trufflesecurity/trufflehog from 3.95.6 to 3.95.7 (#76) Bumps [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog) from 3.95.6 to 3.95.7. - [Release notes](https://github.com/trufflesecurity/trufflehog/releases) - [Commits](trufflesecurity/trufflehog@30d5bb9...f446421) --- updated-dependencies: - dependency-name: trufflesecurity/trufflehog dependency-version: 3.95.7 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * security: review summary (redacted) + safe P0/P1 hardening (#77) * docs: add redacted security & performance review summary Adds a non-actionable high-level summary of a full-source security and performance/scalability review of the SDK (posture, verified-sound controls, severity counts, and remediation themes) and a CHANGELOG entry. Per SECURITY.md, detailed vulnerability findings (exact locations, attack scenarios, remediation specifics) are intentionally kept out of the public repository and handled through the private vulnerability channel. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F8GY2d3HJgCKwgCyRgNFMt * fix(security): harden API-key compare, local-mode bind, headers, logging, scheduler Safe P0/P1 remediations from the security review (no wire-format or auth-model breaking changes): - Constant-time API-key comparison (hmac.compare_digest) in require_api_key and Server.verify_api_key (CWE-208). - Local mode binds 127.0.0.1 instead of 0.0.0.0 unless an explicit non-wildcard host is set, so the default 'local-dev' key is not network-exposed (CWE-798). - Baseline security headers (nosniff, X-Frame-Options DENY, Referrer-Policy, HSTS) via a pure-ASGI middleware that is SSE-safe (CWE-693/1021). - Stop logging decrypted agent-parameter values and full result payloads in validate-agent-parameters (CWE-532). - Allow-list scheduled_method against the agent's declared method paths in the scheduler and workbench execute-now path (CWE-470). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F8GY2d3HJgCKwgCyRgNFMt * fix(security): compare API keys as bytes to avoid TypeError on non-ASCII hmac.compare_digest rejects non-ASCII str inputs, so a malformed X-API-Key with non-ASCII characters raised TypeError (500) instead of failing closed (401/403). Encode both operands to UTF-8 bytes in require_api_key and Server.verify_api_key so malformed credentials are rejected. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F8GY2d3HJgCKwgCyRgNFMt * refactor(security): address review feedback on hardening changes - Scope scheduled-step allow-list to the owning job's agent instead of the union of all agents, so a tampered step cannot invoke another agent's declared methods (per-agent isolation). - Move MutableHeaders import to module scope (repo convention: no function-local imports without a concrete circular/optional/startup reason). - Reword CHANGELOG security bullets to high-level, non-actionable descriptions consistent with the private-advisory disclosure policy. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F8GY2d3HJgCKwgCyRgNFMt * refactor(security): tighten scheduled-step allow-list resolution Address review follow-ups on per-agent method scoping: - Scheduler: if a due step's owning job cannot be resolved, mark the step failed instead of falling back to the union of all agents' methods, so an orphaned/tampered step cannot invoke another agent's method. - Workbench execute-now: verify the job is owned by the request's agent (Jobs().get_job(job_id, agent_name=agent.name)) before using that agent's allow-list, preventing a slug/job-owner mismatch from widening the list. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F8GY2d3HJgCKwgCyRgNFMt * fix(security): use SAMEORIGIN and hoist Jobs import - X-Frame-Options: SAMEORIGIN instead of DENY so the admin instructions iframe (same-origin) still renders, while cross-origin framing stays blocked. - Move the Jobs import in scheduled_steps to module scope (no circular dependency; matches the repo's module-level-imports convention). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F8GY2d3HJgCKwgCyRgNFMt * refactor(admin): hoist scheduled step helper import * fix(security): scope scheduled step ownership checks * ✨ docs: add test summary table to changelog (docs/CHANGELOG.md) * ✨ feat(ci): skip unit tests for docs-only changes in workflow --------- Co-authored-by: Claude <noreply@anthropic.com> * chore(deps): bump trufflesecurity/trufflehog from 3.95.7 to 3.95.9 (#81) Bumps [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog) from 3.95.7 to 3.95.9. - [Release notes](https://github.com/trufflesecurity/trufflehog/releases) - [Commits](trufflesecurity/trufflehog@f446421...27b0417) --- updated-dependencies: - dependency-name: trufflesecurity/trufflehog dependency-version: 3.95.9 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump softprops/action-gh-release from 3.0.1 to 3.0.2 (#82) Bumps [softprops/action-gh-release](https://github.com/softprops/action-gh-release) from 3.0.1 to 3.0.2. - [Release notes](https://github.com/softprops/action-gh-release/releases) - [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md) - [Commits](softprops/action-gh-release@718ea10...3d0d988) --- updated-dependencies: - dependency-name: softprops/action-gh-release dependency-version: 3.0.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump astral-sh/setup-uv from 8.2.0 to 8.3.2 (#83) Bumps [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) from 8.2.0 to 8.3.2. - [Release notes](https://github.com/astral-sh/setup-uv/releases) - [Commits](astral-sh/setup-uv@fac544c...11f9893) --- updated-dependencies: - dependency-name: astral-sh/setup-uv dependency-version: 8.3.2 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump pyasn1 from 0.6.3 to 0.6.4 (#84) Bumps [pyasn1](https://github.com/pyasn1/pyasn1) from 0.6.3 to 0.6.4. - [Release notes](https://github.com/pyasn1/pyasn1/releases) - [Changelog](https://github.com/pyasn1/pyasn1/blob/main/CHANGES.rst) - [Commits](pyasn1/pyasn1@v0.6.3...v0.6.4) --- updated-dependencies: - dependency-name: pyasn1 dependency-version: 0.6.4 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump actions/setup-python from 6.3.0 to 7.0.0 (#85) Bumps [actions/setup-python](https://github.com/actions/setup-python) from 6.3.0 to 7.0.0. - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](actions/setup-python@ece7cb0...5fda3b9) --- updated-dependencies: - dependency-name: actions/setup-python dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump pypa/gh-action-pypi-publish from 1.14.0 to 1.14.1 (#86) Bumps [pypa/gh-action-pypi-publish](https://github.com/pypa/gh-action-pypi-publish) from 1.14.0 to 1.14.1. - [Release notes](https://github.com/pypa/gh-action-pypi-publish/releases) - [Commits](pypa/gh-action-pypi-publish@cef2210...ba38be9) --- updated-dependencies: - dependency-name: pypa/gh-action-pypi-publish dependency-version: 1.14.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump cryptography from 49.0.0 to 50.0.0 (#87) Bumps [cryptography](https://github.com/pyca/cryptography) from 49.0.0 to 50.0.0. - [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst) - [Commits](pyca/cryptography@49.0.0...50.0.0) --- updated-dependencies: - dependency-name: cryptography dependency-version: 50.0.0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * feat: add generic job setup contract (#89) * feat: add generic job setup contract * 🐛 fix(contracts): stop V2JobSetupPolicy defaulting to every action scope An agent opting in with job_policy={"setup": {}} advertised support for the workspace, job, case and step scopes without declaring any, which broadens the contract Studio sees. Default to an empty list, matching V2JobSyncPolicy.supported_statuses. Also declare V2JobSetupPolicy before V2JobPolicy so the generated model reference renders the real type instead of a ForwardRef. * 📝 docs: regenerate model reference and OpenAPI Picks up the job setup contract (V2JobPolicy.setup, V2JobSetupPolicy, V2ActionResult.setup_plan) plus accumulated drift since 0.20.1. * 📝 docs: log generic job setup contract in CHANGELOG Records the V2JobSetupPolicy contract, the empty action_scopes default, and the model reference regeneration under Unreleased. * 🐛 fix(contracts): reject blank job setup and sync action ids An empty preview_action/start_action/submit_action was accepted, then dropped from capabilities.actions by _unique_strings while still being serialized under job_policy.setup, so Studio saw an action it could never invoke. Validate all three as non-blank, plus V2JobSyncPolicy.action, which had the same gap. * doc --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com> Co-authored-by: Cursor <cursoragent@cursor.com>

