Skip to content

✨ feat(contracts): add V2ContextAssignment for context.assign - #71

Merged
alain-sv merged 4 commits into
developfrom
feat/context-assign-contract
Jul 2, 2026
Merged

✨ feat(contracts): add V2ContextAssignment for context.assign#71
alain-sv merged 4 commits into
developfrom
feat/context-assign-contract

Conversation

@alain-sv

@alain-sv alain-sv commented Jul 2, 2026

Copy link
Copy Markdown
Contributor

Adds the typed contract for the new context.assign v2 action: Studio assigns a frozen selection of workspace/mission context items (ref + version + scope + title) to a job; the agent fetches content once via ContextClient and stores provenance (ref, version, hash, synced_at).

  • V2ContextAssignmentItem + V2ContextAssignment in contracts.py (ContractModel, import-light)
  • V2_ACTION_CONTEXT_ASSIGN = "context.assign" + exports
  • Action table row in docs/2026_05_SUPERVAIZER_v2.md + CHANGELOG entry
  • Additive only; dispatch rides the existing Server.v2_action machinery

Part of the Campaign Setup From Studio workstream (spec: RUNWAIZE docs/superpowers/specs/2026-07-02-campaign-setup-studio-integration-design.md). Companion to #65 (ContextClient) — both are needed for the next supervaizer release consumed by agent_interviewer.

🤖 Generated with Claude Code

@qodo-code-review

Copy link
Copy Markdown

PR Summary by Qodo

Add typed v2 contract for context.assign (V2ContextAssignment)

✨ Enhancement 📝 Documentation 🧪 Tests 🕐 20-40 Minutes

Grey Divider

AI Description

• Introduces V2ContextAssignment / V2ContextAssignmentItem models for context.assign payloads.
• Exports V2_ACTION_CONTEXT_ASSIGN and new models at the package level.
• Documents the new action and adds parsing/empty-items coverage in contracts tests.
Diagram

graph TD
  A{{"Studio"}} --> B["context.assign action"] --> C["contracts.py"] --> D["package exports"]
  B --> E["v2 spec docs"]
  C --> F["contract tests"]
  C --> G["CHANGELOG"]
  subgraph Legend
    direction LR
    _ext{{"External"}} ~~~ _mod["Module/File"]
  end
Loading
High-Level Assessment

The following are alternative approaches to this PR:

1. Keep `context.assign` untyped (dict-only)
  • ➕ No new public API surface area to maintain
  • ➕ Maximally flexible if the payload shape is still evolving
  • ➖ Downstream SDK users lose validation/autocomplete
  • ➖ Harder to version/extend safely without breaking consumers
2. Stricter schema (Literal scope + datetime assigned_at)
  • ➕ Earlier validation of malformed payloads (scope values, timestamp parsing)
  • ➕ Clearer contract semantics for clients
  • ➖ Higher risk of rejecting real-world payloads (timezone formats, future scope values)
  • ➖ May conflict with current 'import-light' / interoperability goals

Recommendation: The PR’s approach (additive typed models + exported action id) is the right default for SDK ergonomics and forward-compatible versioning. If interop issues appear, consider tightening scope to a Literal[...] and assigned_at to a datetime in a later, explicitly versioned contract revision.

Files changed (5) +60 / -0

Enhancement (2) +26 / -0
__init__.pyRe-export 'V2_ACTION_CONTEXT_ASSIGN' and context assignment models +9/-0

Re-export 'V2_ACTION_CONTEXT_ASSIGN' and context assignment models

• Updates the lazy export map to include 'V2_ACTION_CONTEXT_ASSIGN', 'V2ContextAssignment', and 'V2ContextAssignmentItem'. Ensures SDK consumers can import these symbols directly from 'supervaizer'.

src/supervaizer/init.py

contracts.pyIntroduce 'V2ContextAssignment' / 'V2ContextAssignmentItem' contracts +17/-0

Introduce 'V2ContextAssignment' / 'V2ContextAssignmentItem' contracts

• Adds the 'V2_ACTION_CONTEXT_ASSIGN = "context.assign"' constant. Defines contract models representing a frozen selection of context items plus job/mission metadata and an ISO-8601 assignment timestamp.

src/supervaizer/contracts.py

Tests (1) +29 / -0
test_contracts.pyAdd tests for parsing and empty-items behavior of context assignment +29/-0

Add tests for parsing and empty-items behavior of context assignment

• Adds coverage that 'V2ContextAssignment' parses nested 'items' correctly and permits an explicit empty list. Also asserts the action id constant value is stable.

tests/test_contracts.py

Documentation (2) +5 / -0
2026_05_SUPERVAIZER_v2.mdDocument new 'context.assign' action in the v2 action table +1/-0

Document new 'context.assign' action in the v2 action table

• Adds a new row describing the 'context.assign' action semantics. Notes that the agent fetches content via 'ContextClient' and stores provenance fields.

docs/2026_05_SUPERVAIZER_v2.md

CHANGELOG.mdAdd Unreleased changelog entry for 'context.assign' contract +4/-0

Add Unreleased changelog entry for 'context.assign' contract

• Documents the newly added typed wire contract ('V2ContextAssignment', 'V2ContextAssignmentItem') and the exported action id constant. Clarifies the change is additive and uses existing dispatch machinery.

docs/CHANGELOG.md

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ac56ecc7ad

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

Comment thread src/supervaizer/contracts.py Outdated
@qodo-code-review

qodo-code-review Bot commented Jul 2, 2026

Copy link
Copy Markdown

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📜 Skill insights (0)

Context used
✅ Compliance rules (platform): 32 rules

Grey Divider


Remediation recommended

1. Unvalidated context scope ✓ Resolved 🐞 Bug ≡ Correctness
Description
V2ContextAssignmentItem.scope is typed as a free-form str despite being documented as only
"workspace" or "mission", so invalid/typo values will validate and can propagate into downstream
logic. This also weakens the generated JSON schema compared to other v2 contract enums that are
constrained with Literal[...].
Code

src/supervaizer/contracts.py[R810-814]

+class V2ContextAssignmentItem(ContractModel):
+    ref: str  # Studio ContextItem ref, e.g. "supervaize.context.mission.january-brief"
+    version: int  # ContextItem version at selection time
+    scope: str  # "workspace" | "mission"
+    title: str
Relevance

⭐⭐⭐ High

Repo uses Literal for closed-set contract fields (e.g., JsonRpcRequest.jsonrpc in PR #47); schema
strictness valued.

PR-#47

ⓘ Recommendations generated based on similar findings in past PRs

Evidence
The new contract comments indicate scope is intended to be a closed set, but it’s defined as str
so validation won’t reject unexpected values. Elsewhere in the same contracts module, similar
closed-vocabulary fields are modeled with Literal[...], demonstrating the established pattern for
enforcing protocol enums.

src/supervaizer/contracts.py[810-815]
src/supervaizer/contracts.py[867-869]
src/supervaizer/contracts.py[923-925]

Agent prompt
The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
`V2ContextAssignmentItem.scope` is currently declared as `str` while the comment indicates it should be a closed vocabulary ("workspace" | "mission"). This means Pydantic will accept any string and the JSON schema won’t communicate/validate the allowed values.

## Issue Context
The codebase already constrains protocol enums with `Literal[...]` (e.g., `V2ActionResult.status`, `V2JobSource.type`). Align `scope` with that pattern.

## Fix Focus Areas
- src/supervaizer/contracts.py[810-815]
- tests/test_contracts.py[738-761]

### Implementation notes
- Change `scope: str` to `scope: Literal["workspace", "mission"]` (or introduce a small `StrEnum` for scope if you expect reuse).
- Add a test asserting `ValidationError` on an invalid scope (e.g., "missions"), to prevent regressions.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools


Grey Divider

Qodo Logo

Comment thread src/supervaizer/contracts.py
@alain-sv
alain-sv force-pushed the feat/context-assign-contract branch from ac56ecc to 5f0d8e1 Compare July 2, 2026 11:51

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 5f0d8e126f

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

Comment thread src/supervaizer/contracts.py
…mantics

Address PR #71 review: V2ContextAssignmentItem.scope is now Literal["workspace", "mission"] (matching other closed v2 vocabularies) with a ValidationError regression test, and the v2 doc gains explicit context.assign semantics: refs-not-content payload, freeze-on-pull with provenance, mandatory fetched-vs-assigned version check that fails the assignment on mismatch, and no live context reads during execution.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 228d674bf3

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

Comment thread src/supervaizer/contracts.py
…nments

Address PR #71 follow-up review: a V2ContextAssignment containing scope="mission" items but no mission_id passed validation while the agent-side ContextClient.open() would have no mission context to fetch with. A model_validator now rejects that combination; workspace-only assignments still allow a null mission_id.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 0a05820fa2

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

Comment thread src/supervaizer/contracts.py Outdated
…d assignments

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@alain-sv
alain-sv merged commit 665ef50 into develop Jul 2, 2026
9 checks passed
alain-sv added a commit that referenced this pull request Jul 2, 2026
* apply dependabot insights

* minor

* chore(ci): SHA-pin actions/checkout and actions/setup-python (#43)

Pin all uses of actions/checkout@v6 and actions/setup-python@v6 to
their commit SHAs across every workflow, closing the remaining
floating-tag attack surface.

- actions/checkout  → de0fac2e (v6)
- actions/setup-python → a309ff8b (v6)

* docs(changelog): add unreleased dependency security refresh entry (#44)

* chore(ci): add uv cache-suffix per Python version + update AGENTS.md facts (#46)

Prevents parallel matrix jobs racing on the same Actions cache
reservation. Also records two CI tooling facts in AGENTS.md.

* supervaizer-v2-mvp-contracts (#47)

* feat: add supervaizer v2 contract primitives

* feat: add supervaizer v2 a2a action endpoint

* feat: expose supervaizer v2 registration in a2a card

* feat: add supervaizer v2 action decorator

* docs: update supervaizer v2 changelog

* precommit fix

* refactor: move controller api version to contracts

* minor

* fix: scope v2 action handlers by agent

* feat: guard supervaizer v2 agent identity

* feat: include v2 job state in sync result

* feat: add v2 resource form fields

* feat: add v2 resource option sources

* feat: add v2 awaiting form fields

* feat: load supervaizer v2 surfaces over a2a

* feat: expose local hello world v2 contract

* feat: add v2 job source target type

* feat: stream v2 action effects over a2a

* fix: advertise v2 push notifications as unsupported

* refactor: remove legacy dynamic choices

* feat: complete local hello world v2 hitl flow

* refactor: remove legacy job poll

* docs: refresh generated contract docs

* test: align v2 prompt editor fixture

* test: align v2 contact import fixture

* test: align v2 scenario builder fixture

* test: align v2 overview fixture

* test: align v2 campaign contact fixture

* feat: add v2 registration builder

* feat: type v2 dataset display metadata

* minor

* fix: precommit

* feat: add comprehensive documentation for SUPERVAIZER API, Admin Interface, CLI, Parameter Validation, Persistence, Protocols, and REST API

* minor

* chore: change copyright dates

from 2024-2025 to 2024-2026

* fix: harden agent model surface and v2 contract hygiene

Use modern typing in agent.py, keep server encrypted params internal,
document deterministic agent ids, tighten A2A health status rules, drop
legacy hello-world v2 input aliases, and clarify v2 contract fields.

