Grant Whitmer

windyadmin pushed to main at windyadmin/windy-git

2026-10-01 09:34:03 +00:00

ef96051d6f Merge pull request #2 from sneakyfree/runner-guard

a0dc6f8568 runner-guard: block workflows that hand a self-hosted runner to strangers (Boss 10-01)

Compare 2 commits »

windyadmin pushed to runner-guard at windyadmin/windy-git

2026-10-01 09:29:02 +00:00

a0dc6f8568 runner-guard: block workflows that hand a self-hosted runner to strangers (Boss 10-01)

windyadmin created branch runner-guard in windyadmin/windy-git

2026-10-01 09:29:02 +00:00

windyadmin pushed to main at windyadmin/windy-git

2026-10-01 09:08:58 +00:00

51e0b9d30b bridge + sync: onboard windy-calendar-site (static, no workflows; guards only)

windyadmin pushed to main at windyadmin/windy-git

2026-10-01 08:53:49 +00:00

51777b0ad0 bridge + sync: onboard windy-hand-site (static site, no workflows yet; guards only)

windyadmin pushed to main at windyadmin/windy-git

2026-10-01 08:03:39 +00:00

cbcb4c206b docs: CUTOVER-PRIMARY.md checklist (draft, nothing flipped)

windyadmin pushed to main at windyadmin/windy-git

2026-10-01 07:58:37 +00:00

2c62e2834a secret-guard allow: windy-agent #412 synthetic Z.ai fixture (hash not in lockbox)

windyadmin created branch veron-ollama-warn in windyadmin/windy-git

2026-10-01 07:38:21 +00:00

windyadmin pushed to veron-ollama-warn at windyadmin/windy-git

2026-10-01 07:38:21 +00:00

windyadmin pushed to main at windyadmin/windy-git

2026-10-01 07:38:21 +00:00

3a9b7ecab7 Merge pull request #1 from sneakyfree/veron-ollama-warn

cd0400c371 compute-guard: WARN (never red) on NEW references to Veron Ollama :11434

Compare 2 commits »

windyadmin pushed to main at windyadmin/windy-git

2026-10-01 07:28:21 +00:00

4e7ab667ed backup_state: pin restic cache dir (systemd has no HOME); init only on a MISSING repo, log other errors

windyadmin pushed to main at windyadmin/windy-git

2026-10-01 07:23:19 +00:00

f10db19316 drill_cross_host.sh: read the R2 pair + endpoint from the lockbox (drill PASSED 10-01)

windyadmin pushed to main at windyadmin/windy-git

2026-10-01 07:03:18 +00:00

3503894a1e state backup: systemd units (NOT enabled) + cross-host drill script

windyadmin pushed to main at windyadmin/windy-git

2026-10-01 06:48:19 +00:00

fbab5c4669 secret-guard/secret-scan: PyPI API token shape (pypi-AgE macaroon), WARN-first

1b552c0882 docs: RESTORE-DRILL.md (state backup + restore procedure)

8ebc18c3bc gitea 1.24.6 -> 1.24.7 (security: LFS auth bypass, symlink bypass, OAuth2 missed return)

Compare 3 commits »

windyadmin pushed to main at windyadmin/windy-git

2026-10-01 06:43:19 +00:00

9566826ce9 lockbox-put: append-only lockbox PR tool (no one reads/greps the lockbox); installer updated

windyadmin pushed to main at windyadmin/windy-git

2026-10-01 06:38:20 +00:00

160a3d69ba backup_state.sh: encrypted restic backup of Postgres + Gitea state to R2 (SOTU 10-01 gap: DB was not backed up)

windyadmin pushed to main at windyadmin/windy-git

2026-10-01 05:17:45 +00:00

7e28a23c22 secret-scan + env-names: shared hash-only tools (Boss 10-01: lanes printed secrets while hunting them)

windyadmin pushed to main at windyadmin/windy-git

2026-10-01 05:02:32 +00:00

1da4d39c0b bridge + sync: onboard windy-text, windy-call, windy-cell (telephony in scope, GitHub Actions dead since 08-14; deploy.yml disabled)

53fbcfe78f secret-guard allow: windy-code VS Code public aiKey, windytalk redaction fixture (hash not in lockbox)

1c552e94de secret-guard: Twilio shapes (SID/API key, 32-hex secret assignment) + per-kind warn mode

Compare 3 commits »

windyadmin pushed to main at windyadmin/windy-git

2026-09-28 10:18:11 +00:00

8690c4f8d3 secret-guard allow: 5 windy-agent #395 FAKE fixtures (weekly scan 09-28; verified never in the lockbox)

windyadmin pushed to main at windyadmin/windy-git

2026-09-24 07:12:41 +00:00

313f41b49c deploy: secret-guard BLOCK drop-in (orchestrator 09-24)