chore(deps): bump trufflesecurity/trufflehog from 3.95.5 to 3.95.6 - #70
Merged
alain-sv merged 1 commit intoJul 2, 2026
Conversation
Bumps [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog) from 3.95.5 to 3.95.6. - [Release notes](https://github.com/trufflesecurity/trufflehog/releases) - [Commits](trufflesecurity/trufflehog@d411fff...30d5bb9) --- updated-dependencies: - dependency-name: trufflesecurity/trufflehog dependency-version: 3.95.6 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
dependabot
Bot
deleted the
dependabot/github_actions/develop/trufflesecurity/trufflehog-3.95.6
branch
July 2, 2026 11:34
alain-sv
added a commit
that referenced
this pull request
Jul 2, 2026
* apply dependabot insights * minor * chore(ci): SHA-pin actions/checkout and actions/setup-python (#43) Pin all uses of actions/checkout@v6 and actions/setup-python@v6 to their commit SHAs across every workflow, closing the remaining floating-tag attack surface. - actions/checkout → de0fac2e (v6) - actions/setup-python → a309ff8b (v6) * docs(changelog): add unreleased dependency security refresh entry (#44) * chore(ci): add uv cache-suffix per Python version + update AGENTS.md facts (#46) Prevents parallel matrix jobs racing on the same Actions cache reservation. Also records two CI tooling facts in AGENTS.md. * supervaizer-v2-mvp-contracts (#47) * feat: add supervaizer v2 contract primitives * feat: add supervaizer v2 a2a action endpoint * feat: expose supervaizer v2 registration in a2a card * feat: add supervaizer v2 action decorator * docs: update supervaizer v2 changelog * precommit fix * refactor: move controller api version to contracts * minor * fix: scope v2 action handlers by agent * feat: guard supervaizer v2 agent identity * feat: include v2 job state in sync result * feat: add v2 resource form fields * feat: add v2 resource option sources * feat: add v2 awaiting form fields * feat: load supervaizer v2 surfaces over a2a * feat: expose local hello world v2 contract * feat: add v2 job source target type * feat: stream v2 action effects over a2a * fix: advertise v2 push notifications as unsupported * refactor: remove legacy dynamic choices * feat: complete local hello world v2 hitl flow * refactor: remove legacy job poll * docs: refresh generated contract docs * test: align v2 prompt editor fixture * test: align v2 contact import fixture * test: align v2 scenario builder fixture * test: align v2 overview fixture * test: align v2 campaign contact fixture * feat: add v2 registration builder * feat: type v2 dataset display metadata * minor * fix: precommit * feat: add comprehensive documentation for SUPERVAIZER API, Admin Interface, CLI, Parameter Validation, Persistence, Protocols, and REST API * minor * chore: change copyright dates from 2024-2025 to 2024-2026 * fix: harden agent model surface and v2 contract hygiene Use modern typing in agent.py, keep server encrypted params internal, document deterministic agent ids, tighten A2A health status rules, drop legacy hello-world v2 input aliases, and clarify v2 contract fields. * feat: enhance agent method validation and improve v2 action safety - Introduced validation to reject agent methods using blocked module roots.- Added checks to ensure declared method paths are used in agent execution.- Enhanced v2 action results with replay safety metadata validation.- Updated changelog and documentation to reflect these changes. * feat: add v2 resource import contracts * test: align v2 contract fixtures * minor * fix: require auth for a2a controller * minor * Minor * chore: update changelog for Supervaizer v2 enhancements and API key validation improvements - Added optional `metadata` field to `V2CaseSnapshot` for case-level context. - Implemented validation for Studio registration handshake to ensure API key consistency. - Enhanced server API key handling for stability during reloads. - Updated tests to cover new functionality and validation paths. * workspace-agent-grants (#50) * docs: plan workspace agent grants * docs: add Studio grant acceptance UX * feat: add workspace agent authorization * feat: add workspace binding protocol * fix: stabilize workspace authorization * ✨feat: add workspace auth helpers and use them in tests * ✨feat: require workspace auth and tighten agent checks * fix: require workspace auth for Studio A2A * fix: harden workspace authorization checks * fix: normalize malformed workspace auth inputs * minor * feat(logging): implement structured logging for Cloud Logging compatibility - Added support for newline-delimited JSON logging when `SUPERVAIZER_LOG_FORMAT=json` is set. - Updated logging configuration to allow structured logs for access-denial events. - Enhanced `log_access_denied_api` and `log_access_denied_tailscale` functions to include structured fields. - Added tests to verify structured logging outputs in `tests/test_common.py`. * Minor * codex/supervaizer-lifespan-cleanup (#54) * Clean up Supervaizer lifespan shutdown * Document Supervaizer import placement rule * Fix lifespan cleanup test determinism * Address lifespan shutdown review feedback * ✨feat: rename test and assert scheduled step task * ✨ feat: update GitNexus index counts in AGENTS.md * codex/refactor-server-modules (#55) * Refactor Supervaizer server modules * ✨ feat: update GitNexus index stats in AGENTS.md * ✨docs update changelog AGENTS guidance * ✨feat: add v2 methods, tests and license header * minor * codex/agent-interviewer-workspace-jobs-refresh (#56) * Clean up Supervaizer lifespan shutdown * Document Supervaizer import placement rule * Fix lifespan cleanup test determinism * Address lifespan shutdown review feedback * ✨feat: rename test and assert scheduled step task * ✨ feat: update GitNexus index counts in AGENTS.md * feat(v2): add agent action methods * Refactor pre-commit configuration and enhance agent validation - Updated mypy hook to use project-specific configuration for consistency with uv.lock. - Improved validation for v2_registration and v2_method_declarations in Agent class to ensure proper type handling. - Enhanced logging configuration to cast message records for structured logging compatibility. * chore(deps): bump uv from 0.11.14 to 0.11.15 (#58) Bumps [uv](https://github.com/astral-sh/uv) from 0.11.14 to 0.11.15. - [Release notes](https://github.com/astral-sh/uv/releases) - [Changelog](https://github.com/astral-sh/uv/blob/main/CHANGELOG.md) - [Commits](astral-sh/uv@0.11.14...0.11.15) --- updated-dependencies: - dependency-name: uv dependency-version: 0.11.15 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump starlette from 0.50.0 to 1.0.1 (#60) Bumps [starlette](https://github.com/Kludex/starlette) from 0.50.0 to 1.0.1. - [Release notes](https://github.com/Kludex/starlette/releases) - [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md) - [Commits](Kludex/starlette@0.50.0...1.0.1) --- updated-dependencies: - dependency-name: starlette dependency-version: 1.0.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump trufflesecurity/trufflehog from 3.95.3 to 3.95.5 (#61) Bumps [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog) from 3.95.3 to 3.95.5. - [Release notes](https://github.com/trufflesecurity/trufflehog/releases) - [Commits](trufflesecurity/trufflehog@37b7700...d411fff) --- updated-dependencies: - dependency-name: trufflesecurity/trufflehog dependency-version: 3.95.5 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * feat(.agents): add skill symlinks from runwaize skills cookbook Add 21 skill symlinks under .agents/skills/ pointing to the local runwaize_skills_cookbook installation, covering cloud-run basics, Pulumi migration/tooling skills (terraform, CDK, ARM, ESC, component, automation-api, upgrade-provider, best-practices, neo-handoff), Google Cloud WAF pillars (security, reliability, performance, cost-optimization, operational-excellence), google-cloud-recipe-auth, google-cloud-networking-observability, cloudformation-to-pulumi, package-usage, provider-upgrade, and upstream-patches. Update AGENTS.md GitNexus index stats to reflect the current index (6273 symbols, 11483 relationships, 281 execution flows). * chore(deps): bump astral-sh/setup-uv from 8.1.0 to 8.2.0 (#62) Bumps [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) from 8.1.0 to 8.2.0. - [Release notes](https://github.com/astral-sh/setup-uv/releases) - [Commits](astral-sh/setup-uv@0880764...fac544c) --- updated-dependencies: - dependency-name: astral-sh/setup-uv dependency-version: 8.2.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump actions/checkout from 6.0.2 to 6.0.3 (#63) Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.2 to 6.0.3. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@de0fac2...df4cb1c) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 6.0.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump starlette from 1.0.1 to 1.3.1 (#66) Bumps [starlette](https://github.com/Kludex/starlette) from 1.0.1 to 1.3.1. - [Release notes](https://github.com/Kludex/starlette/releases) - [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md) - [Commits](Kludex/starlette@1.0.1...1.3.1) --- updated-dependencies: - dependency-name: starlette dependency-version: 1.3.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump cryptography from 48.0.0 to 48.0.1 (#67) Bumps [cryptography](https://github.com/pyca/cryptography) from 48.0.0 to 48.0.1. - [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst) - [Commits](pyca/cryptography@48.0.0...48.0.1) --- updated-dependencies: - dependency-name: cryptography dependency-version: 48.0.1 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump actions/checkout from 6.0.3 to 7.0.0 (#68) Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.3 to 7.0.0. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@df4cb1c...9c091bb) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump softprops/action-gh-release from 3.0.0 to 3.0.1 (#69) Bumps [softprops/action-gh-release](https://github.com/softprops/action-gh-release) from 3.0.0 to 3.0.1. - [Release notes](https://github.com/softprops/action-gh-release/releases) - [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md) - [Commits](softprops/action-gh-release@b430933...718ea10) --- updated-dependencies: - dependency-name: softprops/action-gh-release dependency-version: 3.0.