* feat: enhance agent method validation and improve v2 action safety

- Introduced validation to reject agent methods using blocked module

  roots.- Added checks to ensure declared method paths are used in

  agent execution.- Enhanced v2 action results with replay safety

  metadata validation.- Updated changelog and documentation to reflect

  these changes.

* feat: add v2 resource import contracts

* test: align v2 contract fixtures

* minor

* fix: require auth for a2a controller

* minor

* Minor

* chore: update changelog for Supervaizer v2 enhancements and API key validation improvements

- Added optional `metadata` field to `V2CaseSnapshot` for case-level context.
- Implemented validation for Studio registration handshake to ensure API key consistency.
- Enhanced server API key handling for stability during reloads.
- Updated tests to cover new functionality and validation paths.

* workspace-agent-grants (#50)

* docs: plan workspace agent grants

* docs: add Studio grant acceptance UX

* feat: add workspace agent authorization

* feat: add workspace binding protocol

* fix: stabilize workspace authorization

* ✨feat: add workspace auth helpers and use them in tests

* ✨feat: require workspace auth and tighten agent checks

* fix: require workspace auth for Studio A2A

* fix: harden workspace authorization checks

* fix: normalize malformed workspace auth inputs

* minor

* feat(logging): implement structured logging for Cloud Logging compatibility

- Added support for newline-delimited JSON logging when `SUPERVAIZER_LOG_FORMAT=json` is set.
- Updated logging configuration to allow structured logs for access-denial events.
- Enhanced `log_access_denied_api` and `log_access_denied_tailscale` functions to include structured fields.
- Added tests to verify structured logging outputs in `tests/test_common.py`.

* Minor

* codex/supervaizer-lifespan-cleanup (#54)

* Clean up Supervaizer lifespan shutdown

* Document Supervaizer import placement rule

* Fix lifespan cleanup test determinism

* Address lifespan shutdown review feedback

* ✨feat: rename test and assert scheduled step task

* ✨ feat: update GitNexus index counts in AGENTS.md

* codex/refactor-server-modules (#55)

* Refactor Supervaizer server modules

* ✨ feat: update GitNexus index stats in AGENTS.md

* ✨docs update changelog AGENTS guidance

* ✨feat: add v2 methods, tests and license header

* minor

* codex/agent-interviewer-workspace-jobs-refresh (#56)

* Clean up Supervaizer lifespan shutdown

* Document Supervaizer import placement rule

* Fix lifespan cleanup test determinism

* Address lifespan shutdown review feedback

* ✨feat: rename test and assert scheduled step task

* ✨ feat: update GitNexus index counts in AGENTS.md

* feat(v2): add agent action methods

* Refactor pre-commit configuration and enhance agent validation

- Updated mypy hook to use project-specific configuration for consistency with uv.lock.
- Improved validation for v2_registration and v2_method_declarations in Agent class to ensure proper type handling.
- Enhanced logging configuration to cast message records for structured logging compatibility.

* chore(deps): bump uv from 0.11.14 to 0.11.15 (#58)

Bumps [uv](https://github.com/astral-sh/uv) from 0.11.14 to 0.11.15.
- [Release notes](https://github.com/astral-sh/uv/releases)
- [Changelog](https://github.com/astral-sh/uv/blob/main/CHANGELOG.md)
- [Commits](astral-sh/uv@0.11.14...0.11.15)

---
updated-dependencies:
- dependency-name: uv
  dependency-version: 0.11.15
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps): bump starlette from 0.50.0 to 1.0.1 (#60)

Bumps [starlette](https://github.com/Kludex/starlette) from 0.50.0 to 1.0.1.
- [Release notes](https://github.com/Kludex/starlette/releases)
- [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md)
- [Commits](Kludex/starlette@0.50.0...1.0.1)

---
updated-dependencies:
- dependency-name: starlette
  dependency-version: 1.0.1
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps): bump trufflesecurity/trufflehog from 3.95.3 to 3.95.5 (#61)

Bumps [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog) from 3.95.3 to 3.95.5.
- [Release notes](https://github.com/trufflesecurity/trufflehog/releases)
- [Commits](trufflesecurity/trufflehog@37b7700...d411fff)

---
updated-dependencies:
- dependency-name: trufflesecurity/trufflehog
  dependency-version: 3.95.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* feat(.agents): add skill symlinks from runwaize skills cookbook

Add 21 skill symlinks under .agents/skills/ pointing to the local
runwaize_skills_cookbook installation, covering cloud-run basics,
Pulumi migration/tooling skills (terraform, CDK, ARM, ESC, component,
automation-api, upgrade-provider, best-practices, neo-handoff),
Google Cloud WAF pillars (security, reliability, performance,
cost-optimization, operational-excellence), google-cloud-recipe-auth,
google-cloud-networking-observability, cloudformation-to-pulumi,
package-usage, provider-upgrade, and upstream-patches.

Update AGENTS.md GitNexus index stats to reflect the current index
(6273 symbols, 11483 relationships, 281 execution flows).

* chore(deps): bump astral-sh/setup-uv from 8.1.0 to 8.2.0 (#62)

Bumps [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) from 8.1.0 to 8.2.0.
- [Release notes](https://github.com/astral-sh/setup-uv/releases)
- [Commits](astral-sh/setup-uv@0880764...fac544c)

---
updated-dependencies:
- dependency-name: astral-sh/setup-uv
  dependency-version: 8.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps): bump actions/checkout from 6.0.2 to 6.0.3 (#63)

Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.2 to 6.0.3.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@de0fac2...df4cb1c)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 6.0.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps): bump starlette from 1.0.1 to 1.3.1 (#66)

Bumps [starlette](https://github.com/Kludex/starlette) from 1.0.1 to 1.3.1.
- [Release notes](https://github.com/Kludex/starlette/releases)
- [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md)
- [Commits](Kludex/starlette@1.0.1...1.3.1)

---
updated-dependencies:
- dependency-name: starlette
  dependency-version: 1.3.1
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps): bump cryptography from 48.0.0 to 48.0.1 (#67)

Bumps [cryptography](https://github.com/pyca/cryptography) from 48.0.0 to 48.0.1.
- [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst)
- [Commits](pyca/cryptography@48.0.0...48.0.1)

---
updated-dependencies:
- dependency-name: cryptography
  dependency-version: 48.0.1
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps): bump actions/checkout from 6.0.3 to 7.0.0 (#68)

Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.3 to 7.0.0.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@df4cb1c...9c091bb)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps): bump softprops/action-gh-release from 3.0.0 to 3.0.1 (#69)

Bumps [softprops/action-gh-release](https://github.com/softprops/action-gh-release) from 3.0.0 to 3.0.1.
- [Release notes](https://github.com/softprops/action-gh-release/releases)
- [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md)
- [Commits](softprops/action-gh-release@b430933...718ea10)

---
updated-dependencies:
- dependency-name: softprops/action-gh-release
  dependency-version: 3.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps): bump trufflesecurity/trufflehog from 3.95.5 to 3.95.6 (#70)

Bumps [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog) from 3.95.5 to 3.95.6.
- [Release notes](https://github.com/trufflesecurity/trufflehog/releases)
- [Commits](trufflesecurity/trufflehog@d411fff...30d5bb9)

---
updated-dependencies:
- dependency-name: trufflesecurity/trufflehog
  dependency-version: 3.95.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* codex/managed-context-sdk (#65)

* feat: add managed context SDK client

* ✨ feat: update gitn docs to use local run.cjs and paginate list_repos

* ✨ feat: add MPLv2 license headers to module and test files

* fix: address managed context review feedback

* ✨ feat(contracts): add V2ContextAssignment for context.assign (#71)

* ✨ feat(contracts): add V2ContextAssignment for context.assign

* ✨ feat(contracts): constrain context scope and document assignment semantics

Address PR #71 review: V2ContextAssignmentItem.scope is now Literal["workspace", "mission"] (matching other closed v2 vocabularies) with a ValidationError regression test, and the v2 doc gains explicit context.assign semantics: refs-not-content payload, freeze-on-pull with provenance, mandatory fetched-vs-assigned version check that fails the assignment on mismatch, and no live context reads during execution.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* 🐛 fix(contracts): require mission_id for mission-scoped context assignments

Address PR #71 follow-up review: a V2ContextAssignment containing scope="mission" items but no mission_id passed validation while the agent-side ContextClient.open() would have no mission context to fetch with. A model_validator now rejects that combination; workspace-only assignments still allow a null mission_id.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* 🐛 fix(contracts): reject whitespace-only mission_id for mission-scoped assignments

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
alain-sv added a commit that referenced this pull request Jul 2, 2026
* apply dependabot insights

* minor

* chore(ci): SHA-pin actions/checkout and actions/setup-python (#43)

Pin all uses of actions/checkout@v6 and actions/setup-python@v6 to
their commit SHAs across every workflow, closing the remaining
floating-tag attack surface.

- actions/checkout  → de0fac2e (v6)
- actions/setup-python → a309ff8b (v6)

* docs(changelog): add unreleased dependency security refresh entry (#44)

* chore(ci): add uv cache-suffix per Python version + update AGENTS.md facts (#46)

Prevents parallel matrix jobs racing on the same Actions cache
reservation. Also records two CI tooling facts in AGENTS.md.

* supervaizer-v2-mvp-contracts (#47)

* feat: add supervaizer v2 contract primitives

* feat: add supervaizer v2 a2a action endpoint

* feat: expose supervaizer v2 registration in a2a card

* feat: add supervaizer v2 action decorator

* docs: update supervaizer v2 changelog

* precommit fix

* refactor: move controller api version to contracts

* minor

* fix: scope v2 action handlers by agent

* feat: guard supervaizer v2 agent identity

* feat: include v2 job state in sync result

* feat: add v2 resource form fields

* feat: add v2 resource option sources

* feat: add v2 awaiting form fields

* feat: load supervaizer v2 surfaces over a2a

* feat: expose local hello world v2 contract

* feat: add v2 job source target type

* feat: stream v2 action effects over a2a

* fix: advertise v2 push notifications as unsupported

* refactor: remove legacy dynamic choices

* feat: complete local hello world v2 hitl flow

* refactor: remove legacy job poll

* docs: refresh generated contract docs

* test: align v2 prompt editor fixture

* test: align v2 contact import fixture

* test: align v2 scenario builder fixture

* test: align v2 overview fixture

* test: align v2 campaign contact fixture

* feat: add v2 registration builder

* feat: type v2 dataset display metadata

* minor

* fix: precommit

* feat: add comprehensive documentation for SUPERVAIZER API, Admin Interface, CLI, Parameter Validation, Persistence, Protocols, and REST API

* minor

* chore: change copyright dates

from 2024-2025 to 2024-2026

* fix: harden agent model surface and v2 contract hygiene

Use modern typing in agent.py, keep server encrypted params internal,
document deterministic agent ids, tighten A2A health status rules, drop
legacy hello-world v2 input aliases, and clarify v2 contract fields.

