feat: add v0.6 operator evidence and verified recovery workflows - #23
Merged
Merged
Conversation
brainx
enabled auto-merge (squash)
August 9, 2026 03:57
Add schema-v2 repository audit evidence, deterministic release-v1 gating, and isolated read-only trusted command execution with exact cleanup and compatibility coverage.
## Summary - harden API authentication, access logging, connection limits, and error contracts - tighten launcher, profile-environment, process-group, workspace-path, identifier, and terminal-output boundaries - preserve the Audit v2 contracts now on `main` and add focused security regression coverage ## Verification - focused API, security, and lifecycle suites: 334 passed, 4 host-capability skips - focused Audit v2 overlap suites: 154 passed - process and lifecycle regressions: 4 passed - exact wheel build, isolated installation, and `python -I` launcher import: passed - Ruff, strict mypy, Bandit, and `git diff --check`: passed - full `scripts/test.sh` run: 1,270 passed, 9 skipped; 9 fresh-VPS cases were blocked by the desktop `/dev/fd` sandbox, and the identical module passed 14/14 outside that sandbox
…#24) Bumps [actions/attest-build-provenance](https://github.com/actions/attest-build-provenance) from 4.1.1 to 4.2.2. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/attest-build-provenance/releases">actions/attest-build-provenance's releases</a>.</em></p> <blockquote> <h2>v4.2.2</h2> <blockquote> <p>[!NOTE] As of version 4, <code>actions/attest-build-provenance</code> is simply a wrapper on top of <a href="https://github.com/actions/attest"><code>actions/attest</code></a>.</p> <p>Existing applications may continue to use the <code>attest-build-provenance</code> action, but new implementations should use <code>actions/attest</code> instead.</p> </blockquote> <h2>What's Changed</h2> <ul> <li>Bump actions/attest from 4.2.0 to 4.2.1 in the actions-minor group by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/attest-build-provenance/pull/862">actions/attest-build-provenance#862</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/attest-build-provenance/compare/v4.1.1...v4.2.2">https://github.com/actions/attest-build-provenance/compare/v4.1.1...v4.2.2</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/attest-build-provenance/commit/4d101475d8b20a2381f78447822ac1eab6504dd8"><code>4d10147</code></a> Bump actions/attest from 4.2.0 to 4.2.1 in the actions-minor group (<a href="https://redirect.github.com/actions/attest-build-provenance/issues/862">#862</a>)</li> <li><a href="https://github.com/actions/attest-build-provenance/commit/e3fe62ef559997059fe8380e7d2b4c909e2d65f4"><code>e3fe62e</code></a> Bump the actions-minor group with 2 updates (<a href="https://redirect.github.com/actions/attest-build-provenance/issues/860">#860</a>)</li> <li>See full diff in <a href="https://github.com/actions/attest-build-provenance/compare/0f67c3f4856b2e3261c31976d6725780e5e4c373...4d101475d8b20a2381f78447822ac1eab6504dd8">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: brainx <12695242+brainx@users.noreply.github.com>
Bumps [pytz](https://github.com/stub42/pytz) from 2026.2 to 2026.3.post1. <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/stub42/pytz/commit/661bca921e29dc3eedd4430bac70816c9154c05e"><code>661bca9</code></a> Bump version numbers to 2026.3.post1 for python2 fix</li> <li><a href="https://github.com/stub42/pytz/commit/1e31a162477bfd338df4651cbb55d35a86a15cd1"><code>1e31a16</code></a> Log python version running tests, force python2</li> <li><a href="https://github.com/stub42/pytz/commit/b3ca7c3fc264252e7f8162229f9d0dc4410037ee"><code>b3ca7c3</code></a> Unix line endings</li> <li><a href="https://github.com/stub42/pytz/commit/b55039a6ad038432bfc8e718f1852f54599bfa30"><code>b55039a</code></a> Replace non-ASCII character in comment to fix build with Python 2</li> <li><a href="https://github.com/stub42/pytz/commit/5420ee2c14c95abd5258c0e43381ac9430647ab8"><code>5420ee2</code></a> Replace non-ASCII character in comment</li> <li><a href="https://github.com/stub42/pytz/commit/2c139e800b5353eb6bb9649ee51fc177b51c4e9e"><code>2c139e8</code></a> Merge branch 'fix/localize-overflow-at-datetime-extremes' of <a href="https://github.c">https://github.c</a>...