Feat v0.6.6 final hardening #41

Merged
xcaliber merged 2 commits from feat/v0.6.6-final-hardening into main 2026-03-31 17:40:40 +00:00

2 Commits

Author SHA1 Message Date
f4e66afc80 Fix CI: test manifests need tools/pipes/hooks for extension type
All checks were successful
CI/CD / detect-changes (pull_request) Successful in 4s
CI/CD / test-frontend (pull_request) Successful in 6s
CI/CD / test-sqlite (pull_request) Successful in 2m46s
CI/CD / test-go-pg (pull_request) Successful in 2m47s
CI/CD / build-and-deploy (pull_request) Successful in 1m21s
ValidateManifest() now enforces type-specific constraints on bundled
install too. Two tests used type "extension" without any tools/pipes/hooks,
which is correctly rejected. Added hooks field to make them valid.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-31 17:36:14 +00:00
77ef5b43d9 Feat v0.6.6 final hardening
Some checks failed
CI/CD / detect-changes (pull_request) Successful in 4s
CI/CD / test-frontend (pull_request) Successful in 6s
CI/CD / test-go-pg (pull_request) Failing after 2m41s
CI/CD / test-sqlite (pull_request) Failing after 2m48s
CI/CD / build-and-deploy (pull_request) Has been skipped
Final pass before public release — security, correctness, developer experience.

- ValidateManifest() gate: centralized manifest validation (12 unit tests)
- Extension dependency auto-activation from bundled packages
- OIDC nonce validation: ID token nonce checked against stored state
- Schema migration stub replaced with log-only additive policy
- OptionalAuth middleware for anonymous workflow visitor routes
- Package signing schema reservation (signature field + env var)
- PublishAsync event bus counter fix
- Health UI tooltips explaining published vs delivered gap
- ICD/SDK runner updated for v0.6.x endpoints (metrics, cluster, backups, OpenAPI)
- Version bump, ROADMAP, CHANGELOG

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-31 17:22:18 +00:00