* feat: enhance agent method validation and improve v2 action safety

- Introduced validation to reject agent methods using blocked module

  roots.- Added checks to ensure declared method paths are used in

  agent execution.- Enhanced v2 action results with replay safety

  metadata validation.- Updated changelog and documentation to reflect

  these changes.

* feat: add v2 resource import contracts

* test: align v2 contract fixtures

* minor

* fix: require auth for a2a controller

* minor

* Minor

* chore: update changelog for Supervaizer v2 enhancements and API key validation improvements

- Added optional `metadata` field to `V2CaseSnapshot` for case-level context.
- Implemented validation for Studio registration handshake to ensure API key consistency.
- Enhanced server API key handling for stability during reloads.
- Updated tests to cover new functionality and validation paths.

* workspace-agent-grants (#50)

* docs: plan workspace agent grants

* docs: add Studio grant acceptance UX

* feat: add workspace agent authorization

* feat: add workspace binding protocol

* fix: stabilize workspace authorization

* ✨feat: add workspace auth helpers and use them in tests

* ✨feat: require workspace auth and tighten agent checks

* fix: require workspace auth for Studio A2A

* fix: harden workspace authorization checks

* fix: normalize malformed workspace auth inputs

* minor

* feat(logging): implement structured logging for Cloud Logging compatibility

- Added support for newline-delimited JSON logging when `SUPERVAIZER_LOG_FORMAT=json` is set.
- Updated logging configuration to allow structured logs for access-denial events.
- Enhanced `log_access_denied_api` and `log_access_denied_tailscale` functions to include structured fields.
- Added tests to verify structured logging outputs in `tests/test_common.py`.

* Minor

* codex/supervaizer-lifespan-cleanup (#54)

* Clean up Supervaizer lifespan shutdown

* Document Supervaizer import placement rule

* Fix lifespan cleanup test determinism

* Address lifespan shutdown review feedback

* ✨feat: rename test and assert scheduled step task

* ✨ feat: update GitNexus index counts in AGENTS.md

* codex/refactor-server-modules (#55)

* Refactor Supervaizer server modules

* ✨ feat: update GitNexus index stats in AGENTS.md

* ✨docs update changelog AGENTS guidance

* ✨feat: add v2 methods, tests and license header

* minor

* codex/agent-interviewer-workspace-jobs-refresh (#56)

* Clean up Supervaizer lifespan shutdown

* Document Supervaizer import placement rule

* Fix lifespan cleanup test determinism

* Address lifespan shutdown review feedback

* ✨feat: rename test and assert scheduled step task

* ✨ feat: update GitNexus index counts in AGENTS.md

* feat(v2): add agent action methods

* Refactor pre-commit configuration and enhance agent validation

- Updated mypy hook to use project-specific configuration for consistency with uv.lock.
- Improved validation for v2_registration and v2_method_declarations in Agent class to ensure proper type handling.
- Enhanced logging configuration to cast message records for structured logging compatibility.

* chore(deps): bump uv from 0.11.14 to 0.11.15 (#58)

Bumps [uv](https://github.com/astral-sh/uv) from 0.11.14 to 0.11.15.
- [Release notes](https://github.com/astral-sh/uv/releases)
- [Changelog](https://github.com/astral-sh/uv/blob/main/CHANGELOG.md)
- [Commits](astral-sh/uv@0.11.14...0.11.15)

---
updated-dependencies:
- dependency-name: uv
  dependency-version: 0.11.15
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps): bump starlette from 0.50.0 to 1.0.1 (#60)

Bumps [starlette](https://github.com/Kludex/starlette) from 0.50.0 to 1.0.1.
- [Release notes](https://github.com/Kludex/starlette/releases)
- [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md)
- [Commits](Kludex/starlette@0.50.0...1.0.1)

---
updated-dependencies:
- dependency-name: starlette
  dependency-version: 1.0.1
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps): bump trufflesecurity/trufflehog from 3.95.3 to 3.95.5 (#61)

Bumps [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog) from 3.95.3 to 3.95.5.
- [Release notes](https://github.com/trufflesecurity/trufflehog/releases)
- [Commits](trufflesecurity/trufflehog@37b7700...d411fff)

---
updated-dependencies:
- dependency-name: trufflesecurity/trufflehog
  dependency-version: 3.95.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* feat(.agents): add skill symlinks from runwaize skills cookbook

Add 21 skill symlinks under .agents/skills/ pointing to the local
runwaize_skills_cookbook installation, covering cloud-run basics,
Pulumi migration/tooling skills (terraform, CDK, ARM, ESC, component,
automation-api, upgrade-provider, best-practices, neo-handoff),
Google Cloud WAF pillars (security, reliability, performance,
cost-optimization, operational-excellence), google-cloud-recipe-auth,
google-cloud-networking-observability, cloudformation-to-pulumi,
package-usage, provider-upgrade, and upstream-patches.

Update AGENTS.md GitNexus index stats to reflect the current index
(6273 symbols, 11483 relationships, 281 execution flows).

* chore(deps): bump astral-sh/setup-uv from 8.1.0 to 8.2.0 (#62)

Bumps [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) from 8.1.0 to 8.2.0.
- [Release notes](https://github.com/astral-sh/setup-uv/releases)
- [Commits](astral-sh/setup-uv@0880764...fac544c)

---
updated-dependencies:
- dependency-name: astral-sh/setup-uv
  dependency-version: 8.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps): bump actions/checkout from 6.0.2 to 6.0.3 (#63)

Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.2 to 6.0.3.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@de0fac2...df4cb1c)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 6.0.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps): bump starlette from 1.0.1 to 1.3.1 (#66)

Bumps [starlette](https://github.com/Kludex/starlette) from 1.0.1 to 1.3.1.
- [Release notes](https://github.com/Kludex/starlette/releases)
- [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md)
- [Commits](Kludex/starlette@1.0.1...1.3.1)

---
updated-dependencies:
- dependency-name: starlette
  dependency-version: 1.3.1
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps): bump cryptography from 48.0.0 to 48.0.1 (#67)

Bumps [cryptography](https://github.com/pyca/cryptography) from 48.0.0 to 48.0.1.
- [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst)
- [Commits](pyca/cryptography@48.0.0...48.0.1)

---
updated-dependencies:
- dependency-name: cryptography
  dependency-version: 48.0.1
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps): bump actions/checkout from 6.0.3 to 7.0.0 (#68)

Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.3 to 7.0.0.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@df4cb1c...9c091bb)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps): bump softprops/action-gh-release from 3.0.0 to 3.0.1 (#69)

Bumps [softprops/action-gh-release](https://github.com/softprops/action-gh-release) from 3.0.0 to 3.0.1.
- [Release notes](https://github.com/softprops/action-gh-release/releases)
- [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md)
- [Commits](softprops/action-gh-release@b430933...718ea10)

---
updated-dependencies:
- dependency-name: softprops/action-gh-release
  dependency-version: 3.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps): bump trufflesecurity/trufflehog from 3.95.5 to 3.95.6 (#70)

Bumps [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog) from 3.95.5 to 3.95.6.
- [Release notes](https://github.com/trufflesecurity/trufflehog/releases)
- [Commits](trufflesecurity/trufflehog@d411fff...30d5bb9)

---
updated-dependencies:
- dependency-name: trufflesecurity/trufflehog
  dependency-version: 3.95.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* codex/managed-context-sdk (#65)

* feat: add managed context SDK client

* ✨ feat: update gitn docs to use local run.cjs and paginate list_repos

* ✨ feat: add MPLv2 license headers to module and test files

* fix: address managed context review feedback

* ✨ feat(contracts): add V2ContextAssignment for context.assign (#71)

* ✨ feat(contracts): add V2ContextAssignment for context.assign

* ✨ feat(contracts): constrain context scope and document assignment semantics

Address PR #71 review: V2ContextAssignmentItem.scope is now Literal["workspace", "mission"] (matching other closed v2 vocabularies) with a ValidationError regression test, and the v2 doc gains explicit context.assign semantics: refs-not-content payload, freeze-on-pull with provenance, mandatory fetched-vs-assigned version check that fails the assignment on mismatch, and no live context reads during execution.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* 🐛 fix(contracts): require mission_id for mission-scoped context assignments

Address PR #71 follow-up review: a V2ContextAssignment containing scope="mission" items but no mission_id passed validation while the agent-side ContextClient.open() would have no mission context to fetch with. A model_validator now rejects that combination; workspace-only assignments still allow a null mission_id.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* 🐛 fix(contracts): reject whitespace-only mission_id for mission-scoped assignments

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

* feat: bump version to1.3.0 and update deps; iterate nested (#73)

* fix versions

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
alain-sv added a commit that referenced this pull request Jul 7, 2026
* apply dependabot insights

* minor

* chore(ci): SHA-pin actions/checkout and actions/setup-python (#43)

Pin all uses of actions/checkout@v6 and actions/setup-python@v6 to
their commit SHAs across every workflow, closing the remaining
floating-tag attack surface.

- actions/checkout  → de0fac2e (v6)
- actions/setup-python → a309ff8b (v6)

* docs(changelog): add unreleased dependency security refresh entry (#44)

* chore(ci): add uv cache-suffix per Python version + update AGENTS.md facts (#46)

Prevents parallel matrix jobs racing on the same Actions cache
reservation. Also records two CI tooling facts in AGENTS.md.

* supervaizer-v2-mvp-contracts (#47)

* feat: add supervaizer v2 contract primitives

* feat: add supervaizer v2 a2a action endpoint

* feat: expose supervaizer v2 registration in a2a card

* feat: add supervaizer v2 action decorator

* docs: update supervaizer v2 changelog

* precommit fix

* refactor: move controller api version to contracts

* minor

* fix: scope v2 action handlers by agent

* feat: guard supervaizer v2 agent identity

* feat: include v2 job state in sync result

* feat: add v2 resource form fields

* feat: add v2 resource option sources

* feat: add v2 awaiting form fields

* feat: load supervaizer v2 surfaces over a2a

* feat: expose local hello world v2 contract

* feat: add v2 job source target type

* feat: stream v2 action effects over a2a

* fix: advertise v2 push notifications as unsupported

* refactor: remove legacy dynamic choices

* feat: complete local hello world v2 hitl flow

* refactor: remove legacy job poll

* docs: refresh generated contract docs

* test: align v2 prompt editor fixture

* test: align v2 contact import fixture

* test: align v2 scenario builder fixture

* test: align v2 overview fixture

* test: align v2 campaign contact fixture

* feat: add v2 registration builder

* feat: type v2 dataset display metadata

* minor

* fix: precommit

* feat: add comprehensive documentation for SUPERVAIZER API, Admin Interface, CLI, Parameter Validation, Persistence, Protocols, and REST API

* minor

* chore: change copyright dates

from 2024-2025 to 2024-2026

* fix: harden agent model surface and v2 contract hygiene

Use modern typing in agent.py, keep server encrypted params internal,
document deterministic agent ids, tighten A2A health status rules, drop
legacy hello-world v2 input aliases, and clarify v2 contract fields.

