[MINOR] chore: merge develop to main - #72
Merged
Merged
Conversation
Pin all uses of actions/checkout@v6 and actions/setup-python@v6 to their commit SHAs across every workflow, closing the remaining floating-tag attack surface. - actions/checkout → de0fac2e (v6) - actions/setup-python → a309ff8b (v6)
…facts (#46) Prevents parallel matrix jobs racing on the same Actions cache reservation. Also records two CI tooling facts in AGENTS.md.
* feat: add supervaizer v2 contract primitives * feat: add supervaizer v2 a2a action endpoint * feat: expose supervaizer v2 registration in a2a card * feat: add supervaizer v2 action decorator * docs: update supervaizer v2 changelog * precommit fix * refactor: move controller api version to contracts * minor * fix: scope v2 action handlers by agent * feat: guard supervaizer v2 agent identity * feat: include v2 job state in sync result * feat: add v2 resource form fields * feat: add v2 resource option sources * feat: add v2 awaiting form fields * feat: load supervaizer v2 surfaces over a2a * feat: expose local hello world v2 contract * feat: add v2 job source target type * feat: stream v2 action effects over a2a * fix: advertise v2 push notifications as unsupported * refactor: remove legacy dynamic choices * feat: complete local hello world v2 hitl flow * refactor: remove legacy job poll * docs: refresh generated contract docs * test: align v2 prompt editor fixture * test: align v2 contact import fixture * test: align v2 scenario builder fixture * test: align v2 overview fixture * test: align v2 campaign contact fixture * feat: add v2 registration builder * feat: type v2 dataset display metadata * minor * fix: precommit * feat: add comprehensive documentation for SUPERVAIZER API, Admin Interface, CLI, Parameter Validation, Persistence, Protocols, and REST API * minor * chore: change copyright dates from 2024-2025 to 2024-2026 * fix: harden agent model surface and v2 contract hygiene Use modern typing in agent.py, keep server encrypted params internal, document deterministic agent ids, tighten A2A health status rules, drop legacy hello-world v2 input aliases, and clarify v2 contract fields. * feat: enhance agent method validation and improve v2 action safety - Introduced validation to reject agent methods using blocked module roots.- Added checks to ensure declared method paths are used in agent execution.- Enhanced v2 action results with replay safety metadata validation.- Updated changelog and documentation to reflect these changes. * feat: add v2 resource import contracts * test: align v2 contract fixtures * minor * fix: require auth for a2a controller * minor
…alidation improvements - Added optional `metadata` field to `V2CaseSnapshot` for case-level context. - Implemented validation for Studio registration handshake to ensure API key consistency. - Enhanced server API key handling for stability during reloads. - Updated tests to cover new functionality and validation paths.
* docs: plan workspace agent grants * docs: add Studio grant acceptance UX * feat: add workspace agent authorization * feat: add workspace binding protocol * fix: stabilize workspace authorization * ✨feat: add workspace auth helpers and use them in tests * ✨feat: require workspace auth and tighten agent checks * fix: require workspace auth for Studio A2A * fix: harden workspace authorization checks * fix: normalize malformed workspace auth inputs
…bility - Added support for newline-delimited JSON logging when `SUPERVAIZER_LOG_FORMAT=json` is set. - Updated logging configuration to allow structured logs for access-denial events. - Enhanced `log_access_denied_api` and `log_access_denied_tailscale` functions to include structured fields. - Added tests to verify structured logging outputs in `tests/test_common.py`.
# Conflicts: # docs/CHANGELOG.md
* Clean up Supervaizer lifespan shutdown * Document Supervaizer import placement rule * Fix lifespan cleanup test determinism * Address lifespan shutdown review feedback * ✨feat: rename test and assert scheduled step task * ✨ feat: update GitNexus index counts in AGENTS.md
* Refactor Supervaizer server modules * ✨ feat: update GitNexus index stats in AGENTS.md * ✨docs update changelog AGENTS guidance * ✨feat: add v2 methods, tests and license header
* Clean up Supervaizer lifespan shutdown * Document Supervaizer import placement rule * Fix lifespan cleanup test determinism * Address lifespan shutdown review feedback * ✨feat: rename test and assert scheduled step task * ✨ feat: update GitNexus index counts in AGENTS.md * feat(v2): add agent action methods
- Updated mypy hook to use project-specific configuration for consistency with uv.lock. - Improved validation for v2_registration and v2_method_declarations in Agent class to ensure proper type handling. - Enhanced logging configuration to cast message records for structured logging compatibility.
Bumps [uv](https://github.com/astral-sh/uv) from 0.11.14 to 0.11.15. - [Release notes](https://github.com/astral-sh/uv/releases) - [Changelog](https://github.com/astral-sh/uv/blob/main/CHANGELOG.md) - [Commits](astral-sh/uv@0.11.14...0.11.15) --- updated-dependencies: - dependency-name: uv dependency-version: 0.11.15 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [starlette](https://github.com/Kludex/starlette) from 0.50.0 to 1.0.1. - [Release notes](https://github.com/Kludex/starlette/releases) - [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md) - [Commits](Kludex/starlette@0.50.0...1.0.1) --- updated-dependencies: - dependency-name: starlette dependency-version: 1.0.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog) from 3.95.3 to 3.95.5. - [Release notes](https://github.com/trufflesecurity/trufflehog/releases) - [Commits](trufflesecurity/trufflehog@37b7700...d411fff) --- updated-dependencies: - dependency-name: trufflesecurity/trufflehog dependency-version: 3.95.5 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Add 21 skill symlinks under .agents/skills/ pointing to the local runwaize_skills_cookbook installation, covering cloud-run basics, Pulumi migration/tooling skills (terraform, CDK, ARM, ESC, component, automation-api, upgrade-provider, best-practices, neo-handoff), Google Cloud WAF pillars (security, reliability, performance, cost-optimization, operational-excellence), google-cloud-recipe-auth, google-cloud-networking-observability, cloudformation-to-pulumi, package-usage, provider-upgrade, and upstream-patches. Update AGENTS.md GitNexus index stats to reflect the current index (6273 symbols, 11483 relationships, 281 execution flows).
Bumps [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) from 8.1.0 to 8.2.0. - [Release notes](https://github.com/astral-sh/setup-uv/releases) - [Commits](astral-sh/setup-uv@0880764...fac544c) --- updated-dependencies: - dependency-name: astral-sh/setup-uv dependency-version: 8.2.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.2 to 6.0.3. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@de0fac2...df4cb1c) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 6.0.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [starlette](https://github.com/Kludex/starlette) from 1.0.1 to 1.3.1. - [Release notes](https://github.com/Kludex/starlette/releases) - [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md) - [Commits](Kludex/starlette@1.0.1...1.3.1) --- updated-dependencies: - dependency-name: starlette dependency-version: 1.3.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [cryptography](https://github.com/pyca/cryptography) from 48.0.0 to 48.0.1. - [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst) - [Commits](pyca/cryptography@48.0.0...48.0.1) --- updated-dependencies: - dependency-name: cryptography dependency-version: 48.0.1 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.3 to 7.0.0. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@df4cb1c...9c091bb) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [softprops/action-gh-release](https://github.com/softprops/action-gh-release) from 3.0.0 to 3.0.1. - [Release notes](https://github.com/softprops/action-gh-release/releases) - [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md) - [Commits](softprops/action-gh-release@b430933...718ea10) --- updated-dependencies: - dependency-name: softprops/action-gh-release dependency-version: 3.0.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog) from 3.95.5 to 3.95.6. - [Release notes](https://github.com/trufflesecurity/trufflehog/releases) - [Commits](trufflesecurity/trufflehog@d411fff...30d5bb9) --- updated-dependencies: - dependency-name: trufflesecurity/trufflehog dependency-version: 3.95.6 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* feat: add managed context SDK client * ✨ feat: update gitn docs to use local run.cjs and paginate list_repos * ✨ feat: add MPLv2 license headers to module and test files * fix: address managed context review feedback
* ✨ feat(contracts): add V2ContextAssignment for context.assign * ✨ feat(contracts): constrain context scope and document assignment semantics Address PR #71 review: V2ContextAssignmentItem.scope is now Literal["workspace", "mission"] (matching other closed v2 vocabularies) with a ValidationError regression test, and the v2 doc gains explicit context.assign semantics: refs-not-content payload, freeze-on-pull with provenance, mandatory fetched-vs-assigned version check that fails the assignment on mismatch, and no live context reads during execution. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * 🐛 fix(contracts): require mission_id for mission-scoped context assignments Address PR #71 follow-up review: a V2ContextAssignment containing scope="mission" items but no mission_id passed validation while the agent-side ContextClient.open() would have no mission context to fetch with. A model_validator now rejects that combination; workspace-only assignments still allow a null mission_id. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * 🐛 fix(contracts): reject whitespace-only mission_id for mission-scoped assignments Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
PR Summary by QodoRelease: add ContextClient + context.assign contract; refresh CI action pins
AI Description
Diagram
High-Level Assessment
Files changed (42)
|
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 46e0e51bb2
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| @@ -0,0 +1 @@ | |||
| /Users/alp/.runwaize_skills_cookbook/chef/skills/cloud-run-basics No newline at end of file | |||
There was a problem hiding this comment.
