ochenstarik/server-monitor-manager
1
0
Fork 0
Code Issues Pull requests 6 Projects Releases 17 Packages Wiki Activity Actions
140 commits 8 branches 20 tags 2.6 MiB
Commit graph

140 commits

This branch
This branch
All branches
Author SHA1 Message Date
ochenstarik-ui
ad396fd6a2 fix(tests): Fix Test4 broken JSON, Test2 false positive, add cleanup trap and Test9/Test10 2026-08-10 20:07:49 +07:00
ochenstarik-ui
4f583c9a03 feat(security): Finalize Queue B signed delivery requirements 2026-08-10 19:58:58 +07:00
ochenstarik-ui
ef137bcf7a fix(bootstrap): verify compatible component versions during updates 
- Fixed archive hash extraction from manifest using archive basename
- Added version compatibility checks for Control/Agent/helper in update_role
- Expanded UpdateService tests to 4 unit tests
- Verified against alpha.8 manifest
 2026-08-10 18:12:22 +07:00
ochenstarik-ui
2ca059f0b3
Merge pull request #33 from ochenstarik-ui/hermes/release-single-writer 
Enforce a single immutable release publisher
 2026-08-10 17:49:16 +07:00
Ochenstarik
004f01a842 [verified] Enforce a single release publisher 2026-08-10 17:43:18 +07:00
ochenstarik-ui
d0a46f511b
Merge pull request #32 from ochenstarik-ui/hermes/monitor-snapshot-contract 
Fix Monitor snapshot contract and alpha.9 release compatibility
 2026-08-10 17:31:09 +07:00
Ochenstarik
12dfaf71e8 [verified] Fix monitor snapshot contract and release compatibility 2026-08-10 17:24:07 +07:00
ochenstarik-ui
ad180e9a7e fix(ci): fix casing in windows artifacts download 2026-08-10 15:42:17 +07:00
ochenstarik-ui
1ff4391eba
Merge pull request #29 from ochenstarik-ui/feat/monitor-role 
feat(monitor): implement monitor role
 2026-08-10 15:04:28 +07:00
ochenstarik-ui
9c2440412d feat(monitor): add monitor role installation 2026-08-10 15:04:08 +07:00
ochenstarik-ui
fda9c6dce8 Merge PR #28: repair CycloneDX release jobs 2026-08-10 14:54:29 +07:00
ochenstarik-ui
a17efa0e5c
fix(ci): update CycloneDX release invocation (#27) 
Co-authored-by: Ochenstarik <ochenstarik@inbox.ru>
 2026-08-10 14:52:29 +07:00
ochenstarik-ui
04eab57ef1 Merge branch 'antigravity/signed-delivery-queue-a' 2026-08-10 14:34:57 +07:00
ochenstarik-ui
9972377e9e Merge branch 'antigravity/cert-lifecycle' 2026-08-10 13:54:30 +07:00
ochenstarik-ui
f3aed21aea style: fix trailing whitespace in SchemaCompatibilityTests.cs 2026-08-10 13:35:50 +07:00
ochenstarik-ui
dfab4f4a33 feat: Set PROGRAM_VERSION in dotnet publish and msix 2026-08-10 13:34:38 +07:00
ochenstarik-ui
39736dcee0 Fix CI failure in SQLite compat test 2026-08-10 13:32:36 +07:00
ochenstarik-ui
03e3683074 Add SQLite backward compatibility test (Hermes Task 1) 2026-08-10 13:26:21 +07:00
ochenstarik-ui
32ee96c039 fix: keep 5 workflows 2026-08-10 12:11:31 +07:00
ochenstarik-ui
79a5e8c071 feat: Manifest v2 and keyless signing 2026-08-10 12:06:53 +07:00
ochenstarik-ui
c30a1fc56e feat(cert): refine certificate renewal endpoints, remove TEST_EVIDENCE.md, and add 401 rejection unit test 2026-08-10 12:01:44 +07:00
ochenstarik-ui
25a93f7b35 feat: client certificate lifecycle management, auto-renewal, and CA rotation guide 2026-08-10 12:01:43 +07:00
dependabot[bot]
df4dfd177a
Bump SQLitePCLRaw.bundle_e_sqlite3 from 2.1.12 to 3.0.5 (#23) 
* Bump SQLitePCLRaw.bundle_e_sqlite3 from 2.1.12 to 3.0.5

