Repository navigation

Phase 0 + Phase 1 integration: dev → main - #44

Merged

Pal Lakatos-Toth (pallakatos) merged 192 commits into

mainfrom

dev

Apr 27, 2026

Commits on Apr 24, 2026
- docs(phase0): security-audit scaffolding, AGT boundary, non-compete, vendored-patch audit
  
  Copilot
  authored and
  Pal Lakatos-Toth
  committed
  360aa13
- ci(phase0): six blocking CI gates per implementation-plan §4.4
  Copilot
  committed
  c9e4a7e
- test(phase0): compat-suite skeleton + operator-TUI spec
  
  Copilot
  authored and
  Pal Lakatos-Toth
  committed
  e1cff29
- feat(providers): Phase 0 provider-contract scaffolds (traits only)
  Copilot
  committed
  82813f4
- docs(audit): reviewer sign-off on provider-seams audit
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  7c5e702
- feat(admission): null/noop/disabled-provider VAP + dev-only escape hatch
  
  Copilot
  authored and
  Pal Lakatos-Toth
  committed
  08b19f1
- feat(cli): 'azureclaw convert' command skeleton (Phase 0, exit-3)
  
  Copilot
  authored and
  Pal Lakatos-Toth
  committed
  265a456
- refactor(operator): extract keymap + status-bar to operator/keymap.ts
  
  Copilot
  authored and
  Pal Lakatos-Toth
  committed
  45f2c5b
- docs(audit): reviewer sign-off on null-provider-admission audit
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  9e60b26
- docs: sigs/agent-sandbox compat-mode design doc (Phase 0, no code)
  
  Copilot
  authored and
  Pal Lakatos-Toth
  committed
  29d84a1
- test(conformance): Phase 0 Signal/X3DH/KNOCK + isolation corpus scaffold
  