* apply dependabot insights * minor * chore(ci): SHA-pin actions/checkout and actions/setup-python (#43) Pin all uses of actions/checkout@v6 and actions/setup-python@v6 to their commit SHAs across every workflow, closing the remaining floating-tag attack surface. - actions/checkout → de0fac2e (v6) - actions/setup-python → a309ff8b (v6) * docs(changelog): add unreleased dependency security refresh entry (#44) * chore(ci): add uv cache-suffix per Python version + update AGENTS.md facts (#46) Prevents parallel matrix jobs racing on the same Actions cache reservation. Also records two CI tooling facts in AGENTS.md. * supervaizer-v2-mvp-contracts (#47) * feat: add supervaizer v2 contract primitives * feat: add supervaizer v2 a2a action endpoint * feat: expose supervaizer v2 registration in a2a card * feat: add supervaizer v2 action decorator * docs: update supervaizer v2 changelog * precommit fix * refactor: move controller api version to contracts * minor * fix: scope v2 action handlers by agent * feat: guard supervaizer v2 agent identity * feat: include v2 job state in sync result * feat: add v2 resource form fields * feat: add v2 resource option sources * feat: add v2 awaiting form fields * feat: load supervaizer v2 surfaces over a2a * feat: expose local hello world v2 contract * feat: add v2 job source target type * feat: stream v2 action effects over a2a * fix: advertise v2 push notifications as unsupported * refactor: remove legacy dynamic choices * feat: complete local hello world v2 hitl flow * refactor: remove legacy job poll * docs: refresh generated contract docs * test: align v2 prompt editor fixture * test: align v2 contact import fixture * test: align v2 scenario builder fixture * test: align v2 overview fixture * test: align v2 campaign contact fixture * feat: add v2 registration builder * feat: type v2 dataset display metadata * minor * fix: precommit * feat: add comprehensive documentation for SUPERVAIZER API, Admin Interface, CLI, Parameter Validation, Persistence, Protocols, and REST API * minor * chore: change copyright dates from 2024-2025 to 2024-2026 * fix: harden agent model surface and v2 contract hygiene Use modern typing in agent.py, keep server encrypted params internal, document deterministic agent ids, tighten A2A health status rules, drop legacy hello-world v2 input aliases, and clarify v2 contract fields. * feat: enhance agent method validation and improve v2 action safety - Introduced validation to reject agent methods using blocked module roots.- Added checks to ensure declared method paths are used in agent execution.- Enhanced v2 action results with replay safety metadata validation.- Updated changelog and documentation to reflect these changes. * feat: add v2 resource import contracts * test: align v2 contract fixtures * minor * fix: require auth for a2a controller * minor * Minor * chore: update changelog for Supervaizer v2 enhancements and API key validation improvements - Added optional `metadata` field to `V2CaseSnapshot` for case-level context. - Implemented validation for Studio registration handshake to ensure API key consistency. - Enhanced server API key handling for stability during reloads. - Updated tests to cover new functionality and validation paths. * workspace-agent-grants (#50) * docs: plan workspace agent grants * docs: add Studio grant acceptance UX * feat: add workspace agent authorization * feat: add workspace binding protocol * fix: stabilize workspace authorization * ✨feat: add workspace auth helpers and use them in tests * ✨feat: require workspace auth and tighten agent checks * fix: require workspace auth for Studio A2A * fix: harden workspace authorization checks * fix: normalize malformed workspace auth inputs * minor * feat(logging): implement structured logging for Cloud Logging compatibility - Added support for newline-delimited JSON logging when `SUPERVAIZER_LOG_FORMAT=json` is set. - Updated logging configuration to allow structured logs for access-denial events. - Enhanced `log_access_denied_api` and `log_access_denied_tailscale` functions to include structured fields. - Added tests to verify structured logging outputs in `tests/test_common.py`. * Minor * codex/supervaizer-lifespan-cleanup (#54) * Clean up Supervaizer lifespan shutdown * Document Supervaizer import placement rule * Fix lifespan cleanup test determinism * Address lifespan shutdown review feedback * ✨feat: rename test and assert scheduled step task * ✨ feat: update GitNexus index counts in AGENTS.md * codex/refactor-server-modules (#55) * Refactor Supervaizer server modules * ✨ feat: update GitNexus index stats in AGENTS.md * ✨docs update changelog AGENTS guidance * ✨feat: add v2 methods, tests and license header * minor * codex/agent-interviewer-workspace-jobs-refresh (#56) * Clean up Supervaizer lifespan shutdown * Document Supervaizer import placement rule * Fix lifespan cleanup test determinism * Address lifespan shutdown review feedback * ✨feat: rename test and assert scheduled step task * ✨ feat: update GitNexus index counts in AGENTS.md * feat(v2): add agent action methods * Refactor pre-commit configuration and enhance agent validation - Updated mypy hook to use project-specific configuration for consistency with uv.lock. - Improved validation for v2_registration and v2_method_declarations in Agent class to ensure proper type handling. - Enhanced logging configuration to cast message records for structured logging compatibility. * chore(deps): bump uv from 0.11.14 to 0.11.15 (#58) Bumps [uv](https://github.com/astral-sh/uv) from 0.11.14 to 0.11.15. - [Release notes](https://github.com/astral-sh/uv/releases) - [Changelog](https://github.com/astral-sh/uv/blob/main/CHANGELOG.md) - [Commits](astral-sh/uv@0.11.14...0.11.15) --- updated-dependencies: - dependency-name: uv dependency-version: 0.11.15 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump starlette from 0.50.0 to 1.0.1 (#60) Bumps [starlette](https://github.com/Kludex/starlette) from 0.50.0 to 1.0.1. - [Release notes](https://github.com/Kludex/starlette/releases) - [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md) - [Commits](Kludex/starlette@0.50.0...1.0.1) --- updated-dependencies: - dependency-name: starlette dependency-version: 1.0.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump trufflesecurity/trufflehog from 3.95.3 to 3.95.5 (#61) Bumps [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog) from 3.95.3 to 3.95.5. - [Release notes](https://github.com/trufflesecurity/trufflehog/releases) - [Commits](trufflesecurity/trufflehog@37b7700...d411fff) --- updated-dependencies: - dependency-name: trufflesecurity/trufflehog dependency-version: 3.95.5 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * feat(.agents): add skill symlinks from runwaize skills cookbook Add 21 skill symlinks under .agents/skills/ pointing to the local runwaize_skills_cookbook installation, covering cloud-run basics, Pulumi migration/tooling skills (terraform, CDK, ARM, ESC, component, automation-api, upgrade-provider, best-practices, neo-handoff), Google Cloud WAF pillars (security, reliability, performance, cost-optimization, operational-excellence), google-cloud-recipe-auth, google-cloud-networking-observability, cloudformation-to-pulumi, package-usage, provider-upgrade, and upstream-patches. Update AGENTS.md GitNexus index stats to reflect the current index (6273 symbols, 11483 relationships, 281 execution flows). * chore(deps): bump astral-sh/setup-uv from 8.1.0 to 8.2.0 (#62) Bumps [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) from 8.1.0 to 8.2.0. - [Release notes](https://github.com/astral-sh/setup-uv/releases) - [Commits](astral-sh/setup-uv@0880764...fac544c) --- updated-dependencies: - dependency-name: astral-sh/setup-uv dependency-version: 8.2.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump actions/checkout from 6.0.2 to 6.0.3 (#63) Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.2 to 6.0.3. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@de0fac2...df4cb1c) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 6.0.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump starlette from 1.0.1 to 1.3.1 (#66) Bumps [starlette](https://github.com/Kludex/starlette) from 1.0.1 to 1.3.1. - [Release notes](https://github.com/Kludex/starlette/releases) - [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md) - [Commits](Kludex/starlette@1.0.1...1.3.1) --- updated-dependencies: - dependency-name: starlette dependency-version: 1.3.