Hermes Agent
8744609887
[pending-judge] fix(integration): catalog detail reads app.docker.* (DC-160); Shield committed; composition-root e2e
...
- DC-160: /catalog/:appId read app.image/ports/env/volumes which live under
app.docker.* — every detail response was empty. Now reads docker.* and
surfaces defaultPort/subdomain/healthCheck/mediaMount/claimToken/difficulty/
setupInstructions for the deploy form. List/search use the templates own
category field (old hand-rolled CATEGORY_MAP mis-categorized apps).
- Shield (routes/shield.js + 5-line app.js mount) committed to source after
weeks as prod-only drift; regression test asserts the mount exists.
- New composition-root e2e suite: boots REAL createApp() on an ephemeral
port, probes the historically-broken routes through the REAL mount table
(wizard wiring, shield, catalog detail, deploys bridge) — the class of bug
all 3 P7 dogfood findings belonged to. 5 tests.
- Full suite 3499/3499 (155 suites); table-driven DC-160 test covers all 73
image templates.
2026-10-07 00:58:03 -07:00
Hermes
1fa5ba8baa
[grade=B urn:ump:x37xj4seku3isvffxkwmahymvjijrwinndnfpubv664spur7kogq] fix(installer): remove BACKUP_DIR readonly collision that aborted every install
...
CI / Test & Lint (push) Canceled after 0s
CI / Security audit (push) Canceled after 0s
readonly BACKUP_DIR (constants) collided with the BACKUP_DIR= tunable, so every
curl|bash run died with 'BACKUP_DIR: readonly variable'. Removed the readonly
constant and resolve the default (/etc/dashcaddy/backups) at end of parse_args;
--backup-dir flag still overrides. Live file + /opt copy patched identically.
2026-10-05 18:18:22 -07:00
sami7777
0fd1bbd80b
P7 people-store providerUserId dedupe [grade=B] (PR #4 )
...
CI / Test & Lint (push) Canceled after 0s
CI / Security audit (push) Canceled after 0s
Judge B r1 urn:ump:bbfbsfru4nizg75wcxum7mwzhie6txhr22hw6jvz36wiihmgzmlq. Dogfood finding #3 . 3414/3414.
2026-10-04 12:14:44 +02:00
Hermes Agent
c430e02117
[grade=B urn:ump:bbfbsfru4nizg75wcxum7mwzhie6txhr22hw6jvz36wiihmgzmlq] P7 people store: dedupe upsert by providerUserId
...
CI / Test & Lint (pull_request) Canceled after 0s
CI / Security audit (pull_request) Canceled after 0s
Dogfood finding #3 : upsertPerson resolved existing records by id only.
The wizard upserts a bootstrap admin AFTER a provider sync has already
created a person for the same Tailscale user (no id passed), so the same
providerUserId was duplicated into two records. Resolve existing by
providerUserId when no id is given; bootstrap Admin group + protectedAt are
preserved on the merge. New regression test; full suite 3414/3414.
2026-10-04 03:12:23 -07:00
sami7777
776cf3c4ca
P7 tailscale coord-client wiring [grade=B] (PR #3 )
...
CI / Test & Lint (push) Canceled after 0s
CI / Security audit (push) Canceled after 0s
Judge B r1 urn:ump:mao7vadnesmquhmgr4oeg554edt6fn3ykxyiydtfs2psoekd4s7q. Dogfood finding #2 . 3413/3413.
2026-10-04 11:51:34 +02:00
Hermes Agent
5b3e637423
[grade=B urn:ump:mao7vadnesmquhmgr4oeg554edt6fn3ykxyiydtfs2psoekd4s7q] P7 tailscale provider: wire coord client via ctx delegation
...
CI / Test & Lint (pull_request) Canceled after 0s
CI / Security audit (pull_request) Canceled after 0s
Dogfood finding #2 : createTailscaleProvider() built with coordClient=null;
nothing in prod ever called attachCoordClient() (the wiring the provider
docblock promised never landed), so wizard credential validation always
failed not_configured even with a valid stored token. Pass a delegating
proxy that fetches a fresh coord client per call via the sanctioned
ctx.tailscaleCoord.getClient pattern (token re-read from credentialManager
each call). Full suite 3413/3413.