---
updated-dependencies:
- dependency-name: SQLitePCLRaw.bundle_e_sqlite3
  dependency-version: 3.0.5
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

* build: update Control.Tests lockfile for SQLite 3.0.5

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: ochenstarik-ui <ochenstarik@gmail.com>
 2026-08-10 00:54:27 +07:00
dependabot[bot]
ebd9ae5ac4
Bump Microsoft.NET.Test.Sdk from 18.0.1 to 18.8.1 (#22) 
* Bump Microsoft.NET.Test.Sdk from 18.0.1 to 18.8.1

---
updated-dependencies:
- dependency-name: Microsoft.NET.Test.Sdk
  dependency-version: 18.8.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

* build: update Desktop Security lockfile for Microsoft.NET.Test.Sdk 18.8.1

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: ochenstarik-ui <ochenstarik@gmail.com>
 2026-08-10 00:45:57 +07:00
dependabot[bot]
3f338840c6
Bump actions/checkout from 6.1.0 to 7.0.1 (#21) 
Bumps [actions/checkout](https://github.com/actions/checkout) from 6.1.0 to 7.0.1.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](d23441a48e...3d3c42e5aa)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 7.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-10 00:34:14 +07:00
dependabot[bot]
04a57f047b
Bump actions/upload-artifact from 6.0.0 to 7.0.1 (#20) 
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 6.0.0 to 7.0.1.
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](b7c566a772...043fb46d1a)

---
updated-dependencies:
- dependency-name: actions/upload-artifact
  dependency-version: 7.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-10 00:34:05 +07:00
dependabot[bot]
bcc79124c1
Bump actions/setup-dotnet from 5.4.0 to 6.0.0 (#19) 
Bumps [actions/setup-dotnet](https://github.com/actions/setup-dotnet) from 5.4.0 to 6.0.0.
- [Release notes](https://github.com/actions/setup-dotnet/releases)
- [Commits](26b0ec14cb...a98b56852c)

---
updated-dependencies:
- dependency-name: actions/setup-dotnet
  dependency-version: 6.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-10 00:33:48 +07:00
dependabot[bot]
a25f04e24b
Bump softprops/action-gh-release from 2.6.2 to 3.0.2 (#18) 
Bumps [softprops/action-gh-release](https://github.com/softprops/action-gh-release) from 2.6.2 to 3.0.2.
- [Release notes](https://github.com/softprops/action-gh-release/releases)
- [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md)
- [Commits](3bb12739c2...3d0d9888cb)

---
updated-dependencies:
- dependency-name: softprops/action-gh-release
  dependency-version: 3.0.2
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-10 00:33:35 +07:00
ochenstarik-ui
80b4797f2a
fix(enrollment): repair node enrollment path (#24) 
* fix(enrollment): repair node enrollment path

Make trimmed Agent configuration fail closed, harden Control URL validation, add device-code and bootstrap delivery, and make alpha.7 Control updates migration- and recovery-safe.

* fix(enrollment): allow agent token cleanup

---------

Co-authored-by: Ochenstarik <ochenstarik@inbox.ru>
 2026-08-09 22:32:53 +07:00
ochenstarik-ui
1b798e7ee8
Merge pull request #15 from ochenstarik-ui/antigravity/reproducible-builds 
feat: reproducible builds — central package versions and lock files
 2026-08-09 19:08:08 +07:00
ochenstarik-ui
0f1a653eca
Merge pull request #14 from ochenstarik-ui/antigravity/repo-hygiene 
chore: repo hygiene — pin actions, dependabot, SBOM, security docs
 2026-08-09 19:08:02 +07:00
ochenstarik-ui
2ab32490a5
Merge pull request #13 from ochenstarik-ui/docs/product-horizons-and-integration 
docs: product horizons, approval policies and KAgent integration spec
 2026-08-09 19:07:55 +07:00
ochenstarik-ui
ec78537656 feat: reproducible builds — central package versions and lock files 2026-08-09 18:13:34 +07:00
ochenstarik-ui
d645812d29
test(helper): cover missing node row (#17) 
Co-authored-by: Ochenstarik <ochenstarik@inbox.ru>
 2026-08-09 17:56:13 +07:00
ochenstarik-ui
00dadf27ce
feat(control): reconcile links from factual state (#16) 
Add fact-first Link reconciliation, duplicate and orphan cleanup, generation-aware scheduling, retention, Desktop drift visibility, and strict helper contracts. Preserve exact B-3R batching and lock-safe finalization with Linux/native trimmed evidence.

