cad77fb39c
refactor: consolidate remaining coercion helpers ( #122020 )
2026-08-11 10:22:01 -07:00
fa03d9b913
refactor: consolidate coercion helpers ( #121366 )
...
* refactor: consolidate coercion helpers
* fix: remove duplicate coercion imports
* fix: preserve serialized coercion guard
* chore: ratchet coercion helper carve-outs
* fix(test): keep gauntlet subprocess startup lean
* fix: preserve imported session timestamp semantics
* fix: preserve catalog timestamp string semantics
* chore: align plugin SDK surface ratchet
* fix: preserve trajectory and SDK string contracts
* fix(test): preserve QA record assertion semantics
* fix: complete standalone record guard rename
* refactor(cron): use canonical string coercion
* fix(acpx): preserve Pi timestamp parsing
* test(channels): adapt custody test harnesses
* test(telegram): classify media harness as test support
* test(acpx): split timestamp contract coverage
* test(channels): support generated custody contracts
* chore: ban the full coercion helper name set
Extends the declaration guard to all eleven consolidated helper names and
renames the cron schedule-identity readNumber wrapper to readScheduleInteger
so the banned generic name cannot regrow.
* fix(scripts): repair release-validation guard drift and lint cause
Restores the renamed isJsonRecord guard in assertTrustedWorkflowHarness after
main added isRecord call sites in parallel, and attaches the caught YAML error
as the thrown error cause (preserve-caught-error was red on main).
* fix: preserve Claude timestamp string semantics
* fix: preserve persisted timestamp string semantics
* fix: preserve date-first timestamp contracts
* fix(openai): harden delegation failure formatting
* chore: close coercion helper guard gaps
* test(openai): model non-error delegation rejection
* chore: refresh plugin SDK API contract
* fix(tasks): use canonical string field reader
* fix(ai): use canonical provider error field coercion
* fix(browser): migrate native bootstrap coercion
* docs(plugin-sdk): clarify text record export compatibility
* fix(gateway): normalize approval execution identity
* test(outbound): isolate message action poll harness
2026-08-11 00:02:18 -07:00
7a551bff0c
fix(vault): aggregate provider outage diagnostics ( #110908 )
...
* fix(vault): aggregate provider outage diagnostics
* fix(vault): classify revoked token outages
* fix(vault): preserve scoped ACL failures
* fix(vault): keep token probes advisory
* test(vault): satisfy gateway proof gates
* fix(secrets): attribute web provider outages
* test(secrets): prove web outage fan-out in owner suite
* fix(vault): scope malformed responses per secret
* test(secrets): harden exec fanout fixtures
2026-07-18 22:44:06 +01:00
91ded68990
fix(vault): SecretRef resolution no longer hangs on stalled response bodies ( #108970 )
...
* fix(vault): keep request deadline through response body
* test(vault): use generic stalled-body fixture
* test(vault): mark fixture token synthetic
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com >
2026-07-18 09:46:50 +01:00
7241b2bc80
fix(vault): reject oversized credential files ( #108761 )
...
* fix(vault): bound token and JWT file reads
* fix(vault): remove awaits from synchronous credential reads
2026-07-16 04:02:44 -07:00
e595a8c0ac
Add Vault SecretRef plugin ( #89255 )
...
* Add Vault SecretRef plugin
Signed-off-by: sallyom <somalley@redhat.com >
* expand Vault setup to registered SecretRef targets
Signed-off-by: sallyom <somalley@redhat.com >
* fix(vault): use sdk secret target seam
* fix(vault): preserve auth profile target paths
* docs(vault): document plugin enable step
* fix(vault): make status provider-alias aware
* fix(vault): reject noncanonical secret ids
* fix(vault): separate resolver timeout deadlines
* fix(vault): forward private CA trust settings
* fix(secrets): preserve plugin policy boundaries
---------
Signed-off-by: sallyom <somalley@redhat.com >
Co-authored-by: joshavant <830519+joshavant@users.noreply.github.com >
2026-07-09 05:30:12 -05:00
Peter Steinberger