2026-10-04 02:51:18 -07:00
sami7777
ecdb2fd8ee
P7 wizard prod wiring fix [grade=B] (PR #2 )
...
CI / Test & Lint (push) Canceled after 0s
CI / Security audit (push) Canceled after 0s
Judge B r1 urn:ump:2swys44kxvulm5flu4skibjq3yfvtnzrsbgkvm2g65ht55i4jtoa. Dogfood finding: wizard mount omitted providers. 3413/3413.
2026-10-04 11:41:45 +02:00
Hermes Agent
f7d6fe4a8a
[grade=B urn:ump:2swys44kxvulm5flu4skibjq3yfvtnzrsbgkvm2g65ht55i4jtoa] P7 wizard prod wiring: pass provider instances (dogfood finding)
...
CI / Test & Lint (pull_request) Canceled after 0s
CI / Security audit (pull_request) Canceled after 0s
The /network/wizard mount in app.js omitted providers, so the wizard built
with providers={} and every mode selection returned 503 provider_unavailable
in production. Unit tests never caught it because they inject their own
provider map. Pass built tailscale + wireguard instances.
Full suite: 3413/3413 (152 suites).
2026-10-04 02:41:31 -07:00
sami7777
e04787477a
P7 Private Network [grade=A] (PR #1 )
...
CI / Test & Lint (push) Canceled after 0s
CI / Security audit (push) Canceled after 0s
Judge A r18 urn:ump:rgxdivsp2xf6zy5lsdoclvdgb7cuqd3qpwlszt2p7fu7xwa3zkkq. 3,399/3,399 tests.
2026-10-04 11:04:23 +02:00
Hermes
75a0385c38
P7 r10: probes assert expected head + every outcome (nonzero exit on mismatch); phase-2 rejection-path cleanup guaranteed
CI / Test & Lint (pull_request) Canceled after 0s
CI / Security audit (pull_request) Canceled after 0s
2026-10-04 00:07:56 -07:00
Hermes
51ba85fc69
P7 r9: probes isolated (DATA_DIR tmp), self-authenticating (git stamp + asserts), try/finally cleanup, explicit exit
2026-10-03 23:47:43 -07:00
Hermes
af0d6b2fe5
P7 live probes: real-HTTP transcripts for forward_auth (inactive 503; active: allow/deny/unknown-device/step-up) via seeded real stores + registry stub provider
2026-10-03 23:39:01 -07:00
Hermes
2e651bd84e
P7 r8 fixes: lazy mounts catch ProviderNotActiveError (503 not 500), wg redeem added to PUBLIC_ROUTES (redemption is sessionless), live-curl probe script
2026-10-03 23:34:00 -07:00
Hermes
d4973f3af3
P7 r8 fix: forward_auth trust boundary (XFF/XFH honored only from trusted proxy; direct/spoofed requests use socket identity) + adversarial tests
2026-10-03 23:25:23 -07:00
Hermes
1e606bf0f3
P7 r3 fix: single-preview contract (syncAccess delegates drift-check+preview+push to pushIfNoDrift; acl_preview_failed mapped non-retryable) + test updates
2026-10-03 22:55:22 -07:00
Hermes
d2d0d73477
P7 r2 fixes: drift guard wired through pushIfNoDrift (acl_drift_detected ProviderError, never overwrites drifted remote) + unknown-device forward_auth audit + drift regression tests
2026-10-03 22:47:27 -07:00
Hermes
a5ef5b345e
merge dc/DC-153 into p7-wave1
2026-10-03 22:34:32 -07:00
Hermes
44567031eb
DC-153: provider.syncAccess enforcement wiring (tailscale ACL push + wireguard nftables apply) + contract tests
2026-10-03 22:34:02 -07:00
Hermes
32998fe4b8
merge dc/DC-154 into p7-wave1
2026-10-03 22:31:14 -07:00
Hermes
aac2343df3
DC-154: forward_auth enforcement endpoint (whois + access map + sensitive step-up) + tests
2026-10-03 22:30:23 -07:00
Hermes
88f7600693
P7: mount public WG invite redemption route (lazy provider, 503 when not wireguard)
2026-10-03 22:08:52 -07:00
Hermes
2f14936970