  Copilot
  authored and
  Pal Lakatos-Toth
  committed
  9041dda
- docs(audit): reviewer sign-off on convert-cli-skeleton audit
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  a3880dd
- docs(audit): reviewer sign-off on operator-keymap-extract audit
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  6a95db7
- ci: run workflows on dev branch
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  fcf16d2
- Merge branch 'phase0/foundation-docs' into dev
  Pal Lakatos-Toth
  committed
  ff41252
- Merge branch 'phase0/ci-gates' into dev
  Pal Lakatos-Toth
  committed
  23c9f8b
- Merge branch 'phase0/compat-suite-skeleton' into dev
  Pal Lakatos-Toth
  committed
  c22bc09
- Merge branch 'phase0/provider-trait-scaffolds' into dev
  Pal Lakatos-Toth
  committed
  6886f3b
- Merge branch 'phase0/null-provider-admission' into dev
  Pal Lakatos-Toth
  committed
  53e1d1f
- Merge branch 'phase0/compat-agent-sandbox-design' into dev
  Pal Lakatos-Toth
  committed
  7f11a93
- Merge branch 'phase0/conformance-corpus-signal' into dev
  Pal Lakatos-Toth
  committed
  9240cd8
- Merge branch 'phase0/kubectl-convert-skeleton' into dev
  Pal Lakatos-Toth
  committed
  8cb9452
- Merge branch 'phase0/operator-tui-keymap-extract' into dev
  Pal Lakatos-Toth
  committed
  b1ba543
- feat(providers): outage semantics — pure decision module + controller validator
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  86646b4
- Merge branch 'phase1/provider-outage-modes' into dev
  Pal Lakatos-Toth
  committed
  bdd14e8
- feat(telemetry): OTel GenAI SemConv constants + typed attribute bag
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  7eb976d
- Merge branch 'phase1/otel-genai-semconv' into dev
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  f952fa2
- docs: OWASP MCP Top 10 (2025) controls matrix
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  ba8291a
- Merge branch 'phase1/owasp-mcp-top10-doc' into dev
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  c78a752
- phase1: ClawSandbox observedGeneration + Conditions[]
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  3398572
- Merge phase1/minimal-conditions into dev
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  dc5b53e
- phase1: extract DrainState into handoff/drain.rs submodule
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  87da0e5
- Merge phase1/hotspot-handoff-split into dev
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  fee44a1
- phase1: core VAP set — pod exec ban + sandbox posture lock
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  49abfca
- Merge phase1/vap-pod-exec-ban into dev
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  ccb9e02
- phase1: extract PendingHandoffStore into handoff/pending.rs
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  cfc4fb0
- Merge phase1/hotspot-handoff-pending into dev
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  bedc871
- phase1(hotspot): extract HandoffTokenStore to handoff/token.rs
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  fd0147f
- Merge phase1/hotspot-handoff-token into dev
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  a441bb1
- phase1(provider): impl PolicyDecisionProvider on Governance directly
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  eb2fd16
- Merge branch 'phase1/policy-provider-in-tree' into dev
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  536a14c
- phase1(provider): impl AuditSink on Governance directly
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  6768daf
- Merge branch 'phase1/audit-sink-in-tree' into dev
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  46caed0
- phase1(provider): impl SigningProvider on Governance directly
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  9a3fa9d
- Merge branch 'phase1/signing-provider-in-tree' into dev
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  35612d5
- phase1(controller): stamp Degraded conditions on validation failures
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  591db1a
- Merge branch 'phase1/minimal-conditions-audit' into dev
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  3f23919
- phase1: clarify MeshProvider as plugin-side only (no router impl)
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  8fdb966
- Merge phase1/mesh-seam-clarification into dev
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  61bed52
- phase1: route handoff.rs audit emissions through AuditSink trait
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  62c777e
- Merge phase1/audit-sink-migrate-handoff into dev
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  6d8d0e7
- phase1: migrate inference policy call-sites to PolicyDecisionProvider trait
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  71da3e9
- Merge phase1/policy-provider-migrate-inference into dev
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  43609dc
- phase1: split inference.rs hotspot — extract translate helpers
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  b24a7b7
- Merge phase1/hotspot-pass2-inference-split into dev
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  2922856
- phase1: scaffold inference-router/src/mcp/ for MCP 2026 Streamable HTTP
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  601bfe0
- Merge phase1/mcp-2026-scaffold into dev
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  f6cbb6c
- phase1: scaffold A2A 1.0.0 module (agent_card, error, signature)