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump cryptography from 48.0.0 to 48.0.1 (#67) Bumps [cryptography](https://github.com/pyca/cryptography) from 48.0.0 to 48.0.1. - [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst) - [Commits](pyca/cryptography@48.0.0...48.0.1) --- updated-dependencies: - dependency-name: cryptography dependency-version: 48.0.1 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump actions/checkout from 6.0.3 to 7.0.0 (#68) Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.3 to 7.0.0. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@df4cb1c...9c091bb) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump softprops/action-gh-release from 3.0.0 to 3.0.1 (#69) Bumps [softprops/action-gh-release](https://github.com/softprops/action-gh-release) from 3.0.0 to 3.0.1. - [Release notes](https://github.com/softprops/action-gh-release/releases) - [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md) - [Commits](softprops/action-gh-release@b430933...718ea10) --- updated-dependencies: - dependency-name: softprops/action-gh-release dependency-version: 3.0.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump trufflesecurity/trufflehog from 3.95.5 to 3.95.6 (#70) Bumps [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog) from 3.95.5 to 3.95.6. - [Release notes](https://github.com/trufflesecurity/trufflehog/releases) - [Commits](trufflesecurity/trufflehog@d411fff...30d5bb9) --- updated-dependencies: - dependency-name: trufflesecurity/trufflehog dependency-version: 3.95.6 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * codex/managed-context-sdk (#65) * feat: add managed context SDK client * ✨ feat: update gitn docs to use local run.cjs and paginate list_repos * ✨ feat: add MPLv2 license headers to module and test files * fix: address managed context review feedback * ✨ feat(contracts): add V2ContextAssignment for context.assign (#71) * ✨ feat(contracts): add V2ContextAssignment for context.assign * ✨ feat(contracts): constrain context scope and document assignment semantics Address PR #71 review: V2ContextAssignmentItem.scope is now Literal["workspace", "mission"] (matching other closed v2 vocabularies) with a ValidationError regression test, and the v2 doc gains explicit context.assign semantics: refs-not-content payload, freeze-on-pull with provenance, mandatory fetched-vs-assigned version check that fails the assignment on mismatch, and no live context reads during execution. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * 🐛 fix(contracts): require mission_id for mission-scoped context assignments Address PR #71 follow-up review: a V2ContextAssignment containing scope="mission" items but no mission_id passed validation while the agent-side ContextClient.open() would have no mission context to fetch with. A model_validator now rejects that combination; workspace-only assignments still allow a null mission_id. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * 🐛 fix(contracts): reject whitespace-only mission_id for mission-scoped assignments Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com> * feat: bump version to1.3.0 and update deps; iterate nested (#73) * changelog * chore(deps): bump actions/setup-python from 6.2.0 to 6.3.0 (#75) Bumps [actions/setup-python](https://github.com/actions/setup-python) from 6.2.0 to 6.3.0. - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](actions/setup-python@a309ff8...ece7cb0) --- updated-dependencies: - dependency-name: actions/setup-python dependency-version: 6.3.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump trufflesecurity/trufflehog from 3.95.6 to 3.95.7 (#76) Bumps [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog) from 3.95.6 to 3.95.7. - [Release notes](https://github.com/trufflesecurity/trufflehog/releases) - [Commits](trufflesecurity/trufflehog@30d5bb9...f446421) --- updated-dependencies: - dependency-name: trufflesecurity/trufflehog dependency-version: 3.95.7 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * security: review summary (redacted) + safe P0/P1 hardening (#77) * docs: add redacted security & performance review summary Adds a non-actionable high-level summary of a full-source security and performance/scalability review of the SDK (posture, verified-sound controls, severity counts, and remediation themes) and a CHANGELOG entry. Per SECURITY.md, detailed vulnerability findings (exact locations, attack scenarios, remediation specifics) are intentionally kept out of the public repository and handled through the private vulnerability channel. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F8GY2d3HJgCKwgCyRgNFMt * fix(security): harden API-key compare, local-mode bind, headers, logging, scheduler Safe P0/P1 remediations from the security review (no wire-format or auth-model breaking changes): - Constant-time API-key comparison (hmac.compare_digest) in require_api_key and Server.verify_api_key (CWE-208). - Local mode binds 127.0.0.1 instead of 0.0.0.0 unless an explicit non-wildcard host is set, so the default 'local-dev' key is not network-exposed (CWE-798). - Baseline security headers (nosniff, X-Frame-Options DENY, Referrer-Policy, HSTS) via a pure-ASGI middleware that is SSE-safe (CWE-693/1021). - Stop logging decrypted agent-parameter values and full result payloads in validate-agent-parameters (CWE-532). - Allow-list scheduled_method against the agent's declared method paths in the scheduler and workbench execute-now path (CWE-470). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F8GY2d3HJgCKwgCyRgNFMt * fix(security): compare API keys as bytes to avoid TypeError on non-ASCII hmac.compare_digest rejects non-ASCII str inputs, so a malformed X-API-Key with non-ASCII characters raised TypeError (500) instead of failing closed (401/403). Encode both operands to UTF-8 bytes in require_api_key and Server.verify_api_key so malformed credentials are rejected. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F8GY2d3HJgCKwgCyRgNFMt * refactor(security): address review feedback on hardening changes - Scope scheduled-step allow-list to the owning job's agent instead of the union of all agents, so a tampered step cannot invoke another agent's declared methods (per-agent isolation). - Move MutableHeaders import to module scope (repo convention: no function-local imports without a concrete circular/optional/startup reason). - Reword CHANGELOG security bullets to high-level, non-actionable descriptions consistent with the private-advisory disclosure policy. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F8GY2d3HJgCKwgCyRgNFMt * refactor(security): tighten scheduled-step allow-list resolution Address review follow-ups on per-agent method scoping: - Scheduler: if a due step's owning job cannot be resolved, mark the step failed instead of falling back to the union of all agents' methods, so an orphaned/tampered step cannot invoke another agent's method. - Workbench execute-now: verify the job is owned by the request's agent (Jobs().get_job(job_id, agent_name=agent.name)) before using that agent's allow-list, preventing a slug/job-owner mismatch from widening the list. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F8GY2d3HJgCKwgCyRgNFMt * fix(security): use SAMEORIGIN and hoist Jobs import - X-Frame-Options: SAMEORIGIN instead of DENY so the admin instructions iframe (same-origin) still renders, while cross-origin framing stays blocked. - Move the Jobs import in scheduled_steps to module scope (no circular dependency; matches the repo's module-level-imports convention). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F8GY2d3HJgCKwgCyRgNFMt * refactor(admin): hoist scheduled step helper import * fix(security): scope scheduled step ownership checks * ✨ docs: add test summary table to changelog (docs/CHANGELOG.md) * ✨ feat(ci): skip unit tests for docs-only changes in workflow --------- Co-authored-by: Claude <noreply@anthropic.com> * chore(deps): bump trufflesecurity/trufflehog from 3.95.7 to 3.95.9 (#81) Bumps [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog) from 3.95.7 to 3.95.9. - [Release notes](https://github.com/trufflesecurity/trufflehog/releases) - [Commits](trufflesecurity/trufflehog@f446421...27b0417) --- updated-dependencies: - dependency-name: trufflesecurity/trufflehog dependency-version: 3.95.9 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump softprops/action-gh-release from 3.0.1 to 3.0.2 (#82) Bumps [softprops/action-gh-release](https://github.com/softprops/action-gh-release) from 3.0.1 to 3.0.2. - [Release notes](https://github.com/softprops/action-gh-release/releases) - [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md) - [Commits](softprops/action-gh-release@718ea10...3d0d988) --- updated-dependencies: - dependency-name: softprops/action-gh-release dependency-version: 3.0.