</li> <li><a href="https://github.com/stub42/pytz/commit/c843864ba959a0def449dfe5c4f1547308ab8eb1"><code>c843864</code></a> Run zdump tests quietly</li> <li><a href="https://github.com/stub42/pytz/commit/518500c68a9ed1f6cda32101004c38b4cc1d6fa6"><code>518500c</code></a> Reduce noise when collecting zdump info dumps</li> <li><a href="https://github.com/stub42/pytz/commit/081f935fbc519305e147480ecd3410052f07816c"><code>081f935</code></a> Merge branch 'kytta-fix-dst' into 2026c</li> <li><a href="https://github.com/stub42/pytz/commit/8c9d69b125dabe489741e1eb24ba14fcf4a7e7c9"><code>8c9d69b</code></a> Merge branch 'master' into 2026c</li> <li>Additional commits viewable in <a href="https://github.com/stub42/pytz/compare/release_2026.2...release_2026.3.post1">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: brainx <12695242+brainx@users.noreply.github.com>
Bumps [tqdm](https://github.com/tqdm/tqdm) from 4.69.1 to 4.70.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/tqdm/tqdm/releases">tqdm's releases</a>.</em></p> <blockquote> <h2>tqdm v4.70.0 stable</h2> <ul> <li><code>contrib.concurrent</code>: major improvements <ul> <li>support <code>process_map(mp_context, max_tasks_per_child)</code>, <code>thread_map(thread_name_prefix)</code> (<a href="https://redirect.github.com/tqdm/tqdm/issues/1265">#1265</a>)</li> <li>fix <code>total</code> based on shortest iterable length (<a href="https://redirect.github.com/tqdm/tqdm/issues/1473">#1473</a>)</li> <li>use default <code>max_workers</code> (<a href="https://redirect.github.com/tqdm/tqdm/issues/1543">#1543</a> <- <a href="https://redirect.github.com/tqdm/tqdm/issues/1530">#1530</a>, <a href="https://redirect.github.com/tqdm/tqdm/issues/1518">#1518</a>)</li> <li>support <code>timeout</code>, <code>buffersize</code> (<a href="https://redirect.github.com/tqdm/tqdm/issues/1576">#1576</a>)</li> <li>improve ETA (<a href="https://redirect.github.com/tqdm/tqdm/issues/1708">#1708</a> <- <a href="https://redirect.github.com/tqdm/tqdm/issues/1161">#1161</a>)</li> <li>update <code>as_completed</code> (<a href="https://redirect.github.com/tqdm/tqdm/issues/1709">#1709</a> <- <a href="https://redirect.github.com/tqdm/tqdm/issues/1565">#1565</a>)</li> <li>add <code>tqdm.concurrent.intepreter_map</code> (<a href="https://redirect.github.com/tqdm/tqdm/issues/1777">#1777</a>)</li> </ul> </li> <li><code>asyncio</code>: support iterables with only <code>__aiter__</code> (<a href="https://redirect.github.com/tqdm/tqdm/issues/1714">#1714</a> <- <a href="https://redirect.github.com/tqdm/tqdm/issues/1686">#1686</a>)</li> <li>support <code>reset(float("inf"))</code> (<a href="https://redirect.github.com/tqdm/tqdm/issues/1783">#1783</a> <- <a href="https://redirect.github.com/tqdm/tqdm/issues/1781">#1781</a>, <a href="https://redirect.github.com/tqdm/tqdm/issues/651">#651</a>)</li> <li>framework: test & reduce wheel size (<a href="https://redirect.github.com/tqdm/tqdm/issues/1782">#1782</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/tqdm/tqdm/commit/96f2e60e4584cdab57a23602e27043d0465254ad"><code>96f2e60</code></a> Merge pull request <a href="https://redirect.github.com/tqdm/tqdm/issues/1777">#1777</a> from shermansiu/feat/interpreter-pool</li> <li><a href="https://github.com/tqdm/tqdm/commit/c27393ec3a0a91d83dd53f04b80ee61f9c0cd5e4"><code>c27393e</code></a> misc tidy</li> <li><a href="https://github.com/tqdm/tqdm/commit/061c6236d56f8c1ed0934606c3b4ee5c59cf122e"><code>061c623</code></a> Disable <code>tqdm.monitor_interval</code> for subinterpreters because they do not have ...