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  a135c95
- Merge phase1/a2a-1.0.0-scaffold into dev
  Pal Lakatos-Toth
  committed
  d36bc1c
- phase1: ADR 0001 — A2A ingress (gateway-only, surgical opt-in)
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  57313b7
- Merge phase1/a2a-ingress-adr into dev
  Pal Lakatos-Toth
  committed
  020fc18
- phase1: A2A module isolation CI gate + forbid(unsafe_code)
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  44e42b9
- Merge phase1/a2a-module-isolation-ci into dev
  Pal Lakatos-Toth
  committed
  bbe5eac
- phase1: McpServer CRD scaffold (schema-only, no reconciler)
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  5466499
- Merge phase1/mcp-server-crd-scaffold into dev
  Pal Lakatos-Toth
  committed
  fe25714
- phase1: ToolPolicy CRD scaffold (schema-only, no reconciler)
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  a0035ec
- Merge phase1/tool-policy-crd-scaffold into dev
  Pal Lakatos-Toth
  committed
  73d49ec
- phase1: VAP/MAP set additions (dev-only label + seccomp auto-stamp)
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  1629acb
- Merge phase1/vap-map-set into dev
  Pal Lakatos-Toth
  committed
  26e77be
- phase1: azureclaw a2a list-exposed/schema CLI scaffold
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  68096d8
- Merge phase1/a2a-cli-list-exposed into dev
  Pal Lakatos-Toth
  committed
  8f85f12
- phase1: ClawSandbox.spec.a2a inbound exposure schema (ADR-0001 D6)
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  8a6c436
- Merge phase1/clawsandbox-a2a-spec into dev
  Pal Lakatos-Toth
  committed
  8b82818
- phase1: conformance corpus scaffolds — A2A / MCP 2026 / AP2 / OAuth 2.1
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  b4a22ed
- Merge phase1/conformance-corpus-a2a into dev
  Pal Lakatos-Toth
  committed
  4910907
- phase1: docs/internal-boundaries.md per-CRD posture rows
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  de4ce89
- Merge phase1/docs-internal-boundaries into dev
  Pal Lakatos-Toth
  committed
  68ac79e
- phase1: A2A 'no public router exposure' VAP + Cilium L7 CCNP
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  f8ea4c0
- Merge phase1/a2a-cilium-vap-isolation into dev
  Pal Lakatos-Toth
  committed
  591c7fc
- phase1: A2A JWS + base64url fuzz targets
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  5665aba
- Merge phase1/a2a-fuzz-targets into dev
  Pal Lakatos-Toth
  committed
  6a978de
- phase1: session checkpoint — 12 A2A/Phase-1 scaffolds landed
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  00a7b0d
- Merge phase1/session-checkpoint into dev
  Pal Lakatos-Toth
  committed
  dfe79d7
Commits on Apr 25, 2026
- phase1: ClawSandbox.spec.upstreamCompatibility scaffold (schema-only)
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  f87add8
- Merge phase1/upstream-translate-mode into dev
  Pal Lakatos-Toth
  committed
  ccb8821
- phase1: A2A 1.0.0 AgentCard sign/verify — end-to-end
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  6fabb8e
- Merge phase1/a2a-card-sign-verify into dev
  Pal Lakatos-Toth
  committed
  825b332
- phase1: MCP initialize JSON-RPC handler — end-to-end
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  7c9400e
- Merge phase1/mcp-initialize-handler into dev
  Pal Lakatos-Toth
  committed
  edea247
- phase1: MCP Streamable HTTP request pipeline — end-to-end
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  5ed6e9c
- Merge phase1/mcp-request-pipeline into dev
  Pal Lakatos-Toth
  committed
  d2cab32
- phase1: A2A AgentCard server-side build pipeline — end-to-end
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  52f5e7d
- Merge phase1/a2a-card-server into dev
  Pal Lakatos-Toth
  committed
  ef006ec
- phase1: MCP OAuth 2.1 access-token verifier — RFC 8725 BCP
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  7bb56b4
- Merge phase1/mcp-oauth21-verifier into dev
  Pal Lakatos-Toth
  committed
  cb043ae
- phase1: MCP tools/list + tools/call dispatch — pipeline-wired
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  5085bdd
- Merge phase1/mcp-tools-dispatch into dev
  Pal Lakatos-Toth
  committed
  7b92b81
- phase1: A2A inbound AgentCard verification pipeline — pure function
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  0850f1b
- Merge phase1/a2a-card-verifier into dev
  Pal Lakatos-Toth
  committed
  3187f32
- phase1: A2A JSON-RPC method dispatch — message/send + tasks/get + tasks/cancel
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  ff6ca92
- Merge phase1/a2a-jsonrpc-dispatch: A2A JSON-RPC dispatch + 19 tests
  Pal Lakatos-Toth
  committed
  87b6d82
- phase1: A2A AP2 commerce mandate validation kernel
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  a0885bc
- Merge phase1/a2a-ap2-mandates: AP2 commerce mandate validation + 19 tests
  Pal Lakatos-Toth
  committed
  fce7e2a
- phase1: A2A trust-store cache — snapshot hot-reload for kid → VerifyingKey
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  ee1bbc0
- Merge phase1/a2a-trust-store-cache: snapshot trust-anchor cache + 15 tests
  Pal Lakatos-Toth
  committed
  22631c4
- phase1: AP2 conformance corpus — 14 wire-format fixtures + coverage floor
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  e21dbca
- Merge phase1/a2a-ap2-conformance-fixtures: AP2 fixture corpus + coverage floor
  Pal Lakatos-Toth
  committed
  f51f597
- phase1: bind POST /mcp axum route — 13 tests, sub-router state
