10 Releases 10 Tags

RSS Feed

• v0.1.3 2de11e9724

  Compare

  v0.1.3 — tool auth plane Stable

  coreci-bot released this 2026-10-10 13:28:39 +00:00 | 0 commits to main since this release

  Phase 3 (Tool Auth Plane) of milestone v0.1 coreci-broker.

  Delivered

  • POST /api/broker/agents/register: allowlist gates (403 unknown/revoked), idempotent re-derive (same token when unchanged+unexpired, overwrite on input change), pepper returned only on row-create or tokenless register (KB-loss recovery, D-005), TTL from BROKER_TOKEN_TTL
  • App-auth: Authorization: App ; UUID-scoped slow-hash scan + in-memory verified-token cache (never authoritative; row existence+expiry re-checked on hit, D-004); revoked apps honored until TTL
  • GET /api/broker/agents/: App-auth + identity match, metadata-only (D-015)
  • Agent state GET/PUT with identity enforcement; BROKER_AGENT_STATE_BACKEND=internal (SQLite, in-place schema upgrade) | owui (stub-verified adapter)
  • Security review PASS (STRIDE/CWE, 4x P2 routed to P4); P2 findings F-1/F-3 fixed + F-4 tests
  • AC14 line cap extended to <1200 (D-017) then <1400 pre-P4 (D-018, final projected)
  • 199 tests green; AC4/AC7/AC8/AC10/AC12 acceptance green

  Requirements

  REQ-02, REQ-04, REQ-09, REQ-10 — complete

  Next

  P4 secrets + client ecosystem → v0.1.4

  Downloads

  • broker-v0.1.3.tar.gz
    72 KiB

    2026-10-10 13:28:51 +00:00
  • Source Code (ZIP)
  • Source Code (TAR.GZ)