* feat: enhance agent method validation and improve v2 action safety

- Introduced validation to reject agent methods using blocked module

  roots.- Added checks to ensure declared method paths are used in

  agent execution.- Enhanced v2 action results with replay safety

  metadata validation.- Updated changelog and documentation to reflect

  these changes.

* feat: add v2 resource import contracts

* test: align v2 contract fixtures

* minor

* fix: require auth for a2a controller

* minor

* Minor

* chore: update changelog for Supervaizer v2 enhancements and API key validation improvements

- Added optional `metadata` field to `V2CaseSnapshot` for case-level context.
- Implemented validation for Studio registration handshake to ensure API key consistency.
- Enhanced server API key handling for stability during reloads.
- Updated tests to cover new functionality and validation paths.

* workspace-agent-grants (#50)

* docs: plan workspace agent grants

* docs: add Studio grant acceptance UX

* feat: add workspace agent authorization

* feat: add workspace binding protocol

* fix: stabilize workspace authorization

* ✨feat: add workspace auth helpers and use them in tests

* ✨feat: require workspace auth and tighten agent checks

* fix: require workspace auth for Studio A2A

* fix: harden workspace authorization checks

* fix: normalize malformed workspace auth inputs

* minor

* feat(logging): implement structured logging for Cloud Logging compatibility

- Added support for newline-delimited JSON logging when `SUPERVAIZER_LOG_FORMAT=json` is set.
- Updated logging configuration to allow structured logs for access-denial events.
- Enhanced `log_access_denied_api` and `log_access_denied_tailscale` functions to include structured fields.
- Added tests to verify structured logging outputs in `tests/test_common.py`.

* Minor

* codex/supervaizer-lifespan-cleanup (#54)

* Clean up Supervaizer lifespan shutdown

* Document Supervaizer import placement rule

* Fix lifespan cleanup test determinism

* Address lifespan shutdown review feedback

* ✨feat: rename test and assert scheduled step task

* ✨ feat: update GitNexus index counts in AGENTS.md

* codex/refactor-server-modules (#55)

* Refactor Supervaizer server modules

* ✨ feat: update GitNexus index stats in AGENTS.md

* ✨docs update changelog AGENTS guidance

* ✨feat: add v2 methods, tests and license header

* minor

* codex/agent-interviewer-workspace-jobs-refresh (#56)

* Clean up Supervaizer lifespan shutdown

* Document Supervaizer import placement rule

* Fix lifespan cleanup test determinism

* Address lifespan shutdown review feedback

* ✨feat: rename test and assert scheduled step task

* ✨ feat: update GitNexus index counts in AGENTS.md

* feat(v2): add agent action methods

* Refactor pre-commit configuration and enhance agent validation

- Updated mypy hook to use project-specific configuration for consistency with uv.lock.
- Improved validation for v2_registration and v2_method_declarations in Agent class to ensure proper type handling.
- Enhanced logging configuration to cast message records for structured logging compatibility.

* chore(deps): bump uv from 0.11.14 to 0.11.15 (#58)

Bumps [uv](https://github.com/astral-sh/uv) from 0.11.14 to 0.11.15.
- [Release notes](https://github.com/astral-sh/uv/releases)
- [Changelog](https://github.com/astral-sh/uv/blob/main/CHANGELOG.md)
- [Commits](astral-sh/uv@0.11.14...0.11.15)

---
updated-dependencies:
- dependency-name: uv
  dependency-version: 0.11.15
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps): bump starlette from 0.50.0 to 1.0.1 (#60)

Bumps [starlette](https://github.com/Kludex/starlette) from 0.50.0 to 1.0.1.
- [Release notes](https://github.com/Kludex/starlette/releases)
- [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md)
- [Commits](Kludex/starlette@0.50.0...1.0.1)

---
updated-dependencies:
- dependency-name: starlette
  dependency-version: 1.0.1
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps): bump trufflesecurity/trufflehog from 3.95.3 to 3.95.5 (#61)

Bumps [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog) from 3.95.3 to 3.95.5.
- [Release notes](https://github.com/trufflesecurity/trufflehog/releases)
- [Commits](trufflesecurity/trufflehog@37b7700...d411fff)

---
updated-dependencies:
- dependency-name: trufflesecurity/trufflehog
  dependency-version: 3.95.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* feat(.agents): add skill symlinks from runwaize skills cookbook

Add 21 skill symlinks under .agents/skills/ pointing to the local
runwaize_skills_cookbook installation, covering cloud-run basics,
Pulumi migration/tooling skills (terraform, CDK, ARM, ESC, component,
automation-api, upgrade-provider, best-practices, neo-handoff),
Google Cloud WAF pillars (security, reliability, performance,
cost-optimization, operational-excellence), google-cloud-recipe-auth,
google-cloud-networking-observability, cloudformation-to-pulumi,
package-usage, provider-upgrade, and upstream-patches.

Update AGENTS.md GitNexus index stats to reflect the current index
(6273 symbols, 11483 relationships, 281 execution flows).

* chore(deps): bump astral-sh/setup-uv from 8.1.0 to 8.2.0 (#62)

Bumps [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) from 8.1.0 to 8.2.0.
- [Release notes](https://github.com/astral-sh/setup-uv/releases)
- [Commits](astral-sh/setup-uv@0880764...fac544c)

---
updated-dependencies:
- dependency-name: astral-sh/setup-uv
  dependency-version: 8.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps): bump actions/checkout from 6.0.2 to 6.0.3 (#63)

Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.2 to 6.0.3.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@de0fac2...df4cb1c)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 6.0.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps): bump starlette from 1.0.1 to 1.3.1 (#66)

Bumps [starlette](https://github.com/Kludex/starlette) from 1.0.1 to 1.3.1.
- [Release notes](https://github.com/Kludex/starlette/releases)
- [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md)
- [Commits](Kludex/starlette@1.0.1...1.3.1)

---
updated-dependencies:
- dependency-name: starlette
  dependency-version: 1.3.1
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps): bump cryptography from 48.0.0 to 48.0.1 (#67)

Bumps [cryptography](https://github.com/pyca/cryptography) from 48.0.0 to 48.0.1.
- [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst)
- [Commits](pyca/cryptography@48.0.0...48.0.1)

---
updated-dependencies:
- dependency-name: cryptography
  dependency-version: 48.0.1
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps): bump actions/checkout from 6.0.3 to 7.0.0 (#68)

Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.3 to 7.0.0.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@df4cb1c...9c091bb)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps): bump softprops/action-gh-release from 3.0.0 to 3.0.1 (#69)

Bumps [softprops/action-gh-release](https://github.com/softprops/action-gh-release) from 3.0.0 to 3.0.1.
- [Release notes](https://github.com/softprops/action-gh-release/releases)
- [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md)
- [Commits](softprops/action-gh-release@b430933...718ea10)

---
updated-dependencies:
- dependency-name: softprops/action-gh-release
  dependency-version: 3.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps): bump trufflesecurity/trufflehog from 3.95.5 to 3.95.6 (#70)

Bumps [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog) from 3.95.5 to 3.95.6.
- [Release notes](https://github.com/trufflesecurity/trufflehog/releases)
- [Commits](trufflesecurity/trufflehog@d411fff...30d5bb9)

---
updated-dependencies:
- dependency-name: trufflesecurity/trufflehog
  dependency-version: 3.95.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* codex/managed-context-sdk (#65)

* feat: add managed context SDK client

* ✨ feat: update gitn docs to use local run.cjs and paginate list_repos

* ✨ feat: add MPLv2 license headers to module and test files

* fix: address managed context review feedback

* ✨ feat(contracts): add V2ContextAssignment for context.assign (#71)

* ✨ feat(contracts): add V2ContextAssignment for context.assign

* ✨ feat(contracts): constrain context scope and document assignment semantics

Address PR #71 review: V2ContextAssignmentItem.scope is now Literal["workspace", "mission"] (matching other closed v2 vocabularies) with a ValidationError regression test, and the v2 doc gains explicit context.assign semantics: refs-not-content payload, freeze-on-pull with provenance, mandatory fetched-vs-assigned version check that fails the assignment on mismatch, and no live context reads during execution.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* 🐛 fix(contracts): require mission_id for mission-scoped context assignments

Address PR #71 follow-up review: a V2ContextAssignment containing scope="mission" items but no mission_id passed validation while the agent-side ContextClient.open() would have no mission context to fetch with. A model_validator now rejects that combination; workspace-only assignments still allow a null mission_id.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* 🐛 fix(contracts): reject whitespace-only mission_id for mission-scoped assignments

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

* feat: bump version to1.3.0 and update deps; iterate nested (#73)

* changelog

* chore(deps): bump actions/setup-python from 6.2.0 to 6.3.0 (#75)

Bumps [actions/setup-python](https://github.com/actions/setup-python) from 6.2.0 to 6.3.0.
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](actions/setup-python@a309ff8...ece7cb0)

---
updated-dependencies:
- dependency-name: actions/setup-python
  dependency-version: 6.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps): bump trufflesecurity/trufflehog from 3.95.6 to 3.95.7 (#76)

Bumps [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog) from 3.95.6 to 3.95.7.
- [Release notes](https://github.com/trufflesecurity/trufflehog/releases)
- [Commits](trufflesecurity/trufflehog@30d5bb9...f446421)

---
updated-dependencies:
- dependency-name: trufflesecurity/trufflehog
  dependency-version: 3.95.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* security: review summary (redacted) + safe P0/P1 hardening (#77)

* docs: add redacted security & performance review summary

Adds a non-actionable high-level summary of a full-source security and
performance/scalability review of the SDK (posture, verified-sound controls,
severity counts, and remediation themes) and a CHANGELOG entry.