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  38f2b76
- Merge phase1/mcp-route-binding: POST /mcp axum binding + 13 tests
  Pal Lakatos-Toth
  committed
  19a2f2b
- phase1: bind A2A axum routes — agent.json + POST /a2a + 15 tests
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  fd22033
- Merge phase1/a2a-route-binding: A2A axum routes + 15 tests
  Pal Lakatos-Toth
  committed
  46c0720
- phase1: a2a agent-card verifier conformance corpus
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  0a1573b
- Merge branch 'phase1/a2a-card-verifier-conformance' into dev
  Pal Lakatos-Toth
  committed
  8ff0340
- phase1: AP2 IntentMandate detached-JWS sign/verify primitive
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  ea76a69
- Merge branch 'phase1/ap2-mandate-signing' into dev
  Pal Lakatos-Toth
  committed
  139046a
- phase1: A2AAgent CRD spec to TrustAnchor projection function
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  9b89207
- Merge branch 'phase1/a2a-agent-projection' into dev
  Pal Lakatos-Toth
  committed
  ad62874
- phase1: wire AP2 mandate verify into validate_payment_attempt
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  4632d95
- Merge phase1/ap2-mandate-verify-wired into dev
  Pal Lakatos-Toth
  committed
  5d0fdb6
- phase1: OAuth 2.1 bearer-token verification as a tower::Layer
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  989bcbb
- Merge phase1/oauth-tower-layer into dev
  Pal Lakatos-Toth
  committed
  f1a26bd
- phase1: a2a trust-store hot-reload integration test
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  c6c34c6
- Merge phase1/trust-store-hot-reload-integration
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  62c319a
- phase1: wire OAuthLayer into protected_mcp_route
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  5850415
- Merge phase1/mcp-route-oauth-wiring
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  4622618
- phase1: trust-store snapshot rebuild orchestrator
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  70756bf
- Merge phase1/trust-store-rebuild-orchestrator
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  6e51652
- phase1: CEL admission validations on McpServer + ToolPolicy CRDs
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  75d59ab
- Merge phase1/crd-cel-validations
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  343dc7e
- phase1: MCP 2026 negative-only edge-case integration tests
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  4283f32
- Merge phase1/mcp-negative-edge-cases
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  8d4a16d
- phase1(ap2): add type-safe MandateTrustStore wrapper
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  5b4dd33
- Merge phase1/ap2-mandate-trust-store: type-safe AP2 mandate-issuer trust store
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  cf8e972
- phase1(ap2): wire signed-mandate verification into message/send
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  1fdd98e
- Merge phase1/ap2-message-send-wiring: AP2 verification at A2A message/send
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  ec92a30
- phase1: policy-envelope hot-reload core (pure transition + container)
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  6096cc1
- Merge phase1/policy-envelope-hot-reload (PR 40): pure hot-reload core (17 tests, 561->578)
  Pal Lakatos-Toth
  committed
  e9756d0
- phase1: extract handoff::crypto submodule (hotspot pass #2)
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  805a867
- Merge phase1/handoff-crypto-extract (PR 41): handoff crypto submodule extraction (mod.rs 2075->1954, +7 tests)
  Pal Lakatos-Toth
  committed
  5f66fdc
- phase1: extract handoff::auth submodule (mod.rs under 1800 cap)
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  10c958b
- Merge phase1/handoff-auth-extract (PR 42): handoff auth submodule (mod.rs 1954->1770, under Phase 1 1800 cap)
  Pal Lakatos-Toth
  committed
  ceb1750
- phase1: extract spawn::docker submodule (under Phase 1 900 cap)
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  fbaceae
- Merge phase1/spawn-docker-extract (PR 43): spawn docker submodule (1199->762, under Phase 1 900 cap)
  Pal Lakatos-Toth
  committed
  234906f
- phase1: extract RateLimiter into inference-router/src/rate_limiter.rs
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  d17eacc
- Merge phase1/governance-rate-limiter-extract (PR 44): RateLimiter extracted from governance.rs (1252->1152)
  Pal Lakatos-Toth
  committed
  0494f69
- phase1: extract BehaviorMonitor into inference-router/src/behavior_monitor.rs
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  25be27c
- Merge phase1/governance-behavior-monitor-extract (PR 45): BehaviorMonitor extracted from governance.rs (1152->1014)
  Pal Lakatos-Toth
  committed
  bebb351
- phase1: extract routes/handoff payload handlers into submodule
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  15bfc19
- Merge phase1/routes-handoff-payload-extract (PR 46): handoff payload handlers extracted (1570->872)
  Pal Lakatos-Toth
  committed
  92beb53
- phase1: extract trust-ops impl into governance/trust_ops.rs
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  de22b51
- Merge phase1/governance-trust-ops-extract (PR 47): trust-ops extracted; governance/mod.rs 837 (under Phase 1 900 cap)
  Pal Lakatos-Toth
  committed
  c4f7b1e
- phase1: split controller/src/mesh_peer.rs (1970->1170, under 1200 cap)
