security: review summary (redacted) + safe P0/P1 hardening by alain-sv · Pull Request #77 · supervaize/supervaizer

alain-sv · 2026-07-07T08:13:24Z

Summary

Two parts:

docs/2026_07_SECURITY_REVIEW.md — a non-actionable high-level summary of a full-source security & performance review. Per SECURITY.md, detailed findings (locations, attack scenarios, remediation specifics) are handled privately and omitted here.
Safe P0/P1 security hardening — the low-risk, high-value fixes from the review, with no wire-format or auth-model breaking changes.

Hardening changes

Constant-time API-key comparison (hmac.compare_digest, byte-encoded) in require_api_key and Server.verify_api_key — removes a timing side channel; non-ASCII keys fail closed (CWE-208).
Local mode binds loopback — supervaizer start --local (which uses the well-known default local-dev key) now binds 127.0.0.1 unless an explicit non-wildcard --host is set, so it is not network-exposed by default (CWE-798).
Baseline security headers — X-Content-Type-Options: nosniff, X-Frame-Options: SAMEORIGIN (allows the same-origin instructions iframe, blocks cross-origin framing), Referrer-Policy: no-referrer, Strict-Transport-Security, via a pure-ASGI middleware that is SSE-safe (does not buffer streaming responses) (CWE-693/1021).
No decrypted parameter values in logs — validate-agent-parameters logs only presence/counts and pass/fail, never decrypted values or full result payloads (CWE-532).
Scheduled-step method allow-list — the scheduler and workbench execute-now path only run methods declared by the agent that owns the step's job (verified via the owning job, not the request slug); unresolved/orphaned steps fail closed (CWE-470).

Deferred (need coordinated / breaking changes — tracked in the private report)

AES-CBC → AEAD (AES-GCM) migration for the parameter-encryption wire format (interop with Studio).
Admin-surface auth redesign (move off IP-only trust; stop rendering the API key into HTML).
X-Forwarded-For rightmost-untrusted parsing, workspace-auth jti replay cache, SSE subscriber caps, request body-size limits, secrets-at-rest handling.

Verification

682 passed locally; the single failing test (test_deploy_phase1.py::…test_deploy_down_command) is a pre-existing sandbox/filesystem artifact that fails identically on the base commit and is unrelated to this diff (it touches no deploy code). Ruff and mypy clean. CI green.

🤖 Generated with Claude Code

https://claude.ai/code/session_01F8GY2d3HJgCKwgCyRgNFMt

qodo-code-review · 2026-07-07T08:14:19Z

PR Summary by Qodo

Add full SPARC security & performance review report (July 2026)

📝 Documentation 🕐 20-40 Minutes

AI Description

• Add a full-source security and performance/scalability review report for the SDK.
• Document verified findings, false positives, and a prioritized P0–P3 remediation plan.
• No runtime/code changes; this PR is intended for triage and planning.

Diagram

graph TD
A["Supervaizer SDK source"] --> B["Security & perf review"] --> C["Findings catalog"] --> D["Remediation plan"] --> E["Engineering backlog"]
B --> F["False positives"]
D --> G["Prioritized P0–P3"]
C --> H["Security + Perf"]

High-Level Assessment

The following are alternative approaches to this PR:

1. Split into an executive summary + per-area deep dives

➕ Shorter PR review surface for most readers (summary only).
➕ Easier to assign ownership by component (auth, admin UI, deploy, storage).
➕ Reduces churn when updating one subsystem’s findings.
➖ More files to maintain and keep consistent.
➖ Harder to get a single end-to-end risk narrative in one place.

2. Publish findings as trackable artifacts (issues/SARIF) plus a short doc

➕ Immediate workflow integration (owners, milestones, SLAs, status).
➕ Enables deduping, prioritization, and metrics over time.
➕ SARIF can integrate with code scanning UIs.
➖ Higher up-front coordination cost to create/triage tickets.
➖ Harder to preserve the full verification narrative in ticket form.

3. Convert remediation plan into a formal RFC with acceptance criteria

➕ Forces clear scope boundaries and definition-of-done per P0/P1 item.
➕ Improves review rigor for security model changes (admin auth, key handling).
➖ More process overhead for what may be straightforward fixes.
➖ May delay starting urgent P0 remediation work.

Recommendation: Keep this PR’s approach (single, comprehensive report) because it’s a good triage/planning artifact and preserves verification context. As a follow-up, consider extracting P0/P1 items into the engineering backlog (or SARIF/issues) to ensure ownership and execution tracking, while leaving this document as the canonical narrative and reference.

Files changed (1) +341 / -0

Documentation (1) +341 / -0

2026_07_SECURITY_REVIEW.mdAdd full-source security & performance review report (July 2026) +341/-0

Add full-source security & performance review report (July 2026)

• Introduces a comprehensive, non-diff security and performance/scalability review of the supervaizer SDK source tree. The report includes an executive summary, enumerated SVZ-SEC/SVZ-PERF findings with verification notes, false-positive documentation, and a prioritized P0–P3 remediation plan.

docs/2026_07_SECURITY_REVIEW.md

ⓘ You are approaching your monthly quota for Qodo. Upgrade your plan

qodo-code-review · 2026-07-07T08:17:13Z

Code Review by Qodo

🐞 Bugs (2) 📘 Rule violations (0) 📜 Skill insights (0)

Context used

✅ Compliance rules (platform): 32 rules

1. Security policy disclosure 🐞 Bug ⛨ Security

Description

The PR adds a detailed vulnerability report (attack scenarios + exact locations) into the public
docs tree, which directly conflicts with the repository’s security policy that forbids reporting
security issues in public pull requests. This increases the risk of unintended disclosure and
operationalizes a roadmap for attackers if the repo/docs are externally visible.

Code

docs/2026_07_SECURITY_REVIEW.md[R51-60]

+## 3. Findings At A Glance
+
+| ID | Sev | Title | Component | Location | CWE | Verdict |
+|----|-----|-------|-----------|----------|-----|---------|
+| SVZ-SEC-001 | High | `local-dev` default API key on `0.0.0.0` in local mode | Auth | server.py:282-286, cli.py:116-117 | CWE-798 | CONFIRMED |
+| SVZ-SEC-002 | High | Spoofable leftmost `X-Forwarded-For` → Tailscale admin bypass | Authz | access/client_ip.py:60 | CWE-348 | CONFIRMED |
+| SVZ-SEC-003 | High | Master write-scoped API key rendered into admin HTML/DOM | Auth/UI | admin/routes.py:134, base.html:36, workbench.html:425 | CWE-522 | CONFIRMED |
+| SVZ-SEC-004 | High | Stored/DOM XSS via `x-html` on untrusted HITL content | UI | admin/templates/components/dialog_renderer.html:71,117,211,238 | CWE-79 | CONFIRMED |
+| SVZ-SEC-005 | High | Supervaize API key baked into Docker image via ARG→ENV | Deploy | deploy/docker.py:71-141 | CWE-522/215 | CONFIRMED |
+| SVZ-SEC-006 | High | API key + RSA private key written to world-readable compose file | Deploy | deploy/docker.py:204-221 | CWE-312/732 | CONFIRMED |

Relevance

⭐⭐⭐ High
Repo promotes private vulnerability reporting in changelog/security posture; public exploit details
likely rejected.
PR-#42
PR-#40

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The added markdown is a comprehensive security finding list with exploit descriptions, while the
repository’s security policy explicitly prohibits reporting security issues in public pull requests.

docs/2026_07_SECURITY_REVIEW.md[51-200]
SECURITY.md[3-9]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
`docs/2026_07_SECURITY_REVIEW.md` publishes detailed, actionable security findings (including attack steps and precise code locations) in a public-facing documentation path. This conflicts with the repo’s `SECURITY.md` guidance to avoid disclosing security issues in public PRs.

## Issue Context
The repository explicitly requests private vulnerability reporting via GitHub Security Advisories and states not to report security issues in public PRs. The added doc contains dozens of confirmed findings with exploit narratives.

## Fix Focus Areas
- docs/2026_07_SECURITY_REVIEW.md[1-341]

## Suggested fix
- Remove this detailed report from the public `docs/` tree (or gate it behind a private/internal channel).
- If you still want something in-repo, replace it with a non-actionable high-level summary that omits exploit steps, payloads, and precise file/line pointers, and link to the private advisory/remediation tracker accessible only to maintainers.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

2. Outdated supply-chain advice 🐞 Bug ⚙ Maintainability

Description

The new report states there is a “>= without lockfile” caveat and recommends committing a lockfile
and adding Dependabot, but the repo already has uv.lock and .github/dependabot.yml. This makes
parts of the report demonstrably incorrect and undermines its usefulness as a planning artifact.

Code

docs/2026_07_SECURITY_REVIEW.md[R335-338]

+**Recommended next steps (out of static scope):**
+- Run a secrets scan across git history (the repo already ships TruffleHog config) to confirm no key was ever committed.
+- Add `pip-audit`/Dependabot to CI and commit a lockfile for reproducible resolution.
+- Dynamic testing: exercise the XFF-spoof and CSRF paths against a staged reverse-proxy deployment; fuzz the decrypt endpoint to confirm the oracle is closed after the AEAD migration.

