This website requires JavaScript.
ef96051d6f
Merge pull request #2 from sneakyfree/runner-guard
Grant Whitmer
2026-10-01 05:29:07 -04:00
a0dc6f8568
runner-guard: block workflows that hand a self-hosted runner to strangers (Boss 10-01)
2026-10-01 05:28:37 -04:00
51e0b9d30b
bridge + sync: onboard windy-calendar-site (static, no workflows; guards only)
2026-10-01 05:04:49 -04:00
51777b0ad0
bridge + sync: onboard windy-hand-site (static site, no workflows yet; guards only)
2026-10-01 04:50:15 -04:00
cbcb4c206b
docs: CUTOVER-PRIMARY.md checklist (draft, nothing flipped)
2026-10-01 04:03:09 -04:00
2c62e2834a
secret-guard allow: windy-agent #412 synthetic Z.ai fixture (hash not in lockbox)
2026-10-01 03:56:48 -04:00
3a9b7ecab7
Merge pull request #1 from sneakyfree/veron-ollama-warn
Grant Whitmer
2026-10-01 03:36:32 -04:00
cd0400c371
compute-guard: WARN (never red) on NEW references to Veron Ollama :11434
2026-10-01 03:36:11 -04:00
4e7ab667ed
backup_state: pin restic cache dir (systemd has no HOME); init only on a MISSING repo, log other errors
2026-10-01 03:23:41 -04:00
f10db19316
drill_cross_host.sh: read the R2 pair + endpoint from the lockbox (drill PASSED 10-01)
2026-10-01 03:19:56 -04:00
3503894a1e
state backup: systemd units (NOT enabled) + cross-host drill script
2026-10-01 02:59:19 -04:00
fbab5c4669
secret-guard/secret-scan: PyPI API token shape (pypi-AgE macaroon), WARN-first
2026-10-01 02:47:53 -04:00
1b552c0882
docs: RESTORE-DRILL.md (state backup + restore procedure)
2026-10-01 02:46:53 -04:00
8ebc18c3bc
gitea 1.24.6 -> 1.24.7 (security: LFS auth bypass, symlink bypass, OAuth2 missed return)
2026-10-01 02:45:28 -04:00
9566826ce9
lockbox-put: append-only lockbox PR tool (no one reads/greps the lockbox); installer updated
2026-10-01 02:40:31 -04:00
160a3d69ba
backup_state.sh: encrypted restic backup of Postgres + Gitea state to R2 (SOTU 10-01 gap: DB was not backed up)
2026-10-01 02:35:09 -04:00
7e28a23c22
secret-scan + env-names: shared hash-only tools (Boss 10-01: lanes printed secrets while hunting them)
2026-10-01 01:17:30 -04:00
1da4d39c0b
bridge + sync: onboard windy-text, windy-call, windy-cell (telephony in scope, GitHub Actions dead since 08-14; deploy.yml disabled)
2026-10-01 01:00:48 -04:00
53fbcfe78f
secret-guard allow: windy-code VS Code public aiKey, windytalk redaction fixture (hash not in lockbox)
2026-10-01 00:59:59 -04:00
1c552e94de
secret-guard: Twilio shapes (SID/API key, 32-hex secret assignment) + per-kind warn mode
2026-10-01 00:59:05 -04:00
8690c4f8d3
secret-guard allow: 5 windy-agent #395 FAKE fixtures (weekly scan 09-28; verified never in the lockbox)
2026-09-28 06:13:22 -04:00
313f41b49c
deploy: secret-guard BLOCK drop-in (orchestrator 09-24)
2026-09-24 03:08:11 -04:00
ea02ade0cb
weekly public secret scan (all 5 GitHub accounts, full history, hash-only)
2026-09-24 03:05:16 -04:00
497222094f
secret-guard: triaged allow list (fakes by hash, test PEMs by path)
2026-09-24 03:04:13 -04:00
d28da26000
secret-guard: no live credentials in bridged repos (hash-only findings)
2026-09-24 03:01:59 -04:00
04c857654a
rerun_ci.sh: find wg-q in the invoking user home under sudo
2026-09-24 02:38:25 -04:00
32512a32fc
bridge windy-inbox (new private repo; Windy Drops is build lead)
2026-09-23 20:51:09 -04:00
b52e6b4784
bridge: post no-Docker smoke jobs (name regex skipped "no Docker")
2026-09-23 20:11:55 -04:00
6440c7d5f4
deploy: compute-guard BLOCK drop-in (live on Veron since 09-24 00:0xZ)
2026-09-23 20:05:34 -04:00
17acae6af6
guards: Grant-owned findings never block (compute-guard + ci-hygiene)
2026-09-23 20:04:01 -04:00
790d794900
bridge: drop eternitas ci/build from BRIDGE_NO_DAEMON (converted to ci/smoke, #179 )
2026-09-23 19:51:26 -04:00
1b8cebbfe1
branding: friendly invite-only page instead of Gitea's raw Registration is disabled
2026-09-23 19:49:34 -04:00
83fbf1f992