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump astral-sh/setup-uv from 8.2.0 to 8.3.2 (#83) Bumps [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) from 8.2.0 to 8.3.2. - [Release notes](https://github.com/astral-sh/setup-uv/releases) - [Commits](astral-sh/setup-uv@fac544c...11f9893) --- updated-dependencies: - dependency-name: astral-sh/setup-uv dependency-version: 8.3.2 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump pyasn1 from 0.6.3 to 0.6.4 (#84) Bumps [pyasn1](https://github.com/pyasn1/pyasn1) from 0.6.3 to 0.6.4. - [Release notes](https://github.com/pyasn1/pyasn1/releases) - [Changelog](https://github.com/pyasn1/pyasn1/blob/main/CHANGES.rst) - [Commits](pyasn1/pyasn1@v0.6.3...v0.6.4) --- updated-dependencies: - dependency-name: pyasn1 dependency-version: 0.6.4 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump actions/setup-python from 6.3.0 to 7.0.0 (#85) Bumps [actions/setup-python](https://github.com/actions/setup-python) from 6.3.0 to 7.0.0. - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](actions/setup-python@ece7cb0...5fda3b9) --- updated-dependencies: - dependency-name: actions/setup-python dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump pypa/gh-action-pypi-publish from 1.14.0 to 1.14.1 (#86) Bumps [pypa/gh-action-pypi-publish](https://github.com/pypa/gh-action-pypi-publish) from 1.14.0 to 1.14.1. - [Release notes](https://github.com/pypa/gh-action-pypi-publish/releases) - [Commits](pypa/gh-action-pypi-publish@cef2210...ba38be9) --- updated-dependencies: - dependency-name: pypa/gh-action-pypi-publish dependency-version: 1.14.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump cryptography from 49.0.0 to 50.0.0 (#87) Bumps [cryptography](https://github.com/pyca/cryptography) from 49.0.0 to 50.0.0. - [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst) - [Commits](pyca/cryptography@49.0.0...50.0.0) --- updated-dependencies: - dependency-name: cryptography dependency-version: 50.0.0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * feat: add generic job setup contract (#89) * feat: add generic job setup contract * 🐛 fix(contracts): stop V2JobSetupPolicy defaulting to every action scope An agent opting in with job_policy={"setup": {}} advertised support for the workspace, job, case and step scopes without declaring any, which broadens the contract Studio sees. Default to an empty list, matching V2JobSyncPolicy.supported_statuses. Also declare V2JobSetupPolicy before V2JobPolicy so the generated model reference renders the real type instead of a ForwardRef. * 📝 docs: regenerate model reference and OpenAPI Picks up the job setup contract (V2JobPolicy.setup, V2JobSetupPolicy, V2ActionResult.setup_plan) plus accumulated drift since 0.20.1. * 📝 docs: log generic job setup contract in CHANGELOG Records the V2JobSetupPolicy contract, the empty action_scopes default, and the model reference regeneration under Unreleased. * 🐛 fix(contracts): reject blank job setup and sync action ids An empty preview_action/start_action/submit_action was accepted, then dropped from capabilities.actions by _unique_strings while still being serialized under job_policy.setup, so Studio saw an action it could never invoke. Validate all three as non-blank, plus V2JobSyncPolicy.action, which had the same gap. * doc * changelog update * ✨ feat(contracts): declare action scope and mutability (#92) (#93) * ✨ feat(contracts): declare action scope and mutability (#92) V2AgentCapabilities.actions becomes list[V2ActionDefinition] carrying id, mutating and scope, so consumers authorize and group actions from declared metadata instead of pattern-matching the caller-supplied id. Bare strings still validate and coerce to mutating=True, scope=job. The builder derives metadata from each action's parent definition; precedence is explicit > derived > bare. Also adds V2DatasetDefinition.scope and V2AwaitingState.reopenable. * 📝 chore: update documentation * 🐛 fix(contracts): keep explicit action metadata when an id is declared twice An id given both as a V2ActionDefinition and as a bare string in actions= marked the id bare regardless of which declaration was retained, so the derived entry then overwrote the explicit metadata. Bareness is now tracked per retained declaration and an explicit definition wins wherever the two appear. * Changelog --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com> Co-authored-by: Cursor <cursoragent@cursor.com>