Relevance

⭐⭐⭐ High
Team fixes doc inaccuracies; repo already has uv.lock and Dependabot per recent security/CI work.
PR-#41
PR-#40
PR-#44

ⓘ Recommendations generated based on similar findings in past PRs

Evidence
The report explicitly claims a missing-lockfile caveat and recommends committing a lockfile/adding
Dependabot, but the repo already contains uv.lock and Dependabot configuration (and documents
frozen lockfile usage).
docs/2026_07_SECURITY_REVIEW.md[297-298]
docs/2026_07_SECURITY_REVIEW.md[335-338]
uv.lock[1-4]
.github/dependabot.yml[1-29]
SECURITY.md[19-33]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The security review doc contains statements/recommendations that contradict the repository’s current state (e.g., implying no lockfile and recommending adding Dependabot).

## Issue Context
The repo already includes `uv.lock` and Dependabot configuration. The report should accurately reflect existing controls to avoid redundant work and preserve credibility.

## Fix Focus Areas
- docs/2026_07_SECURITY_REVIEW.md[297-298]
- docs/2026_07_SECURITY_REVIEW.md[335-338]

## Suggested fix
- Update the “Dependency CVEs” bullet to acknowledge the committed `uv.lock` and frozen resolution workflow.
- Update “Recommended next steps” to remove/adjust the Dependabot + lockfile recommendation (or narrow it to what’s actually missing, e.g., adding `pip-audit` specifically, if desired).
- Optionally add a short note that CI already runs OSV scanning and that supply-chain posture items are documented in `SECURITY.md`.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

ⓘ You are approaching your monthly quota for Qodo. Upgrade your plan

alain-sv · 2026-07-07T09:06:58Z

Both review points are addressed:

Public disclosure of unpatched findings — The detailed report has been redacted to a non-actionable high-level summary (posture, verified-sound controls, severity counts, and remediation themes only; no code locations or attack scenarios). Per SECURITY.md, the full findings are handled through the private vulnerability channel. The branch was force-pushed so the public history no longer carries the detailed version.
Outdated supply-chain advice — Corrected. The summary now reflects the existing baseline (committed uv.lock with uv sync --frozen in CI, Dependabot, and OSV-Scanner per SECURITY.md); no supply-chain action is recommended.

Generated by Claude Code

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 373c4e43fc

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 3abbd907f2

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 821c276d61

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ae83ed289a

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

chatgpt-codex-connector · 2026-07-07T12:00:21Z

                _execute_scheduled_method(
                    update.scheduled_method,
                    update.scheduled_params or {},
+                    allowed_methods=agent._declared_method_paths(),


Verify the step's job owner before using the slug allow-list

In the immediate-execute workbench route, a request can supply the slug for agent A while job_id/case_id identify a case belonging to agent B, because Cases().get_case(case_id, job_id=job_id) does not verify the job is owned by the slug's agent. In that mismatched multi-agent scenario, this new allow-list is taken from agent A, so a tampered scheduled step on B's case can still invoke any method declared by A; look up the job with agent_name=agent.name (as nearby workbench routes do) or derive the allow-list from the owning job before executing.

Useful? React with 👍 / 👎.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 3162a756b5

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

Adds a non-actionable high-level summary of a full-source security and performance/scalability review of the SDK (posture, verified-sound controls, severity counts, and remediation themes) and a CHANGELOG entry. Per SECURITY.md, detailed vulnerability findings (exact locations, attack scenarios, remediation specifics) are intentionally kept out of the public repository and handled through the private vulnerability channel. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F8GY2d3HJgCKwgCyRgNFMt

…ing, scheduler Safe P0/P1 remediations from the security review (no wire-format or auth-model breaking changes): - Constant-time API-key comparison (hmac.compare_digest) in require_api_key and Server.verify_api_key (CWE-208). - Local mode binds 127.0.0.1 instead of 0.0.0.0 unless an explicit non-wildcard host is set, so the default 'local-dev' key is not network-exposed (CWE-798). - Baseline security headers (nosniff, X-Frame-Options DENY, Referrer-Policy, HSTS) via a pure-ASGI middleware that is SSE-safe (CWE-693/1021). - Stop logging decrypted agent-parameter values and full result payloads in validate-agent-parameters (CWE-532). - Allow-list scheduled_method against the agent's declared method paths in the scheduler and workbench execute-now path (CWE-470). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F8GY2d3HJgCKwgCyRgNFMt

hmac.compare_digest rejects non-ASCII str inputs, so a malformed X-API-Key with non-ASCII characters raised TypeError (500) instead of failing closed (401/403). Encode both operands to UTF-8 bytes in require_api_key and Server.verify_api_key so malformed credentials are rejected. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F8GY2d3HJgCKwgCyRgNFMt

- Scope scheduled-step allow-list to the owning job's agent instead of the union of all agents, so a tampered step cannot invoke another agent's declared methods (per-agent isolation). - Move MutableHeaders import to module scope (repo convention: no function-local imports without a concrete circular/optional/startup reason). - Reword CHANGELOG security bullets to high-level, non-actionable descriptions consistent with the private-advisory disclosure policy. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F8GY2d3HJgCKwgCyRgNFMt

Address review follow-ups on per-agent method scoping: - Scheduler: if a due step's owning job cannot be resolved, mark the step failed instead of falling back to the union of all agents' methods, so an orphaned/tampered step cannot invoke another agent's method. - Workbench execute-now: verify the job is owned by the request's agent (Jobs().get_job(job_id, agent_name=agent.name)) before using that agent's allow-list, preventing a slug/job-owner mismatch from widening the list. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F8GY2d3HJgCKwgCyRgNFMt

- X-Frame-Options: SAMEORIGIN instead of DENY so the admin instructions iframe (same-origin) still renders, while cross-origin framing stays blocked. - Move the Jobs import in scheduled_steps to module scope (no circular dependency; matches the repo's module-level-imports convention). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F8GY2d3HJgCKwgCyRgNFMt

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a14dd61f3e

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 55e220284d

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

chatgpt-codex-connector · 2026-07-07T21:30:24Z

+  change_scope:
+    runs-on: ubuntu-latest


Revert workflow edits until explicitly approved

/workspace/supervaizer/AGENTS.md says “Never modify files in .github/workflows/ without explicit user approval.” This commit adds a new CI change-scope job in python-package.yml; unless this PR has explicit approval for workflow changes, it violates the repo's supply-chain controls and should be reverted or split into an approved workflow-only change.

Useful? React with 👍 / 👎.

