kami/Maven
1
0
Fork 0
Code Issues 1 Pull Requests 1 Actions Packages Projects Releases Wiki Activity

progress: mark revert step-up gate and go.mod deps as closed

Browse Source 
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
kami
2026-07-06 12:04:36 +04:00
parent f2b97e4ab9
commit 9c2ccad7ef
1 changed files with 6 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
PROGRESS.md
+6 -6
View File
@@ -184,15 +184,15 @@ The overnight session (`SESSION-05-07-2026.md`, 25 tasks) closed the previous
1. **Purge + rotate the leaked db key** — a live AES key was committed at 1. **Purge + rotate the leaked db key** — a live AES key was committed at
`deploy/db_key.env` before it was gitignored. It must be scrubbed from git `deploy/db_key.env` before it was gitignored. It must be scrubbed from git
history and rotated. Operator action, highest urgency. history and rotated. Operator action, highest urgency.
2. **Step-up gate on `/api/revert`** — it mutates the store (voids facts) but 2. **Cold-start unlock** — the at-rest key still comes from env/config; the
has no passkey gate, unlike POST `/tools`. Inconsistent with the auth model.
3. **Cold-start unlock** — the at-rest key still comes from env/config; the
passkey→key L3 dance is a documented seam, not a feature. Until then the key passkey→key L3 dance is a documented seam, not a feature. Until then the key
sits in the container env. sits in the container env.
4. **Multi-user (SPEC item 8)** — deliberately deferred, see the tail. 3. **Multi-user (SPEC item 8)** — deliberately deferred, see the tail.
Housekeeping: `go.mod` isn't tidied — `onnxruntime_go`, `coder/websocket`, and Closed (jul6 follow-ups): `/api/revert` now sits behind the same passkey
`robfig/cron` are used directly but marked `// indirect`. step-up as POST `/tools`; `go.mod` direct deps (`onnxruntime_go`,
`coder/websocket`, `robfig/cron`) are labeled correctly — `go mod tidy` can't
run here because it walks the vendored `deps/go` toolchain tree.
Done earlier (2026-07-03): **act tool executor, store-backed, full flow** Done earlier (2026-07-03): **act tool executor, store-backed, full flow**
(`internal/tool` + `internal/store/tools.go` + `tools` CoreAPI methods). (`internal/tool` + `internal/store/tools.go` + `tools` CoreAPI methods).