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  c8663ce
- Merge phase1/mesh-peer-offload-extract: mesh_peer.rs split (1970->1170 + offload 718 + pair 124, under Phase 1 cap)
  Pal Lakatos-Toth
  committed
  423110c
- phase1: split controller/src/reconciler.rs (2326->1464, under 1500 cap)
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  c61c81b
- Merge phase1/reconciler-tests-extract: reconciler.rs split (2326->1464, under Phase 1 cap)
  Pal Lakatos-Toth
  committed
  80a3fb4
- phase1: CI greenup + Phase 0/1 gap review
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  bcdd2e4
- Merge phase1/ci-greenup-and-review into dev
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  5d35ff8
- phase1: runtime-compat fixes (plugin ESM, preflight, policy dir, admin-token)
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  b9c37a6
- phase1: extract Foundry discovery from plugin.ts (LOC) + rustfmt
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  a33165b
- phase1: pre-stage OpenClaw bundled-runtime-deps + sub-agent npm 403 fix
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  cdb9728
- phase1: controller mesh-peer exponential reconnect backoff + jitter
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  bdb5fd8
- phase1: copy dist/core/ subdir into sandbox plugin (fix a33165b regression)
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  8df519d
Commits on Apr 26, 2026
- phase1: PR #44 CI fixes (digest bump, rustfmt 1.95, audit signoffs)
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  71abb07
- phase1: fix sub-agent registry lookup (sibling mesh_send + discover)
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  98977ac
- phase1: AGT_SKIP_ENTRA toggle + multi-arch Azure Linux base
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  164359b
- fix(controller): break reconcile loop, register controller mesh peer, fix postgres deadlock
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  b7ac128
- fix(plugin): refresh stale AMID after sub-agent identity rotation
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  9bee8e3
- fix(helm): gate seccomp MAP behind flag + fix VAP message line-break
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  22e249a
- fix(helm): drop optional-chain inside has() in null-provider VAP
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  a972d26
- fix(sandbox-base): handle multiple staged openclaw versions in pre-stage check
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  1667c81
- docs(vap): document container-scoped exec ban rationale
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  3763180
- fix(sandbox): mirror staged deps to writable tmpfs for RO-rootfs pods
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  4c3094a
- fix(plugin): pre-discovery must not pin sub-agent AMID into TTL cache
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  1c6c9ef
- fix(plugin): push peer trust to router on first successful mesh send
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  37ab456
- fix(plugin): bypass delegateToNativeAgent (sessions_spawn denied)
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  17f5785
- Revert "fix(plugin): bypass delegateToNativeAgent (sessions_spawn denied)"
  Pal Lakatos-Toth
  committed
  622d0e6
- Reapply "fix(plugin): bypass delegateToNativeAgent (sessions_spawn denied)"
  Pal Lakatos-Toth
  committed
  209f989
Commits on Apr 27, 2026
- fix(plugin): resend mesh task on reply timeout if peer AMID changed
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  33bef5d
- fix(plugin): sub-agent mesh_send/discover use router-proxied registry
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  016b2df
- fix(cli): surface kubectl stderr on port-forward failure in connect
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  85b99bf
- fix(controller): plumb OPENCLAW_GATEWAY_TOKEN via secretKeyRef
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  299206c
- fix(plugin): gate heavy runtime side-effects on registrationMode==full
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  c2d78de
- fix(sandbox): unblock built-in image_generate provider on loopback router
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  97ef710
- refactor(plugin): extract router-client helpers to core/router-client.ts
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  31a80ee
- docs(security-audits): retroactive audit for image_generate loopback unblock (97ef710)
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  14de655
- feat(controller): add periodic fedcred reaper for orphan GC
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  4762aee
- docs: pre-merge revamp for PR #44
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  0772efe
- docs: scrub references to gitignored internal plans
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  f6a4be0
- docs: scrub internal AGT/MSFT-product coordination from public docs
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  a041d28
- docs: gitignore docs/internal/ — remove all public references to internal docs
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  ff467bd
- docs: reword 'provider: null/noop/disabled' prose to satisfy ci/no-null-provider-prod gate
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  a819855
- docs: document MAP feature-gate caveat + fix rustfmt drift
  
  Pal Lakatos-Toth
  and
  Copilot
  committed
  5fc190a

Commits

Commits on Apr 24, 2026

Commits on Apr 25, 2026