* apply dependabot insights * minor * chore(ci): SHA-pin actions/checkout and actions/setup-python (#43) Pin all uses of actions/checkout@v6 and actions/setup-python@v6 to their commit SHAs across every workflow, closing the remaining floating-tag attack surface. - actions/checkout → de0fac2e (v6) - actions/setup-python → a309ff8b (v6) * docs(changelog): add unreleased dependency security refresh entry (#44) * chore(ci): add uv cache-suffix per Python version + update AGENTS.md facts (#46) Prevents parallel matrix jobs racing on the same Actions cache reservation. Also records two CI tooling facts in AGENTS.md. * supervaizer-v2-mvp-contracts (#47) * feat: add supervaizer v2 contract primitives * feat: add supervaizer v2 a2a action endpoint * feat: expose supervaizer v2 registration in a2a card * feat: add supervaizer v2 action decorator * docs: update supervaizer v2 changelog * precommit fix * refactor: move controller api version to contracts * minor * fix: scope v2 action handlers by agent * feat: guard supervaizer v2 agent identity * feat: include v2 job state in sync result * feat: add v2 resource form fields * feat: add v2 resource option sources * feat: add v2 awaiting form fields * feat: load supervaizer v2 surfaces over a2a * feat: expose local hello world v2 contract * feat: add v2 job source target type * feat: stream v2 action effects over a2a * fix: advertise v2 push notifications as unsupported * refactor: remove legacy dynamic choices * feat: complete local hello world v2 hitl flow * refactor: remove legacy job poll * docs: refresh generated contract docs * test: align v2 prompt editor fixture * test: align v2 contact import fixture * test: align v2 scenario builder fixture * test: align v2 overview fixture * test: align v2 campaign contact fixture * feat: add v2 registration builder * feat: type v2 dataset display metadata * minor * fix: precommit * feat: add comprehensive documentation for SUPERVAIZER API, Admin Interface, CLI, Parameter Validation, Persistence, Protocols, and REST API * minor * chore: change copyright dates from 2024-2025 to 2024-2026 * fix: harden agent model surface and v2 contract hygiene Use modern typing in agent.py, keep server encrypted params internal, document deterministic agent ids, tighten A2A health status rules, drop legacy hello-world v2 input aliases, and clarify v2 contract fields. * feat: enhance agent method validation and improve v2 action safety - Introduced validation to reject agent methods using blocked module roots.- Added checks to ensure declared method paths are used in agent execution.- Enhanced v2 action results with replay safety metadata validation.- Updated changelog and documentation to reflect these changes. * feat: add v2 resource import contracts * test: align v2 contract fixtures * minor * fix: require auth for a2a controller * minor * Minor * chore: update changelog for Supervaizer v2 enhancements and API key validation improvements - Added optional `metadata` field to `V2CaseSnapshot` for case-level context. - Implemented validation for Studio registration handshake to ensure API key consistency. - Enhanced server API key handling for stability during reloads. - Updated tests to cover new functionality and validation paths. * workspace-agent-grants (#50) * docs: plan workspace agent grants * docs: add Studio grant acceptance UX * feat: add workspace agent authorization * feat: add workspace binding protocol * fix: stabilize workspace authorization * ✨feat: add workspace auth helpers and use them in tests * ✨feat: require workspace auth and tighten agent checks * fix: require workspace auth for Studio A2A * fix: harden workspace authorization checks * fix: normalize malformed workspace auth inputs * minor * feat(logging): implement structured logging for Cloud Logging compatibility - Added support for newline-delimited JSON logging when `SUPERVAIZER_LOG_FORMAT=json` is set. - Updated logging configuration to allow structured logs for access-denial events. - Enhanced `log_access_denied_api` and `log_access_denied_tailscale` functions to include structured fields. - Added tests to verify structured logging outputs in `tests/test_common.py`. * Minor * codex/supervaizer-lifespan-cleanup (#54) * Clean up Supervaizer lifespan shutdown * Document Supervaizer import placement rule * Fix lifespan cleanup test determinism * Address lifespan shutdown review feedback * ✨feat: rename test and assert scheduled step task * ✨ feat: update GitNexus index counts in AGENTS.md * codex/refactor-server-modules (#55) * Refactor Supervaizer server modules * ✨ feat: update GitNexus index stats in AGENTS.md * ✨docs update changelog AGENTS guidance * ✨feat: add v2 methods, tests and license header * minor * codex/agent-interviewer-workspace-jobs-refresh (#56) * Clean up Supervaizer lifespan shutdown * Document Supervaizer import placement rule * Fix lifespan cleanup test determinism * Address lifespan shutdown review feedback * ✨feat: rename test and assert scheduled step task * ✨ feat: update GitNexus index counts in AGENTS.md * feat(v2): add agent action methods * Refactor pre-commit configuration and enhance agent validation - Updated mypy hook to use project-specific configuration for consistency with uv.lock. - Improved validation for v2_registration and v2_method_declarations in Agent class to ensure proper type handling. - Enhanced logging configuration to cast message records for structured logging compatibility. * chore(deps): bump uv from 0.11.14 to 0.11.15 (#58) Bumps [uv](https://github.com/astral-sh/uv) from 0.11.14 to 0.11.15. - [Release notes](https://github.com/astral-sh/uv/releases) - [Changelog](https://github.com/astral-sh/uv/blob/main/CHANGELOG.md) - [Commits](astral-sh/uv@0.11.14...0.11.15) --- updated-dependencies: - dependency-name: uv dependency-version: 0.11.15 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump starlette from 0.50.0 to 1.0.1 (#60) Bumps [starlette](https://github.com/Kludex/starlette) from 0.50.0 to 1.0.1. - [Release notes](https://github.com/Kludex/starlette/releases) - [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md) - [Commits](Kludex/starlette@0.50.0...1.0.1) --- updated-dependencies: - dependency-name: starlette dependency-version: 1.0.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump trufflesecurity/trufflehog from 3.95.3 to 3.95.5 (#61) Bumps [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog) from 3.95.3 to 3.95.5. - [Release notes](https://github.com/trufflesecurity/trufflehog/releases) - [Commits](trufflesecurity/trufflehog@37b7700...d411fff) --- updated-dependencies: - dependency-name: trufflesecurity/trufflehog dependency-version: 3.95.5 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * feat(.agents): add skill symlinks from runwaize skills cookbook Add 21 skill symlinks under .agents/skills/ pointing to the local runwaize_skills_cookbook installation, covering cloud-run basics, Pulumi migration/tooling skills (terraform, CDK, ARM, ESC, component, automation-api, upgrade-provider, best-practices, neo-handoff), Google Cloud WAF pillars (security, reliability, performance, cost-optimization, operational-excellence), google-cloud-recipe-auth, google-cloud-networking-observability, cloudformation-to-pulumi, package-usage, provider-upgrade, and upstream-patches. Update AGENTS.md GitNexus index stats to reflect the current index (6273 symbols, 11483 relationships, 281 execution flows). * chore(deps): bump astral-sh/setup-uv from 8.1.0 to 8.2.0 (#62) Bumps [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) from 8.1.0 to 8.2.0. - [Release notes](https://github.com/astral-sh/setup-uv/releases) - [Commits](astral-sh/setup-uv@0880764...fac544c) --- updated-dependencies: - dependency-name: astral-sh/setup-uv dependency-version: 8.2.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump actions/checkout from 6.0.2 to 6.0.3 (#63) Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.2 to 6.0.3. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@de0fac2...df4cb1c) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 6.0.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump starlette from 1.0.1 to 1.3.1 (#66) Bumps [starlette](https://github.com/Kludex/starlette) from 1.0.1 to 1.3.1. - [Release notes](https://github.com/Kludex/starlette/releases) - [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md) - [Commits](Kludex/starlette@1.0.1...1.3.1) --- updated-dependencies: - dependency-name: starlette dependency-version: 1.3.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump cryptography from 48.0.0 to 48.0.1 (#67) Bumps [cryptography](https://github.com/pyca/cryptography) from 48.0.0 to 48.0.1. - [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst) - [Commits](pyca/cryptography@48.0.0...48.0.1) --- updated-dependencies: - dependency-name: cryptography dependency-version: 48.0.1 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump actions/checkout from 6.0.3 to 7.0.0 (#68) Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.3 to 7.0.0. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@df4cb1c...9c091bb) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump softprops/action-gh-release from 3.0.0 to 3.0.1 (#69) Bumps [softprops/action-gh-release](https://github.com/softprops/action-gh-release) from 3.0.0 to 3.0.1. - [Release notes](https://github.com/softprops/action-gh-release/releases) - [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md) - [Commits](softprops/action-gh-release@b430933...718ea10) --- updated-dependencies: - dependency-name: softprops/action-gh-release dependency-version: 3.0.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump trufflesecurity/trufflehog from 3.95.5 to 3.95.6 (#70) Bumps [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog) from 3.95.5 to 3.95.6. - [Release notes](https://github.com/trufflesecurity/trufflehog/releases) - [Commits](trufflesecurity/trufflehog@d411fff...30d5bb9) --- updated-dependencies: - dependency-name: trufflesecurity/trufflehog dependency-version: 3.95.6 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * codex/managed-context-sdk (#65) * feat: add managed context SDK client * ✨ feat: update gitn docs to use local run.cjs and paginate list_repos * ✨ feat: add MPLv2 license headers to module and test files * fix: address managed context review feedback * ✨ feat(contracts): add V2ContextAssignment for context.assign (#71) * ✨ feat(contracts): add V2ContextAssignment for context.assign * ✨ feat(contracts): constrain context scope and document assignment semantics Address PR #71 review: V2ContextAssignmentItem.scope is now Literal["workspace", "mission"] (matching other closed v2 vocabularies) with a ValidationError regression test, and the v2 doc gains explicit context.assign semantics: refs-not-content payload, freeze-on-pull with provenance, mandatory fetched-vs-assigned version check that fails the assignment on mismatch, and no live context reads during execution. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * 🐛 fix(contracts): require mission_id for mission-scoped context assignments Address PR #71 follow-up review: a V2ContextAssignment containing scope="mission" items but no mission_id passed validation while the agent-side ContextClient.open() would have no mission context to fetch with. A model_validator now rejects that combination; workspace-only assignments still allow a null mission_id. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * 🐛 fix(contracts): reject whitespace-only mission_id for mission-scoped assignments Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com> * feat: bump version to1.3.0 and update deps; iterate nested (#73) * changelog * chore(deps): bump actions/setup-python from 6.2.0 to 6.3.0 (#75) Bumps [actions/setup-python](https://github.com/actions/setup-python) from 6.2.0 to 6.3.0. - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](actions/setup-python@a309ff8...ece7cb0) --- updated-dependencies: - dependency-name: actions/setup-python dependency-version: 6.3.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump trufflesecurity/trufflehog from 3.95.6 to 3.95.7 (#76) Bumps [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog) from 3.95.6 to 3.95.7. - [Release notes](https://github.com/trufflesecurity/trufflehog/releases) - [Commits](trufflesecurity/trufflehog@30d5bb9...f446421) --- updated-dependencies: - dependency-name: trufflesecurity/trufflehog dependency-version: 3.95.7 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * security: review summary (redacted) + safe P0/P1 hardening (#77) * docs: add redacted security & performance review summary Adds a non-actionable high-level summary of a full-source security and performance/scalability review of the SDK (posture, verified-sound controls, severity counts, and remediation themes) and a CHANGELOG entry. Per SECURITY.md, detailed vulnerability findings (exact locations, attack scenarios, remediation specifics) are intentionally kept out of the public repository and handled through the private vulnerability channel. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F8GY2d3HJgCKwgCyRgNFMt * fix(security): harden API-key compare, local-mode bind, headers, logging, scheduler Safe P0/P1 remediations from the security review (no wire-format or auth-model breaking changes): - Constant-time API-key comparison (hmac.compare_digest) in require_api_key and Server.verify_api_key (CWE-208). - Local mode binds 127.0.0.1 instead of 0.0.0.0 unless an explicit non-wildcard host is set, so the default 'local-dev' key is not network-exposed (CWE-798). - Baseline security headers (nosniff, X-Frame-Options DENY, Referrer-Policy, HSTS) via a pure-ASGI middleware that is SSE-safe (CWE-693/1021). - Stop logging decrypted agent-parameter values and full result payloads in validate-agent-parameters (CWE-532). - Allow-list scheduled_method against the agent's declared method paths in the scheduler and workbench execute-now path (CWE-470). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F8GY2d3HJgCKwgCyRgNFMt * fix(security): compare API keys as bytes to avoid TypeError on non-ASCII hmac.compare_digest rejects non-ASCII str inputs, so a malformed X-API-Key with non-ASCII characters raised TypeError (500) instead of failing closed (401/403). Encode both operands to UTF-8 bytes in require_api_key and Server.verify_api_key so malformed credentials are rejected. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F8GY2d3HJgCKwgCyRgNFMt * refactor(security): address review feedback on hardening changes - Scope scheduled-step allow-list to the owning job's agent instead of the union of all agents, so a tampered step cannot invoke another agent's declared methods (per-agent isolation). - Move MutableHeaders import to module scope (repo convention: no function-local imports without a concrete circular/optional/startup reason). - Reword CHANGELOG security bullets to high-level, non-actionable descriptions consistent with the private-advisory disclosure policy. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F8GY2d3HJgCKwgCyRgNFMt * refactor(security): tighten scheduled-step allow-list resolution Address review follow-ups on per-agent method scoping: - Scheduler: if a due step's owning job cannot be resolved, mark the step failed instead of falling back to the union of all agents' methods, so an orphaned/tampered step cannot invoke another agent's method. - Workbench execute-now: verify the job is owned by the request's agent (Jobs().get_job(job_id, agent_name=agent.name)) before using that agent's allow-list, preventing a slug/job-owner mismatch from widening the list. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F8GY2d3HJgCKwgCyRgNFMt * fix(security): use SAMEORIGIN and hoist Jobs import - X-Frame-Options: SAMEORIGIN instead of DENY so the admin instructions iframe (same-origin) still renders, while cross-origin framing stays blocked. - Move the Jobs import in scheduled_steps to module scope (no circular dependency; matches the repo's module-level-imports convention). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F8GY2d3HJgCKwgCyRgNFMt * refactor(admin): hoist scheduled step helper import * fix(security): scope scheduled step ownership checks * ✨ docs: add test summary table to changelog (docs/CHANGELOG.md) * ✨ feat(ci): skip unit tests for docs-only changes in workflow --------- Co-authored-by: Claude <noreply@anthropic.com> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

