ochenstarik/server-monitor-manager
1
0
Fork 0
Code Issues Pull requests 6 Projects Releases 17 Packages Wiki Activity Actions
106 commits 8 branches 20 tags 2.6 MiB
Commit graph

106 commits

This branch
This branch
All branches
Author SHA1 Message Date
ochenstarik-ui
00dadf27ce
feat(control): reconcile links from factual state (#16) 
Add fact-first Link reconciliation, duplicate and orphan cleanup, generation-aware scheduling, retention, Desktop drift visibility, and strict helper contracts. Preserve exact B-3R batching and lock-safe finalization with Linux/native trimmed evidence.

Co-authored-by: Ochenstarik <ochenstarik@inbox.ru>
 2026-08-09 12:53:49 +07:00
ochenstarik-ui
2745ee55a5 fix: move permissions to job level, fix SBOM attachment 
- permissions: contents: write moved from step to job level in
  linux-release.yml (both 'bootstrap' and 'publish' jobs) and
  windows-release.yml ('package' job); step-level permissions key
  is not valid in GitHub Actions schema
- Remove redundant SBOM generation from 'bootstrap' job (no .NET
  setup there; 'publish' job already covers the full solution)
- Remove '|| true' from SBOM steps — failures are now visible
- Add SBOM JSON to upload-artifact path and release files in
  linux-release.yml (publish job) and windows-release.yml

Verified with actionlint 1.7.7 — 0 errors on all 5 workflow files
 2026-08-07 12:03:50 +07:00
ochenstarik-ui
4cc873883c chore: repo hygiene — pin actions, dependabot, SBOM, docs 
- Pin all 23 GitHub Actions uses to 40-char commit SHA with tag comments:
  actions/checkout@v6  -> d23441a48e516b6c34aea4fa41551a30e30af803 (v6.1.0)
  actions/setup-dotnet@v5 -> 26b0ec14cb23fa6904739307f278c14f94c95bf1 (v5.4.0)
  actions/upload-artifact@v6 -> b7c566a772e6b6bfb58ed0dc250532a479d7789f (v6.0.0)
  actions/download-artifact@v8 -> 3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c (v8.0.1)
  softprops/action-gh-release@v2 -> 3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 (v2.6.2)
  SHAs verified via gh api repos/<owner>/<action>/git/ref/tags/<tag>
- Move contents:write from workflow level to release steps only
- Add dotnet CycloneDX SBOM generation to linux-release and windows-release
- Add .github/dependabot.yml (github-actions + nuget, weekly, limit 5 PRs)
- Add SECURITY.md with private advisory channel, 72h SLA, threat model
- Add CHANGELOG.md from real git history (Keep a Changelog format)
- Add CONTRIBUTING.md with build/test instructions and Linux test note
- Add CODEOWNERS
- Add .github/ISSUE_TEMPLATE/{bug_report,feature_request}.md
- Add .github/PULL_REQUEST_TEMPLATE.md with mandatory verification checklist
 2026-08-07 11:40:34 +07:00
Ochenstarik
4de849e3bf docs: add product horizons, approval policies and KAgent integration spec 
Adopt the reviewed parts of the external vision document as repository
specifications, and record the work-order gates that keep unimplemented
subsystems from starting before their prerequisites are closed.

- product-horizons.md: four horizons with hard exit criteria; Horizon 0
  closes physical acceptance, signed delivery, the Monitor role and
  certificate rotation before anything new begins.
- approval-policies.md: nine approval modes over the existing binary
  confirmation, mapped onto ProvisioningJob, TTL and execution grants.
- integration-kagent.md: capability model split into read, request and
  never-grantable; untrusted-executor invariant for KAgent Worker;
  SO_PEERCRED on the discovery socket; API designed against entities
  that exist today.
- security-model.md: untrusted executors on a Node, the public web
  surface decision that must be recorded before that work starts, and
  never-grantable capabilities.
- roadmap.md: stages 14-18 for the adopted scope, pinned to horizons.

