Hermes
ae78e2e318
merge dc/DC-152 into p7-wave1
2026-10-03 21:49:08 -07:00
Hermes
178a2fbb9f
merge dc/DC-147 into p7-wave1
2026-10-03 21:48:27 -07:00
Hermes
38af7ba224
DC-152: Private Network setup wizard (mode/domain/connect/dns/ca/admin steps) + status API + tests
2026-10-03 21:47:34 -07:00
Hermes
c12bff597b
merge dc/DC-146 into p7-wave1
2026-10-03 21:47:32 -07:00
Hermes
d224a24566
DC-147: named root CA with critical name constraints, leaf compliance assertions, install-page hardening, encrypted backup + tests
2026-10-03 21:43:11 -07:00
Hermes
9215037553
DC-146: Technitium zone/record sync (idempotent upserts) + split-DNS gate + setup check + tests
2026-10-03 21:39:33 -07:00
Hermes
de6a2fa4ae
merge dc/DC-144 into p7-wave1
2026-10-03 21:38:34 -07:00
Hermes
3291f80d0c
merge dc/DC-151 into p7-wave1
2026-10-03 21:37:39 -07:00
Hermes
695794987b
DC-144: DashCaddy-side groups + resources model/routes with cascade delete + tests
2026-10-03 21:37:13 -07:00
Hermes
24ec88a30d
DC-151: WG nftables matrix compiler + transactional apply/rollback + tests
2026-10-03 21:35:15 -07:00
Hermes
f7c5ff1d0b
merge dc/DC-142 into p7-wave1
2026-10-03 21:34:22 -07:00
Hermes
151b42e0ea
merge dc/DC-149 into p7-wave1
2026-10-03 21:33:37 -07:00
Hermes
b7d9e2b983
merge dc/DC-143 into p7-wave1
2026-10-03 21:32:45 -07:00
Hermes
88d34c6d7e
DC-142: link-first invites routes via network provider + tests
2026-10-03 21:31:57 -07:00
Hermes
fcfe5dff1b
DC-149: WireGuard hub provider (peer store, pool allocator, hub lifecycle) + tests
2026-10-03 21:31:09 -07:00
Hermes
4e4306b00f
DC-143: block/unblock/remove person + revoke device orchestration + tests
2026-10-03 21:29:41 -07:00
Hermes
97de94d496
merge dc/DC-148 into p7-wave1
2026-10-03 21:28:29 -07:00
Hermes
486d0e8d11
DC-148: Tailscale ACL compiler + lockout guard + preview/push/rollback + drift detection + tests
2026-10-03 21:26:29 -07:00
Hermes
a8183459e7
merge spec rev3 into p7-wave1
2026-10-03 21:25:35 -07:00
Hermes
5f47e12f18
P7 spec rev3: X25519-only browser keygen (no ECDSA fallback), unblock row + honest semantics everywhere, three-zone WG firewall model
2026-10-03 21:25:30 -07:00
Hermes
6e25001738
P7 spec rev3: X25519-only browser keygen (no ECDSA fallback), unblock row + honest semantics everywhere, three-zone WG firewall model
2026-10-03 21:25:17 -07:00
Hermes
a78d0ef857
Merge branch 'dc/DC-145' into dc/DC-142
2026-10-03 21:23:43 -07:00
Hermes
b2c70a0323
Merge branch 'dc/DC-141' into dc/DC-142
2026-10-03 21:23:42 -07:00
Hermes
806d720af6
Merge branch 'dc/DC-140' into dc/DC-142
2026-10-03 21:23:41 -07:00
Hermes
c09fc7b1ef
Merge branch 'dc/DC-145' into dc/DC-143
2026-10-03 21:23:14 -07:00
Hermes
5d786afcce
Merge branch 'dc/DC-141' into dc/DC-143
2026-10-03 21:23:14 -07:00
Hermes
2452bebfc9
Merge branch 'dc/DC-140' into dc/DC-143
2026-10-03 21:23:14 -07:00
Hermes
26f4aa8ad0
merge dc/DC-145 into p7-wave1
2026-10-03 21:20:41 -07:00
Hermes
d3c1dfd996
merge dc/DC-141 into p7-wave1
2026-10-03 21:20:40 -07:00
Hermes
45a2b6b07c
merge dc/DC-140 into p7-wave1
2026-10-03 21:20:40 -07:00
Hermes
b7df8f5fe0
Merge branch 'dc/DC-140' into dc/DC-148
2026-10-03 21:20:01 -07:00
Hermes
5e03f120b4
Merge branch 'dc/DC-141' into dc/DC-148
2026-10-03 21:20:00 -07:00
Hermes
7ef3914730
DC-140: network provider abstraction (src/network/) + tailscale provider + registry + tests