* apply dependabot insights * minor * chore(ci): SHA-pin actions/checkout and actions/setup-python (#43) Pin all uses of actions/checkout@v6 and actions/setup-python@v6 to their commit SHAs across every workflow, closing the remaining floating-tag attack surface. - actions/checkout → de0fac2e (v6) - actions/setup-python → a309ff8b (v6) * docs(changelog): add unreleased dependency security refresh entry (#44) * chore(ci): add uv cache-suffix per Python version + update AGENTS.md facts (#46) Prevents parallel matrix jobs racing on the same Actions cache reservation. Also records two CI tooling facts in AGENTS.md. * supervaizer-v2-mvp-contracts (#47) * feat: add supervaizer v2 contract primitives * feat: add supervaizer v2 a2a action endpoint * feat: expose supervaizer v2 registration in a2a card * feat: add supervaizer v2 action decorator * docs: update supervaizer v2 changelog * precommit fix * refactor: move controller api version to contracts * minor * fix: scope v2 action handlers by agent * feat: guard supervaizer v2 agent identity * feat: include v2 job state in sync result * feat: add v2 resource form fields * feat: add v2 resource option sources * feat: add v2 awaiting form fields * feat: load supervaizer v2 surfaces over a2a * feat: expose local hello world v2 contract * feat: add v2 job source target type * feat: stream v2 action effects over a2a * fix: advertise v2 push notifications as unsupported * refactor: remove legacy dynamic choices * feat: complete local hello world v2 hitl flow * refactor: remove legacy job poll * docs: refresh generated contract docs * test: align v2 prompt editor fixture * test: align v2 contact import fixture * test: align v2 scenario builder fixture * test: align v2 overview fixture * test: align v2 campaign contact fixture * feat: add v2 registration builder * feat: type v2 dataset display metadata * minor * fix: precommit * feat: add comprehensive documentation for SUPERVAIZER API, Admin Interface, CLI, Parameter Validation, Persistence, Protocols, and REST API * minor * chore: change copyright dates from 2024-2025 to 2024-2026 * fix: harden agent model surface and v2 contract hygiene Use modern typing in agent.py, keep server encrypted params internal, document deterministic agent ids, tighten A2A health status rules, drop legacy hello-world v2 input aliases, and clarify v2 contract fields. * feat: enhance agent method validation and improve v2 action safety - Introduced validation to reject agent methods using blocked module roots.- Added checks to ensure declared method paths are used in agent execution.- Enhanced v2 action results with replay safety metadata validation.- Updated changelog and documentation to reflect these changes. * feat: add v2 resource import contracts * test: align v2 contract fixtures * minor * fix: require auth for a2a controller * minor * Minor * chore: update changelog for Supervaizer v2 enhancements and API key validation improvements - Added optional `metadata` field to `V2CaseSnapshot` for case-level context. - Implemented validation for Studio registration handshake to ensure API key consistency. - Enhanced server API key handling for stability during reloads. - Updated tests to cover new functionality and validation paths. * workspace-agent-grants (#50) * docs: plan workspace agent grants * docs: add Studio grant acceptance UX * feat: add workspace agent authorization * feat: add workspace binding protocol * fix: stabilize workspace authorization * ✨feat: add workspace auth helpers and use them in tests * ✨feat: require workspace auth and tighten agent checks * fix: require workspace auth for Studio A2A * fix: harden workspace authorization checks * fix: normalize malformed workspace auth inputs * minor * feat(logging): implement structured logging for Cloud Logging compatibility - Added support for newline-delimited JSON logging when `SUPERVAIZER_LOG_FORMAT=json` is set. - Updated logging configuration to allow structured logs for access-denial events. - Enhanced `log_access_denied_api` and `log_access_denied_tailscale` functions to include structured fields. - Added tests to verify structured logging outputs in `tests/test_common.py`. * Minor * codex/supervaizer-lifespan-cleanup (#54) * Clean up Supervaizer lifespan shutdown * Document Supervaizer import placement rule * Fix lifespan cleanup test determinism * Address lifespan shutdown review feedback * ✨feat: rename test and assert scheduled step task * ✨ feat: update GitNexus index counts in AGENTS.md * codex/refactor-server-modules (#55) * Refactor Supervaizer server modules * ✨ feat: update GitNexus index stats in AGENTS.md * ✨docs update changelog AGENTS guidance * ✨feat: add v2 methods, tests and license header * minor * codex/agent-interviewer-workspace-jobs-refresh (#56) * Clean up Supervaizer lifespan shutdown * Document Supervaizer import placement rule * Fix lifespan cleanup test determinism * Address lifespan shutdown review feedback * ✨feat: rename test and assert scheduled step task * ✨ feat: update GitNexus index counts in AGENTS.md * feat(v2): add agent action methods * Refactor pre-commit configuration and enhance agent validation - Updated mypy hook to use project-specific configuration for consistency with uv.lock. - Improved validation for v2_registration and v2_method_declarations in Agent class to ensure proper type handling. - Enhanced logging configuration to cast message records for structured logging compatibility. * chore(deps): bump uv from 0.11.14 to 0.11.15 (#58) Bumps [uv](https://github.com/astral-sh/uv) from 0.11.14 to 0.11.15. - [Release notes](https://github.com/astral-sh/uv/releases) - [Changelog](https://github.com/astral-sh/uv/blob/main/CHANGELOG.md) - [Commits](astral-sh/uv@0.11.14...0.11.15) --- updated-dependencies: - dependency-name: uv dependency-version: 0.11.15 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump starlette from 0.50.0 to 1.0.1 (#60) Bumps [starlette](https://github.com/Kludex/starlette) from 0.50.0 to 1.0.1. - [Release notes](https://github.com/Kludex/starlette/releases) - [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md) - [Commits](Kludex/starlette@0.50.0...1.0.1) --- updated-dependencies: - dependency-name: starlette dependency-version: 1.0.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump trufflesecurity/trufflehog from 3.95.3 to 3.95.5 (#61) Bumps [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog) from 3.95.3 to 3.95.5. - [Release notes](https://github.com/trufflesecurity/trufflehog/releases) - [Commits](trufflesecurity/trufflehog@37b7700...d411fff) --- updated-dependencies: - dependency-name: trufflesecurity/trufflehog dependency-version: 3.95.5 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * feat(.agents): add skill symlinks from runwaize skills cookbook Add 21 skill symlinks under .agents/skills/ pointing to the local runwaize_skills_cookbook installation, covering cloud-run basics, Pulumi migration/tooling skills (terraform, CDK, ARM, ESC, component, automation-api, upgrade-provider, best-practices, neo-handoff), Google Cloud WAF pillars (security, reliability, performance, cost-optimization, operational-excellence), google-cloud-recipe-auth, google-cloud-networking-observability, cloudformation-to-pulumi, package-usage, provider-upgrade, and upstream-patches. Update AGENTS.md GitNexus index stats to reflect the current index (6273 symbols, 11483 relationships, 281 execution flows). * chore(deps): bump astral-sh/setup-uv from 8.1.0 to 8.2.0 (#62) Bumps [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) from 8.1.0 to 8.2.0. - [Release notes](https://github.com/astral-sh/setup-uv/releases) - [Commits](astral-sh/setup-uv@0880764...fac544c) --- updated-dependencies: - dependency-name: astral-sh/setup-uv dependency-version: 8.2.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump actions/checkout from 6.0.2 to 6.0.3 (#63) Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.2 to 6.0.3. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@de0fac2...df4cb1c) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 6.0.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump starlette from 1.0.1 to 1.3.1 (#66) Bumps [starlette](https://github.com/Kludex/starlette) from 1.0.1 to 1.3.1. - [Release notes](https://github.com/Kludex/starlette/releases) - [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md) - [Commits](Kludex/starlette@1.0.1...1.3.1) --- updated-dependencies: - dependency-name: starlette dependency-version: 1.3.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump cryptography from 48.0.0 to 48.0.1 (#67) Bumps [cryptography](https://github.com/pyca/cryptography) from 48.0.0 to 48.0.1. - [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst) - [Commits](pyca/cryptography@48.0.0...48.0.1) --- updated-dependencies: - dependency-name: cryptography dependency-version: 48.0.1 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump actions/checkout from 6.0.3 to 7.0.0 (#68) Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.3 to 7.0.0. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@df4cb1c...9c091bb) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump softprops/action-gh-release from 3.0.0 to 3.0.1 (#69) Bumps [softprops/action-gh-release](https://github.com/softprops/action-gh-release) from 3.0.0 to 3.0.1. - [Release notes](https://github.com/softprops/action-gh-release/releases) - [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md) - [Commits](softprops/action-gh-release@b430933...718ea10) --- updated-dependencies: - dependency-name: softprops/action-gh-release dependency-version: 3.0.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump trufflesecurity/trufflehog from 3.95.5 to 3.95.6 (#70) Bumps [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog) from 3.95.5 to 3.95.6. - [Release notes](https://github.com/trufflesecurity/trufflehog/releases) - [Commits](trufflesecurity/trufflehog@d411fff...30d5bb9) --- updated-dependencies: - dependency-name: trufflesecurity/trufflehog dependency-version: 3.95.6 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * codex/managed-context-sdk (#65) * feat: add managed context SDK client * ✨ feat: update gitn docs to use local run.cjs and paginate list_repos * ✨ feat: add MPLv2 license headers to module and test files * fix: address managed context review feedback * ✨ feat(contracts): add V2ContextAssignment for context.assign (#71) * ✨ feat(contracts): add V2ContextAssignment for context.assign * ✨ feat(contracts): constrain context scope and document assignment semantics Address PR #71 review: V2ContextAssignmentItem.scope is now Literal["workspace", "mission"] (matching other closed v2 vocabularies) with a ValidationError regression test, and the v2 doc gains explicit context.assign semantics: refs-not-content payload, freeze-on-pull with provenance, mandatory fetched-vs-assigned version check that fails the assignment on mismatch, and no live context reads during execution. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * 🐛 fix(contracts): require mission_id for mission-scoped context assignments Address PR #71 follow-up review: a V2ContextAssignment containing scope="mission" items but no mission_id passed validation while the agent-side ContextClient.open() would have no mission context to fetch with. A model_validator now rejects that combination; workspace-only assignments still allow a null mission_id. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * 🐛 fix(contracts): reject whitespace-only mission_id for mission-scoped assignments Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com> * feat: bump version to1.3.0 and update deps; iterate nested (#73) * changelog * chore(deps): bump actions/setup-python from 6.2.0 to 6.3.0 (#75) Bumps [actions/setup-python](https://github.com/actions/setup-python) from 6.2.0 to 6.3.0. - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](actions/setup-python@a309ff8...ece7cb0) --- updated-dependencies: - dependency-name: actions/setup-python dependency-version: 6.3.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump trufflesecurity/trufflehog from 3.95.6 to 3.95.7 (#76) Bumps [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog) from 3.95.6 to 3.95.7. - [Release notes](https://github.com/trufflesecurity/trufflehog/releases) - [Commits](trufflesecurity/trufflehog@30d5bb9...f446421) --- updated-dependencies: - dependency-name: trufflesecurity/trufflehog dependency-version: 3.95.7 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * security: review summary (redacted) + safe P0/P1 hardening (#77) * docs: add redacted security & performance review summary Adds a non-actionable high-level summary of a full-source security and performance/scalability review of the SDK (posture, verified-sound controls, severity counts, and remediation themes) and a CHANGELOG entry. Per SECURITY.md, detailed vulnerability findings (exact locations, attack scenarios, remediation specifics) are intentionally kept out of the public repository and handled through the private vulnerability channel. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F8GY2d3HJgCKwgCyRgNFMt * fix(security): harden API-key compare, local-mode bind, headers, logging, scheduler Safe P0/P1 remediations from the security review (no wire-format or auth-model breaking changes): - Constant-time API-key comparison (hmac.compare_digest) in require_api_key and Server.verify_api_key (CWE-208). - Local mode binds 127.0.0.1 instead of 0.0.0.0 unless an explicit non-wildcard host is set, so the default 'local-dev' key is not network-exposed (CWE-798). - Baseline security headers (nosniff, X-Frame-Options DENY, Referrer-Policy, HSTS) via a pure-ASGI middleware that is SSE-safe (CWE-693/1021). - Stop logging decrypted agent-parameter values and full result payloads in validate-agent-parameters (CWE-532). - Allow-list scheduled_method against the agent's declared method paths in the scheduler and workbench execute-now path (CWE-470). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F8GY2d3HJgCKwgCyRgNFMt * fix(security): compare API keys as bytes to avoid TypeError on non-ASCII hmac.compare_digest rejects non-ASCII str inputs, so a malformed X-API-Key with non-ASCII characters raised TypeError (500) instead of failing closed (401/403). Encode both operands to UTF-8 bytes in require_api_key and Server.verify_api_key so malformed credentials are rejected. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F8GY2d3HJgCKwgCyRgNFMt * refactor(security): address review feedback on hardening changes - Scope scheduled-step allow-list to the owning job's agent instead of the union of all agents, so a tampered step cannot invoke another agent's declared methods (per-agent isolation). - Move MutableHeaders import to module scope (repo convention: no function-local imports without a concrete circular/optional/startup reason). - Reword CHANGELOG security bullets to high-level, non-actionable descriptions consistent with the private-advisory disclosure policy. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F8GY2d3HJgCKwgCyRgNFMt * refactor(security): tighten scheduled-step allow-list resolution Address review follow-ups on per-agent method scoping: - Scheduler: if a due step's owning job cannot be resolved, mark the step failed instead of falling back to the union of all agents' methods, so an orphaned/tampered step cannot invoke another agent's method. - Workbench execute-now: verify the job is owned by the request's agent (Jobs().get_job(job_id, agent_name=agent.name)) before using that agent's allow-list, preventing a slug/job-owner mismatch from widening the list. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F8GY2d3HJgCKwgCyRgNFMt * fix(security): use SAMEORIGIN and hoist Jobs import - X-Frame-Options: SAMEORIGIN instead of DENY so the admin instructions iframe (same-origin) still renders, while cross-origin framing stays blocked. - Move the Jobs import in scheduled_steps to module scope (no circular dependency; matches the repo's module-level-imports convention). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F8GY2d3HJgCKwgCyRgNFMt * refactor(admin): hoist scheduled step helper import * fix(security): scope scheduled step ownership checks * ✨ docs: add test summary table to changelog (docs/CHANGELOG.md) * ✨ feat(ci): skip unit tests for docs-only changes in workflow --------- Co-authored-by: Claude <noreply@anthropic.com> * chore(deps): bump trufflesecurity/trufflehog from 3.95.7 to 3.95.9 (#81) Bumps [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog) from 3.95.7 to 3.95.9. - [Release notes](https://github.com/trufflesecurity/trufflehog/releases) - [Commits](trufflesecurity/trufflehog@f446421...27b0417) --- updated-dependencies: - dependency-name: trufflesecurity/trufflehog dependency-version: 3.95.9 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump softprops/action-gh-release from 3.0.1 to 3.0.2 (#82) Bumps [softprops/action-gh-release](https://github.com/softprops/action-gh-release) from 3.0.1 to 3.0.2. - [Release notes](https://github.com/softprops/action-gh-release/releases) - [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md) - [Commits](softprops/action-gh-release@718ea10...3d0d988) --- updated-dependencies: - dependency-name: softprops/action-gh-release dependency-version: 3.0.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump astral-sh/setup-uv from 8.2.0 to 8.3.2 (#83) Bumps [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) from 8.2.0 to 8.3.2. - [Release notes](https://github.com/astral-sh/setup-uv/releases) - [Commits](astral-sh/setup-uv@fac544c...11f9893) --- updated-dependencies: - dependency-name: astral-sh/setup-uv dependency-version: 8.3.2 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump pyasn1 from 0.6.3 to 0.6.4 (#84) Bumps [pyasn1](https://github.com/pyasn1/pyasn1) from 0.6.3 to 0.6.4. - [Release notes](https://github.com/pyasn1/pyasn1/releases) - [Changelog](https://github.com/pyasn1/pyasn1/blob/main/CHANGES.rst) - [Commits](pyasn1/pyasn1@v0.6.3...v0.6.4) --- updated-dependencies: - dependency-name: pyasn1 dependency-version: 0.6.4 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump actions/setup-python from 6.3.0 to 7.0.0 (#85) Bumps [actions/setup-python](https://github.com/actions/setup-python) from 6.3.0 to 7.0.0. - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](actions/setup-python@ece7cb0...5fda3b9) --- updated-dependencies: - dependency-name: actions/setup-python dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump pypa/gh-action-pypi-publish from 1.14.0 to 1.14.1 (#86) Bumps [pypa/gh-action-pypi-publish](https://github.com/pypa/gh-action-pypi-publish) from 1.14.0 to 1.14.1. - [Release notes](https://github.com/pypa/gh-action-pypi-publish/releases) - [Commits](pypa/gh-action-pypi-publish@cef2210...ba38be9) --- updated-dependencies: - dependency-name: pypa/gh-action-pypi-publish dependency-version: 1.14.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump cryptography from 49.0.0 to 50.0.0 (#87) Bumps [cryptography](https://github.com/pyca/cryptography) from 49.0.0 to 50.0.0. - [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst) - [Commits](pyca/cryptography@49.0.0...50.0.0) --- updated-dependencies: - dependency-name: cryptography dependency-version: 50.0.0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * feat: add generic job setup contract (#89) * feat: add generic job setup contract * 🐛 fix(contracts): stop V2JobSetupPolicy defaulting to every action scope An agent opting in with job_policy={"setup": {}} advertised support for the workspace, job, case and step scopes without declaring any, which broadens the contract Studio sees. Default to an empty list, matching V2JobSyncPolicy.supported_statuses. Also declare V2JobSetupPolicy before V2JobPolicy so the generated model reference renders the real type instead of a ForwardRef. * 📝 docs: regenerate model reference and OpenAPI Picks up the job setup contract (V2JobPolicy.setup, V2JobSetupPolicy, V2ActionResult.setup_plan) plus accumulated drift since 0.20.1. * 📝 docs: log generic job setup contract in CHANGELOG Records the V2JobSetupPolicy contract, the empty action_scopes default, and the model reference regeneration under Unreleased. * 🐛 fix(contracts): reject blank job setup and sync action ids An empty preview_action/start_action/submit_action was accepted, then dropped from capabilities.actions by _unique_strings while still being serialized under job_policy.setup, so Studio saw an action it could never invoke. Validate all three as non-blank, plus V2JobSyncPolicy.action, which had the same gap. * doc --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com> Co-authored-by: Cursor <cursoragent@cursor.com>