</li> <li><a href="https://github.com/tqdm/tqdm/commit/9fc160ba7f959f955058985b0d1122fc9f0b2729"><code>9fc160b</code></a> Update how we check for <code>interpreter_map</code> support in the tests</li> <li><a href="https://github.com/tqdm/tqdm/commit/b42463a20fffc17ad4df2aa145076afb0dc4486d"><code>b42463a</code></a> Ensure that subinterpreters can import tqdm while unpickling the initializer</li> <li><a href="https://github.com/tqdm/tqdm/commit/16d5486c402a2808ec9c398538e0bc56d00866de"><code>16d5486</code></a> Add support for nested progress bars</li> <li><a href="https://github.com/tqdm/tqdm/commit/9f5890fda6cf43e66782fbf34647f808bdc66d58"><code>9f5890f</code></a> Add initial implementation for interpreter_map</li> <li><a href="https://github.com/tqdm/tqdm/commit/321f920bb7368e27eee04fed1c0de2a8a236fd9d"><code>321f920</code></a> Merge pull request <a href="https://redirect.github.com/tqdm/tqdm/issues/1783">#1783</a> from LuShadowX/reset-inf-total</li> <li><a href="https://github.com/tqdm/tqdm/commit/4664b5701ebc5299290a1fb31a229fb1bfc64703"><code>4664b57</code></a> minor tidy</li> <li><a href="https://github.com/tqdm/tqdm/commit/426a0988a1e9970041f5a649ae8a6376c5293fbe"><code>426a098</code></a> Treat inf total as unknown in reset() too</li> <li>Additional commits viewable in <a href="https://github.com/tqdm/tqdm/compare/v4.69.1...v4.70.0">compare view</a></li> </ul> </details> <br /> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: brainx <12695242+brainx@users.noreply.github.com>
….6-operator-workflows
brainx
changed the title
brainx
disabled auto-merge
September 7, 2026 00:31
brainx
enabled auto-merge (squash)
September 7, 2026 00:31
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Zeus now exposes persisted reconciliation runs and fleet attention state without starting another reconciliation or probing gateways. The v0.6 development package adds paginated
zeus reconcile list/showandzeus fleet statuscommands plus strictly authenticated/reconcile/runs,/reconcile/runs/<run-id>, and/fleetendpoints. Fleet responses distinguish cached observation freshness from live health and include pending intent and restart budget.Schema v7 adds indexes for history ordering and latest observations. Existing lifecycle routes retain their response shapes. The one-shot reconcile unit preserves gateways after a pass exits, and a required Ubuntu installed-wheel drill checks API interruption, pending-intent recovery, timer persistence, quiesced backup/restore, and exact-owned shutdown before preview artifacts are uploaded.
Cross-process shutdown now recognizes a confirmed Linux/macOS zombie when its API parent has not reaped it. Unreadable native state remains unknown, and the existing process ownership and generation checks still gate signals. A real subprocess regression preserves the parent while a separate CLI completes shutdown.
Olymp compatibility is coordinated in https://github.com/brainx/olymp/pull/6, preserving exact v0.5/schema-v6 checks while adding exact v0.6.0.dev0/schema-v7 support.
Test Evidence
make release-checkpassed: both 1,390-test runs (3 skips each), 83.12% branch/source coverage, repository contracts, Ruff, mypy, Bandit, ShellCheck, wheel/sdist build, installed-wheel smoke, Twine, and checksums.9bb9fa48c6199ad4a2d0bdc8535eb0456a0d16dc: interrupted API intent recovered, timer preserved the gateway, backup restored, exact-owned gateway stopped, cleanup completed.0.6.0.dev0.Risk
KillMode=processis deliberate for the one-shot reconciler. Stopping the timer does not stop gateways; operators must use Zeus lifecycle shutdown. The API retains its existing cgroup cleanup.