merge dc/mount (network router mounts) into p7-wave1
2026-10-03 22:08:44 -07:00
Hermes
5bcf4e99ee
merge dc/DC-150 into p7-wave1
2026-10-03 22:05:39 -07:00
Hermes
e8ef2a089b
merge spec rev5 into p7-wave1
2026-10-03 21:54:40 -07:00
Hermes
a39602afe5
P7 spec rev5: DC-150 ticket X25519-only (remove ECDSA fallback contradiction)
2026-10-03 21:54:40 -07:00
Hermes
a443f030c0
P7 integration: mount network routers (people/access/invites/lifecycle/groups/resources/wizard) with shared stores + lazy lifecycle proxy
2026-10-03 21:52:14 -07:00
Hermes
ae78e2e318
merge dc/DC-152 into p7-wave1
2026-10-03 21:49:08 -07:00
Hermes
178a2fbb9f
merge dc/DC-147 into p7-wave1
2026-10-03 21:48:27 -07:00
Hermes
38af7ba224
DC-152: Private Network setup wizard (mode/domain/connect/dns/ca/admin steps) + status API + tests
2026-10-03 21:47:34 -07:00
Hermes
c12bff597b
merge dc/DC-146 into p7-wave1
2026-10-03 21:47:32 -07:00
Hermes
d224a24566
DC-147: named root CA with critical name constraints, leaf compliance assertions, install-page hardening, encrypted backup + tests
2026-10-03 21:43:11 -07:00
Hermes
b4e683a7fc
DC-150: WG invite redemption page (browser X25519 keygen, client-side config+QR) + public redeem API + tests
2026-10-03 21:40:09 -07:00
Hermes
9215037553
DC-146: Technitium zone/record sync (idempotent upserts) + split-DNS gate + setup check + tests
2026-10-03 21:39:33 -07:00
Hermes
de6a2fa4ae
merge dc/DC-144 into p7-wave1
2026-10-03 21:38:34 -07:00
Hermes
3291f80d0c
merge dc/DC-151 into p7-wave1
2026-10-03 21:37:39 -07:00
Hermes
695794987b
DC-144: DashCaddy-side groups + resources model/routes with cascade delete + tests
2026-10-03 21:37:13 -07:00
Hermes
24ec88a30d
DC-151: WG nftables matrix compiler + transactional apply/rollback + tests
2026-10-03 21:35:15 -07:00
Hermes
f7c5ff1d0b
merge dc/DC-142 into p7-wave1
2026-10-03 21:34:22 -07:00
Hermes
151b42e0ea
merge dc/DC-149 into p7-wave1
2026-10-03 21:33:37 -07:00
Hermes
b7d9e2b983
merge dc/DC-143 into p7-wave1
2026-10-03 21:32:45 -07:00
Hermes
88d34c6d7e
DC-142: link-first invites routes via network provider + tests
2026-10-03 21:31:57 -07:00
Hermes
fcfe5dff1b
DC-149: WireGuard hub provider (peer store, pool allocator, hub lifecycle) + tests
2026-10-03 21:31:09 -07:00
Hermes
a4f961d609
P7 spec rev4: pin provider-contract unblock wording, PKCS8-prefix X25519 private-key extraction, DC-143 authorization-vs-key-expiry distinction
2026-10-03 21:31:08 -07:00
Hermes
4e4306b00f
DC-143: block/unblock/remove person + revoke device orchestration + tests
2026-10-03 21:29:41 -07:00
Hermes
97de94d496
merge dc/DC-148 into p7-wave1
2026-10-03 21:28:29 -07:00
Hermes
486d0e8d11
DC-148: Tailscale ACL compiler + lockout guard + preview/push/rollback + drift detection + tests
2026-10-03 21:26:29 -07:00
Hermes
a8183459e7
merge spec rev3 into p7-wave1
2026-10-03 21:25:35 -07:00
Hermes
5f47e12f18
P7 spec rev3: X25519-only browser keygen (no ECDSA fallback), unblock row + honest semantics everywhere, three-zone WG firewall model
2026-10-03 21:25:30 -07:00
Hermes
6e25001738
P7 spec rev3: X25519-only browser keygen (no ECDSA fallback), unblock row + honest semantics everywhere, three-zone WG firewall model
2026-10-03 21:25:17 -07:00
Hermes
a78d0ef857
Merge branch 'dc/DC-145' into dc/DC-142
2026-10-03 21:23:43 -07:00
Hermes Agent
sami7777