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump trufflesecurity/trufflehog from 3.95.5 to 3.95.6 (#70) Bumps [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog) from 3.95.5 to 3.95.6. - [Release notes](https://github.com/trufflesecurity/trufflehog/releases) - [Commits](trufflesecurity/trufflehog@d411fff...30d5bb9) --- updated-dependencies: - dependency-name: trufflesecurity/trufflehog dependency-version: 3.95.6 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * codex/managed-context-sdk (#65) * feat: add managed context SDK client * ✨ feat: update gitn docs to use local run.cjs and paginate list_repos * ✨ feat: add MPLv2 license headers to module and test files * fix: address managed context review feedback * ✨ feat(contracts): add V2ContextAssignment for context.assign (#71) * ✨ feat(contracts): add V2ContextAssignment for context.assign * ✨ feat(contracts): constrain context scope and document assignment semantics Address PR #71 review: V2ContextAssignmentItem.scope is now Literal["workspace", "mission"] (matching other closed v2 vocabularies) with a ValidationError regression test, and the v2 doc gains explicit context.assign semantics: refs-not-content payload, freeze-on-pull with provenance, mandatory fetched-vs-assigned version check that fails the assignment on mismatch, and no live context reads during execution. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * 🐛 fix(contracts): require mission_id for mission-scoped context assignments Address PR #71 follow-up review: a V2ContextAssignment containing scope="mission" items but no mission_id passed validation while the agent-side ContextClient.open() would have no mission context to fetch with. A model_validator now rejects that combination; workspace-only assignments still allow a null mission_id. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * 🐛 fix(contracts): reject whitespace-only mission_id for mission-scoped assignments Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
alain-sv
added a commit
that referenced
this pull request
Jul 2, 2026
* apply dependabot insights * minor * chore(ci): SHA-pin actions/checkout and actions/setup-python (#43) Pin all uses of actions/checkout@v6 and actions/setup-python@v6 to their commit SHAs across every workflow, closing the remaining floating-tag attack surface. - actions/checkout → de0fac2e (v6) - actions/setup-python → a309ff8b (v6) * docs(changelog): add unreleased dependency security refresh entry (#44) * chore(ci): add uv cache-suffix per Python version + update AGENTS.md facts (#46) Prevents parallel matrix jobs racing on the same Actions cache reservation. Also records two CI tooling facts in AGENTS.md. * supervaizer-v2-mvp-contracts (#47) * feat: add supervaizer v2 contract primitives * feat: add supervaizer v2 a2a action endpoint * feat: expose supervaizer v2 registration in a2a card * feat: add supervaizer v2 action decorator * docs: update supervaizer v2 changelog * precommit fix * refactor: move controller api version to contracts * minor * fix: scope v2 action handlers by agent * feat: guard supervaizer v2 agent identity * feat: include v2 job state in sync result * feat: add v2 resource form fields * feat: add v2 resource option sources * feat: add v2 awaiting form fields * feat: load supervaizer v2 surfaces over a2a * feat: expose local hello world v2 contract * feat: add v2 job source target type * feat: stream v2 action effects over a2a * fix: advertise v2 push notifications as unsupported * refactor: remove legacy dynamic choices * feat: complete local hello world v2 hitl flow * refactor: remove legacy job poll * docs: refresh generated contract docs * test: align v2 prompt editor fixture * test: align v2 contact import fixture * test: align v2 scenario builder fixture * test: align v2 overview fixture * test: align v2 campaign contact fixture * feat: add v2 registration builder * feat: type v2 dataset display metadata * minor * fix: precommit * feat: add comprehensive documentation for SUPERVAIZER API, Admin Interface, CLI, Parameter Validation, Persistence, Protocols, and REST API * minor * chore: change copyright dates from 2024-2025 to 2024-2026 * fix: harden agent model surface and v2 contract hygiene Use modern typing in agent.py, keep server encrypted params internal, document deterministic agent ids, tighten A2A health status rules, drop legacy hello-world v2 input aliases, and clarify v2 contract fields. * feat: enhance agent method validation and improve v2 action safety - Introduced validation to reject agent methods using blocked module roots.- Added checks to ensure declared method paths are used in agent execution.- Enhanced v2 action results with replay safety metadata validation.- Updated changelog and documentation to reflect these changes. * feat: add v2 resource import contracts * test: align v2 contract fixtures * minor * fix: require auth for a2a controller * minor * Minor * chore: update changelog for Supervaizer v2 enhancements and API key validation improvements - Added optional `metadata` field to `V2CaseSnapshot` for case-level context. - Implemented validation for Studio registration handshake to ensure API key consistency. - Enhanced server API key handling for stability during reloads. - Updated tests to cover new functionality and validation paths. * workspace-agent-grants (#50) * docs: plan workspace agent grants * docs: add Studio grant acceptance UX * feat: add workspace agent authorization * feat: add workspace binding protocol * fix: stabilize workspace authorization * ✨feat: add workspace auth helpers and use them in tests * ✨feat: require workspace auth and tighten agent checks * fix: require workspace auth for Studio A2A * fix: harden workspace authorization checks * fix: normalize malformed workspace auth inputs * minor * feat(logging): implement structured logging for Cloud Logging compatibility - Added support for newline-delimited JSON logging when `SUPERVAIZER_LOG_FORMAT=json` is set. - Updated logging configuration to allow structured logs for access-denial events. - Enhanced `log_access_denied_api` and `log_access_denied_tailscale` functions to include structured fields. - Added tests to verify structured logging outputs in `tests/test_common.py`. * Minor * codex/supervaizer-lifespan-cleanup (#54) * Clean up Supervaizer lifespan shutdown * Document Supervaizer import placement rule * Fix lifespan cleanup test determinism * Address lifespan shutdown review feedback * ✨feat: rename test and assert scheduled step task * ✨ feat: update GitNexus index counts in AGENTS.md * codex/refactor-server-modules (#55) * Refactor Supervaizer server modules * ✨ feat: update GitNexus index stats in AGENTS.md * ✨docs update changelog AGENTS guidance * ✨feat: add v2 methods, tests and license header * minor * codex/agent-interviewer-workspace-jobs-refresh (#56) * Clean up Supervaizer lifespan shutdown * Document Supervaizer import placement rule * Fix lifespan cleanup test determinism * Address lifespan shutdown review feedback * ✨feat: rename test and assert scheduled step task * ✨ feat: update GitNexus index counts in AGENTS.md * feat(v2): add agent action methods * Refactor pre-commit configuration and enhance agent validation - Updated mypy hook to use project-specific configuration for consistency with uv.lock. - Improved validation for v2_registration and v2_method_declarations in Agent class to ensure proper type handling. - Enhanced logging configuration to cast message records for structured logging compatibility. * chore(deps): bump uv from 0.11.14 to 0.11.15 (#58) Bumps [uv](https://github.com/astral-sh/uv) from 0.11.14 to 0.11.15. - [Release notes](https://github.com/astral-sh/uv/releases) - [Changelog](https://github.com/astral-sh/uv/blob/main/CHANGELOG.md) - [Commits](astral-sh/uv@0.11.14...0.11.15) --- updated-dependencies: - dependency-name: uv dependency-version: 0.11.15 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump starlette from 0.50.0 to 1.0.1 (#60) Bumps [starlette](https://github.com/Kludex/starlette) from 0.50.0 to 1.0.1. - [Release notes](https://github.com/Kludex/starlette/releases) - [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md) - [Commits](Kludex/starlette@0.50.0...1.0.1) --- updated-dependencies: - dependency-name: starlette dependency-version: 1.0.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump trufflesecurity/trufflehog from 3.95.3 to 3.95.5 (#61) Bumps [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog) from 3.95.3 to 3.95.5. - [Release notes](https://github.com/trufflesecurity/trufflehog/releases) - [Commits](trufflesecurity/trufflehog@37b7700...d411fff) --- updated-dependencies: - dependency-name: trufflesecurity/trufflehog dependency-version: 3.95.5 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * feat(.agents): add skill symlinks from runwaize skills cookbook Add 21 skill symlinks under .agents/skills/ pointing to the local runwaize_skills_cookbook installation, covering cloud-run basics, Pulumi migration/tooling skills (terraform, CDK, ARM, ESC, component, automation-api, upgrade-provider, best-practices, neo-handoff), Google Cloud WAF pillars (security, reliability, performance, cost-optimization, operational-excellence), google-cloud-recipe-auth, google-cloud-networking-observability, cloudformation-to-pulumi, package-usage, provider-upgrade, and upstream-patches. Update AGENTS.md GitNexus index stats to reflect the current index (6273 symbols, 11483 relationships, 281 execution flows). * chore(deps): bump astral-sh/setup-uv from 8.1.0 to 8.2.0 (#62) Bumps [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) from 8.1.0 to 8.2.0. - [Release notes](https://github.com/astral-sh/setup-uv/releases) - [Commits](astral-sh/setup-uv@0880764...fac544c) --- updated-dependencies: - dependency-name: astral-sh/setup-uv dependency-version: 8.2.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump actions/checkout from 6.0.2 to 6.0.3 (#63) Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.2 to 6.0.3. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@de0fac2...df4cb1c) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 6.0.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump starlette from 1.0.1 to 1.3.1 (#66) Bumps [starlette](https://github.com/Kludex/starlette) from 1.0.1 to 1.3.1. - [Release notes](https://github.com/Kludex/starlette/releases) - [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md) - [Commits](Kludex/starlette@1.0.1...1.3.1) --- updated-dependencies: - dependency-name: starlette dependency-version: 1.3.