2026-10-03 21:16:20 -07:00
Hermes
2e6d535242
P7 spec rev2: honest unblock semantics, WG addressing/keygen model (browser-side keygen, CIDR AllowedIPs), ticket-set fixes
2026-10-03 21:14:30 -07:00
Hermes
4b560b9c40
DC-141: people store (atomic JSON) + /network/people routes + last-admin guard + tests
2026-10-03 21:14:20 -07:00
Hermes
09152dfde2
DC-145: access map store (grants, effective access, change events) + /network/access routes + tests
2026-10-03 21:12:35 -07:00
Hermes
420fa2ba2a
P7 Private Network lane: product spec (Tailscale v1 + WireGuard self-hosted) + backlog tickets DC-140..DC-152
2026-10-03 21:06:44 -07:00
Hermes
7557b49b5b
[grade=B urn:ump:zluxbji5tepzdqybrctqfyjdvbfin2o66atw6rwykg6vdwkzhfsa] backlog v3: P6 Shipdeck era (DC-109-119) cross-platform + barrier-removal lane
...
CI / Test & Lint (push) Canceled after 0s
CI / Security audit (push) Canceled after 0s
- DC-109-112: native runtime, installer remote mode, self-distribution,
updater v2 (Shipdeck engine; v0 DoD-verified)
- DC-113-115: first-run doctor, auth-gate helper, update nudge
- DC-116-119: Podman runtime, service-control abstraction, Mac signing
(electron-builder, 5 acceptance gates), 3-OS CI matrix
- DC-P6-EVIDENCE.md: verbatim live-state evidence (E1-E6) backing the claims
- DC-102 status corrected (mismatched DiskSpaceMonitor annotation)
2026-09-14 05:22:16 -07:00
DashCaddy Polish Loop
65a447e27e
DC-130 rev3: log.error on unexpected bridge status in /status + test asserting the log call (13 tests green)
CI / Test & Lint (push) Canceled after 0s
CI / Security audit (push) Canceled after 0s
2026-09-14 04:19:55 -07:00
DashCaddy Polish Loop
121caef488
DC-130 rev2: fail-fast bridge bindings (host), /status gateway-error mapping (401/403/unreachable -> 502, probe-failure stays ok:false) + 3 new tests (13 total)
CI / Test & Lint (push) Canceled after 0s
CI / Security audit (push) Canceled after 0s
2026-09-14 04:11:30 -07:00
DashCaddy Polish Loop
0ab1dfe6e5
DC-130: start.sh passes SHIPDECK_BRIDGE_URL/TOKEN_FILE to the container (deploys panel bridge wiring)
CI / Test & Lint (push) Canceled after 0s
CI / Security audit (push) Canceled after 0s
2026-09-14 03:49:35 -07:00
DashCaddy Polish Loop
c90851f25f
DC-130: deploys panel frontend — modal with services/deploy/journal tabs, rollback + status actions (bundle + cache tag rebuilt)
2026-09-14 03:49:35 -07:00
DashCaddy Polish Loop
98d25ac41b
DC-130: deploys panel frontend — modal with services/deploy/journal tabs, rollback + status actions, wired into features bundle + top bar
2026-09-14 03:49:19 -07:00
DashCaddy Polish Loop
1fc61c3fdb
DC-130: shipdeck deploys panel — bridge-proxied source deploys (routes + tests, opt-in via SHIPDECK_BRIDGE_URL)
2026-09-14 03:33:31 -07:00
DashCaddy Polish Loop
e33bc91438
fix(publish): prune build artifacts (build-output, out, dist_electron, data, release) from release tarball — v1.16.0 tarball was 817MB with gitignored Electron build-output; now 21MB
CI / Test & Lint (push) Canceled after 0s
CI / Security audit (push) Canceled after 0s
2026-09-13 05:45:40 -07:00
DashCaddy Polish Loop
70e252c8a5
[grade=A urn:ump:seyasvbntxsjibq5jiaqmfowc6xgchwe4jvcc54jd6355ujgm75q] DC-122: self-updater hardening + auto-update on + docker disk discipline (v1.16.0)
...
