Repository navigation
fix: h09-plugins-stale-prs - #460
Merged
Merged
Conversation
The exec funnel allowlists the child environment, so the signer's config secrets resolve and set calls ran without NSELF_V15 and failed on cli 1.4.x with E717. ExecRunner gains a base Env; the signer's resolver and key store pass NSELF_V15=1.
…ath (D-1086) AdmitPlacement re-reads the node row inside the admission transaction (state and authorization), so the grant path already refuses a revoked node. The recheck table lacked the revoked case; add it.
…he host (D-1219) Add a pre-add hook point that runs on the destination alone, after ParseHostSpec and before the host-key scan. The deploy-host check registers there (identity from ssh -G and DNS only): a match without --allow-deploy-host is refused before any scan, probe or install, and an override is confirmed and audited once, there. Matches that need the host key or machine id are still caught at the add point.
…ource (D-1219) The confirmation taken before contact covers only the match it was given for; a different match found after contact is confirmed again. The installer name is validated before the pre-add hook, so no override is confirmed for an add that cannot proceed.
… toolchain (P7-CI-46)
…scenario (P7-CI-46)
…very hosted baseline (P7-CI-46)
…'s isolation and same-repo trust
acamarata
force-pushed
the
job/h09-plugins-stale-prs
branch
from
October 29, 2026 16:10
409f765 to
efd0c1e
Compare
Contributor
Author
|
Rebased onto current origin/main and force-pushed (efd0c1e). Conflicts were in files main had already split or reworked for the file-size gate, so those took main's layout and dropped the PR's duplicate split files (engine_pack, cache_hook_image, tool_digest, chokepoint_roles_test). The signer env change was merged with main's BaselineIsolator. Two follow-ups after the rebase: the bench executor now sets BaselineIsolator (main requires an isolation policy, E611), and the hosted-workflow trust test now checks main's same-repo-only NSELF_CI_TRUST wiring. go build, go vet and go test -mod=vendor ./... pass in free/ci (the two failures after the rebase were those two, fixed in this push). |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Codex-built; one commit per item.