Skip to content

Fix configuration label isolation and add opt-in verified TLS bootstrap - #404

Merged
Paulo Lacerda (placerda) merged 4 commits into
developfrom
feature/hosted-runtime-recovery
Oct 14, 2026
Merged

Fix configuration label isolation and add opt-in verified TLS bootstrap#404
Paulo Lacerda (placerda) merged 4 commits into
developfrom
feature/hosted-runtime-recovery

Conversation

@placerda

@placerda Paulo Lacerda (placerda) commented Oct 14, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Changed

  • Use the explicit null-label selector instead of an all-label wildcard, retaining existing label precedence.
  • Add opt-in verified TLS compatibility privately within the existing configuration connector; no new public module/API or protected-policy changes.
  • Preserve credential identity, provider availability/authentication classification and existing approved exception contracts.
  • Fully annotate the connector and add endpoint, trust, redaction and failure-classification regressions.

Validation

  • Clean environment matching CI: 2427 tests passed, 4 intentionally skipped; 31 transport/configuration regressions passed including 5 additional negative cases.
  • All five original protected-base quality checks passed; direct connector mypy passed without casts, baselines or suppressions.
  • Azure validation and deployment omitted at maintainer request.

@placerda
fix: isolate configuration labels and add opt-in verified TLS transport
f24f604 
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
@placerda
chore: register configuration transport ownership and blocking typing…
96dd673 
… scope

Register only the new verified transport boundary and its existing consumer; leave bootstrap debt and approvals unchanged.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
@placerda Paulo Lacerda (placerda) mentioned this pull request Oct 14, 2026
Merged
@placerda
fix: preserve configuration loader contracts and private TLS ownership
ee35f3c 
Keep the opt-in transport within the existing configuration connector, preserve singleton credentials and loader failure classification, and fully type the connector. Restore unchanged protected registries instead of adding exemptions or changing the quality evaluator.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
@placerda
style: preserve configuration connector line endings
5d2b561 
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
@placerda
Paulo Lacerda (placerda) merged commit 840ecd4 into develop Oct 14, 2026
9 checks passed
@placerda Paulo Lacerda (placerda) mentioned this pull request Oct 14, 2026
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@gxjorge Jorge Garcia Ximenez (gxjorge) Awaiting requested review from gxjorge

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@placerda