chatgpt-codex-connector Bot reviewed Jun 17, 2026

View reviewed changes

qodo-code-review Bot reviewed Jun 17, 2026

View reviewed changes

Comment thread src/supervaizer/context.py

Comment thread tests/test_context_client.py

alain-sv force-pushed the codex/managed-context-sdk branch from 2874f48 to 0e2a012 Compare July 2, 2026 11:32

chatgpt-codex-connector Bot reviewed Jul 2, 2026

View reviewed changes

alain-sv added 3 commits July 2, 2026 14:38

feat: add managed context SDK client

7f80036

✨ feat: update gitn docs to use local run.cjs and paginate list_repos

894eb2b

✨ feat: add MPLv2 license headers to module and test files

18cc23a

alain-sv force-pushed the codex/managed-context-sdk branch from 0e2a012 to 18cc23a Compare July 2, 2026 11:40

alain-sv mentioned this pull request Jul 2, 2026

✨ feat(contracts): add V2ContextAssignment for context.assign #71

Merged

chatgpt-codex-connector Bot reviewed Jul 2, 2026

View reviewed changes

Comment thread src/supervaizer/context.py Outdated

fix: address managed context review feedback

bcb385d

alain-sv merged commit dbd4e3f into develop Jul 2, 2026
17 checks passed

qodo-code-review Bot mentioned this pull request Jul 2, 2026

[MINOR] chore: merge develop to main #72

Merged

Navigation Menu

Uh oh!

codex/managed-context-sdk - #65

codex/managed-context-sdk#65
alain-sv merged 4 commits into
developfrom
codex/managed-context-sdk

alain-sv commented Jun 17, 2026

Uh oh!

qodo-code-review Bot commented Jun 17, 2026

Uh oh!

qodo-code-review Bot commented Jun 17, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

chatgpt-codex-connector Bot Jun 17, 2026

Uh oh!

alain-sv Jul 2, 2026

Uh oh!

qodo-code-review Bot commented Jun 17, 2026 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

chatgpt-codex-connector Bot Jul 2, 2026

Uh oh!

alain-sv Jul 2, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

alain-sv commented Jun 17, 2026

Uh oh!

qodo-code-review Bot commented Jun 17, 2026

CI Feedback 🧐

Uh oh!

qodo-code-review Bot commented Jun 17, 2026

PR Summary by Qodo

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Jun 17, 2026

Choose a reason for hiding this comment

Uh oh!

alain-sv Jul 2, 2026

Choose a reason for hiding this comment

Uh oh!

qodo-code-review Bot commented Jun 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Review by Qodo

Uh oh!

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Jul 2, 2026

Choose a reason for hiding this comment

Uh oh!

alain-sv Jul 2, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

qodo-code-review Bot commented Jun 17, 2026 •

edited

Loading