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump cryptography from 48.0.0 to 48.0.1 (#67) Bumps [cryptography](https://github.com/pyca/cryptography) from 48.0.0 to 48.0.1. - [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst) - [Commits](pyca/cryptography@48.0.0...48.0.1) --- updated-dependencies: - dependency-name: cryptography dependency-version: 48.0.1 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump actions/checkout from 6.0.3 to 7.0.0 (#68) Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.3 to 7.0.0. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@df4cb1c...9c091bb) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump softprops/action-gh-release from 3.0.0 to 3.0.1 (#69) Bumps [softprops/action-gh-release](https://github.com/softprops/action-gh-release) from 3.0.0 to 3.0.1. - [Release notes](https://github.com/softprops/action-gh-release/releases) - [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md) - [Commits](softprops/action-gh-release@b430933...718ea10) --- updated-dependencies: - dependency-name: softprops/action-gh-release dependency-version: 3.0.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump trufflesecurity/trufflehog from 3.95.5 to 3.95.6 (#70) Bumps [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog) from 3.95.5 to 3.95.6. - [Release notes](https://github.com/trufflesecurity/trufflehog/releases) - [Commits](trufflesecurity/trufflehog@d411fff...30d5bb9) --- updated-dependencies: - dependency-name: trufflesecurity/trufflehog dependency-version: 3.95.6 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * codex/managed-context-sdk (#65) * feat: add managed context SDK client * ✨ feat: update gitn docs to use local run.cjs and paginate list_repos * ✨ feat: add MPLv2 license headers to module and test files * fix: address managed context review feedback * ✨ feat(contracts): add V2ContextAssignment for context.assign (#71) * ✨ feat(contracts): add V2ContextAssignment for context.assign * ✨ feat(contracts): constrain context scope and document assignment semantics Address PR #71 review: V2ContextAssignmentItem.scope is now Literal["workspace", "mission"] (matching other closed v2 vocabularies) with a ValidationError regression test, and the v2 doc gains explicit context.assign semantics: refs-not-content payload, freeze-on-pull with provenance, mandatory fetched-vs-assigned version check that fails the assignment on mismatch, and no live context reads during execution. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * 🐛 fix(contracts): require mission_id for mission-scoped context assignments Address PR #71 follow-up review: a V2ContextAssignment containing scope="mission" items but no mission_id passed validation while the agent-side ContextClient.open() would have no mission context to fetch with. A model_validator now rejects that combination; workspace-only assignments still allow a null mission_id. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * 🐛 fix(contracts): reject whitespace-only mission_id for mission-scoped assignments Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com> * feat: bump version to1.3.0 and update deps; iterate nested (#73) * fix versions --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
alain-sv
added a commit
that referenced
this pull request
Jul 7, 2026
* apply dependabot insights * minor * chore(ci): SHA-pin actions/checkout and actions/setup-python (#43) Pin all uses of actions/checkout@v6 and actions/setup-python@v6 to their commit SHAs across every workflow, closing the remaining floating-tag attack surface. - actions/checkout → de0fac2e (v6) - actions/setup-python → a309ff8b (v6) * docs(changelog): add unreleased dependency security refresh entry (#44) * chore(ci): add uv cache-suffix per Python version + update AGENTS.md facts (#46) Prevents parallel matrix jobs racing on the same Actions cache reservation. Also records two CI tooling facts in AGENTS.md. * supervaizer-v2-mvp-contracts (#47) * feat: add supervaizer v2 contract primitives * feat: add supervaizer v2 a2a action endpoint * feat: expose supervaizer v2 registration in a2a card * feat: add supervaizer v2 action decorator * docs: update supervaizer v2 changelog * precommit fix * refactor: move controller api version to contracts * minor * fix: scope v2 action handlers by agent * feat: guard supervaizer v2 agent identity * feat: include v2 job state in sync result * feat: add v2 resource form fields * feat: add v2 resource option sources * feat: add v2 awaiting form fields * feat: load supervaizer v2 surfaces over a2a * feat: expose local hello world v2 contract * feat: add v2 job source target type * feat: stream v2 action effects over a2a * fix: advertise v2 push notifications as unsupported * refactor: remove legacy dynamic choices * feat: complete local hello world v2 hitl flow * refactor: remove legacy job poll * docs: refresh generated contract docs * test: align v2 prompt editor fixture * test: align v2 contact import fixture * test: align v2 scenario builder fixture * test: align v2 overview fixture * test: align v2 campaign contact fixture * feat: add v2 registration builder * feat: type v2 dataset display metadata * minor * fix: precommit * feat: add comprehensive documentation for SUPERVAIZER API, Admin Interface, CLI, Parameter Validation, Persistence, Protocols, and REST API * minor * chore: change copyright dates from 2024-2025 to 2024-2026 * fix: harden agent model surface and v2 contract hygiene Use modern typing in agent.py, keep server encrypted params internal, document deterministic agent ids, tighten A2A health status rules, drop legacy hello-world v2 input aliases, and clarify v2 contract fields. * feat: enhance agent method validation and improve v2 action safety - Introduced validation to reject agent methods using blocked module roots.- Added checks to ensure declared method paths are used in agent execution.- Enhanced v2 action results with replay safety metadata validation.- Updated changelog and documentation to reflect these changes. * feat: add v2 resource import contracts * test: align v2 contract fixtures * minor * fix: require auth for a2a controller * minor * Minor * chore: update changelog for Supervaizer v2 enhancements and API key validation improvements - Added optional `metadata` field to `V2CaseSnapshot` for case-level context. - Implemented validation for Studio registration handshake to ensure API key consistency. - Enhanced server API key handling for stability during reloads. - Updated tests to cover new functionality and validation paths. * workspace-agent-grants (#50) * docs: plan workspace agent grants * docs: add Studio grant acceptance UX * feat: add workspace agent authorization * feat: add workspace binding protocol * fix: stabilize workspace authorization * ✨feat: add workspace auth helpers and use them in tests * ✨feat: require workspace auth and tighten agent checks * fix: require workspace auth for Studio A2A * fix: harden workspace authorization checks * fix: normalize malformed workspace auth inputs * minor * feat(logging): implement structured logging for Cloud Logging compatibility - Added support for newline-delimited JSON logging when `SUPERVAIZER_LOG_FORMAT=json` is set. - Updated logging configuration to allow structured logs for access-denial events. - Enhanced `log_access_denied_api` and `log_access_denied_tailscale` functions to include structured fields. - Added tests to verify structured logging outputs in `tests/test_common.py`. * Minor * codex/supervaizer-lifespan-cleanup (#54) * Clean up Supervaizer lifespan shutdown * Document Supervaizer import placement rule * Fix lifespan cleanup test determinism * Address lifespan shutdown review feedback * ✨feat: rename test and assert scheduled step task * ✨ feat: update GitNexus index counts in AGENTS.md * codex/refactor-server-modules (#55) * Refactor Supervaizer server modules * ✨ feat: update GitNexus index stats in AGENTS.md * ✨docs update changelog AGENTS guidance * ✨feat: add v2 methods, tests and license header * minor * codex/agent-interviewer-workspace-jobs-refresh (#56) * Clean up Supervaizer lifespan shutdown * Document Supervaizer import placement rule * Fix lifespan cleanup test determinism * Address lifespan shutdown review feedback * ✨feat: rename test and assert scheduled step task * ✨ feat: update GitNexus index counts in AGENTS.md * feat(v2): add agent action methods * Refactor pre-commit configuration and enhance agent validation - Updated mypy hook to use project-specific configuration for consistency with uv.lock. - Improved validation for v2_registration and v2_method_declarations in Agent class to ensure proper type handling. - Enhanced logging configuration to cast message records for structured logging compatibility. * chore(deps): bump uv from 0.11.14 to 0.11.15 (#58) Bumps [uv](https://github.com/astral-sh/uv) from 0.11.14 to 0.11.15. - [Release notes](https://github.com/astral-sh/uv/releases) - [Changelog](https://github.com/astral-sh/uv/blob/main/CHANGELOG.md) - [Commits](astral-sh/uv@0.11.14...0.11.15) --- updated-dependencies: - dependency-name: uv dependency-version: 0.11.15 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump starlette from 0.50.0 to 1.0.1 (#60) Bumps [starlette](https://github.com/Kludex/starlette) from 0.50.0 to 1.0.1. - [Release notes](https://github.com/Kludex/starlette/releases) - [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md) - [Commits](Kludex/starlette@0.50.0...1.0.1) --- updated-dependencies: - dependency-name: starlette dependency-version: 1.0.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump trufflesecurity/trufflehog from 3.95.3 to 3.95.5 (#61) Bumps [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog) from 3.95.3 to 3.95.5. - [Release notes](https://github.com/trufflesecurity/trufflehog/releases) - [Commits](trufflesecurity/trufflehog@37b7700...d411fff) --- updated-dependencies: - dependency-name: trufflesecurity/trufflehog dependency-version: 3.95.5 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * feat(.agents): add skill symlinks from runwaize skills cookbook Add 21 skill symlinks under .agents/skills/ pointing to the local runwaize_skills_cookbook installation, covering cloud-run basics, Pulumi migration/tooling skills (terraform, CDK, ARM, ESC, component, automation-api, upgrade-provider, best-practices, neo-handoff), Google Cloud WAF pillars (security, reliability, performance, cost-optimization, operational-excellence), google-cloud-recipe-auth, google-cloud-networking-observability, cloudformation-to-pulumi, package-usage, provider-upgrade, and upstream-patches. Update AGENTS.md GitNexus index stats to reflect the current index (6273 symbols, 11483 relationships, 281 execution flows). * chore(deps): bump astral-sh/setup-uv from 8.1.0 to 8.2.0 (#62) Bumps [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) from 8.1.0 to 8.2.0. - [Release notes](https://github.com/astral-sh/setup-uv/releases) - [Commits](astral-sh/setup-uv@0880764...fac544c) --- updated-dependencies: - dependency-name: astral-sh/setup-uv dependency-version: 8.2.