T100, 16.3a: a served repository's bindings are trusted per machine (plan 034) - #82

Merged

brettheap merged 61 commits into

mainfrom

build/034-p3-t100-binding-trust

Oct 4, 2026

Commits on Sep 28, 2026

T078: 16.1, the OpenAI-compatible dialect joins DIALECTS (plan 034)

brettheap
and
claude
committed
4514a9e
T079: 16.2, a `model` field the provider receives (plan 034)

brettheap
and
claude
committed
7c83c2c
T080: 16.3, the credential stays a reference; a raw key is refused (plan 034)

brettheap
and
claude
committed
e9ef951
T078: one throwing call per pytest.raises block in the new tests (SonarCloud)

brettheap
and
claude
committed
6e1b894
Merge T078's SonarCloud test fix into T079's branch

brettheap
and
claude
committed
a63dcb8
T079: the intake module's docstring stops counting the binding's fields

brettheap
and
claude
committed
053e207
Merge T079's branch (T078's SonarCloud fix, the intake docstring) into T080's

brettheap
and
claude
committed
15adc2b
T080: bound the endpoint before the detector; present only what a bearer can carry

brettheap
and
claude
committed
f92fca4
T080: the stand-in server's record is reset through monkeypatch (SonarCloud)

brettheap
and
claude
committed
68b6e41
T080: the console flow's kinds are the ones a broker enrols, said and pinned

brettheap
and
claude
committed
146b5a2
T080: a built-in credential travels only over https:// or to this host

brettheap
and
claude
committed
4abc6d4
T080: the endpoint's checks and the private-route rule move into two helpers (SonarCloud)

brettheap
and
claude
committed
d240fd5
T080: a request carrying a built-in credential follows no redirect

brettheap
and
claude
committed
5167084
T080: no frame a refusal keeps holds a raw credential

brettheap
and
claude
committed
1b0fb3f
T080: a built-in credential over plain http:// uses no proxy

brettheap
and
claude
committed
286655f
T080: a broker's reference may not take a built-in form; keyring failures keep no context

brettheap
and
claude
committed
3f14bb9

Commits on Sep 29, 2026

Broker path: a minted token travels only by a private route (follows T080)

brettheap
and
claude
committed
464d8e3
Broker path: a minted token follows no redirect, uses no proxy, and chains nothing

brettheap
and
claude
committed
823dc03
Broker path: a minted token must be presentable, and no mint refusal keeps it

brettheap
and
claude
committed
7d465b6
Broker path tests: two escapes and three docstrings

brettheap
and
claude
committed
af457e6
Broker path tests: the redirect case says which codes urllib followed

brettheap
and
claude
committed
a2c838a
Broker path: a mint answer whose expiry is no finite number is malformed

brettheap
and
claude
committed
788d764

Commits on Sep 30, 2026

Broker runner: a misbehaving broker's refusal keeps nothing it wrote

brettheap
and
claude
committed
25788f9
Broker runner: the answer's bound limits what is read

brettheap
and
claude
committed
b847ef3
Broker runner: reap the child when anything else escapes

brettheap
and
claude
committed
e3eec6b
Broker runner: a refusal kills the broker's process group, and waits boundedly

brettheap
and
claude
committed
a603a03
Broker runner: one selector loop, one deadline, no reader thread

brettheap
and
claude
committed
e75900f

Commits on Oct 2, 2026

Merge main 047bb4fa into T078 (phase 2 has landed)

brettheap
and
claude
committed
d07b937
Merge T078's head d07b9371 into T079 (main 047bb4fa)

brettheap
and
claude
committed
b04a3a9
Merge T079's head b04a3a95 into T080 (main 047bb4fa)

brettheap
and
claude
committed
4948e6d
Merge T080's head 4948e6dd into the broker hardening (main 047bb4fa)

brettheap
and
claude
committed
e1a6cb0
Broker hardening: a provider answer nested past the recursion limit is malformed

brettheap
and
claude
committed
da9e639
Broker hardening tests: one throwing call per pytest.raises block (SonarCloud S5778)

brettheap
and
claude
committed
f0d28a7
Broker hardening: name ValueError alone for the parse's decode error (SonarCloud S5713)

brettheap
and
claude
committed
a271d30
Broker runner: a refusal after the broker exits kills what is left of its group

brettheap
and
claude
committed
bbcb565
Broker runner: signal the group before the broker is reaped, and bound the reap's wait

brettheap
and
claude
committed
f8bc8ac

Commits on Oct 3, 2026

T100, 16.3a: a served repository's bindings are trusted per machine (plan 034)

brettheap
and
claude
committed
31bddd8
T100: the rail's trust remedy has its Python twin, and its case mounts the rail

brettheap
and
claude
committed
e545165
T100: the rail probe offers intake before the catalog answers, as a host does

brettheap
and
claude
committed
a539bb6
T100: the rail's trust sentence names no credential

brettheap
and
claude
committed
c73cbea
Merge main 1130e996 into the broker hardening (T080 landed as #63)

brettheap
and
claude
committed
63e534c
Merge #64's head 63e534cb into T100 (main 1130e996: #63 T080 and #74 T081)

brettheap
and
claude
committed
1ef4c71
Broker path: L4's cases raise afresh there too, with no token kept

brettheap
and
claude
committed
b8323d0
Broker runner: a refused answer kills what is left of the broker's group too

brettheap
and
claude
committed
e313437
Merge branch 'main' into build/034-p3-broker-credential-hardening
brettheap
authored
04bcb68
Merge #64's final head 04bcb68e into T100 (e313437b, and main 5e7ab003 with #69)

brettheap
and
claude
committed
3264687
Merge main 8e377823 into T100 (#64 landed; #73 T075), with 04bcb68e as the base

brettheap
and
claude
committed
11489a5
T100: what a trust policy answers is held to the binding; the store locks across processes; the intake asks its own question

brettheap
and
claude
committed
7a04590
T100: the governed stand-in takes 5970369724's shape, and answers the intake's own question

brettheap
and
claude
committed
8270dff
T100: the store refuses an unsupported platform and an unresolvable state directory by name; verdicts are held to the root; the rail line says what list shows

brettheap
and
claude
committed
e4b145d
Merge main e49b17c3 into T100 (#77 T084 landed)

brettheap
and
claude
committed
78d1e90
Merge main 390e2c28 into T100 (#80 T103 landed)

brettheap
and
claude
committed
cb691b1
T100: the printed trust command runs as printed; only openDox's exact store passes its refusal; the store writes nothing it could not read

brettheap
and
claude
committed
24a1c25
Merge main 0116293a into T100 (#81 T102 landed)

brettheap
and
claude
committed
7012cda
T100 round 5: printed commands a shell reads back exactly, unservable bindings never trusted, one list reading, dangling links refused (plan 034)

brettheap
and
claude
committed
db77c4e
Merge main c4b55cc4 (#85, the T102 follow-on) into T100

brettheap
and
claude
committed
55766d8
T100 round 5: the cases that kill the round's last two mutants (plan 034)

brettheap
and
claude
committed
e05c475

Commits on Oct 4, 2026

T100 round 6: a binding the catalog cannot list is told its remedy, never to trust (plan 034)

brettheap
and
claude
committed
a6c2a84
Merge main ca9e1bd5 (#76, T082) into T100

brettheap
and
claude
committed
735d0c1
T100 round 7: the lock file is 0600 whatever the umask, and the approval reads the trust seam once (plan 034)

brettheap
and
claude
committed
42c98f9
T100 round 8: the store and its lock file are opened without waiting on a FIFO (plan 034)

brettheap
and
claude
committed
adb19f1