Co-authored-by: Ochenstarik <ochenstarik@inbox.ru>
 2026-08-09 12:53:49 +07:00
ochenstarik-ui
2745ee55a5 fix: move permissions to job level, fix SBOM attachment 
- permissions: contents: write moved from step to job level in
  linux-release.yml (both 'bootstrap' and 'publish' jobs) and
  windows-release.yml ('package' job); step-level permissions key
  is not valid in GitHub Actions schema
- Remove redundant SBOM generation from 'bootstrap' job (no .NET
  setup there; 'publish' job already covers the full solution)
- Remove '|| true' from SBOM steps — failures are now visible
- Add SBOM JSON to upload-artifact path and release files in
  linux-release.yml (publish job) and windows-release.yml

Verified with actionlint 1.7.7 — 0 errors on all 5 workflow files
 2026-08-07 12:03:50 +07:00
ochenstarik-ui
4cc873883c chore: repo hygiene — pin actions, dependabot, SBOM, docs 
- Pin all 23 GitHub Actions uses to 40-char commit SHA with tag comments:
  actions/checkout@v6  -> d23441a48e516b6c34aea4fa41551a30e30af803 (v6.1.0)
  actions/setup-dotnet@v5 -> 26b0ec14cb23fa6904739307f278c14f94c95bf1 (v5.4.0)
  actions/upload-artifact@v6 -> b7c566a772e6b6bfb58ed0dc250532a479d7789f (v6.0.0)
  actions/download-artifact@v8 -> 3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c (v8.0.1)
  softprops/action-gh-release@v2 -> 3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 (v2.6.2)
  SHAs verified via gh api repos/<owner>/<action>/git/ref/tags/<tag>
- Move contents:write from workflow level to release steps only
- Add dotnet CycloneDX SBOM generation to linux-release and windows-release
- Add .github/dependabot.yml (github-actions + nuget, weekly, limit 5 PRs)
- Add SECURITY.md with private advisory channel, 72h SLA, threat model
- Add CHANGELOG.md from real git history (Keep a Changelog format)
- Add CONTRIBUTING.md with build/test instructions and Linux test note
- Add CODEOWNERS
- Add .github/ISSUE_TEMPLATE/{bug_report,feature_request}.md
- Add .github/PULL_REQUEST_TEMPLATE.md with mandatory verification checklist
 2026-08-07 11:40:34 +07:00
Ochenstarik
4de849e3bf docs: add product horizons, approval policies and KAgent integration spec 
Adopt the reviewed parts of the external vision document as repository
specifications, and record the work-order gates that keep unimplemented
subsystems from starting before their prerequisites are closed.

- product-horizons.md: four horizons with hard exit criteria; Horizon 0
  closes physical acceptance, signed delivery, the Monitor role and
  certificate rotation before anything new begins.
- approval-policies.md: nine approval modes over the existing binary
  confirmation, mapped onto ProvisioningJob, TTL and execution grants.
- integration-kagent.md: capability model split into read, request and
  never-grantable; untrusted-executor invariant for KAgent Worker;
  SO_PEERCRED on the discovery socket; API designed against entities
  that exist today.
- security-model.md: untrusted executors on a Node, the public web
  surface decision that must be recorded before that work starts, and
  never-grantable capabilities.
- roadmap.md: stages 14-18 for the adopted scope, pinned to horizons.

All three new documents state that nothing in them is implemented.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
 2026-08-06 18:31:09 +07:00
ochenstarik-ui
b11c277ac7
feat(control): add background link reconciliation (#12) 
Co-authored-by: Ochenstarik <ochenstarik@inbox.ru>
 2026-08-03 13:55:48 +07:00
ochenstarik-ui
89ef2fd9d3
feat(control): reconcile link policies (#11) 
* feat(control): reconcile link policies