All three new documents state that nothing in them is implemented.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
 2026-08-06 18:31:09 +07:00
ochenstarik-ui
b11c277ac7
feat(control): add background link reconciliation (#12) 
Co-authored-by: Ochenstarik <ochenstarik@inbox.ru>
 2026-08-03 13:55:48 +07:00
ochenstarik-ui
89ef2fd9d3
feat(control): reconcile link policies (#11) 
* feat(control): reconcile link policies

* test(control): align factual helper sequence

---------

Co-authored-by: Ochenstarik <ochenstarik@inbox.ru>
 2026-08-03 10:52:18 +07:00
ochenstarik-ui
ba14d29211
fix(security): close desktop and helper debts (#10) 
Co-authored-by: Ochenstarik <ochenstarik@inbox.ru>
 2026-07-31 13:22:00 +07:00
ochenstarik-ui
c320b7df9c
chore(release): bump MSIX version to 1.0.0.6 (#9) 
Co-authored-by: Ochenstarik <ochenstarik@inbox.ru>
 2026-07-31 02:43:04 +07:00
ochenstarik-ui
c13501e529
fix(security): pin SSH trust and protect session keys (#8) 
Co-authored-by: Ochenstarik <ochenstarik@inbox.ru>
 2026-07-31 02:36:52 +07:00
ochenstarik-ui
93e0f8ddbd
fix(security): harden enrollment and provisioning helper (#7) 
Co-authored-by: Ochenstarik <ochenstarik@inbox.ru>
 2026-07-31 02:32:47 +07:00
ochenstarik-ui
2d28b8d19c
Execute confirmed timezone provisioning safely (#6) 
* Add standalone Linux bootstrap foundation

* Record bootstrap foundation progress

* Add single-code Node enrollment

* Validate bootstrap release payloads

* Add managed WireGuard mesh bootstrap

* Exercise repeated systemd installation in CI

* Expose systemd smoke failure diagnostics

* Fix bootstrap os-release variable collision

* Create policy helper directory during install

* Capture systemd smoke healthcheck errors

* Report Control listener diagnostics in CI

* Capture stalled Control process diagnostics

* Set service working directories

* Run protected CA healthcheck as root

* Add local Mesh emergency recovery

* Add multi-architecture Linux system matrix

* Add provisioning job control plane

* Stabilize Debian systemd smoke files

* Add node-scoped provisioning job channel

* Add provisioning progress state machine

* Reconcile expired provisioning jobs

* Add provisioning rollback workflow

* Add redacted provisioning event history

* Add restricted provisioning preflight helper

* Persist typed provisioning preflight facts

* Add preflight desired state drift detection

* Define strict base install schema catalog

* Add safe base install plan generation

* Add pre-confirmation base install plans

* Test base install plan API flow

* Authorize confirmed provisioning execution

* Execute confirmed timezone provisioning safely

* test: stabilize execution grant expiry boundary

---------

Co-authored-by: Ochenstarik <ochenstarik@inbox.ru>
 2026-07-30 21:40:30 +07:00
ochenstarik-ui
3851d87534
Add standalone Linux bootstrap foundation (#5) 
* Add standalone Linux bootstrap foundation

* Record bootstrap foundation progress

* Add single-code Node enrollment

* Validate bootstrap release payloads

* Add managed WireGuard mesh bootstrap

* Exercise repeated systemd installation in CI

* Expose systemd smoke failure diagnostics

* Fix bootstrap os-release variable collision

* Create policy helper directory during install

* Capture systemd smoke healthcheck errors

* Report Control listener diagnostics in CI

* Capture stalled Control process diagnostics

* Set service working directories

* Run protected CA healthcheck as root

* Add local Mesh emergency recovery

* Add multi-architecture Linux system matrix

* Add provisioning job control plane

* Stabilize Debian systemd smoke files

* Add node-scoped provisioning job channel

* Add provisioning progress state machine

* Reconcile expired provisioning jobs

* Add provisioning rollback workflow

* Add redacted provisioning event history

* Add restricted provisioning preflight helper

* Persist typed provisioning preflight facts

* Add preflight desired state drift detection

* Define strict base install schema catalog

* Add safe base install plan generation

* Add pre-confirmation base install plans

* Test base install plan API flow

* Authorize confirmed provisioning execution

---------

Co-authored-by: Ochenstarik <ochenstarik@inbox.ru>
 2026-07-30 21:18:39 +07:00
ochenstarik-ui
95c919ecbe
Define standalone Server Monitor Manager roadmap 
* Remove unrelated repository references

* Define standalone provisioning and VPN roadmap

---------

Co-authored-by: Ochenstarik <ochenstarik@inbox.ru>
 2026-07-19 12:59:27 +07:00
ochenstarik-ui
266900115c
Harden Link lifecycle and Control operations 
* Harden link lifecycle and control operations

* Complete three-server acceptance lifecycle

---------

Co-authored-by: Ochenstarik <ochenstarik@inbox.ru>
 2026-07-19 12:25:10 +07:00
Ochenstarik
b3dd5f0a5d Record completed installer and mesh validation 2026-07-17 09:53:28 +07:00
Ochenstarik
497f197069 Normalize Windows workflow script indentation 2026-07-17 09:49:50 +07:00
Ochenstarik
2c31a10216 Fix clean runner MSIX publishing 2026-07-17 09:49:10 +07:00
Ochenstarik
1f02310d45 Prepare alpha 5 installer release 2026-07-17 09:42:32 +07:00
Ochenstarik
5c383ec9e2 Add signed Windows MSIX release pipeline 2026-07-17 09:19:09 +07:00
Ochenstarik
a8978c085e Add dedicated desktop management pages 2026-07-17 08:51:21 +07:00
Ochenstarik
199e70c804 Add 100-node Hub load test 2026-07-17 08:28:31 +07:00
Ochenstarik
f34f902f3b Add source-scoped automation identity 2026-07-17 08:15:35 +07:00
Ochenstarik
c252701623 Make diagnostics JSON trim safe 2026-07-17 01:04:26 +07:00
Ochenstarik
160a5c683d Export redacted desktop diagnostics 2026-07-17 00:56:29 +07:00
Ochenstarik
2fe570afd8 Test kill switch helper failures 2026-07-17 00:38:54 +07:00
Ochenstarik
7cffd04d2f Enforce disabled links after reconnect 2026-07-17 00:27:42 +07:00
Ochenstarik
2d775dec92 Document alpha 4 release 2026-07-17 00:09:27 +07:00
Ochenstarik
d63554c629 Add certificate re-enrollment lifecycle 2026-07-16 23:59:52 +07:00
Ochenstarik
7774a7ffbd Merge main into Apache license and Agent buffering 2026-07-16 23:29:47 +07:00
Ochenstarik
9efd8324eb Buffer offline agent metrics 2026-07-16 23:07:36 +07:00
Ochenstarik
6b8139581c Add Apache 2.0 license 2026-07-16 22:41:35 +07:00
ochenstarik-ui
85aab2b3ed
Merge pull request #1 from ochenstarik-ui/agent/windows-ssh-monitoring 
Add Windows SSH monitoring MVP
 2026-07-16 22:25:18 +07:00
Ochenstarik
7b17df8c42 Document project in twelve languages 2026-07-16 22:20:36 +07:00
Ochenstarik
1e5e44a6ad Move Links to SQLite control plane 2026-07-16 21:59:20 +07:00
Ochenstarik
3b28ff4462 Mark alpha artifacts as prerelease 2026-07-16 20:46:57 +07:00
Ochenstarik
46a1c393c7 Add persistent mTLS control layer 2026-07-16 20:35:05 +07:00
Ochenstarik
7bd7c950a6 Protect monitoring key and add SSH terminal 2026-07-16 19:57:31 +07:00
Ochenstarik
0b642cf9a3 Persist and chart short metrics history 2026-07-16 19:46:37 +07:00
Ochenstarik
594b9aaced Show health warnings and refresh automatically 2026-07-16 19:23:47 +07:00
Ochenstarik
210acb7bbc Make Windows navigation functional 2026-07-16 19:17:12 +07:00
Ochenstarik
46f00afb7d Add server profile editing and deletion 2026-07-16 19:13:44 +07:00
Ochenstarik
bd94af38e7 Mark installer lifecycle complete 2026-07-16 19:08:16 +07:00
Ochenstarik
b19e3e8b31 Confirm applied Link state in Windows client 2026-07-16 19:02:05 +07:00
Ochenstarik
0f6dd31646 Restore ReadyToRun pack in CI 2026-07-16 18:52:48 +07:00
Ochenstarik
4fc5263c8d Restore explicit Windows runtime in CI 2026-07-16 18:48:00 +07:00
Ochenstarik
231ba69754 Add restricted Link policy controls 2026-07-16 18:43:51 +07:00
Ochenstarik
b92bb75b08 Document secure node enrollment 2026-07-16 18:31:11 +07:00
Ochenstarik
4015e3e777 Add Windows build verification 2026-07-16 18:18:03 +07:00
Ochenstarik
27e71a9831 Align specification with Hub and Node architecture 2026-07-16 18:12:40 +07:00
Ochenstarik
2708a0a786 Replace Hermes with generic AI agent 2026-07-15 23:42:29 +07:00