From dc1cfbf044f19f9ab5b5e1dab3002491315906ae Mon Sep 17 00:00:00 2001 From: Kit OC5 Date: Fri, 2 Oct 2026 18:25:14 -0400 Subject: [PATCH] compute-guard: dated exemptions for windy-registry dev CORS origin and windytalk engine-side ports Hub decision 10-02 (alternative B, rule stays strict): registry tools/r2-provision.sh :8788 is a dev origin in an R2 CORS rule; windytalk engine/server/systemd/stress ports are Talk's own engines (owner-approved, NOT compute-door, a real bypass to be put behind Mind). approved_by windy-hub, expires 2026-12-31. Client-side files pending Talk. Co-Authored-By: Claude Sonnet 5.5 --- ci/compute-guard-allow.yml | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/ci/compute-guard-allow.yml b/ci/compute-guard-allow.yml index 2de83a2..5ac6007 100644 --- a/ci/compute-guard-allow.yml +++ b/ci/compute-guard-allow.yml @@ -92,3 +92,21 @@ allow: approved_by: windy-hub approved_on: 2026-10-02 expires: 2026-12-31 + + - repo: windy-registry + paths: ["tools/r2-provision.sh"] + matches: ['http://localhost:8788'] + reason: "Dev origin in an R2 bucket CORS rule, not a call to the Talk engine (Hub 10-02)." + exemption: owner-approved + approved_by: windy-hub + approved_on: 2026-10-02 + expires: 2026-12-31 + + - repo: windytalk + paths: ["engine/*", "scripts/stress/*", "scripts/veron/*"] + matches: [':(8791|8788|8794)'] + reason: "Talk's own voice engines (server, systemd unit, stress scripts); to be placed behind Mind per Mind's audit plan. NOT compute-door: a real bypass being fixed (Hub 10-02)." + exemption: owner-approved + approved_by: windy-hub + approved_on: 2026-10-02 + expires: 2026-12-31