10 Releases 10 Tags

RSS Feed

• v0.1.4 cd6892a5bd

  Compare

  v0.1.4 — secrets + client ecosystem Stable

  coreci-bot released this 2026-10-10 14:41:45 +00:00 | -2 commits to main since this release

  Phase 4 (Secrets + Client Ecosystem — final execution phase) of milestone v0.1 coreci-broker.

  Delivered

  • Creds-source adapter: FileCredsSource (default data/creds.json, fresh reads) | OwuiApiCredsSource (KB→files→content, Bearer, cached, fail-closed toggle)
  • GET /api/broker/secrets/: App-auth, scope path == coreci/<agent_id> (403), traversal defense (decode-before-validate, double/triple-encode safe), every attempt audited (ok/denied/error)
  • Public client module coreci_broker_client.py (160 lines, stdlib-urllib only, zero deps): ensure-registered (idempotent), state get/put, 401→re-register→retry-once, data.get("pepper"), served unauthenticated at /static/
  • Reference OWUI tools: proxmox §11 flow (register→persist→read, safe dry-run default) + minimal auth-then-use showcase + README
  • P3 remediation batch: colon-collision class eliminated, 50-agent cap, cache eviction on overwrite, IntegrityError idempotent path, RecursionError→400, App-auth failures audited as denied
  • P0 security fix (in-verify): default static root no longer serves data/creds.json (CWE-200) — protected set extended + regression tests
  • 283 tests green; AC5/AC6 acceptance green; end-to-end: fetch client from /static/ → import → register → state → secret read

  Requirements

  REQ-07, REQ-08, REQ-19, REQ-20 — complete

  Next

  P5 final review + ship → v0.1.5 (milestone release)

  Downloads

  • broker-v0.1.4.tar.gz
    90 KiB

    2026-10-10 14:41:54 +00:00
  • Source Code (ZIP)
  • Source Code (TAR.GZ)