* test(control): align factual helper sequence

---------

Co-authored-by: Ochenstarik <ochenstarik@inbox.ru>
 2026-08-03 10:52:18 +07:00
ochenstarik-ui
ba14d29211
fix(security): close desktop and helper debts (#10) 
Co-authored-by: Ochenstarik <ochenstarik@inbox.ru>
 2026-07-31 13:22:00 +07:00
ochenstarik-ui
c320b7df9c
chore(release): bump MSIX version to 1.0.0.6 (#9) 
Co-authored-by: Ochenstarik <ochenstarik@inbox.ru>
 2026-07-31 02:43:04 +07:00
ochenstarik-ui
c13501e529
fix(security): pin SSH trust and protect session keys (#8) 
Co-authored-by: Ochenstarik <ochenstarik@inbox.ru>
 2026-07-31 02:36:52 +07:00
ochenstarik-ui
93e0f8ddbd
fix(security): harden enrollment and provisioning helper (#7) 
Co-authored-by: Ochenstarik <ochenstarik@inbox.ru>
 2026-07-31 02:32:47 +07:00
ochenstarik-ui
2d28b8d19c
Execute confirmed timezone provisioning safely (#6) 
* Add standalone Linux bootstrap foundation

* Record bootstrap foundation progress

* Add single-code Node enrollment

* Validate bootstrap release payloads

* Add managed WireGuard mesh bootstrap

* Exercise repeated systemd installation in CI

* Expose systemd smoke failure diagnostics

* Fix bootstrap os-release variable collision

* Create policy helper directory during install

* Capture systemd smoke healthcheck errors

* Report Control listener diagnostics in CI

* Capture stalled Control process diagnostics

* Set service working directories

* Run protected CA healthcheck as root

* Add local Mesh emergency recovery

* Add multi-architecture Linux system matrix

* Add provisioning job control plane

* Stabilize Debian systemd smoke files

* Add node-scoped provisioning job channel

* Add provisioning progress state machine

* Reconcile expired provisioning jobs

* Add provisioning rollback workflow

* Add redacted provisioning event history

* Add restricted provisioning preflight helper

* Persist typed provisioning preflight facts

* Add preflight desired state drift detection

* Define strict base install schema catalog

* Add safe base install plan generation

* Add pre-confirmation base install plans

* Test base install plan API flow

* Authorize confirmed provisioning execution

* Execute confirmed timezone provisioning safely

* test: stabilize execution grant expiry boundary

---------

Co-authored-by: Ochenstarik <ochenstarik@inbox.ru>
 2026-07-30 21:40:30 +07:00
ochenstarik-ui
3851d87534
Add standalone Linux bootstrap foundation (#5) 
* Add standalone Linux bootstrap foundation

* Record bootstrap foundation progress

* Add single-code Node enrollment

* Validate bootstrap release payloads

* Add managed WireGuard mesh bootstrap

* Exercise repeated systemd installation in CI

* Expose systemd smoke failure diagnostics

* Fix bootstrap os-release variable collision

* Create policy helper directory during install

* Capture systemd smoke healthcheck errors

* Report Control listener diagnostics in CI

* Capture stalled Control process diagnostics

* Set service working directories

* Run protected CA healthcheck as root

* Add local Mesh emergency recovery

* Add multi-architecture Linux system matrix

* Add provisioning job control plane

* Stabilize Debian systemd smoke files

* Add node-scoped provisioning job channel

* Add provisioning progress state machine

* Reconcile expired provisioning jobs

* Add provisioning rollback workflow

* Add redacted provisioning event history

* Add restricted provisioning preflight helper

* Persist typed provisioning preflight facts

* Add preflight desired state drift detection

* Define strict base install schema catalog

* Add safe base install plan generation

* Add pre-confirmation base install plans

* Test base install plan API flow

* Authorize confirmed provisioning execution

---------

Co-authored-by: Ochenstarik <ochenstarik@inbox.ru>
 2026-07-30 21:18:39 +07:00
ochenstarik-ui
95c919ecbe
Define standalone Server Monitor Manager roadmap 
* Remove unrelated repository references

* Define standalone provisioning and VPN roadmap

---------

Co-authored-by: Ochenstarik <ochenstarik@inbox.ru>
 2026-07-19 12:59:27 +07:00
ochenstarik-ui
266900115c
Harden Link lifecycle and Control operations 
* Harden link lifecycle and control operations

* Complete three-server acceptance lifecycle

---------

Co-authored-by: Ochenstarik <ochenstarik@inbox.ru>
 2026-07-19 12:25:10 +07:00
Ochenstarik
b3dd5f0a5d Record completed installer and mesh validation 2026-07-17 09:53:28 +07:00
Ochenstarik
497f197069 Normalize Windows workflow script indentation 2026-07-17 09:49:50 +07:00