Per SECURITY.md, detailed vulnerability findings (exact locations, attack
scenarios, remediation specifics) are intentionally kept out of the public
repository and handled through the private vulnerability channel.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01F8GY2d3HJgCKwgCyRgNFMt

* fix(security): harden API-key compare, local-mode bind, headers, logging, scheduler

Safe P0/P1 remediations from the security review (no wire-format or
auth-model breaking changes):

- Constant-time API-key comparison (hmac.compare_digest) in require_api_key
  and Server.verify_api_key (CWE-208).
- Local mode binds 127.0.0.1 instead of 0.0.0.0 unless an explicit non-wildcard
  host is set, so the default 'local-dev' key is not network-exposed (CWE-798).
- Baseline security headers (nosniff, X-Frame-Options DENY, Referrer-Policy,
  HSTS) via a pure-ASGI middleware that is SSE-safe (CWE-693/1021).
- Stop logging decrypted agent-parameter values and full result payloads in
  validate-agent-parameters (CWE-532).
- Allow-list scheduled_method against the agent's declared method paths in the
  scheduler and workbench execute-now path (CWE-470).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01F8GY2d3HJgCKwgCyRgNFMt

* fix(security): compare API keys as bytes to avoid TypeError on non-ASCII

hmac.compare_digest rejects non-ASCII str inputs, so a malformed X-API-Key
with non-ASCII characters raised TypeError (500) instead of failing closed
(401/403). Encode both operands to UTF-8 bytes in require_api_key and
Server.verify_api_key so malformed credentials are rejected.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01F8GY2d3HJgCKwgCyRgNFMt

* refactor(security): address review feedback on hardening changes

- Scope scheduled-step allow-list to the owning job's agent instead of the
  union of all agents, so a tampered step cannot invoke another agent's
  declared methods (per-agent isolation).
- Move MutableHeaders import to module scope (repo convention: no function-local
  imports without a concrete circular/optional/startup reason).
- Reword CHANGELOG security bullets to high-level, non-actionable descriptions
  consistent with the private-advisory disclosure policy.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01F8GY2d3HJgCKwgCyRgNFMt

* refactor(security): tighten scheduled-step allow-list resolution

Address review follow-ups on per-agent method scoping:

- Scheduler: if a due step's owning job cannot be resolved, mark the step
  failed instead of falling back to the union of all agents' methods, so an
  orphaned/tampered step cannot invoke another agent's method.
- Workbench execute-now: verify the job is owned by the request's agent
  (Jobs().get_job(job_id, agent_name=agent.name)) before using that agent's
  allow-list, preventing a slug/job-owner mismatch from widening the list.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01F8GY2d3HJgCKwgCyRgNFMt

* fix(security): use SAMEORIGIN and hoist Jobs import

- X-Frame-Options: SAMEORIGIN instead of DENY so the admin instructions
  iframe (same-origin) still renders, while cross-origin framing stays blocked.
- Move the Jobs import in scheduled_steps to module scope (no circular
  dependency; matches the repo's module-level-imports convention).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01F8GY2d3HJgCKwgCyRgNFMt

* refactor(admin): hoist scheduled step helper import

* fix(security): scope scheduled step ownership checks

* ✨ docs: add test summary table to changelog (docs/CHANGELOG.md)

* ✨ feat(ci): skip unit tests for docs-only changes in workflow

---------

Co-authored-by: Claude <noreply@anthropic.com>

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
alain-sv added a commit that referenced this pull request Aug 28, 2026
* apply dependabot insights

* minor

* chore(ci): SHA-pin actions/checkout and actions/setup-python (#43)

Pin all uses of actions/checkout@v6 and actions/setup-python@v6 to
their commit SHAs across every workflow, closing the remaining
floating-tag attack surface.

- actions/checkout  → de0fac2e (v6)
- actions/setup-python → a309ff8b (v6)

* docs(changelog): add unreleased dependency security refresh entry (#44)

* chore(ci): add uv cache-suffix per Python version + update AGENTS.md facts (#46)

Prevents parallel matrix jobs racing on the same Actions cache
reservation. Also records two CI tooling facts in AGENTS.md.

* supervaizer-v2-mvp-contracts (#47)

* feat: add supervaizer v2 contract primitives

* feat: add supervaizer v2 a2a action endpoint

* feat: expose supervaizer v2 registration in a2a card

* feat: add supervaizer v2 action decorator

* docs: update supervaizer v2 changelog

* precommit fix

* refactor: move controller api version to contracts

* minor

* fix: scope v2 action handlers by agent

* feat: guard supervaizer v2 agent identity

* feat: include v2 job state in sync result

* feat: add v2 resource form fields

* feat: add v2 resource option sources

* feat: add v2 awaiting form fields

* feat: load supervaizer v2 surfaces over a2a

* feat: expose local hello world v2 contract

* feat: add v2 job source target type

* feat: stream v2 action effects over a2a

* fix: advertise v2 push notifications as unsupported

* refactor: remove legacy dynamic choices

* feat: complete local hello world v2 hitl flow

* refactor: remove legacy job poll

* docs: refresh generated contract docs

* test: align v2 prompt editor fixture

* test: align v2 contact import fixture

* test: align v2 scenario builder fixture

* test: align v2 overview fixture

* test: align v2 campaign contact fixture

* feat: add v2 registration builder

* feat: type v2 dataset display metadata

* minor

* fix: precommit

* feat: add comprehensive documentation for SUPERVAIZER API, Admin Interface, CLI, Parameter Validation, Persistence, Protocols, and REST API

* minor

* chore: change copyright dates

from 2024-2025 to 2024-2026

* fix: harden agent model surface and v2 contract hygiene

Use modern typing in agent.py, keep server encrypted params internal,
document deterministic agent ids, tighten A2A health status rules, drop
legacy hello-world v2 input aliases, and clarify v2 contract fields.

* feat: enhance agent method validation and improve v2 action safety

- Introduced validation to reject agent methods using blocked module

  roots.- Added checks to ensure declared method paths are used in

  agent execution.- Enhanced v2 action results with replay safety

  metadata validation.- Updated changelog and documentation to reflect

  these changes.

* feat: add v2 resource import contracts

* test: align v2 contract fixtures

* minor

* fix: require auth for a2a controller

* minor

* Minor

* chore: update changelog for Supervaizer v2 enhancements and API key validation improvements

- Added optional `metadata` field to `V2CaseSnapshot` for case-level context.
- Implemented validation for Studio registration handshake to ensure API key consistency.
- Enhanced server API key handling for stability during reloads.
- Updated tests to cover new functionality and validation paths.

* workspace-agent-grants (#50)

* docs: plan workspace agent grants

* docs: add Studio grant acceptance UX

* feat: add workspace agent authorization

* feat: add workspace binding protocol

* fix: stabilize workspace authorization

* ✨feat: add workspace auth helpers and use them in tests

* ✨feat: require workspace auth and tighten agent checks

* fix: require workspace auth for Studio A2A

* fix: harden workspace authorization checks

* fix: normalize malformed workspace auth inputs

* minor

* feat(logging): implement structured logging for Cloud Logging compatibility

- Added support for newline-delimited JSON logging when `SUPERVAIZER_LOG_FORMAT=json` is set.
- Updated logging configuration to allow structured logs for access-denial events.
- Enhanced `log_access_denied_api` and `log_access_denied_tailscale` functions to include structured fields.
- Added tests to verify structured logging outputs in `tests/test_common.py`.

* Minor

* codex/supervaizer-lifespan-cleanup (#54)

* Clean up Supervaizer lifespan shutdown

* Document Supervaizer import placement rule

* Fix lifespan cleanup test determinism

* Address lifespan shutdown review feedback

* ✨feat: rename test and assert scheduled step task

* ✨ feat: update GitNexus index counts in AGENTS.md

* codex/refactor-server-modules (#55)

* Refactor Supervaizer server modules

* ✨ feat: update GitNexus index stats in AGENTS.md

* ✨docs update changelog AGENTS guidance

* ✨feat: add v2 methods, tests and license header

* minor

* codex/agent-interviewer-workspace-jobs-refresh (#56)

* Clean up Supervaizer lifespan shutdown

* Document Supervaizer import placement rule

* Fix lifespan cleanup test determinism

* Address lifespan shutdown review feedback

* ✨feat: rename test and assert scheduled step task

* ✨ feat: update GitNexus index counts in AGENTS.md

* feat(v2): add agent action methods

* Refactor pre-commit configuration and enhance agent validation

- Updated mypy hook to use project-specific configuration for consistency with uv.lock.
- Improved validation for v2_registration and v2_method_declarations in Agent class to ensure proper type handling.
- Enhanced logging configuration to cast message records for structured logging compatibility.

* chore(deps): bump uv from 0.11.14 to 0.11.15 (#58)

Bumps [uv](https://github.com/astral-sh/uv) from 0.11.14 to 0.11.15.
- [Release notes](https://github.com/astral-sh/uv/releases)
- [Changelog](https://github.com/astral-sh/uv/blob/main/CHANGELOG.md)
- [Commits](astral-sh/uv@0.11.14...0.11.15)

---
updated-dependencies:
- dependency-name: uv
  dependency-version: 0.11.15
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps): bump starlette from 0.50.0 to 1.0.1 (#60)

Bumps [starlette](https://github.com/Kludex/starlette) from 0.50.0 to 1.0.1.
- [Release notes](https://github.com/Kludex/starlette/releases)
- [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md)
- [Commits](Kludex/starlette@0.50.0...1.0.1)

---
updated-dependencies:
- dependency-name: starlette
  dependency-version: 1.0.1
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps): bump trufflesecurity/trufflehog from 3.95.3 to 3.95.5 (#61)

Bumps [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog) from 3.95.3 to 3.95.5.
- [Release notes](https://github.com/trufflesecurity/trufflehog/releases)
- [Commits](trufflesecurity/trufflehog@37b7700...d411fff)

---
updated-dependencies:
- dependency-name: trufflesecurity/trufflehog
  dependency-version: 3.95.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* feat(.agents): add skill symlinks from runwaize skills cookbook

Add 21 skill symlinks under .agents/skills/ pointing to the local
runwaize_skills_cookbook installation, covering cloud-run basics,
Pulumi migration/tooling skills (terraform, CDK, ARM, ESC, component,
automation-api, upgrade-provider, best-practices, neo-handoff),
Google Cloud WAF pillars (security, reliability, performance,
cost-optimization, operational-excellence), google-cloud-recipe-auth,
google-cloud-networking-observability, cloudformation-to-pulumi,
package-usage, provider-upgrade, and upstream-patches.

Update AGENTS.md GitNexus index stats to reflect the current index
(6273 symbols, 11483 relationships, 281 execution flows).