* apply dependabot insights * minor * chore(ci): SHA-pin actions/checkout and actions/setup-python (#43) Pin all uses of actions/checkout@v6 and actions/setup-python@v6 to their commit SHAs across every workflow, closing the remaining floating-tag attack surface. - actions/checkout → de0fac2e (v6) - actions/setup-python → a309ff8b (v6) * docs(changelog): add unreleased dependency security refresh entry (#44) * chore(ci): add uv cache-suffix per Python version + update AGENTS.md facts (#46) Prevents parallel matrix jobs racing on the same Actions cache reservation. Also records two CI tooling facts in AGENTS.md. * supervaizer-v2-mvp-contracts (#47) * feat: add supervaizer v2 contract primitives * feat: add supervaizer v2 a2a action endpoint * feat: expose supervaizer v2 registration in a2a card * feat: add supervaizer v2 action decorator * docs: update supervaizer v2 changelog * precommit fix * refactor: move controller api version to contracts * minor * fix: scope v2 action handlers by agent * feat: guard supervaizer v2 agent identity * feat: include v2 job state in sync result * feat: add v2 resource form fields * feat: add v2 resource option sources * feat: add v2 awaiting form fields * feat: load supervaizer v2 surfaces over a2a * feat: expose local hello world v2 contract * feat: add v2 job source target type * feat: stream v2 action effects over a2a * fix: advertise v2 push notifications as unsupported * refactor: remove legacy dynamic choices * feat: complete local hello world v2 hitl flow * refactor: remove legacy job poll * docs: refresh generated contract docs * test: align v2 prompt editor fixture * test: align v2 contact import fixture * test: align v2 scenario builder fixture * test: align v2 overview fixture * test: align v2 campaign contact fixture * feat: add v2 registration builder * feat: type v2 dataset display metadata * minor * fix: precommit * feat: add comprehensive documentation for SUPERVAIZER API, Admin Interface, CLI, Parameter Validation, Persistence, Protocols, and REST API * minor * chore: change copyright dates from 2024-2025 to 2024-2026 * fix: harden agent model surface and v2 contract hygiene Use modern typing in agent.py, keep server encrypted params internal, document deterministic agent ids, tighten A2A health status rules, drop legacy hello-world v2 input aliases, and clarify v2 contract fields. * feat: enhance agent method validation and improve v2 action safety - Introduced validation to reject agent methods using blocked module roots.- Added checks to ensure declared method paths are used in agent execution.- Enhanced v2 action results with replay safety metadata validation.- Updated changelog and documentation to reflect these changes. * feat: add v2 resource import contracts * test: align v2 contract fixtures * minor * fix: require auth for a2a controller * minor * Minor * chore: update changelog for Supervaizer v2 enhancements and API key validation improvements - Added optional `metadata` field to `V2CaseSnapshot` for case-level context. - Implemented validation for Studio registration handshake to ensure API key consistency. - Enhanced server API key handling for stability during reloads. - Updated tests to cover new functionality and validation paths. * workspace-agent-grants (#50) * docs: plan workspace agent grants * docs: add Studio grant acceptance UX * feat: add workspace agent authorization * feat: add workspace binding protocol * fix: stabilize workspace authorization * ✨feat: add workspace auth helpers and use them in tests * ✨feat: require workspace auth and tighten agent checks * fix: require workspace auth for Studio A2A * fix: harden workspace authorization checks * fix: normalize malformed workspace auth inputs * minor * feat(logging): implement structured logging for Cloud Logging compatibility - Added support for newline-delimited JSON logging when `SUPERVAIZER_LOG_FORMAT=json` is set. - Updated logging configuration to allow structured logs for access-denial events. - Enhanced `log_access_denied_api` and `log_access_denied_tailscale` functions to include structured fields. - Added tests to verify structured logging outputs in `tests/test_common.py`. * Minor * codex/supervaizer-lifespan-cleanup (#54) * Clean up Supervaizer lifespan shutdown * Document Supervaizer import placement rule * Fix lifespan cleanup test determinism * Address lifespan shutdown review feedback * ✨feat: rename test and assert scheduled step task * ✨ feat: update GitNexus index counts in AGENTS.md * codex/refactor-server-modules (#55) * Refactor Supervaizer server modules * ✨ feat: update GitNexus index stats in AGENTS.md * ✨docs update changelog AGENTS guidance * ✨feat: add v2 methods, tests and license header * minor * codex/agent-interviewer-workspace-jobs-refresh (#56) * Clean up Supervaizer lifespan shutdown * Document Supervaizer import placement rule * Fix lifespan cleanup test determinism * Address lifespan shutdown review feedback * ✨feat: rename test and assert scheduled step task * ✨ feat: update GitNexus index counts in AGENTS.md * feat(v2): add agent action methods * Refactor pre-commit configuration and enhance agent validation - Updated mypy hook to use project-specific configuration for consistency with uv.lock. - Improved validation for v2_registration and v2_method_declarations in Agent class to ensure proper type handling. - Enhanced logging configuration to cast message records for structured logging compatibility. * chore(deps): bump uv from 0.11.14 to 0.11.15 (#58) Bumps [uv](https://github.com/astral-sh/uv) from 0.11.14 to 0.11.15. - [Release notes](https://github.com/astral-sh/uv/releases) - [Changelog](https://github.com/astral-sh/uv/blob/main/CHANGELOG.md) - [Commits](astral-sh/uv@0.11.14...0.11.15) --- updated-dependencies: - dependency-name: uv dependency-version: 0.11.15 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump starlette from 0.50.0 to 1.0.1 (#60) Bumps [starlette](https://github.com/Kludex/starlette) from 0.50.0 to 1.0.1. - [Release notes](https://github.com/Kludex/starlette/releases) - [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md) - [Commits](Kludex/starlette@0.50.0...1.0.1) --- updated-dependencies: - dependency-name: starlette dependency-version: 1.0.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump trufflesecurity/trufflehog from 3.95.3 to 3.95.5 (#61) Bumps [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog) from 3.95.3 to 3.95.5. - [Release notes](https://github.com/trufflesecurity/trufflehog/releases) - [Commits](trufflesecurity/trufflehog@37b7700...d411fff) --- updated-dependencies: - dependency-name: trufflesecurity/trufflehog dependency-version: 3.95.5 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * feat(.agents): add skill symlinks from runwaize skills cookbook Add 21 skill symlinks under .agents/skills/ pointing to the local runwaize_skills_cookbook installation, covering cloud-run basics, Pulumi migration/tooling skills (terraform, CDK, ARM, ESC, component, automation-api, upgrade-provider, best-practices, neo-handoff), Google Cloud WAF pillars (security, reliability, performance, cost-optimization, operational-excellence), google-cloud-recipe-auth, google-cloud-networking-observability, cloudformation-to-pulumi, package-usage, provider-upgrade, and upstream-patches. Update AGENTS.md GitNexus index stats to reflect the current index (6273 symbols, 11483 relationships, 281 execution flows). * chore(deps): bump astral-sh/setup-uv from 8.1.0 to 8.2.0 (#62) Bumps [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) from 8.1.0 to 8.2.0. - [Release notes](https://github.com/astral-sh/setup-uv/releases) - [Commits](astral-sh/setup-uv@0880764...fac544c) --- updated-dependencies: - dependency-name: astral-sh/setup-uv dependency-version: 8.2.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump actions/checkout from 6.0.2 to 6.0.3 (#63) Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.2 to 6.0.3. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@de0fac2...df4cb1c) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 6.0.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump starlette from 1.0.1 to 1.3.1 (#66) Bumps [starlette](https://github.com/Kludex/starlette) from 1.0.1 to 1.3.1. - [Release notes](https://github.com/Kludex/starlette/releases) - [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md) - [Commits](Kludex/starlette@1.0.1...1.3.1) --- updated-dependencies: - dependency-name: starlette dependency-version: 1.3.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump cryptography from 48.0.0 to 48.0.1 (#67) Bumps [cryptography](https://github.com/pyca/cryptography) from 48.0.0 to 48.0.1. - [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst) - [Commits](pyca/cryptography@48.0.0...48.0.1) --- updated-dependencies: - dependency-name: cryptography dependency-version: 48.0.1 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump actions/checkout from 6.0.3 to 7.0.0 (#68) Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.3 to 7.0.0. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@df4cb1c...9c091bb) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump softprops/action-gh-release from 3.0.0 to 3.0.1 (#69) Bumps [softprops/action-gh-release](https://github.com/softprops/action-gh-release) from 3.0.0 to 3.0.1. - [Release notes](https://github.com/softprops/action-gh-release/releases) - [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md) - [Commits](softprops/action-gh-release@b430933...718ea10) --- updated-dependencies: - dependency-name: softprops/action-gh-release dependency-version: 3.0.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump trufflesecurity/trufflehog from 3.95.5 to 3.95.6 (#70) Bumps [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog) from 3.95.5 to 3.95.6. - [Release notes](https://github.com/trufflesecurity/trufflehog/releases) - [Commits](trufflesecurity/trufflehog@d411fff...30d5bb9) --- updated-dependencies: - dependency-name: trufflesecurity/trufflehog dependency-version: 3.95.6 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * codex/managed-context-sdk (#65) * feat: add managed context SDK client * ✨ feat: update gitn docs to use local run.cjs and paginate list_repos * ✨ feat: add MPLv2 license headers to module and test files * fix: address managed context review feedback * ✨ feat(contracts): add V2ContextAssignment for context.assign (#71) * ✨ feat(contracts): add V2ContextAssignment for context.assign * ✨ feat(contracts): constrain context scope and document assignment semantics Address PR #71 review: V2ContextAssignmentItem.scope is now Literal["workspace", "mission"] (matching other closed v2 vocabularies) with a ValidationError regression test, and the v2 doc gains explicit context.assign semantics: refs-not-content payload, freeze-on-pull with provenance, mandatory fetched-vs-assigned version check that fails the assignment on mismatch, and no live context reads during execution. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * 🐛 fix(contracts): require mission_id for mission-scoped context assignments Address PR #71 follow-up review: a V2ContextAssignment containing scope="mission" items but no mission_id passed validation while the agent-side ContextClient.open() would have no mission context to fetch with. A model_validator now rejects that combination; workspace-only assignments still allow a null mission_id. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * 🐛 fix(contracts): reject whitespace-only mission_id for mission-scoped assignments Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com> * feat: bump version to1.3.0 and update deps; iterate nested (#73) * changelog * chore(deps): bump actions/setup-python from 6.2.0 to 6.3.0 (#75) Bumps [actions/setup-python](https://github.com/actions/setup-python) from 6.2.0 to 6.3.0. - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](actions/setup-python@a309ff8...ece7cb0) --- updated-dependencies: - dependency-name: actions/setup-python dependency-version: 6.3.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump trufflesecurity/trufflehog from 3.95.6 to 3.95.7 (#76) Bumps [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog) from 3.95.6 to 3.95.7. - [Release notes](https://github.com/trufflesecurity/trufflehog/releases) - [Commits](trufflesecurity/trufflehog@30d5bb9...f446421) --- updated-dependencies: - dependency-name: trufflesecurity/trufflehog dependency-version: 3.95.7 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * security: review summary (redacted) + safe P0/P1 hardening (#77) * docs: add redacted security & performance review summary Adds a non-actionable high-level summary of a full-source security and performance/scalability review of the SDK (posture, verified-sound controls, severity counts, and remediation themes) and a CHANGELOG entry. Per SECURITY.md, detailed vulnerability findings (exact locations, attack scenarios, remediation specifics) are intentionally kept out of the public repository and handled through the private vulnerability channel. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F8GY2d3HJgCKwgCyRgNFMt * fix(security): harden API-key compare, local-mode bind, headers, logging, scheduler Safe P0/P1 remediations from the security review (no wire-format or auth-model breaking changes): - Constant-time API-key comparison (hmac.compare_digest) in require_api_key and Server.verify_api_key (CWE-208). - Local mode binds 127.0.0.1 instead of 0.0.0.0 unless an explicit non-wildcard host is set, so the default 'local-dev' key is not network-exposed (CWE-798). - Baseline security headers (nosniff, X-Frame-Options DENY, Referrer-Policy, HSTS) via a pure-ASGI middleware that is SSE-safe (CWE-693/1021). - Stop logging decrypted agent-parameter values and full result payloads in validate-agent-parameters (CWE-532). - Allow-list scheduled_method against the agent's declared method paths in the scheduler and workbench execute-now path (CWE-470). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F8GY2d3HJgCKwgCyRgNFMt * fix(security): compare API keys as bytes to avoid TypeError on non-ASCII hmac.compare_digest rejects non-ASCII str inputs, so a malformed X-API-Key with non-ASCII characters raised TypeError (500) instead of failing closed (401/403). Encode both operands to UTF-8 bytes in require_api_key and Server.verify_api_key so malformed credentials are rejected. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F8GY2d3HJgCKwgCyRgNFMt * refactor(security): address review feedback on hardening changes - Scope scheduled-step allow-list to the owning job's agent instead of the union of all agents, so a tampered step cannot invoke another agent's declared methods (per-agent isolation). - Move MutableHeaders import to module scope (repo convention: no function-local imports without a concrete circular/optional/startup reason). - Reword CHANGELOG security bullets to high-level, non-actionable descriptions consistent with the private-advisory disclosure policy. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F8GY2d3HJgCKwgCyRgNFMt * refactor(security): tighten scheduled-step allow-list resolution Address review follow-ups on per-agent method scoping: - Scheduler: if a due step's owning job cannot be resolved, mark the step failed instead of falling back to the union of all agents' methods, so an orphaned/tampered step cannot invoke another agent's method. - Workbench execute-now: verify the job is owned by the request's agent (Jobs().get_job(job_id, agent_name=agent.name)) before using that agent's allow-list, preventing a slug/job-owner mismatch from widening the list. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F8GY2d3HJgCKwgCyRgNFMt * fix(security): use SAMEORIGIN and hoist Jobs import - X-Frame-Options: SAMEORIGIN instead of DENY so the admin instructions iframe (same-origin) still renders, while cross-origin framing stays blocked. - Move the Jobs import in scheduled_steps to module scope (no circular dependency; matches the repo's module-level-imports convention). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F8GY2d3HJgCKwgCyRgNFMt * refactor(admin): hoist scheduled step helper import * fix(security): scope scheduled step ownership checks * ✨ docs: add test summary table to changelog (docs/CHANGELOG.md) * ✨ feat(ci): skip unit tests for docs-only changes in workflow --------- Co-authored-by: Claude <noreply@anthropic.com> * chore(deps): bump trufflesecurity/trufflehog from 3.95.7 to 3.95.9 (#81) Bumps [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog) from 3.95.7 to 3.95.9. - [Release notes](https://github.com/trufflesecurity/trufflehog/releases) - [Commits](trufflesecurity/trufflehog@f446421...27b0417) --- updated-dependencies: - dependency-name: trufflesecurity/trufflehog dependency-version: 3.95.9 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump softprops/action-gh-release from 3.0.1 to 3.0.2 (#82) Bumps [softprops/action-gh-release](https://github.com/softprops/action-gh-release) from 3.0.1 to 3.0.2. - [Release notes](https://github.com/softprops/action-gh-release/releases) - [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md) - [Commits](softprops/action-gh-release@718ea10...3d0d988) --- updated-dependencies: - dependency-name: softprops/action-gh-release dependency-version: 3.0.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump astral-sh/setup-uv from 8.2.0 to 8.3.2 (#83) Bumps [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) from 8.2.0 to 8.3.2. - [Release notes](https://github.com/astral-sh/setup-uv/releases) - [Commits](astral-sh/setup-uv@fac544c...11f9893) --- updated-dependencies: - dependency-name: astral-sh/setup-uv dependency-version: 8.3.2 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump pyasn1 from 0.6.3 to 0.6.4 (#84) Bumps [pyasn1](https://github.com/pyasn1/pyasn1) from 0.6.3 to 0.6.4. - [Release notes](https://github.com/pyasn1/pyasn1/releases) - [Changelog](https://github.com/pyasn1/pyasn1/blob/main/CHANGES.rst) - [Commits](pyasn1/pyasn1@v0.6.3...v0.6.4) --- updated-dependencies: - dependency-name: pyasn1 dependency-version: 0.6.4 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump actions/setup-python from 6.3.0 to 7.0.0 (#85) Bumps [actions/setup-python](https://github.com/actions/setup-python) from 6.3.0 to 7.0.0. - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](actions/setup-python@ece7cb0...5fda3b9) --- updated-dependencies: - dependency-name: actions/setup-python dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump pypa/gh-action-pypi-publish from 1.14.0 to 1.14.1 (#86) Bumps [pypa/gh-action-pypi-publish](https://github.com/pypa/gh-action-pypi-publish) from 1.14.0 to 1.14.1. - [Release notes](https://github.com/pypa/gh-action-pypi-publish/releases) - [Commits](pypa/gh-action-pypi-publish@cef2210...ba38be9) --- updated-dependencies: - dependency-name: pypa/gh-action-pypi-publish dependency-version: 1.14.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump cryptography from 49.0.0 to 50.0.0 (#87) Bumps [cryptography](https://github.com/pyca/cryptography) from 49.0.0 to 50.0.0. - [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst) - [Commits](pyca/cryptography@49.0.0...50.0.0) --- updated-dependencies: - dependency-name: cryptography dependency-version: 50.0.0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * feat: add generic job setup contract (#89) * feat: add generic job setup contract * 🐛 fix(contracts): stop V2JobSetupPolicy defaulting to every action scope An agent opting in with job_policy={"setup": {}} advertised support for the workspace, job, case and step scopes without declaring any, which broadens the contract Studio sees. Default to an empty list, matching V2JobSyncPolicy.supported_statuses. Also declare V2JobSetupPolicy before V2JobPolicy so the generated model reference renders the real type instead of a ForwardRef. * 📝 docs: regenerate model reference and OpenAPI Picks up the job setup contract (V2JobPolicy.setup, V2JobSetupPolicy, V2ActionResult.setup_plan) plus accumulated drift since 0.20.1. * 📝 docs: log generic job setup contract in CHANGELOG Records the V2JobSetupPolicy contract, the empty action_scopes default, and the model reference regeneration under Unreleased. * 🐛 fix(contracts): reject blank job setup and sync action ids An empty preview_action/start_action/submit_action was accepted, then dropped from capabilities.actions by _unique_strings while still being serialized under job_policy.setup, so Studio saw an action it could never invoke. Validate all three as non-blank, plus V2JobSyncPolicy.action, which had the same gap. * doc * changelog update * ✨ feat(contracts): declare action scope and mutability (#92) (#93) * ✨ feat(contracts): declare action scope and mutability (#92) V2AgentCapabilities.actions becomes list[V2ActionDefinition] carrying id, mutating and scope, so consumers authorize and group actions from declared metadata instead of pattern-matching the caller-supplied id. Bare strings still validate and coerce to mutating=True, scope=job. The builder derives metadata from each action's parent definition; precedence is explicit > derived > bare. Also adds V2DatasetDefinition.scope and V2AwaitingState.reopenable. * 📝 chore: update documentation * 🐛 fix(contracts): keep explicit action metadata when an id is declared twice An id given both as a V2ActionDefinition and as a bare string in actions= marked the id bare regardless of which declaration was retained, so the derived entry then overwrote the explicit metadata. Bareness is now tracked per retained declaration and an explicit definition wins wherever the two appear. * Changelog --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com> Co-authored-by: Cursor <cursoragent@cursor.com>