CI / Test & Lint (push) Canceled after 0s
CI / Security audit (push) Canceled after 0s
- _isNewer: same-version releases are never 'newer' (commit labels are
opaque stamps) — kills the same-version auto-apply regression loop
- _autoCheckAndApply: identical version@sha256 never re-applied
- dashcaddy-update.sh: truthful rollback verdicts (failed rebuild/health
= exit 1 + failure result), exact frontend snapshot/restore (incl.
update-introduced owned subtrees), contents-copy cp fallbacks with
manifest reconciliation, JSON-encoded results/meta/stamp, prune on
every exit path
- self-updater: frontend-only Linux releases fail loudly (no more silent
no-op success stuck in 'applying')
- start.sh: DASHCADDY_UPDATE_ENABLED=true (Sami 2026-09-13), json-file
log caps 10M x3, source->webroot sync via update-stamp contract
- tests: _isNewer regression suite, functional cycle + json/escape suites
(scripts/test-frontend-cycle.sh, scripts/test-json-escape.sh)
15 judge rounds: C,C,D,D,C,C,D,C,C,C,D,C,A
2026-09-13 05:32:14 -07:00
DashCaddy Polish Loop
939fdbb68b
fix(services): commit deployed sec.sami card addition (staged during last night's deploy, missed the commit)
2026-09-13 05:32:13 -07:00
DashCaddy Polish Loop
fad51c81b2
[grade=A] Register sec.sami dashboard in DashCaddy login-page map
...
Add 'sec' to the buildLoginPage pages map in sso-gate.js. Without it,
/api/v1/auth/login-page?service=sec returned 404 'Unknown service' — the
TOTP login page is built from a hardcoded per-service map, so adding sec
to services.json (runtime config, gitignored) alone was not enough.
sec needs no app-token (plain web app behind the TOTP gate): after
check-session verifies the session it redirects to /?direct=1, bypassing
the Caddy @needsAutoLogin loop.
Codex grade A (urn:ump:p3jkreyxpqikwt54uxgpl7sybkbsnklbs5kdonq5ejfqyh27udla).
2026-09-13 05:32:13 -07:00
Hermes
af970aa564
[grade=B] feat: real macOS .dmg built entirely on Linux (libguestfs + libdmg-hfsplus)
...
CI / Test & Lint (push) Canceled after 0s
CI / Security audit (push) Canceled after 0s
Adds scripts/build-dmg-linux.sh + 'npm run build:dmg':
- virt-make-fs creates an HFS+ volume inside a plain 400M image file
(guestfs appliance; never touches block devices)
- libdmg-hfsplus converts it to compressed UDZO .dmg (real koly/UDIF)
- app + /Applications drag-install symlink; secret scan on extracted contents
- BUILD_GUIDE documents the route + Gatekeeper first-run note
Verified end-to-end: rc=0, 121MB DMG with valid koly trailer,
extractall round-trip reproduced the full 264MB app, secrets scan clean.
2026-09-01 03:36:16 -07:00
Hermes
d87ca00e58
[grade=B] docs+cleanup: fix BUILD_GUIDE factual errors, document wine/i386 NSIS pitfall, drop .bak junk
...
CI / Test & Lint (push) Canceled after 0s
CI / Security audit (push) Canceled after 0s
BUILD_GUIDE.md wrongly said output goes to dist/ (actual: build-output),
mac builds produce .dmg (actual target: zip), and cited a nonexistent
win-unpacked portable path. Corrected to the verified config truth and
added the wine64+wine32:i386 cross-build requirement discovered today:
without wine32 the NSIS setup exe ships as a 211KB payload-less stub
while electron-builder exits 0. Documented the authoritative 7z payload
check + post-build secrets scan. Round1 judge B+5 polish, folded:
version placeholders, heuristic-vs-authoritative wording, distro/sudo
notes, mac zip wording. Judge: qwen3.8-max stand-in lane.
Also removes package.json.bak and index.js.bak (stale junk).
2026-09-01 00:51:24 -07:00
Hermes