* chore(deps): bump astral-sh/setup-uv from 8.1.0 to 8.2.0 (#62)

Bumps [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) from 8.1.0 to 8.2.0.
- [Release notes](https://github.com/astral-sh/setup-uv/releases)
- [Commits](astral-sh/setup-uv@0880764...fac544c)

---
updated-dependencies:
- dependency-name: astral-sh/setup-uv
  dependency-version: 8.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps): bump actions/checkout from 6.0.2 to 6.0.3 (#63)

Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.2 to 6.0.3.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@de0fac2...df4cb1c)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 6.0.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps): bump starlette from 1.0.1 to 1.3.1 (#66)

Bumps [starlette](https://github.com/Kludex/starlette) from 1.0.1 to 1.3.1.
- [Release notes](https://github.com/Kludex/starlette/releases)
- [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md)
- [Commits](Kludex/starlette@1.0.1...1.3.1)

---
updated-dependencies:
- dependency-name: starlette
  dependency-version: 1.3.1
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps): bump cryptography from 48.0.0 to 48.0.1 (#67)

Bumps [cryptography](https://github.com/pyca/cryptography) from 48.0.0 to 48.0.1.
- [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst)
- [Commits](pyca/cryptography@48.0.0...48.0.1)

---
updated-dependencies:
- dependency-name: cryptography
  dependency-version: 48.0.1
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps): bump actions/checkout from 6.0.3 to 7.0.0 (#68)

Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.3 to 7.0.0.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@df4cb1c...9c091bb)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps): bump softprops/action-gh-release from 3.0.0 to 3.0.1 (#69)

Bumps [softprops/action-gh-release](https://github.com/softprops/action-gh-release) from 3.0.0 to 3.0.1.
- [Release notes](https://github.com/softprops/action-gh-release/releases)
- [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md)
- [Commits](softprops/action-gh-release@b430933...718ea10)

---
updated-dependencies:
- dependency-name: softprops/action-gh-release
  dependency-version: 3.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps): bump trufflesecurity/trufflehog from 3.95.5 to 3.95.6 (#70)

Bumps [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog) from 3.95.5 to 3.95.6.
- [Release notes](https://github.com/trufflesecurity/trufflehog/releases)
- [Commits](trufflesecurity/trufflehog@d411fff...30d5bb9)

---
updated-dependencies:
- dependency-name: trufflesecurity/trufflehog
  dependency-version: 3.95.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* codex/managed-context-sdk (#65)

* feat: add managed context SDK client

* ✨ feat: update gitn docs to use local run.cjs and paginate list_repos

* ✨ feat: add MPLv2 license headers to module and test files

* fix: address managed context review feedback

* ✨ feat(contracts): add V2ContextAssignment for context.assign (#71)

* ✨ feat(contracts): add V2ContextAssignment for context.assign

* ✨ feat(contracts): constrain context scope and document assignment semantics

Address PR #71 review: V2ContextAssignmentItem.scope is now Literal["workspace", "mission"] (matching other closed v2 vocabularies) with a ValidationError regression test, and the v2 doc gains explicit context.assign semantics: refs-not-content payload, freeze-on-pull with provenance, mandatory fetched-vs-assigned version check that fails the assignment on mismatch, and no live context reads during execution.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* 🐛 fix(contracts): require mission_id for mission-scoped context assignments

Address PR #71 follow-up review: a V2ContextAssignment containing scope="mission" items but no mission_id passed validation while the agent-side ContextClient.open() would have no mission context to fetch with. A model_validator now rejects that combination; workspace-only assignments still allow a null mission_id.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* 🐛 fix(contracts): reject whitespace-only mission_id for mission-scoped assignments

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

* feat: bump version to1.3.0 and update deps; iterate nested (#73)

* changelog

* chore(deps): bump actions/setup-python from 6.2.0 to 6.3.0 (#75)

Bumps [actions/setup-python](https://github.com/actions/setup-python) from 6.2.0 to 6.3.0.
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](actions/setup-python@a309ff8...ece7cb0)

---
updated-dependencies:
- dependency-name: actions/setup-python
  dependency-version: 6.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps): bump trufflesecurity/trufflehog from 3.95.6 to 3.95.7 (#76)

Bumps [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog) from 3.95.6 to 3.95.7.
- [Release notes](https://github.com/trufflesecurity/trufflehog/releases)
- [Commits](trufflesecurity/trufflehog@30d5bb9...f446421)

---
updated-dependencies:
- dependency-name: trufflesecurity/trufflehog
  dependency-version: 3.95.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* security: review summary (redacted) + safe P0/P1 hardening (#77)

* docs: add redacted security & performance review summary

Adds a non-actionable high-level summary of a full-source security and
performance/scalability review of the SDK (posture, verified-sound controls,
severity counts, and remediation themes) and a CHANGELOG entry.

Per SECURITY.md, detailed vulnerability findings (exact locations, attack
scenarios, remediation specifics) are intentionally kept out of the public
repository and handled through the private vulnerability channel.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01F8GY2d3HJgCKwgCyRgNFMt

* fix(security): harden API-key compare, local-mode bind, headers, logging, scheduler

Safe P0/P1 remediations from the security review (no wire-format or
auth-model breaking changes):

- Constant-time API-key comparison (hmac.compare_digest) in require_api_key
  and Server.verify_api_key (CWE-208).
- Local mode binds 127.0.0.1 instead of 0.0.0.0 unless an explicit non-wildcard
  host is set, so the default 'local-dev' key is not network-exposed (CWE-798).
- Baseline security headers (nosniff, X-Frame-Options DENY, Referrer-Policy,
  HSTS) via a pure-ASGI middleware that is SSE-safe (CWE-693/1021).
- Stop logging decrypted agent-parameter values and full result payloads in
  validate-agent-parameters (CWE-532).
- Allow-list scheduled_method against the agent's declared method paths in the
  scheduler and workbench execute-now path (CWE-470).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01F8GY2d3HJgCKwgCyRgNFMt

* fix(security): compare API keys as bytes to avoid TypeError on non-ASCII

hmac.compare_digest rejects non-ASCII str inputs, so a malformed X-API-Key
with non-ASCII characters raised TypeError (500) instead of failing closed
(401/403). Encode both operands to UTF-8 bytes in require_api_key and
Server.verify_api_key so malformed credentials are rejected.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01F8GY2d3HJgCKwgCyRgNFMt

* refactor(security): address review feedback on hardening changes

- Scope scheduled-step allow-list to the owning job's agent instead of the
  union of all agents, so a tampered step cannot invoke another agent's
  declared methods (per-agent isolation).
- Move MutableHeaders import to module scope (repo convention: no function-local
  imports without a concrete circular/optional/startup reason).
- Reword CHANGELOG security bullets to high-level, non-actionable descriptions
  consistent with the private-advisory disclosure policy.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01F8GY2d3HJgCKwgCyRgNFMt

* refactor(security): tighten scheduled-step allow-list resolution

Address review follow-ups on per-agent method scoping:

- Scheduler: if a due step's owning job cannot be resolved, mark the step
  failed instead of falling back to the union of all agents' methods, so an
  orphaned/tampered step cannot invoke another agent's method.
- Workbench execute-now: verify the job is owned by the request's agent
  (Jobs().get_job(job_id, agent_name=agent.name)) before using that agent's
  allow-list, preventing a slug/job-owner mismatch from widening the list.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01F8GY2d3HJgCKwgCyRgNFMt

* fix(security): use SAMEORIGIN and hoist Jobs import

- X-Frame-Options: SAMEORIGIN instead of DENY so the admin instructions
  iframe (same-origin) still renders, while cross-origin framing stays blocked.
- Move the Jobs import in scheduled_steps to module scope (no circular
  dependency; matches the repo's module-level-imports convention).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01F8GY2d3HJgCKwgCyRgNFMt

* refactor(admin): hoist scheduled step helper import

* fix(security): scope scheduled step ownership checks

* ✨ docs: add test summary table to changelog (docs/CHANGELOG.md)

* ✨ feat(ci): skip unit tests for docs-only changes in workflow

---------

Co-authored-by: Claude <noreply@anthropic.com>

* chore(deps): bump trufflesecurity/trufflehog from 3.95.7 to 3.95.9 (#81)

Bumps [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog) from 3.95.7 to 3.95.9.
- [Release notes](https://github.com/trufflesecurity/trufflehog/releases)
- [Commits](trufflesecurity/trufflehog@f446421...27b0417)

---
updated-dependencies:
- dependency-name: trufflesecurity/trufflehog
  dependency-version: 3.95.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps): bump softprops/action-gh-release from 3.0.1 to 3.0.2 (#82)

Bumps [softprops/action-gh-release](https://github.com/softprops/action-gh-release) from 3.0.1 to 3.0.2.
- [Release notes](https://github.com/softprops/action-gh-release/releases)
- [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md)
- [Commits](softprops/action-gh-release@718ea10...3d0d988)

---
updated-dependencies:
- dependency-name: softprops/action-gh-release
  dependency-version: 3.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps): bump astral-sh/setup-uv from 8.2.0 to 8.3.2 (#83)

Bumps [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) from 8.2.0 to 8.3.2.
- [Release notes](https://github.com/astral-sh/setup-uv/releases)
- [Commits](astral-sh/setup-uv@fac544c...11f9893)

---
updated-dependencies:
- dependency-name: astral-sh/setup-uv
  dependency-version: 8.3.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps): bump pyasn1 from 0.6.3 to 0.6.4 (#84)

Bumps [pyasn1](https://github.com/pyasn1/pyasn1) from 0.6.3 to 0.6.4.
- [Release notes](https://github.com/pyasn1/pyasn1/releases)
- [Changelog](https://github.com/pyasn1/pyasn1/blob/main/CHANGES.rst)
- [Commits](pyasn1/pyasn1@v0.6.3...v0.6.4)

---
updated-dependencies:
- dependency-name: pyasn1
  dependency-version: 0.6.4
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps): bump actions/setup-python from 6.3.0 to 7.0.0 (#85)

Bumps [actions/setup-python](https://github.com/actions/setup-python) from 6.3.0 to 7.0.0.
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](actions/setup-python@ece7cb0...5fda3b9)

---
updated-dependencies:
- dependency-name: actions/setup-python
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps): bump pypa/gh-action-pypi-publish from 1.14.0 to 1.14.1 (#86)

Bumps [pypa/gh-action-pypi-publish](https://github.com/pypa/gh-action-pypi-publish) from 1.14.0 to 1.14.1.
- [Release notes](https://github.com/pypa/gh-action-pypi-publish/releases)
- [Commits](pypa/gh-action-pypi-publish@cef2210...ba38be9)

---
updated-dependencies:
- dependency-name: pypa/gh-action-pypi-publish
  dependency-version: 1.14.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps): bump cryptography from 49.0.0 to 50.0.0 (#87)

Bumps [cryptography](https://github.com/pyca/cryptography) from 49.0.0 to 50.0.0.
- [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst)
- [Commits](pyca/cryptography@49.0.0...50.0.0)

---
updated-dependencies:
- dependency-name: cryptography
  dependency-version: 50.0.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* feat: add generic job setup contract (#89)

* feat: add generic job setup contract

* 🐛 fix(contracts): stop V2JobSetupPolicy defaulting to every action scope

An agent opting in with job_policy={"setup": {}} advertised support for
the workspace, job, case and step scopes without declaring any, which
broadens the contract Studio sees. Default to an empty list, matching
V2JobSyncPolicy.supported_statuses. Also declare V2JobSetupPolicy before
V2JobPolicy so the generated model reference renders the real type
instead of a ForwardRef.