When this repo is cloned anywhere other than the original /Users/alp machine, this new symlink and the other new .agents/skills/* symlinks are dangling, so agent skill discovery cannot open the referenced SKILL.md files. Please commit the actual skill directories or use repo-relative links instead of absolute workstation paths.
Useful? React with 👍 / 👎.
Code Review by Qodo
Context used✅ Compliance rules (platform):
32 rules 1. Absolute-path skill pointers
|
![qodo-code-review[bot]](https://avatars.githubusercontent.com/in/484649?s=60&v=4){kind=small}
| @@ -0,0 +1 @@ | |||
| /Users/alp/.runwaize_skills_cookbook/chef/skills/cloud-run-basics No newline at end of file | |||
There was a problem hiding this comment.
2. Absolute-path skill pointers 🐞 Bug ⛨ Security
The PR adds multiple .agents/skills/* entries whose content is an absolute developer-local path under /Users/alp/..., which will not exist on CI/other machines and leaks a local filesystem path into the repo. Any tooling that loads these skills will fail to resolve them outside the author’s workstation.
Agent Prompt
## Issue description
Several new `.agents/skills/*` files embed an absolute path like `/Users/alp/...`. This is non-portable and leaks a developer-local path into the repository.
## Issue Context
These one-line files look like symlink targets or path pointers. Absolute paths will break in CI and on other developers’ machines.
## Fix
- Remove these absolute-path entries from the repo, or replace them with:
- repo-relative symlinks/paths, or
- checked-in skill content within the repo.
- Ensure the resulting files work in a fresh clone on Linux CI.
## Fix Focus Areas
- .agents/skills/cloud-run-basics[1-1]
- .agents/skills/cloudformation-to-pulumi[1-1]
- .agents/skills/google-cloud-networking-observability[1-1]
- .agents/skills/google-cloud-recipe-auth[1-1]
- .agents/skills/google-cloud-waf-cost-optimization[1-1]
- .agents/skills/google-cloud-waf-operational-excellence[1-1]
- .agents/skills/google-cloud-waf-performance-optimization[1-1]
- .agents/skills/google-cloud-waf-reliability[1-1]
- .agents/skills/google-cloud-waf-security[1-1]
- .agents/skills/package-usage[1-1]
- .agents/skills/provider-upgrade[1-1]
- .agents/skills/pulumi-arm-to-pulumi[1-1]
- .agents/skills/pulumi-automation-api[1-1]
- .agents/skills/pulumi-best-practices[1-1]
- .agents/skills/pulumi-cdk-to-pulumi[1-1]
- .agents/skills/pulumi-component[1-1]
- .agents/skills/pulumi-esc[1-1]
- .agents/skills/pulumi-neo-handoff[1-1]
- .agents/skills/pulumi-terraform-to-pulumi[1-1]
- .agents/skills/pulumi-upgrade-provider[1-1]
- .agents/skills/upstream-patches[1-1]
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
Comment on lines
+23
to
+26
| _sync_httpx_transport = httpx.HTTPTransport( | ||
| retries=int(os.getenv("SUPERVAIZE_HTTP_MAX_RETRIES", 2)) | ||
| ) | ||
| _sync_httpx_client = httpx.Client(transport=_sync_httpx_transport) |
There was a problem hiding this comment.
3. Retries env import crash 🐞 Bug ☼ Reliability
supervaizer.context evaluates int(os.getenv("SUPERVAIZE_HTTP_MAX_RETRIES")) at import time, so a
non-integer env value raises ValueError and prevents importing the SDK. This is now triggered by a
normal Account import because account.py imports ContextClient unconditionally.
Agent Prompt
## Issue description
`src/supervaizer/context.py` parses `SUPERVAIZE_HTTP_MAX_RETRIES` with `int(...)` at module import time. If the environment variable is malformed (e.g. `"two"`), importing `supervaizer.context` (and now `Account`) raises `ValueError` and breaks application startup.
## Issue Context
`Account` now imports `ContextClient`, which imports `supervaizer.context`, so this failure mode can happen even when callers are not using the context feature.
## Fix
- Parse `SUPERVAIZE_HTTP_MAX_RETRIES` defensively:
- Wrap `int(...)` in `try/except ValueError` and fall back to the default.
- Optionally log a warning indicating the value was invalid and defaulted.
- (Optional) Factor this into a shared helper so all HTTP clients use consistent parsing.
## Fix Focus Areas
- src/supervaizer/context.py[23-26]
- src/supervaizer/account.py[19-22]
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Release PR created by
just ship minor. Merge this PR after required checks pass; the publish workflow will bump the minor version from the merge commit token.