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump actions/checkout from 6.0.2 to 6.0.3 (#63) Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.2 to 6.0.3. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@de0fac2...df4cb1c) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 6.0.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump starlette from 1.0.1 to 1.3.1 (#66) Bumps [starlette](https://github.com/Kludex/starlette) from 1.0.1 to 1.3.1. - [Release notes](https://github.com/Kludex/starlette/releases) - [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md) - [Commits](Kludex/starlette@1.0.1...1.3.1) --- updated-dependencies: - dependency-name: starlette dependency-version: 1.3.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump cryptography from 48.0.0 to 48.0.1 (#67) Bumps [cryptography](https://github.com/pyca/cryptography) from 48.0.0 to 48.0.1. - [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst) - [Commits](pyca/cryptography@48.0.0...48.0.1) --- updated-dependencies: - dependency-name: cryptography dependency-version: 48.0.1 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump actions/checkout from 6.0.3 to 7.0.0 (#68) Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.3 to 7.0.0. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@df4cb1c...9c091bb) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump softprops/action-gh-release from 3.0.0 to 3.0.1 (#69) Bumps [softprops/action-gh-release](https://github.com/softprops/action-gh-release) from 3.0.0 to 3.0.1. - [Release notes](https://github.com/softprops/action-gh-release/releases) - [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md) - [Commits](softprops/action-gh-release@b430933...718ea10) --- updated-dependencies: - dependency-name: softprops/action-gh-release dependency-version: 3.0.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump trufflesecurity/trufflehog from 3.95.5 to 3.95.6 (#70) Bumps [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog) from 3.95.5 to 3.95.6. - [Release notes](https://github.com/trufflesecurity/trufflehog/releases) - [Commits](trufflesecurity/trufflehog@d411fff...30d5bb9) --- updated-dependencies: - dependency-name: trufflesecurity/trufflehog dependency-version: 3.95.6 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * codex/managed-context-sdk (#65) * feat: add managed context SDK client * ✨ feat: update gitn docs to use local run.cjs and paginate list_repos * ✨ feat: add MPLv2 license headers to module and test files * fix: address managed context review feedback * ✨ feat(contracts): add V2ContextAssignment for context.assign (#71) * ✨ feat(contracts): add V2ContextAssignment for context.assign * ✨ feat(contracts): constrain context scope and document assignment semantics Address PR #71 review: V2ContextAssignmentItem.scope is now Literal["workspace", "mission"] (matching other closed v2 vocabularies) with a ValidationError regression test, and the v2 doc gains explicit context.assign semantics: refs-not-content payload, freeze-on-pull with provenance, mandatory fetched-vs-assigned version check that fails the assignment on mismatch, and no live context reads during execution. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * 🐛 fix(contracts): require mission_id for mission-scoped context assignments Address PR #71 follow-up review: a V2ContextAssignment containing scope="mission" items but no mission_id passed validation while the agent-side ContextClient.open() would have no mission context to fetch with. A model_validator now rejects that combination; workspace-only assignments still allow a null mission_id. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * 🐛 fix(contracts): reject whitespace-only mission_id for mission-scoped assignments Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com> * feat: bump version to1.3.0 and update deps; iterate nested (#73) * changelog * chore(deps): bump actions/setup-python from 6.2.0 to 6.3.0 (#75) Bumps [actions/setup-python](https://github.com/actions/setup-python) from 6.2.0 to 6.3.0. - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](actions/setup-python@a309ff8...ece7cb0) --- updated-dependencies: - dependency-name: actions/setup-python dependency-version: 6.3.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump trufflesecurity/trufflehog from 3.95.6 to 3.95.7 (#76) Bumps [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog) from 3.95.6 to 3.95.7. - [Release notes](https://github.com/trufflesecurity/trufflehog/releases) - [Commits](trufflesecurity/trufflehog@30d5bb9...f446421) --- updated-dependencies: - dependency-name: trufflesecurity/trufflehog dependency-version: 3.95.7 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * security: review summary (redacted) + safe P0/P1 hardening (#77) * docs: add redacted security & performance review summary Adds a non-actionable high-level summary of a full-source security and performance/scalability review of the SDK (posture, verified-sound controls, severity counts, and remediation themes) and a CHANGELOG entry. Per SECURITY.md, detailed vulnerability findings (exact locations, attack scenarios, remediation specifics) are intentionally kept out of the public repository and handled through the private vulnerability channel. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F8GY2d3HJgCKwgCyRgNFMt * fix(security): harden API-key compare, local-mode bind, headers, logging, scheduler Safe P0/P1 remediations from the security review (no wire-format or auth-model breaking changes): - Constant-time API-key comparison (hmac.compare_digest) in require_api_key and Server.verify_api_key (CWE-208). - Local mode binds 127.0.0.1 instead of 0.0.0.0 unless an explicit non-wildcard host is set, so the default 'local-dev' key is not network-exposed (CWE-798). - Baseline security headers (nosniff, X-Frame-Options DENY, Referrer-Policy, HSTS) via a pure-ASGI middleware that is SSE-safe (CWE-693/1021). - Stop logging decrypted agent-parameter values and full result payloads in validate-agent-parameters (CWE-532). - Allow-list scheduled_method against the agent's declared method paths in the scheduler and workbench execute-now path (CWE-470). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F8GY2d3HJgCKwgCyRgNFMt * fix(security): compare API keys as bytes to avoid TypeError on non-ASCII hmac.compare_digest rejects non-ASCII str inputs, so a malformed X-API-Key with non-ASCII characters raised TypeError (500) instead of failing closed (401/403). Encode both operands to UTF-8 bytes in require_api_key and Server.verify_api_key so malformed credentials are rejected. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F8GY2d3HJgCKwgCyRgNFMt * refactor(security): address review feedback on hardening changes - Scope scheduled-step allow-list to the owning job's agent instead of the union of all agents, so a tampered step cannot invoke another agent's declared methods (per-agent isolation). - Move MutableHeaders import to module scope (repo convention: no function-local imports without a concrete circular/optional/startup reason). - Reword CHANGELOG security bullets to high-level, non-actionable descriptions consistent with the private-advisory disclosure policy. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F8GY2d3HJgCKwgCyRgNFMt * refactor(security): tighten scheduled-step allow-list resolution Address review follow-ups on per-agent method scoping: - Scheduler: if a due step's owning job cannot be resolved, mark the step failed instead of falling back to the union of all agents' methods, so an orphaned/tampered step cannot invoke another agent's method. - Workbench execute-now: verify the job is owned by the request's agent (Jobs().get_job(job_id, agent_name=agent.name)) before using that agent's allow-list, preventing a slug/job-owner mismatch from widening the list. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F8GY2d3HJgCKwgCyRgNFMt * fix(security): use SAMEORIGIN and hoist Jobs import - X-Frame-Options: SAMEORIGIN instead of DENY so the admin instructions iframe (same-origin) still renders, while cross-origin framing stays blocked. - Move the Jobs import in scheduled_steps to module scope (no circular dependency; matches the repo's module-level-imports convention). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F8GY2d3HJgCKwgCyRgNFMt * refactor(admin): hoist scheduled step helper import * fix(security): scope scheduled step ownership checks * ✨ docs: add test summary table to changelog (docs/CHANGELOG.md) * ✨ feat(ci): skip unit tests for docs-only changes in workflow --------- Co-authored-by: Claude <noreply@anthropic.com> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
alain-sv
added a commit
that referenced
this pull request
Aug 28, 2026