qodo-code-review Bot reviewed Jul 7, 2026

View reviewed changes

Comment thread docs/2026_07_SECURITY_REVIEW.md Outdated

Comment thread docs/2026_07_SECURITY_REVIEW.md Outdated

alain-sv force-pushed the claude/sparc-security-review-imcyu6 branch from 8f45956 to 373c4e4 Compare July 7, 2026 09:05

alain-sv changed the title ~~docs: full SPARC security & performance review report~~ docs: security & performance review summary (redacted) Jul 7, 2026

chatgpt-codex-connector Bot reviewed Jul 7, 2026

View reviewed changes

Comment thread docs/2026_07_SECURITY_REVIEW.md

alain-sv changed the title ~~docs: security & performance review summary (redacted)~~ security: review summary (redacted) + safe P0/P1 hardening Jul 7, 2026

chatgpt-codex-connector Bot reviewed Jul 7, 2026

View reviewed changes

Comment thread src/supervaizer/access/api_auth.py Outdated

chatgpt-codex-connector Bot reviewed Jul 7, 2026

View reviewed changes

Comment thread docs/CHANGELOG.md Outdated

Comment thread src/supervaizer/scheduled_steps.py Outdated

Comment thread src/supervaizer/server.py Outdated

chatgpt-codex-connector Bot reviewed Jul 7, 2026

View reviewed changes

Comment thread src/supervaizer/server.py Outdated

Comment thread src/supervaizer/scheduled_steps.py Outdated

claude added 6 commits July 8, 2026 00:08

alain-sv force-pushed the claude/sparc-security-review-imcyu6 branch from cf81e88 to a14dd61 Compare July 7, 2026 21:08

chatgpt-codex-connector Bot reviewed Jul 7, 2026

View reviewed changes

Comment thread docs/CHANGELOG.md Outdated

Comment thread src/supervaizer/scheduled_steps.py Outdated

Comment thread src/supervaizer/admin/workbench_routes.py Outdated

alain-sv added 2 commits July 8, 2026 00:16

refactor(admin): hoist scheduled step helper import

202e7bc

fix(security): scope scheduled step ownership checks

18fb77a

alain-sv force-pushed the claude/sparc-security-review-imcyu6 branch from eec2566 to 18fb77a Compare July 7, 2026 21:22

alain-sv added 2 commits July 8, 2026 00:23

✨ docs: add test summary table to changelog (docs/CHANGELOG.md)

14e1663

✨ feat(ci): skip unit tests for docs-only changes in workflow

55e2202

chatgpt-codex-connector Bot reviewed Jul 7, 2026

View reviewed changes

alain-sv merged commit fe1d11d into develop Jul 7, 2026
10 checks passed

Uh oh!

Conversation

alain-sv commented Jul 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Hardening changes

Deferred (need coordinated / breaking changes — tracked in the private report)

Verification

Uh oh!

qodo-code-review Bot commented Jul 7, 2026

PR Summary by Qodo

Uh oh!

qodo-code-review Bot commented Jul 7, 2026

Code Review by Qodo

Uh oh!

Uh oh!

Uh oh!

alain-sv commented Jul 7, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Jul 7, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Jul 7, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

alain-sv commented Jul 7, 2026 •

edited

Loading