* 📝 docs: regenerate model reference and OpenAPI

Picks up the job setup contract (V2JobPolicy.setup, V2JobSetupPolicy,
V2ActionResult.setup_plan) plus accumulated drift since 0.20.1.

* 📝 docs: log generic job setup contract in CHANGELOG

Records the V2JobSetupPolicy contract, the empty action_scopes default,
and the model reference regeneration under Unreleased.

* 🐛 fix(contracts): reject blank job setup and sync action ids

An empty preview_action/start_action/submit_action was accepted, then
dropped from capabilities.actions by _unique_strings while still being
serialized under job_policy.setup, so Studio saw an action it could
never invoke. Validate all three as non-blank, plus V2JobSyncPolicy.action,
which had the same gap.

* doc

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
alain-sv added a commit that referenced this pull request Aug 30, 2026
* apply dependabot insights

* minor

* chore(ci): SHA-pin actions/checkout and actions/setup-python (#43)

Pin all uses of actions/checkout@v6 and actions/setup-python@v6 to
their commit SHAs across every workflow, closing the remaining
floating-tag attack surface.

- actions/checkout  → de0fac2e (v6)
- actions/setup-python → a309ff8b (v6)

* docs(changelog): add unreleased dependency security refresh entry (#44)

* chore(ci): add uv cache-suffix per Python version + update AGENTS.md facts (#46)

Prevents parallel matrix jobs racing on the same Actions cache
reservation. Also records two CI tooling facts in AGENTS.md.

* supervaizer-v2-mvp-contracts (#47)

* feat: add supervaizer v2 contract primitives

* feat: add supervaizer v2 a2a action endpoint

* feat: expose supervaizer v2 registration in a2a card

* feat: add supervaizer v2 action decorator

* docs: update supervaizer v2 changelog

* precommit fix

* refactor: move controller api version to contracts

* minor

* fix: scope v2 action handlers by agent

* feat: guard supervaizer v2 agent identity

* feat: include v2 job state in sync result

* feat: add v2 resource form fields

* feat: add v2 resource option sources

* feat: add v2 awaiting form fields

* feat: load supervaizer v2 surfaces over a2a

* feat: expose local hello world v2 contract

* feat: add v2 job source target type

* feat: stream v2 action effects over a2a

* fix: advertise v2 push notifications as unsupported

* refactor: remove legacy dynamic choices

* feat: complete local hello world v2 hitl flow

* refactor: remove legacy job poll

* docs: refresh generated contract docs

* test: align v2 prompt editor fixture

* test: align v2 contact import fixture

* test: align v2 scenario builder fixture

* test: align v2 overview fixture

* test: align v2 campaign contact fixture

* feat: add v2 registration builder

* feat: type v2 dataset display metadata

* minor

* fix: precommit

* feat: add comprehensive documentation for SUPERVAIZER API, Admin Interface, CLI, Parameter Validation, Persistence, Protocols, and REST API

* minor

* chore: change copyright dates

from 2024-2025 to 2024-2026

* fix: harden agent model surface and v2 contract hygiene

Use modern typing in agent.py, keep server encrypted params internal,
document deterministic agent ids, tighten A2A health status rules, drop
legacy hello-world v2 input aliases, and clarify v2 contract fields.

* feat: enhance agent method validation and improve v2 action safety

- Introduced validation to reject agent methods using blocked module

  roots.- Added checks to ensure declared method paths are used in

  agent execution.- Enhanced v2 action results with replay safety

  metadata validation.- Updated changelog and documentation to reflect

  these changes.

* feat: add v2 resource import contracts

* test: align v2 contract fixtures

* minor

* fix: require auth for a2a controller

* minor

* Minor

* chore: update changelog for Supervaizer v2 enhancements and API key validation improvements

- Added optional `metadata` field to `V2CaseSnapshot` for case-level context.
- Implemented validation for Studio registration handshake to ensure API key consistency.
- Enhanced server API key handling for stability during reloads.
- Updated tests to cover new functionality and validation paths.

* workspace-agent-grants (#50)

* docs: plan workspace agent grants

* docs: add Studio grant acceptance UX

* feat: add workspace agent authorization

* feat: add workspace binding protocol

* fix: stabilize workspace authorization

* ✨feat: add workspace auth helpers and use them in tests

* ✨feat: require workspace auth and tighten agent checks

* fix: require workspace auth for Studio A2A

* fix: harden workspace authorization checks

* fix: normalize malformed workspace auth inputs

* minor

* feat(logging): implement structured logging for Cloud Logging compatibility

- Added support for newline-delimited JSON logging when `SUPERVAIZER_LOG_FORMAT=json` is set.
- Updated logging configuration to allow structured logs for access-denial events.
- Enhanced `log_access_denied_api` and `log_access_denied_tailscale` functions to include structured fields.
- Added tests to verify structured logging outputs in `tests/test_common.py`.

* Minor

* codex/supervaizer-lifespan-cleanup (#54)

* Clean up Supervaizer lifespan shutdown

* Document Supervaizer import placement rule

* Fix lifespan cleanup test determinism

* Address lifespan shutdown review feedback

* ✨feat: rename test and assert scheduled step task

* ✨ feat: update GitNexus index counts in AGENTS.md

* codex/refactor-server-modules (#55)

* Refactor Supervaizer server modules

* ✨ feat: update GitNexus index stats in AGENTS.md

* ✨docs update changelog AGENTS guidance

* ✨feat: add v2 methods, tests and license header

* minor

* codex/agent-interviewer-workspace-jobs-refresh (#56)

* Clean up Supervaizer lifespan shutdown

* Document Supervaizer import placement rule

* Fix lifespan cleanup test determinism

* Address lifespan shutdown review feedback

* ✨feat: rename test and assert scheduled step task

* ✨ feat: update GitNexus index counts in AGENTS.md

* feat(v2): add agent action methods

* Refactor pre-commit configuration and enhance agent validation

- Updated mypy hook to use project-specific configuration for consistency with uv.lock.
- Improved validation for v2_registration and v2_method_declarations in Agent class to ensure proper type handling.
- Enhanced logging configuration to cast message records for structured logging compatibility.

* chore(deps): bump uv from 0.11.14 to 0.11.15 (#58)

Bumps [uv](https://github.com/astral-sh/uv) from 0.11.14 to 0.11.15.
- [Release notes](https://github.com/astral-sh/uv/releases)
- [Changelog](https://github.com/astral-sh/uv/blob/main/CHANGELOG.md)
- [Commits](astral-sh/uv@0.11.14...0.11.15)

---
updated-dependencies:
- dependency-name: uv
  dependency-version: 0.11.15
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps): bump starlette from 0.50.0 to 1.0.1 (#60)

Bumps [starlette](https://github.com/Kludex/starlette) from 0.50.0 to 1.0.1.
- [Release notes](https://github.com/Kludex/starlette/releases)
- [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md)
- [Commits](Kludex/starlette@0.50.0...1.0.1)

---
updated-dependencies:
- dependency-name: starlette
  dependency-version: 1.0.1
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps): bump trufflesecurity/trufflehog from 3.95.3 to 3.95.5 (#61)

Bumps [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog) from 3.95.3 to 3.95.5.
- [Release notes](https://github.com/trufflesecurity/trufflehog/releases)
- [Commits](trufflesecurity/trufflehog@37b7700...d411fff)

---
updated-dependencies:
- dependency-name: trufflesecurity/trufflehog
  dependency-version: 3.95.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* feat(.agents): add skill symlinks from runwaize skills cookbook

Add 21 skill symlinks under .agents/skills/ pointing to the local
runwaize_skills_cookbook installation, covering cloud-run basics,
Pulumi migration/tooling skills (terraform, CDK, ARM, ESC, component,
automation-api, upgrade-provider, best-practices, neo-handoff),
Google Cloud WAF pillars (security, reliability, performance,
cost-optimization, operational-excellence), google-cloud-recipe-auth,
google-cloud-networking-observability, cloudformation-to-pulumi,
package-usage, provider-upgrade, and upstream-patches.

Update AGENTS.md GitNexus index stats to reflect the current index
(6273 symbols, 11483 relationships, 281 execution flows).

* chore(deps): bump astral-sh/setup-uv from 8.1.0 to 8.2.0 (#62)

Bumps [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) from 8.1.0 to 8.2.0.
- [Release notes](https://github.com/astral-sh/setup-uv/releases)
- [Commits](astral-sh/setup-uv@0880764...fac544c)

---
updated-dependencies:
- dependency-name: astral-sh/setup-uv
  dependency-version: 8.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps): bump actions/checkout from 6.0.2 to 6.0.3 (#63)

Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.2 to 6.0.3.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@de0fac2...df4cb1c)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 6.0.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps): bump starlette from 1.0.1 to 1.3.1 (#66)

Bumps [starlette](https://github.com/Kludex/starlette) from 1.0.1 to 1.3.1.
- [Release notes](https://github.com/Kludex/starlette/releases)
- [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md)
- [Commits](Kludex/starlette@1.0.1...1.3.1)

---
updated-dependencies:
- dependency-name: starlette
  dependency-version: 1.3.1
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps): bump cryptography from 48.0.0 to 48.0.1 (#67)

Bumps [cryptography](https://github.com/pyca/cryptography) from 48.0.0 to 48.0.1.
- [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst)
- [Commits](pyca/cryptography@48.0.0...48.0.1)

---
updated-dependencies:
- dependency-name: cryptography
  dependency-version: 48.0.1
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps): bump actions/checkout from 6.0.3 to 7.0.0 (#68)

Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.3 to 7.0.0.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@df4cb1c...9c091bb)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps): bump softprops/action-gh-release from 3.0.0 to 3.0.1 (#69)

Bumps [softprops/action-gh-release](https://github.com/softprops/action-gh-release) from 3.0.0 to 3.0.1.
- [Release notes](https://github.com/softprops/action-gh-release/releases)
- [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md)
- [Commits](softprops/action-gh-release@b430933...718ea10)

---
updated-dependencies:
- dependency-name: softprops/action-gh-release
  dependency-version: 3.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps): bump trufflesecurity/trufflehog from 3.95.5 to 3.95.6 (#70)

Bumps [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog) from 3.95.5 to 3.95.6.
- [Release notes](https://github.com/trufflesecurity/trufflehog/releases)
- [Commits](trufflesecurity/trufflehog@d411fff...30d5bb9)

---
updated-dependencies:
- dependency-name: trufflesecurity/trufflehog
  dependency-version: 3.95.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* codex/managed-context-sdk (#65)