* apply dependabot insights * minor * chore(ci): SHA-pin actions/checkout and actions/setup-python (#43) Pin all uses of actions/checkout@v6 and actions/setup-python@v6 to their commit SHAs across every workflow, closing the remaining floating-tag attack surface. - actions/checkout → de0fac2e (v6) - actions/setup-python → a309ff8b (v6) * docs(changelog): add unreleased dependency security refresh entry (#44) * chore(ci): add uv cache-suffix per Python version + update AGENTS.md facts (#46) Prevents parallel matrix jobs racing on the same Actions cache reservation. Also records two CI tooling facts in AGENTS.md. * supervaizer-v2-mvp-contracts (#47) * feat: add supervaizer v2 contract primitives * feat: add supervaizer v2 a2a action endpoint * feat: expose supervaizer v2 registration in a2a card * feat: add supervaizer v2 action decorator * docs: update supervaizer v2 changelog * precommit fix * refactor: move controller api version to contracts * minor * fix: scope v2 action handlers by agent * feat: guard supervaizer v2 agent identity * feat: include v2 job state in sync result * feat: add v2 resource form fields * feat: add v2 resource option sources * feat: add v2 awaiting form fields * feat: load supervaizer v2 surfaces over a2a * feat: expose local hello world v2 contract * feat: add v2 job source target type * feat: stream v2 action effects over a2a * fix: advertise v2 push notifications as unsupported * refactor: remove legacy dynamic choices * feat: complete local hello world v2 hitl flow * refactor: remove legacy job poll * docs: refresh generated contract docs * test: align v2 prompt editor fixture * test: align v2 contact import fixture * test: align v2 scenario builder fixture * test: align v2 overview fixture * test: align v2 campaign contact fixture * feat: add v2 registration builder * feat: type v2 dataset display metadata * minor * fix: precommit * feat: add comprehensive documentation for SUPERVAIZER API, Admin Interface, CLI, Parameter Validation, Persistence, Protocols, and REST API * minor * chore: change copyright dates from 2024-2025 to 2024-2026 * fix: harden agent model surface and v2 contract hygiene Use modern typing in agent.py, keep server encrypted params internal, document deterministic agent ids, tighten A2A health status rules, drop legacy hello-world v2 input aliases, and clarify v2 contract fields. * feat: enhance agent method validation and improve v2 action safety - Introduced validation to reject agent methods using blocked module roots.- Added checks to ensure declared method paths are used in agent execution.- Enhanced v2 action results with replay safety metadata validation.- Updated changelog and documentation to reflect these changes. * feat: add v2 resource import contracts * test: align v2 contract fixtures * minor * fix: require auth for a2a controller * minor * Minor * chore: update changelog for Supervaizer v2 enhancements and API key validation improvements - Added optional `metadata` field to `V2CaseSnapshot` for case-level context. - Implemented validation for Studio registration handshake to ensure API key consistency. - Enhanced server API key handling for stability during reloads. - Updated tests to cover new functionality and validation paths. * workspace-agent-grants (#50) * docs: plan workspace agent grants * docs: add Studio grant acceptance UX * feat: add workspace agent authorization * feat: add workspace binding protocol * fix: stabilize workspace authorization * ✨feat: add workspace auth helpers and use them in tests * ✨feat: require workspace auth and tighten agent checks * fix: require workspace auth for Studio A2A * fix: harden workspace authorization checks * fix: normalize malformed workspace auth inputs * minor * feat(logging): implement structured logging for Cloud Logging compatibility - Added support for newline-delimited JSON logging when `SUPERVAIZER_LOG_FORMAT=json` is set. - Updated logging configuration to allow structured logs for access-denial events. - Enhanced `log_access_denied_api` and `log_access_denied_tailscale` functions to include structured fields. - Added tests to verify structured logging outputs in `tests/test_common.py`. * Minor * codex/supervaizer-lifespan-cleanup (#54) * Clean up Supervaizer lifespan shutdown * Document Supervaizer import placement rule * Fix lifespan cleanup test determinism * Address lifespan shutdown review feedback * ✨feat: rename test and assert scheduled step task * ✨ feat: update GitNexus index counts in AGENTS.md * codex/refactor-server-modules (#55) * Refactor Supervaizer server modules * ✨ feat: update GitNexus index stats in AGENTS.md * ✨docs update changelog AGENTS guidance * ✨feat: add v2 methods, tests and license header * minor * codex/agent-interviewer-workspace-jobs-refresh (#56) * Clean up Supervaizer lifespan shutdown * Document Supervaizer import placement rule * Fix lifespan cleanup test determinism * Address lifespan shutdown review feedback * ✨feat: rename test and assert scheduled step task * ✨ feat: update GitNexus index counts in AGENTS.md * feat(v2): add agent action methods * Refactor pre-commit configuration and enhance agent validation - Updated mypy hook to use project-specific configuration for consistency with uv.lock. - Improved validation for v2_registration and v2_method_declarations in Agent class to ensure proper type handling. - Enhanced logging configuration to cast message records for structured logging compatibility. * chore(deps): bump uv from 0.11.14 to 0.11.15 (#58) Bumps [uv](https://github.com/astral-sh/uv) from 0.11.14 to 0.11.15. - [Release notes](https://github.com/astral-sh/uv/releases) - [Changelog](https://github.com/astral-sh/uv/blob/main/CHANGELOG.md) - [Commits](astral-sh/uv@0.11.14...0.11.15) --- updated-dependencies: - dependency-name: uv dependency-version: 0.11.15 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump starlette from 0.50.0 to 1.0.1 (#60) Bumps [starlette](https://github.com/Kludex/starlette) from 0.50.0 to 1.0.1. - [Release notes](https://github.com/Kludex/starlette/releases) - [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md) - [Commits](Kludex/starlette@0.50.0...1.0.1) --- updated-dependencies: - dependency-name: starlette dependency-version: 1.0.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump trufflesecurity/trufflehog from 3.95.3 to 3.95.5 (#61) Bumps [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog) from 3.95.3 to 3.95.5. - [Release notes](https://github.com/trufflesecurity/trufflehog/releases) - [Commits](trufflesecurity/trufflehog@37b7700...d411fff) --- updated-dependencies: - dependency-name: trufflesecurity/trufflehog dependency-version: 3.95.5 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * feat(.agents): add skill symlinks from runwaize skills cookbook Add 21 skill symlinks under .agents/skills/ pointing to the local runwaize_skills_cookbook installation, covering cloud-run basics, Pulumi migration/tooling skills (terraform, CDK, ARM, ESC, component, automation-api, upgrade-provider, best-practices, neo-handoff), Google Cloud WAF pillars (security, reliability, performance, cost-optimization, operational-excellence), google-cloud-recipe-auth, google-cloud-networking-observability, cloudformation-to-pulumi, package-usage, provider-upgrade, and upstream-patches. Update AGENTS.md GitNexus index stats to reflect the current index (6273 symbols, 11483 relationships, 281 execution flows). * chore(deps): bump astral-sh/setup-uv from 8.1.0 to 8.2.0 (#62) Bumps [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) from 8.1.0 to 8.2.0. - [Release notes](https://github.com/astral-sh/setup-uv/releases) - [Commits](astral-sh/setup-uv@0880764...fac544c) --- updated-dependencies: - dependency-name: astral-sh/setup-uv dependency-version: 8.2.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump actions/checkout from 6.0.2 to 6.0.3 (#63) Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.2 to 6.0.3. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@de0fac2...df4cb1c) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 6.0.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump starlette from 1.0.1 to 1.3.1 (#66) Bumps [starlette](https://github.com/Kludex/starlette) from 1.0.1 to 1.3.1. - [Release notes](https://github.com/Kludex/starlette/releases) - [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md) - [Commits](Kludex/starlette@1.0.1...1.3.1) --- updated-dependencies: - dependency-name: starlette dependency-version: 1.3.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump cryptography from 48.0.0 to 48.0.1 (#67) Bumps [cryptography](https://github.com/pyca/cryptography) from 48.0.0 to 48.0.1. - [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst) - [Commits](pyca/cryptography@48.0.0...48.0.1) --- updated-dependencies: - dependency-name: cryptography dependency-version: 48.0.1 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump actions/checkout from 6.0.3 to 7.0.0 (#68) Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.3 to 7.0.0. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@df4cb1c...9c091bb) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump softprops/action-gh-release from 3.0.0 to 3.0.1 (#69) Bumps [softprops/action-gh-release](https://github.com/softprops/action-gh-release) from 3.0.0 to 3.0.1. - [Release notes](https://github.com/softprops/action-gh-release/releases) - [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md) - [Commits](softprops/action-gh-release@b430933...718ea10) --- updated-dependencies: - dependency-name: softprops/action-gh-release dependency-version: 3.0.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump trufflesecurity/trufflehog from 3.95.5 to 3.95.6 (#70) Bumps [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog) from 3.95.5 to 3.95.6. - [Release notes](https://github.com/trufflesecurity/trufflehog/releases) - [Commits](trufflesecurity/trufflehog@d411fff...30d5bb9) --- updated-dependencies: - dependency-name: trufflesecurity/trufflehog dependency-version: 3.95.6 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * codex/managed-context-sdk (#65) * feat: add managed context SDK client * ✨ feat: update gitn docs to use local run.cjs and paginate list_repos * ✨ feat: add MPLv2 license headers to module and test files * fix: address managed context review feedback * ✨ feat(contracts): add V2ContextAssignment for context.assign (#71) * ✨ feat(contracts): add V2ContextAssignment for context.assign * ✨ feat(contracts): constrain context scope and document assignment semantics Address PR #71 review: V2ContextAssignmentItem.scope is now Literal["workspace", "mission"] (matching other closed v2 vocabularies) with a ValidationError regression test, and the v2 doc gains explicit context.assign semantics: refs-not-content payload, freeze-on-pull with provenance, mandatory fetched-vs-assigned version check that fails the assignment on mismatch, and no live context reads during execution. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * 🐛 fix(contracts): require mission_id for mission-scoped context assignments Address PR #71 follow-up review: a V2ContextAssignment containing scope="mission" items but no mission_id passed validation while the agent-side ContextClient.open() would have no mission context to fetch with. A model_validator now rejects that combination; workspace-only assignments still allow a null mission_id. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * 🐛 fix(contracts): reject whitespace-only mission_id for mission-scoped assignments Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com> * feat: bump version to1.3.0 and update deps; iterate nested (#73) * changelog * chore(deps): bump actions/setup-python from 6.2.0 to 6.3.0 (#75) Bumps [actions/setup-python](https://github.com/actions/setup-python) from 6.2.0 to 6.3.0. - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](actions/setup-python@a309ff8...ece7cb0) --- updated-dependencies: - dependency-name: actions/setup-python dependency-version: 6.3.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump trufflesecurity/trufflehog from 3.95.6 to 3.95.7 (#76) Bumps [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog) from 3.95.6 to 3.95.7. - [Release notes](https://github.com/trufflesecurity/trufflehog/releases) - [Commits](trufflesecurity/trufflehog@30d5bb9...f446421) --- updated-dependencies: - dependency-name: trufflesecurity/trufflehog dependency-version: 3.95.7 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * security: review summary (redacted) + safe P0/P1 hardening (#77) * docs: add redacted security & performance review summary Adds a non-actionable high-level summary of a full-source security and performance/scalability review of the SDK (posture, verified-sound controls, severity counts, and remediation themes) and a CHANGELOG entry. Per SECURITY.md, detailed vulnerability findings (exact locations, attack scenarios, remediation specifics) are intentionally kept out of the public repository and handled through the private vulnerability channel. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F8GY2d3HJgCKwgCyRgNFMt * fix(security): harden API-key compare, local-mode bind, headers, logging, scheduler Safe P0/P1 remediations from the security review (no wire-format or auth-model breaking changes): - Constant-time API-key comparison (hmac.compare_digest) in require_api_key and Server.verify_api_key (CWE-208). - Local mode binds 127.0.0.1 instead of 0.0.0.0 unless an explicit non-wildcard host is set, so the default 'local-dev' key is not network-exposed (CWE-798). - Baseline security headers (nosniff, X-Frame-Options DENY, Referrer-Policy, HSTS) via a pure-ASGI middleware that is SSE-safe (CWE-693/1021). - Stop logging decrypted agent-parameter values and full result payloads in validate-agent-parameters (CWE-532). - Allow-list scheduled_method against the agent's declared method paths in the scheduler and workbench execute-now path (CWE-470). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F8GY2d3HJgCKwgCyRgNFMt * fix(security): compare API keys as bytes to avoid TypeError on non-ASCII hmac.compare_digest rejects non-ASCII str inputs, so a malformed X-API-Key with non-ASCII characters raised TypeError (500) instead of failing closed (401/403). Encode both operands to UTF-8 bytes in require_api_key and Server.verify_api_key so malformed credentials are rejected. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F8GY2d3HJgCKwgCyRgNFMt * refactor(security): address review feedback on hardening changes - Scope scheduled-step allow-list to the owning job's agent instead of the union of all agents, so a tampered step cannot invoke another agent's declared methods (per-agent isolation). - Move MutableHeaders import to module scope (repo convention: no function-local imports without a concrete circular/optional/startup reason). - Reword CHANGELOG security bullets to high-level, non-actionable descriptions consistent with the private-advisory disclosure policy. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F8GY2d3HJgCKwgCyRgNFMt * refactor(security): tighten scheduled-step allow-list resolution Address review follow-ups on per-agent method scoping: - Scheduler: if a due step's owning job cannot be resolved, mark the step failed instead of falling back to the union of all agents' methods, so an orphaned/tampered step cannot invoke another agent's method. - Workbench execute-now: verify the job is owned by the request's agent (Jobs().get_job(job_id, agent_name=agent.name)) before using that agent's allow-list, preventing a slug/job-owner mismatch from widening the list. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F8GY2d3HJgCKwgCyRgNFMt * fix(security): use SAMEORIGIN and hoist Jobs import - X-Frame-Options: SAMEORIGIN instead of DENY so the admin instructions iframe (same-origin) still renders, while cross-origin framing stays blocked. - Move the Jobs import in scheduled_steps to module scope (no circular dependency; matches the repo's module-level-imports convention). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F8GY2d3HJgCKwgCyRgNFMt * refactor(admin): hoist scheduled step helper import * fix(security): scope scheduled step ownership checks * ✨ docs: add test summary table to changelog (docs/CHANGELOG.md) * ✨ feat(ci): skip unit tests for docs-only changes in workflow --------- Co-authored-by: Claude <noreply@anthropic.com> * chore(deps): bump trufflesecurity/trufflehog from 3.95.7 to 3.95.9 (#81) Bumps [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog) from 3.95.7 to 3.95.9. - [Release notes](https://github.com/trufflesecurity/trufflehog/releases) - [Commits](trufflesecurity/trufflehog@f446421...27b0417) --- updated-dependencies: - dependency-name: trufflesecurity/trufflehog dependency-version: 3.95.9 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump softprops/action-gh-release from 3.0.1 to 3.0.2 (#82) Bumps [softprops/action-gh-release](https://github.com/softprops/action-gh-release) from 3.0.1 to 3.0.2. - [Release notes](https://github.com/softprops/action-gh-release/releases) - [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md) - [Commits](softprops/action-gh-release@718ea10...3d0d988) --- updated-dependencies: - dependency-name: softprops/action-gh-release dependency-version: 3.0.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump astral-sh/setup-uv from 8.2.0 to 8.3.2 (#83) Bumps [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) from 8.2.0 to 8.3.2. - [Release notes](https://github.com/astral-sh/setup-uv/releases) - [Commits](astral-sh/setup-uv@fac544c...11f9893) --- updated-dependencies: - dependency-name: astral-sh/setup-uv dependency-version: 8.3.2 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump pyasn1 from 0.6.3 to 0.6.4 (#84) Bumps [pyasn1](https://github.com/pyasn1/pyasn1) from 0.6.3 to 0.6.4. - [Release notes](https://github.com/pyasn1/pyasn1/releases) - [Changelog](https://github.com/pyasn1/pyasn1/blob/main/CHANGES.rst) - [Commits](pyasn1/pyasn1@v0.6.3...v0.6.4) --- updated-dependencies: - dependency-name: pyasn1 dependency-version: 0.6.4 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump actions/setup-python from 6.3.0 to 7.0.0 (#85) Bumps [actions/setup-python](https://github.com/actions/setup-python) from 6.3.0 to 7.0.0. - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](actions/setup-python@ece7cb0...5fda3b9) --- updated-dependencies: - dependency-name: actions/setup-python dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump pypa/gh-action-pypi-publish from 1.14.0 to 1.14.1 (#86) Bumps [pypa/gh-action-pypi-publish](https://github.com/pypa/gh-action-pypi-publish) from 1.14.0 to 1.14.1. - [Release notes](https://github.com/pypa/gh-action-pypi-publish/releases) - [Commits](pypa/gh-action-pypi-publish@cef2210...ba38be9) --- updated-dependencies: - dependency-name: pypa/gh-action-pypi-publish dependency-version: 1.14.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump cryptography from 49.0.0 to 50.0.0 (#87) Bumps [cryptography](https://github.com/pyca/cryptography) from 49.0.0 to 50.0.0. - [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst) - [Commits](pyca/cryptography@49.0.0...50.0.0) --- updated-dependencies: - dependency-name: cryptography dependency-version: 50.0.0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * feat: add generic job setup contract (#89) * feat: add generic job setup contract * 🐛 fix(contracts): stop V2JobSetupPolicy defaulting to every action scope An agent opting in with job_policy={"setup": {}} advertised support for the workspace, job, case and step scopes without declaring any, which broadens the contract Studio sees. Default to an empty list, matching V2JobSyncPolicy.supported_statuses. Also declare V2JobSetupPolicy before V2JobPolicy so the generated model reference renders the real type instead of a ForwardRef. * 📝 docs: regenerate model reference and OpenAPI Picks up the job setup contract (V2JobPolicy.setup, V2JobSetupPolicy, V2ActionResult.setup_plan) plus accumulated drift since 0.20.1. * 📝 docs: log generic job setup contract in CHANGELOG Records the V2JobSetupPolicy contract, the empty action_scopes default, and the model reference regeneration under Unreleased. * 🐛 fix(contracts): reject blank job setup and sync action ids An empty preview_action/start_action/submit_action was accepted, then dropped from capabilities.actions by _unique_strings while still being serialized under job_policy.setup, so Studio saw an action it could never invoke. Validate all three as non-blank, plus V2JobSyncPolicy.action, which had the same gap. * doc --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com> Co-authored-by: Cursor <cursoragent@cursor.com>
alain-sv
added a commit
that referenced
this pull request
Aug 30, 2026
* apply dependabot insights * minor * chore(ci): SHA-pin actions/checkout and actions/setup-python (#43) Pin all uses of actions/checkout@v6 and actions/setup-python@v6 to their commit SHAs across every workflow, closing the remaining floating-tag attack surface. - actions/checkout → de0fac2e (v6) - actions/setup-python → a309ff8b (v6) * docs(changelog): add unreleased dependency security refresh entry (#44) * chore(ci): add uv cache-suffix per Python version + update AGENTS.md facts (#46) Prevents parallel matrix jobs racing on the same Actions cache reservation. Also records two CI tooling facts in AGENTS.md. * supervaizer-v2-mvp-contracts (#47) * feat: add supervaizer v2 contract primitives * feat: add supervaizer v2 a2a action endpoint * feat: expose supervaizer v2 registration in a2a card * feat: add supervaizer v2 action decorator * docs: update supervaizer v2 changelog * precommit fix * refactor: move controller api version to contracts * minor * fix: scope v2 action handlers by agent * feat: guard supervaizer v2 agent identity * feat: include v2 job state in sync result * feat: add v2 resource form fields * feat: add v2 resource option sources * feat: add v2 awaiting form fields * feat: load supervaizer v2 surfaces over a2a * feat: expose local hello world v2 contract * feat: add v2 job source target type * feat: stream v2 action effects over a2a * fix: advertise v2 push notifications as unsupported * refactor: remove legacy dynamic choices * feat: complete local hello world v2 hitl flow * refactor: remove legacy job poll * docs: refresh generated contract docs * test: align v2 prompt editor fixture * test: align v2 contact import fixture * test: align v2 scenario builder fixture * test: align v2 overview fixture * test: align v2 campaign contact fixture * feat: add v2 registration builder * feat: type v2 dataset display metadata * minor * fix: precommit * feat: add comprehensive documentation for SUPERVAIZER API, Admin Interface, CLI, Parameter Validation, Persistence, Protocols, and REST API * minor * chore: change copyright dates from 2024-2025 to 2024-2026 * fix: harden agent model surface and v2 contract hygiene Use modern typing in agent.py, keep server encrypted params internal, document deterministic agent ids, tighten A2A health status rules, drop legacy hello-world v2 input aliases, and clarify v2 contract fields. * feat: enhance agent method validation and improve v2 action safety - Introduced validation to reject agent methods using blocked module roots.