guards_report: chat lane is now the Windy Chat session
2026-09-23 19:12:40 -04:00
9b5334fee7
test: allow-list entries must be line-scoped (replaces is-empty check)
2026-09-23 19:11:53 -04:00
f71a5aab39
ci-hygiene allow: windy-pro disabled deploy job (needs-docker false positive)
2026-09-23 19:11:20 -04:00
f219437282
ci-hygiene report: same disabled-workflow filter as check()
2026-09-23 19:10:35 -04:00
b15584d33a
ci-hygiene: needs-docker skips workflows disabled on Windy Git
2026-09-23 19:10:11 -04:00
0a57d96f2e
bridge + ci-hygiene: Docker-needing CI jobs (option A)
2026-09-23 19:09:09 -04:00
8b1ae4ac60
branding: home page says invite only (forge registration closed at launch)
2026-09-23 19:02:55 -04:00
14ed23a9fe
guards_report: owner-lane column (session names: 8c -> Windy Hub, calendar -> Windy Calender)
2026-09-23 18:44:11 -04:00
c4799dcc13
ci: mount windy-pro's read-only build inputs into dind; allow exactly that path for jobs
2026-09-23 14:56:48 -04:00
683c01ec7d
rerun_ci: Gitea stores repos lowercased on disk (WindyCloud failed)
2026-09-23 17:22:17 -04:00
4bb4893131
bridge: replace the mirror PR when a GitHub PR is retargeted to another base
2026-09-23 16:16:15 -04:00
9e9eb08d96
compute guard: line-scoped allow entries; allow MindKeychain.jsx's two OAuth endpoints only
2026-09-23 15:46:53 -04:00
dece301bf0
grant-owned: windy-pro ROOT .env.example (desktop BYOK dev fallback; hub reads neither)
2026-09-23 15:45:33 -04:00
87dcddb87d
guards_report: one live status page for compute-guard + ci-hygiene
2026-09-23 15:38:21 -04:00
a5f7b036a8
guards: skip a commit the sync hasn't fetched yet, quietly (race, not error)
2026-09-23 15:36:19 -04:00
255aa58b35
ci-hygiene guard: lockfile-only installs, pinned images, no host-port services (warn-only)
2026-09-23 15:30:51 -04:00
e64a1b5fcb
deps: install from uv.lock (hash-pinned) in the image and CI, never floating
2026-09-23 15:25:18 -04:00
a2daca61ef
ci: mount windy-pro's read-only build inputs into dind; allow exactly that path for jobs
2026-09-23 14:56:48 -04:00
1bc55eaec9
compute guard: flag direct AI-provider use (Windy Mind is the only door), warn-only
2026-09-23 14:42:10 -04:00
fdb0f5989e
ci: run dind under Sysbox, not privileged (rollback override kept)
2026-09-23 12:41:42 -04:00
9be2952ff8
rerun_ci: detect a running oneshot sync correctly (is-active lies for oneshot)
2026-09-23 14:22:59 -04:00
fe3bce39ff
bridge: post pending for queued jobs a runner can take
2026-09-23 14:20:32 -04:00
6b0b60eb4a
scripts: rerun_ci.sh — re-fire a PR's CI without the web button
2026-09-23 14:17:10 -04:00
60708dd8db
push velocity: correlate the SSO-id subquery on the grouped column
2026-09-23 14:06:10 -04:00
aedc772d29
push velocity: isolate its query so a failure never costs ci.run rows
2026-09-23 13:06:20 -04:00
acb8ec3a16
push velocity: key humans on windy_identity_id (SSO link); no id -> system + caller
2026-09-23 12:52:32 -04:00
0051c72037
telemetry: detect push velocity from Gitea's action table (alert only)
2026-09-23 12:51:37 -04:00
44e824c762
push velocity: correlate the SSO-id subquery on the grouped column
2026-09-23 14:06:10 -04:00
4c76b1b12a
canary: end the hub session the login probe opens (journey cleanup rule)
2026-09-23 13:39:55 -04:00
4e2db1e2e0
push velocity: isolate its query so a failure never costs ci.run rows
2026-09-23 13:06:20 -04:00
54c63b4d89
push velocity: key humans on windy_identity_id (SSO link); no id -> system + caller
2026-09-23 12:52:32 -04:00
ac83c4721e
telemetry: detect push velocity from Gitea's action table (alert only)
2026-09-23 12:51:37 -04:00
2d4fadb090
sync: bound the janitor and telemetry steps (docker exec hangs in an IO stall)
2026-09-23 12:54:34 -04:00
b438b6a053
ci: run dind under Sysbox, not privileged (rollback override kept)
2026-09-23 12:41:42 -04:00
e3b69fa759
telemetry: UPDATE 7 — read the ingest body; count quarantined + dropped on heartbeats
