Repository navigation

Fail-closed security posture, hardware gates in code, auto-merge fixes, appliance preflight, reboot setting - #48

Merged

github-actions[bot] merged 47 commits into

masterfrom

integ/round4

Oct 11, 2026

Merged

Fail-closed security posture, hardware gates in code, auto-merge fixes, appliance preflight, reboot setting#48
github-actions[bot] merged 47 commits into
masterfrom
integ/round4

Commits on Oct 11, 2026
- ci(auto-merge): wait for every required check and dispatch master lanes after merge
  
  Amantux
  and
  claude
  committed
  c15fca9
- docs(readme): document trusted auto-merge two-workflow wait and post-merge dispatch
  
  Amantux
  and
  claude
  committed
  89f6641
- fix(safety): consume format safety token atomically before the job
  
  Amantux
  and
  claude
  committed
  629624f
- fix(auth): fail closed at startup in production on open auth gates
  
  Amantux
  and
  claude
  committed
  071cece
- test(hardware): opt-in appliance soft-reboot persistence test
  
  Amantux
  and
  claude
  committed
  b59c7c7
- ci(hardware-destructive): opt-in reboot persistence step
  
  Amantux
  and
  claude
  committed
  8ab0ce5
- feat(hardware): add read-only appliance preflight tool
  
  Amantux
  and
  claude
  committed
  7ad591d
- test(hardware): unit-test every preflight check with fakes
  
  Amantux
  and
  claude
  committed
  56066ce
- fix(auth): make the test-runner route dev-only and loopback-targeted
  
  Amantux
  and
  claude
  committed
  2d8e8e3
- docs(runbooks): document the opt-in reboot persistence setting
  
  Amantux
  and
  claude
  committed
  24e322d
- ci(hardware): run the preflight tool instead of inline env checks
  
  Amantux
  and
  claude
  committed
  e7798d3
- ci(auto-merge): address review — keep retries, Actions-only checks, fail on dispatch error
  
  Amantux
  and
  claude
  committed
  527da13
- docs(readme): state the auto-merge fallback list and master-tip dispatch accurately
  
  Amantux
  and
  claude
  committed
  c85cd40
- Merge fleet4/reboot-setting: opt-in appliance soft-reboot persistence check
  Amantux
  committed
  dc1cee2
- build: add make hw-preflight target
  
  Amantux
  and
  claude
  committed
  532f1a6
- docs(runbook): add §0 Day one checklist and reference the preflight
  
  Amantux
  and
  claude
  committed
  bb7422e
- feat(deploy): bind compose to loopback; add opt-in production LAN override
  
  Amantux
  and
  claude
  committed
  bd295c3
- Merge fleet4/automerge: wait for every required check, dispatch master lanes after merge
  Amantux
  committed
  e1c23bc
- ci: only PR runs cancel in-progress runs; dispatched master runs never cancel each other
  
  Amantux
  and
  claude
  committed
  69966eb
- feat(auth): warn on insecure Flask cookies in production; document LAN exposure
  
  Amantux
  and
  claude
  committed
  decea9a
- fix(nas): refuse ingest start when pool_id differs from the plan's booked pool
  
  Amantux
  and
  claude
  committed
  756784d
- feat(safety): enforce scratch-media allowlist in FormatService on real backend
  
  Amantux
  and
  claude
  committed
  afa04f2
- fix(nas): book share-push capacity before registering the plan
  
  Amantux
  and
  claude
  committed
  e4ee030
- feat(safety): real backend requires an API token; accept simulator alias
  
  Amantux
  and
  claude
  committed
  9766472
- docs(safety): document new gates; flag vacuous operator_acknowledgment
  
  Amantux
  and
  claude
  committed
  e6d25db
- Merge fleet4/harden-hw: single-use format token, in-code scratch allowlist, real backend requires API token
  Amantux
  committed
  944e1c2
- fix(nas): roll back the capacity booking when an ingest start fails
  
  Amantux
  and
  claude
  committed
  362ce3d
- docs(decisions): mark the capacity start-path risks resolved
  
  Amantux
  and
  claude
  committed
  971af9d
- Merge fleet4/harden-auth: fail-closed production startup, dev-only test runner, loopback compose + LAN override
  Amantux
  committed
  dae3aee
- Merge fleet4/appliance-preflight: read-only day-one preflight tool, lanes use it, runbook §0
  Amantux
  committed
  8cffcdd
- ci(hardware): mint a masked per-run API token in every real lane
  
  Amantux
  and
  claude
  committed
  8eecdc9
- Merge fleet4/capacity-safety: pool mismatch 409, book-before-register, rollback on start failure
  Amantux
  committed
  c93ec16
- refactor(hardware): share the read-only ApplianceClient between the lane and preflight
  
  Amantux
  and
  claude
  committed
  6665fca
- Merge fleet4/lanes-token: per-run API token in real lanes, shared ApplianceClient
  Amantux
  committed
  14649ab
- fix(config): redact credentials from OPENBLADE_DB_URL in validation findings
  
  Amantux
  and
  claude
  committed
  e9493b0
- fix(nas): ingest refuses to auto-format on a real backend
  
  Amantux
  and
  claude
  committed
  813659a
- fix(format): normalise barcodes once at the FormatService boundary
  
  Amantux
  and
  claude
  committed
  cd59035
- fix(hardware): preflight FAILs (exit 1) when run armed
  
  Amantux
  and
  claude
  committed
  a3cdeab
- docs(agents): ingest never formats on a real backend
  
  Amantux
  and
  claude
  committed
  e253ea7
- fix(auth): reject blank, short (<12) and default AML passwords
  
  Amantux
  and
  claude
  committed
  62494d5
- ci(auto-merge): require owner approval on head SHA for non-owner trusted authors
  
  Amantux
  and
  claude
  committed
  70a71b3
- test(format): claim a safety token from two independent repositories once
  
  Amantux
  and
  claude
  committed
  48631cd
- test: armed-real-backend fixtures supply the now-required API token
  
  Amantux
  and
  claude
  committed
  96ac4d8
- fix(capacity): isolate rollback cleanups so the original start error propagates
  
  Amantux
  and
  claude
  committed
  3670034
- Merge fleet4/fix-safety: no auto-format on real backend, barcode normalisation, preflight fails when armed
  Amantux
  committed
  4c40f5c
- Merge fleet4/fix-misc2: URL redaction, password strength gate, owner approval for Copilot PRs, token test, rollback isolation
  Amantux
  committed
  5bff565
- ci(operability): positive-control production config carries an API token
  
  Amantux
  and
  claude
  committed
  fdb40d4

Commits

Commits on Oct 11, 2026