- Added checks to ensure declared method paths are used in agent execution.- Enhanced v2 action results with replay safety metadata validation.- Updated changelog and documentation to reflect these changes. * feat: add v2 resource import contracts * test: align v2 contract fixtures * minor * fix: require auth for a2a controller * minor * Minor * chore: update changelog for Supervaizer v2 enhancements and API key validation improvements - Added optional `metadata` field to `V2CaseSnapshot` for case-level context. - Implemented validation for Studio registration handshake to ensure API key consistency. - Enhanced server API key handling for stability during reloads. - Updated tests to cover new functionality and validation paths. * workspace-agent-grants (#50) * docs: plan workspace agent grants * docs: add Studio grant acceptance UX * feat: add workspace agent authorization * feat: add workspace binding protocol * fix: stabilize workspace authorization * ✨feat: add workspace auth helpers and use them in tests * ✨feat: require workspace auth and tighten agent checks * fix: require workspace auth for Studio A2A * fix: harden workspace authorization checks * fix: normalize malformed workspace auth inputs * minor * feat(logging): implement structured logging for Cloud Logging compatibility - Added support for newline-delimited JSON logging when `SUPERVAIZER_LOG_FORMAT=json` is set. - Updated logging configuration to allow structured logs for access-denial events. - Enhanced `log_access_denied_api` and `log_access_denied_tailscale` functions to include structured fields. - Added tests to verify structured logging outputs in `tests/test_common.py`. * Minor * codex/supervaizer-lifespan-cleanup (#54) * Clean up Supervaizer lifespan shutdown * Document Supervaizer import placement rule * Fix lifespan cleanup test determinism * Address lifespan shutdown review feedback * ✨feat: rename test and assert scheduled step task * ✨ feat: update GitNexus index counts in AGENTS.md * codex/refactor-server-modules (#55) * Refactor Supervaizer server modules * ✨ feat: update GitNexus index stats in AGENTS.md * ✨docs update changelog AGENTS guidance * ✨feat: add v2 methods, tests and license header * minor * codex/agent-interviewer-workspace-jobs-refresh (#56) * Clean up Supervaizer lifespan shutdown * Document Supervaizer import placement rule * Fix lifespan cleanup test determinism * Address lifespan shutdown review feedback * ✨feat: rename test and assert scheduled step task * ✨ feat: update GitNexus index counts in AGENTS.md * feat(v2): add agent action methods * Refactor pre-commit configuration and enhance agent validation - Updated mypy hook to use project-specific configuration for consistency with uv.lock. - Improved validation for v2_registration and v2_method_declarations in Agent class to ensure proper type handling. - Enhanced logging configuration to cast message records for structured logging compatibility. * chore(deps): bump uv from 0.11.14 to 0.11.15 (#58) Bumps [uv](https://github.com/astral-sh/uv) from 0.11.14 to 0.11.15. - [Release notes](https://github.com/astral-sh/uv/releases) - [Changelog](https://github.com/astral-sh/uv/blob/main/CHANGELOG.md) - [Commits](astral-sh/uv@0.11.14...0.11.15) --- updated-dependencies: - dependency-name: uv dependency-version: 0.11.15 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump starlette from 0.50.0 to 1.0.1 (#60) Bumps [starlette](https://github.com/Kludex/starlette) from 0.50.0 to 1.0.1. - [Release notes](https://github.com/Kludex/starlette/releases) - [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md) - [Commits](Kludex/starlette@0.50.0...1.0.1) --- updated-dependencies: - dependency-name: starlette dependency-version: 1.0.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump trufflesecurity/trufflehog from 3.95.3 to 3.95.5 (#61) Bumps [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog) from 3.95.3 to 3.95.5. - [Release notes](https://github.com/trufflesecurity/trufflehog/releases) - [Commits](trufflesecurity/trufflehog@37b7700...d411fff) --- updated-dependencies: - dependency-name: trufflesecurity/trufflehog dependency-version: 3.95.5 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * feat(.agents): add skill symlinks from runwaize skills cookbook Add 21 skill symlinks under .agents/skills/ pointing to the local runwaize_skills_cookbook installation, covering cloud-run basics, Pulumi migration/tooling skills (terraform, CDK, ARM, ESC, component, automation-api, upgrade-provider, best-practices, neo-handoff), Google Cloud WAF pillars (security, reliability, performance, cost-optimization, operational-excellence), google-cloud-recipe-auth, google-cloud-networking-observability, cloudformation-to-pulumi, package-usage, provider-upgrade, and upstream-patches. Update AGENTS.md GitNexus index stats to reflect the current index (6273 symbols, 11483 relationships, 281 execution flows). * chore(deps): bump astral-sh/setup-uv from 8.1.0 to 8.2.0 (#62) Bumps [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) from 8.1.0 to 8.2.0. - [Release notes](https://github.com/astral-sh/setup-uv/releases) - [Commits](astral-sh/setup-uv@0880764...fac544c) --- updated-dependencies: - dependency-name: astral-sh/setup-uv dependency-version: 8.2.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump actions/checkout from 6.0.2 to 6.0.3 (#63) Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.2 to 6.0.3. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@de0fac2...df4cb1c) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 6.0.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump starlette from 1.0.1 to 1.3.1 (#66) Bumps [starlette](https://github.com/Kludex/starlette) from 1.0.1 to 1.3.1. - [Release notes](https://github.com/Kludex/starlette/releases) - [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md) - [Commits](Kludex/starlette@1.0.1...1.3.1) --- updated-dependencies: - dependency-name: starlette dependency-version: 1.3.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump cryptography from 48.0.0 to 48.0.1 (#67) Bumps [cryptography](https://github.com/pyca/cryptography) from 48.0.0 to 48.0.1. - [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst) - [Commits](pyca/cryptography@48.0.0...48.0.1) --- updated-dependencies: - dependency-name: cryptography dependency-version: 48.0.1 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump actions/checkout from 6.0.3 to 7.0.0 (#68) Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.3 to 7.0.0. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@df4cb1c...9c091bb) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump softprops/action-gh-release from 3.0.0 to 3.0.1 (#69) Bumps [softprops/action-gh-release](https://github.com/softprops/action-gh-release) from 3.0.0 to 3.0.1. - [Release notes](https://github.com/softprops/action-gh-release/releases) - [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md) - [Commits](softprops/action-gh-release@b430933...718ea10) --- updated-dependencies: - dependency-name: softprops/action-gh-release dependency-version: 3.0.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump trufflesecurity/trufflehog from 3.95.5 to 3.95.6 (#70) Bumps [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog) from 3.95.5 to 3.95.6. - [Release notes](https://github.com/trufflesecurity/trufflehog/releases) - [Commits](trufflesecurity/trufflehog@d411fff...30d5bb9) --- updated-dependencies: - dependency-name: trufflesecurity/trufflehog dependency-version: 3.95.6 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * codex/managed-context-sdk (#65) * feat: add managed context SDK client * ✨ feat: update gitn docs to use local run.cjs and paginate list_repos * ✨ feat: add MPLv2 license headers to module and test files * fix: address managed context review feedback * ✨ feat(contracts): add V2ContextAssignment for context.assign (#71) * ✨ feat(contracts): add V2ContextAssignment for context.assign * ✨ feat(contracts): constrain context scope and document assignment semantics Address PR #71 review: V2ContextAssignmentItem.scope is now Literal["workspace", "mission"] (matching other closed v2 vocabularies) with a ValidationError regression test, and the v2 doc gains explicit context.assign semantics: refs-not-content payload, freeze-on-pull with provenance, mandatory fetched-vs-assigned version check that fails the assignment on mismatch, and no live context reads during execution. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * 🐛 fix(contracts): require mission_id for mission-scoped context assignments Address PR #71 follow-up review: a V2ContextAssignment containing scope="mission" items but no mission_id passed validation while the agent-side ContextClient.open() would have no mission context to fetch with. A model_validator now rejects that combination; workspace-only assignments still allow a null mission_id. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * 🐛 fix(contracts): reject whitespace-only mission_id for mission-scoped assignments Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com> * feat: bump version to1.3.0 and update deps; iterate nested (#73) * changelog * chore(deps): bump actions/setup-python from 6.2.0 to 6.3.0 (#75) Bumps [actions/setup-python](https://github.com/actions/setup-python) from 6.2.0 to 6.3.0. - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](actions/setup-python@a309ff8...ece7cb0) --- updated-dependencies: - dependency-name: actions/setup-python dependency-version: 6.3.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump trufflesecurity/trufflehog from 3.95.6 to 3.95.7 (#76) Bumps [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog) from 3.95.6 to 3.95.7. - [Release notes](https://github.com/trufflesecurity/trufflehog/releases) - [Commits](trufflesecurity/trufflehog@30d5bb9...f446421) --- updated-dependencies: - dependency-name: trufflesecurity/trufflehog dependency-version: 3.95.7 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * security: review summary (redacted) + safe P0/P1 hardening (#77) * docs: add redacted security & performance review summary Adds a non-actionable high-level summary of a full-source security and performance/scalability review of the SDK (posture, verified-sound controls, severity counts, and remediation themes) and a CHANGELOG entry. Per SECURITY.md, detailed vulnerability findings (exact locations, attack scenarios, remediation specifics) are intentionally kept out of the public repository and handled through the private vulnerability channel. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F8GY2d3HJgCKwgCyRgNFMt * fix(security): harden API-key compare, local-mode bind, headers, logging, scheduler Safe P0/P1 remediations from the security review (no wire-format or auth-model breaking changes): - Constant-time API-key comparison (hmac.compare_digest) in require_api_key and Server.verify_api_key (CWE-208). - Local mode binds 127.0.0.1 instead of 0.0.0.0 unless an explicit non-wildcard host is set, so the default 'local-dev' key is not network-exposed (CWE-798). - Baseline security headers (nosniff, X-Frame-Options DENY, Referrer-Policy, HSTS) via a pure-ASGI middleware that is SSE-safe (CWE-693/1021). - Stop logging decrypted agent-parameter values and full result payloads in validate-agent-parameters (CWE-532). - Allow-list scheduled_method against the agent's declared method paths in the scheduler and workbench execute-now path (CWE-470). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F8GY2d3HJgCKwgCyRgNFMt * fix(security): compare API keys as bytes to avoid TypeError on non-ASCII hmac.compare_digest rejects non-ASCII str inputs, so a malformed X-API-Key with non-ASCII characters raised TypeError (500) instead of failing closed (401/403). Encode both operands to UTF-8 bytes in require_api_key and Server.verify_api_key so malformed credentials are rejected. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F8GY2d3HJgCKwgCyRgNFMt * refactor(security): address review feedback on hardening changes - Scope scheduled-step allow-list to the owning job's agent instead of the union of all agents, so a tampered step cannot invoke another agent's declared methods (per-agent isolation). - Move MutableHeaders import to module scope (repo convention: no function-local imports without a concrete circular/optional/startup reason). - Reword CHANGELOG security bullets to high-level, non-actionable descriptions consistent with the private-advisory disclosure policy. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F8GY2d3HJgCKwgCyRgNFMt * refactor(security): tighten scheduled-step allow-list resolution Address review follow-ups on per-agent method scoping: - Scheduler: if a due step's owning job cannot be resolved, mark the step failed instead of falling back to the union of all agents' methods, so an orphaned/tampered step cannot invoke another agent's method. - Workbench execute-now: verify the job is owned by the request's agent (Jobs().get_job(job_id, agent_name=agent.name)) before using that agent's allow-list, preventing a slug/job-owner mismatch from widening the list. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F8GY2d3HJgCKwgCyRgNFMt * fix(security): use SAMEORIGIN and hoist Jobs import - X-Frame-Options: SAMEORIGIN instead of DENY so the admin instructions iframe (same-origin) still renders, while cross-origin framing stays blocked. - Move the Jobs import in scheduled_steps to module scope (no circular dependency; matches the repo's module-level-imports convention). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F8GY2d3HJgCKwgCyRgNFMt * refactor(admin): hoist scheduled step helper import * fix(security): scope scheduled step ownership checks * ✨ docs: add test summary table to changelog (docs/CHANGELOG.md) * ✨ feat(ci): skip unit tests for docs-only changes in workflow --------- Co-authored-by: Claude <noreply@anthropic.com> * chore(deps): bump trufflesecurity/trufflehog from 3.95.7 to 3.95.9 (#81) Bumps [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog) from 3.95.7 to 3.95.9. - [Release notes](https://github.com/trufflesecurity/trufflehog/releases) - [Commits](trufflesecurity/trufflehog@f446421...27b0417) --- updated-dependencies: - dependency-name: trufflesecurity/trufflehog dependency-version: 3.95.9 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump softprops/action-gh-release from 3.0.1 to 3.0.2 (#82) Bumps [softprops/action-gh-release](https://github.com/softprops/action-gh-release) from 3.0.1 to 3.0.2. - [Release notes](https://github.com/softprops/action-gh-release/releases) - [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md) - [Commits](softprops/action-gh-release@718ea10...3d0d988) --- updated-dependencies: - dependency-name: softprops/action-gh-release dependency-version: 3.0.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump astral-sh/setup-uv from 8.2.0 to 8.3.2 (#83) Bumps [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) from 8.2.0 to 8.3.2. - [Release notes](https://github.com/astral-sh/setup-uv/releases) - [Commits](astral-sh/setup-uv@fac544c...11f9893) --- updated-dependencies: - dependency-name: astral-sh/setup-uv dependency-version: 8.3.2 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump pyasn1 from 0.6.3 to 0.6.4 (#84) Bumps [pyasn1](https://github.com/pyasn1/pyasn1) from 0.6.3 to 0.6.4. - [Release notes](https://github.com/pyasn1/pyasn1/releases) - [Changelog](https://github.com/pyasn1/pyasn1/blob/main/CHANGES.rst) - [Commits](pyasn1/pyasn1@v0.6.3...v0.6.4) --- updated-dependencies: - dependency-name: pyasn1 dependency-version: 0.6.4 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump actions/setup-python from 6.3.0 to 7.0.0 (#85) Bumps [actions/setup-python](https://github.com/actions/setup-python) from 6.3.0 to 7.0.0. - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](actions/setup-python@ece7cb0...5fda3b9) --- updated-dependencies: - dependency-name: actions/setup-python dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump pypa/gh-action-pypi-publish from 1.14.0 to 1.14.1 (#86) Bumps [pypa/gh-action-pypi-publish](https://github.com/pypa/gh-action-pypi-publish) from 1.14.0 to 1.14.1. - [Release notes](https://github.com/pypa/gh-action-pypi-publish/releases) - [Commits](pypa/gh-action-pypi-publish@cef2210...ba38be9) --- updated-dependencies: - dependency-name: pypa/gh-action-pypi-publish dependency-version: 1.14.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump cryptography from 49.0.0 to 50.0.0 (#87) Bumps [cryptography](https://github.com/pyca/cryptography) from 49.0.0 to 50.0.0. - [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst) - [Commits](pyca/cryptography@49.0.0...50.0.0) --- updated-dependencies: - dependency-name: cryptography dependency-version: 50.0.0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * feat: add generic job setup contract (#89) * feat: add generic job setup contract * 🐛 fix(contracts): stop V2JobSetupPolicy defaulting to every action scope An agent opting in with job_policy={"setup": {}} advertised support for the workspace, job, case and step scopes without declaring any, which broadens the contract Studio sees. Default to an empty list, matching V2JobSyncPolicy.supported_statuses. Also declare V2JobSetupPolicy before V2JobPolicy so the generated model reference renders the real type instead of a ForwardRef. * 📝 docs: regenerate model reference and OpenAPI Picks up the job setup contract (V2JobPolicy.setup, V2JobSetupPolicy, V2ActionResult.setup_plan) plus accumulated drift since 0.20.1. * 📝 docs: log generic job setup contract in CHANGELOG Records the V2JobSetupPolicy contract, the empty action_scopes default, and the model reference regeneration under Unreleased. * 🐛 fix(contracts): reject blank job setup and sync action ids An empty preview_action/start_action/submit_action was accepted, then dropped from capabilities.actions by _unique_strings while still being serialized under job_policy.setup, so Studio saw an action it could never invoke. Validate all three as non-blank, plus V2JobSyncPolicy.action, which had the same gap. * doc * changelog update * ✨ feat(contracts): declare action scope and mutability (#92) (#93) * ✨ feat(contracts): declare action scope and mutability (#92) V2AgentCapabilities.actions becomes list[V2ActionDefinition] carrying id, mutating and scope, so consumers authorize and group actions from declared metadata instead of pattern-matching the caller-supplied id. Bare strings still validate and coerce to mutating=True, scope=job. The builder derives metadata from each action's parent definition; precedence is explicit > derived > bare. Also adds V2DatasetDefinition.scope and V2AwaitingState.reopenable. * 📝 chore: update documentation * 🐛 fix(contracts): keep explicit action metadata when an id is declared twice An id given both as a V2ActionDefinition and as a bare string in actions= marked the id bare regardless of which declaration was retained, so the derived entry then overwrote the explicit metadata. Bareness is now tracked per retained declaration and an explicit definition wins wherever the two appear. * Changelog --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com> Co-authored-by: Cursor <cursoragent@cursor.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps trufflesecurity/trufflehog from 3.95.5 to 3.95.6.
Release notes
Sourced from trufflesecurity/trufflehog's releases.
Commits
30d5bb9S3: surface bucket listing failures and fix multi-role object count (#5035)f0739f1close todo - embed small HTTP test fixtures (#5001)36d680aadd filetype=sdist param so we get the correct response code (#4988)248ffd5fix(dropbox): prevent long sl.u. tokens from being truncated before verificat...afbdaa8Fix: Resolve known dedup issues in notifierWorker (#5028)7bcf376[INS-472] [INS-515] Add user detector to defaults.go, gate it behind feat fla...84a2b33Fix Renovate lookup: update setup-captain version comment (#4999)ac0805e[INS-469] Added Rev detectors to defaults.go and gated it behind feature flag...d03d087GitHub finegrain analyzer was improperly handling errors (#4498)b64cefeset redacted value to last 4 characters of secret, to match how the secret ty...Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)