2026-09-23 12:32:28 -04:00
4acf50d9ef
bridge tests: fake serves workflow contents; cover invalid-workflow status
2026-09-23 12:31:19 -04:00
b7a7e94df0
bridge: post an error status when Windy Git ignores an invalid workflow
2026-09-23 12:29:12 -04:00
c83f808a60
bridge: retry transport blips (TLS timeout/reset), never HTTP errors
Grant Whitmer
2026-09-23 12:15:22 -04:00
eb27e63db3
telemetry: adopt the end-to-end synthetic convention (UPDATE 4)
Grant Whitmer
2026-09-23 12:06:51 -04:00
1c3b5b0638
telemetry: synthetic:true on canary refusals (keyed, not a bare flag)
Grant Whitmer
2026-09-23 11:54:56 -04:00
90643fe48e
telemetry step 2: API boot/health + forge.auth.failed (declared)
Grant Whitmer
2026-09-23 11:47:29 -04:00
00ec963f82
telemetry: fix ci.run completeness — cursor on (finish time, job id)
Grant Whitmer
2026-09-23 11:42:36 -04:00
b5e4eaf57a
telemetry: ci.job_cancelled from the janitor; interval_s on heartbeat
Grant Whitmer
2026-09-23 11:27:53 -04:00
baaa542bae
docs: audit disposition 09-23 — R2 god token replaced by bucket-scoped token
Grant Whitmer
2026-09-23 11:15:35 -04:00
0634a6cb1b
style: ruff fix in telemetry_emit
Grant Whitmer
2026-09-23 11:08:21 -04:00
1a171eabd5
telemetry: CI emitter for admin.windyword.ai (inert until token)
Grant Whitmer
2026-09-23 11:06:54 -04:00
28c31236b8
ci: janitor also clears jobs blocked forever on failed needs
Grant Whitmer
2026-09-23 11:06:33 -04:00
cd5967031b
ci: janitor cancels jobs no runner can ever take
Grant Whitmer
2026-09-23 10:58:53 -04:00
f246417095
ci: windy-pro desktop/installer jobs are NON-BLOCKING (Grant, 09-23)
Grant Whitmer
2026-09-23 10:58:07 -04:00
50c1464043
security: never bundle credential repos to R2 in plaintext
Grant Whitmer
2026-09-23 10:48:42 -04:00
7a63f90da3
ci: bridge windy-mind (private) verdicts to GitHub
Grant Whitmer
2026-09-23 09:59:28 -04:00
b8f97f0731
ops: sync never pushes archive/* branches to Windy Git
Grant Whitmer
2026-09-23 09:57:57 -04:00
95c33c8004
ops: host systemd units in git; windy-pro tags never reach Windy Git
Grant Whitmer
2026-09-23 09:51:51 -04:00
d5181f1c6d
ci: G11.5 resolved — onboard windy-pro; cloud cells + windytalk; promote script
Grant Whitmer
2026-09-23 09:49:15 -04:00
e6530d3171
test: behavioral G3.5 webhook tests (audit: tests were source-string asserts)
Grant Whitmer
2026-09-23 03:26:14 -04:00
419443573a
ci: onboard windy-hand; stop running windy-agent CI twice
Grant Whitmer
2026-09-23 03:23:25 -04:00
4a34b35441
security: CI egress filter — jobs reach the internet, never Veron/LAN
Grant Whitmer
2026-09-23 03:20:45 -04:00
dfe5543eda
docs: runbook + AGENTS match reality (item 5 of the launch bar)
Grant Whitmer
2026-09-23 03:19:12 -04:00
40cb455d0d
ci: onboard windy-translate, windytranslate-site, windytraveler-site
Grant Whitmer
2026-09-23 03:13:40 -04:00
8c404eb410
security: turn off Gitea OAuth auto-registration
Grant Whitmer
2026-09-23 03:09:43 -04:00
5b16114b98
auth: token contract v1 (aud windy_git, both issuers); CI for eternitas
Grant Whitmer
2026-09-23 02:58:56 -04:00
18ea9a4686
auth: G3.2 hub JWKS verifier — humans can sign in to the plane (SSO #14 )
Grant Whitmer
2026-09-23 02:55:17 -04:00
32e8ac8474
ci: bridge windy-registry (private) PR/main verdicts to GitHub
Grant Whitmer
2026-09-23 02:53:20 -04:00
8e9fa3116c
ci: six runners; SSO #8 Gitea sign-in hardening (staged)
Grant Whitmer
2026-09-23 02:51:56 -04:00
74ad4950b2
ci: onboard windy-drops, windy-code-web, windy-code, windy-traveler
Grant Whitmer
2026-09-23 02:49:00 -04:00
e7bbf9af51
ci: prune.sh must address dind over TCP (it has no unix socket)
Grant Whitmer
2026-09-23 02:47:35 -04:00
45686283be
ci: bound CI storage; don't bridge image-build jobs
Grant Whitmer
2026-09-23 02:47:28 -04:00
e4a15869c0
ci: onboard windy-connect + windy-search to private-repo CI
Grant Whitmer
2026-09-23 02:44:19 -04:00
Grant Whitmer
Kit OC5