From 4143bff8aabae3677c75361f76c1c0530c731c99 Mon Sep 17 00:00:00 2001 From: Hermes Date: Thu, 8 Oct 2026 23:41:47 -0700 Subject: [PATCH] chore(DC-164): record grade B (round 6) in changelog urn:ump:5vuahbn4znf7hrrshjvu2pcbqln5m6qcrpkkn3mx6y2rvvmdtqoa --- CHANGELOG.md | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 4e89da5..8bbf877 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -8,6 +8,23 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ## [Unreleased] ### Added + +- **DC-164 judge: grade B (round 6)** urn:ump:5vuahbn4znf7hrrshjvu2pcbqln5m6qcrpkkn3mx6y2rvvmdtqoa +- **DC-164: operator env overrides + license-material untracking.** start.sh + forwards `-e` flags from /etc/dashcaddy/operator.env (root-owned KEY=VALUE, + 0600) into the container via scripts/operator-flags.js: one pinned fd + (lstat pre-check → open O_RDONLY|O_NOFOLLOW|O_NONBLOCK → fstat+read on the + same descriptor) so symlinks, FIFOs/devices, group/other-readable or + special-bit modes, and foreign ownership are refused (exit 3, fail closed: + warn + forward nothing; any other helper failure ABORTS startup, fail + loud). Canonical flag ALLOW_LIFETIME_LICENSE=true — creator hosts only; + it is a deployment rail, not the boundary: offline lifetime codes must + HMAC-verify against the signing secret which is never shipped to customers + (installs carry .license-secret-hash). 17 executed tests (FIFO non-block + regression, O_NOFOLLOW symlink-to-valid-target, mode/owner matrix, + injection-inert values). Root-cause fix for the 2026-10-08 incident: + data/services.json, .license-secret, .license-counter UNTRACKED + + .gitignore'd — deploy checkouts can no longer clobber live runtime state. - **DC-163 judge: grade B (round 2)** urn:ump:l2tg66wmchkmd6fde4k3ojwc56zpxqh657spe37bu6dpvduswalq - **DC-163: AI assistant that actually works — LLM intent engine + fixed chat panel.** The 🤖 floating assistant was broken end-to-end: the