* feat: add managed context SDK client

* ✨ feat: update gitn docs to use local run.cjs and paginate list_repos

* ✨ feat: add MPLv2 license headers to module and test files

* fix: address managed context review feedback

* ✨ feat(contracts): add V2ContextAssignment for context.assign (#71)

* ✨ feat(contracts): add V2ContextAssignment for context.assign

* ✨ feat(contracts): constrain context scope and document assignment semantics

Address PR #71 review: V2ContextAssignmentItem.scope is now Literal["workspace", "mission"] (matching other closed v2 vocabularies) with a ValidationError regression test, and the v2 doc gains explicit context.assign semantics: refs-not-content payload, freeze-on-pull with provenance, mandatory fetched-vs-assigned version check that fails the assignment on mismatch, and no live context reads during execution.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* 🐛 fix(contracts): require mission_id for mission-scoped context assignments

Address PR #71 follow-up review: a V2ContextAssignment containing scope="mission" items but no mission_id passed validation while the agent-side ContextClient.open() would have no mission context to fetch with. A model_validator now rejects that combination; workspace-only assignments still allow a null mission_id.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* 🐛 fix(contracts): reject whitespace-only mission_id for mission-scoped assignments

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

* feat: bump version to1.3.0 and update deps; iterate nested (#73)

* changelog

* chore(deps): bump actions/setup-python from 6.2.0 to 6.3.0 (#75)

Bumps [actions/setup-python](https://github.com/actions/setup-python) from 6.2.0 to 6.3.0.
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](actions/setup-python@a309ff8...ece7cb0)

---
updated-dependencies:
- dependency-name: actions/setup-python
  dependency-version: 6.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps): bump trufflesecurity/trufflehog from 3.95.6 to 3.95.7 (#76)

Bumps [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog) from 3.95.6 to 3.95.7.
- [Release notes](https://github.com/trufflesecurity/trufflehog/releases)
- [Commits](trufflesecurity/trufflehog@30d5bb9...f446421)

---
updated-dependencies:
- dependency-name: trufflesecurity/trufflehog
  dependency-version: 3.95.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* security: review summary (redacted) + safe P0/P1 hardening (#77)

* docs: add redacted security & performance review summary

Adds a non-actionable high-level summary of a full-source security and
performance/scalability review of the SDK (posture, verified-sound controls,
severity counts, and remediation themes) and a CHANGELOG entry.

Per SECURITY.md, detailed vulnerability findings (exact locations, attack
scenarios, remediation specifics) are intentionally kept out of the public
repository and handled through the private vulnerability channel.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01F8GY2d3HJgCKwgCyRgNFMt

* fix(security): harden API-key compare, local-mode bind, headers, logging, scheduler

Safe P0/P1 remediations from the security review (no wire-format or
auth-model breaking changes):

- Constant-time API-key comparison (hmac.compare_digest) in require_api_key
  and Server.verify_api_key (CWE-208).
- Local mode binds 127.0.0.1 instead of 0.0.0.0 unless an explicit non-wildcard
  host is set, so the default 'local-dev' key is not network-exposed (CWE-798).
- Baseline security headers (nosniff, X-Frame-Options DENY, Referrer-Policy,
  HSTS) via a pure-ASGI middleware that is SSE-safe (CWE-693/1021).
- Stop logging decrypted agent-parameter values and full result payloads in
  validate-agent-parameters (CWE-532).
- Allow-list scheduled_method against the agent's declared method paths in the
  scheduler and workbench execute-now path (CWE-470).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01F8GY2d3HJgCKwgCyRgNFMt

* fix(security): compare API keys as bytes to avoid TypeError on non-ASCII

hmac.compare_digest rejects non-ASCII str inputs, so a malformed X-API-Key
with non-ASCII characters raised TypeError (500) instead of failing closed
(401/403). Encode both operands to UTF-8 bytes in require_api_key and
Server.verify_api_key so malformed credentials are rejected.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01F8GY2d3HJgCKwgCyRgNFMt

* refactor(security): address review feedback on hardening changes

- Scope scheduled-step allow-list to the owning job's agent instead of the
  union of all agents, so a tampered step cannot invoke another agent's
  declared methods (per-agent isolation).
- Move MutableHeaders import to module scope (repo convention: no function-local
  imports without a concrete circular/optional/startup reason).
- Reword CHANGELOG security bullets to high-level, non-actionable descriptions
  consistent with the private-advisory disclosure policy.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01F8GY2d3HJgCKwgCyRgNFMt

* refactor(security): tighten scheduled-step allow-list resolution

Address review follow-ups on per-agent method scoping:

- Scheduler: if a due step's owning job cannot be resolved, mark the step
  failed instead of falling back to the union of all agents' methods, so an
  orphaned/tampered step cannot invoke another agent's method.
- Workbench execute-now: verify the job is owned by the request's agent
  (Jobs().get_job(job_id, agent_name=agent.name)) before using that agent's
  allow-list, preventing a slug/job-owner mismatch from widening the list.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01F8GY2d3HJgCKwgCyRgNFMt

* fix(security): use SAMEORIGIN and hoist Jobs import

- X-Frame-Options: SAMEORIGIN instead of DENY so the admin instructions
  iframe (same-origin) still renders, while cross-origin framing stays blocked.
- Move the Jobs import in scheduled_steps to module scope (no circular
  dependency; matches the repo's module-level-imports convention).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01F8GY2d3HJgCKwgCyRgNFMt

* refactor(admin): hoist scheduled step helper import

* fix(security): scope scheduled step ownership checks

* ✨ docs: add test summary table to changelog (docs/CHANGELOG.md)

* ✨ feat(ci): skip unit tests for docs-only changes in workflow

---------

Co-authored-by: Claude <noreply@anthropic.com>

* chore(deps): bump trufflesecurity/trufflehog from 3.95.7 to 3.95.9 (#81)

Bumps [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog) from 3.95.7 to 3.95.9.
- [Release notes](https://github.com/trufflesecurity/trufflehog/releases)
- [Commits](trufflesecurity/trufflehog@f446421...27b0417)

---
updated-dependencies:
- dependency-name: trufflesecurity/trufflehog
  dependency-version: 3.95.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps): bump softprops/action-gh-release from 3.0.1 to 3.0.2 (#82)

Bumps [softprops/action-gh-release](https://github.com/softprops/action-gh-release) from 3.0.1 to 3.0.2.
- [Release notes](https://github.com/softprops/action-gh-release/releases)
- [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md)
- [Commits](softprops/action-gh-release@718ea10...3d0d988)

---
updated-dependencies:
- dependency-name: softprops/action-gh-release
  dependency-version: 3.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps): bump astral-sh/setup-uv from 8.2.0 to 8.3.2 (#83)

Bumps [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) from 8.2.0 to 8.3.2.
- [Release notes](https://github.com/astral-sh/setup-uv/releases)
- [Commits](astral-sh/setup-uv@fac544c...11f9893)

---
updated-dependencies:
- dependency-name: astral-sh/setup-uv
  dependency-version: 8.3.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps): bump pyasn1 from 0.6.3 to 0.6.4 (#84)

Bumps [pyasn1](https://github.com/pyasn1/pyasn1) from 0.6.3 to 0.6.4.
- [Release notes](https://github.com/pyasn1/pyasn1/releases)
- [Changelog](https://github.com/pyasn1/pyasn1/blob/main/CHANGES.rst)
- [Commits](pyasn1/pyasn1@v0.6.3...v0.6.4)

---
updated-dependencies:
- dependency-name: pyasn1
  dependency-version: 0.6.4
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps): bump actions/setup-python from 6.3.0 to 7.0.0 (#85)

Bumps [actions/setup-python](https://github.com/actions/setup-python) from 6.3.0 to 7.0.0.
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](actions/setup-python@ece7cb0...5fda3b9)

---
updated-dependencies:
- dependency-name: actions/setup-python
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps): bump pypa/gh-action-pypi-publish from 1.14.0 to 1.14.1 (#86)

Bumps [pypa/gh-action-pypi-publish](https://github.com/pypa/gh-action-pypi-publish) from 1.14.0 to 1.14.1.
- [Release notes](https://github.com/pypa/gh-action-pypi-publish/releases)
- [Commits](pypa/gh-action-pypi-publish@cef2210...ba38be9)

---
updated-dependencies:
- dependency-name: pypa/gh-action-pypi-publish
  dependency-version: 1.14.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps): bump cryptography from 49.0.0 to 50.0.0 (#87)

Bumps [cryptography](https://github.com/pyca/cryptography) from 49.0.0 to 50.0.0.
- [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst)
- [Commits](pyca/cryptography@49.0.0...50.0.0)

---
updated-dependencies:
- dependency-name: cryptography
  dependency-version: 50.0.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* feat: add generic job setup contract (#89)

* feat: add generic job setup contract

* 🐛 fix(contracts): stop V2JobSetupPolicy defaulting to every action scope

An agent opting in with job_policy={"setup": {}} advertised support for
the workspace, job, case and step scopes without declaring any, which
broadens the contract Studio sees. Default to an empty list, matching
V2JobSyncPolicy.supported_statuses. Also declare V2JobSetupPolicy before
V2JobPolicy so the generated model reference renders the real type
instead of a ForwardRef.

* 📝 docs: regenerate model reference and OpenAPI

Picks up the job setup contract (V2JobPolicy.setup, V2JobSetupPolicy,
V2ActionResult.setup_plan) plus accumulated drift since 0.20.1.

* 📝 docs: log generic job setup contract in CHANGELOG

Records the V2JobSetupPolicy contract, the empty action_scopes default,
and the model reference regeneration under Unreleased.

* 🐛 fix(contracts): reject blank job setup and sync action ids

An empty preview_action/start_action/submit_action was accepted, then
dropped from capabilities.actions by _unique_strings while still being
serialized under job_policy.setup, so Studio saw an action it could
never invoke. Validate all three as non-blank, plus V2JobSyncPolicy.action,
which had the same gap.

* doc

* changelog update

* ✨ feat(contracts): declare action scope and mutability (#92) (#93)

* ✨ feat(contracts): declare action scope and mutability (#92)

V2AgentCapabilities.actions becomes list[V2ActionDefinition] carrying
id, mutating and scope, so consumers authorize and group actions from
declared metadata instead of pattern-matching the caller-supplied id.

Bare strings still validate and coerce to mutating=True, scope=job.
The builder derives metadata from each action's parent definition;
precedence is explicit > derived > bare.

Also adds V2DatasetDefinition.scope and V2AwaitingState.reopenable.

* 📝 chore: update documentation

* 🐛 fix(contracts): keep explicit action metadata when an id is declared twice

An id given both as a V2ActionDefinition and as a bare string in actions=
marked the id bare regardless of which declaration was retained, so the
derived entry then overwrote the explicit metadata. Bareness is now
tracked per retained declaration and an explicit definition wins
wherever the two appear.

* Changelog

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant