coreci/broker
7
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 10 Wiki Activity

10 Releases 10 Tags

RSS Feed
  • v0.1.5 e650681755
    Compare

    v0.1.5 — CoreCI Broker v0.1 (milestone release) Stable

    coreci-bot released this 2026-10-10 15:30:14 +00:00 | 5 commits to main since this release

    Milestone v0.1 coreci-broker — the complete Requirements Specification v0.5 implementation.

    Milestone summary

    CoreCI Broker: a single-file credential broker (stdlib-only Python 3.11, <1400 lines per owner decisions D-016..D-018) for autonomous agent tools on the Open WebUI host. Derived tokens (base64(sha256(pepper:UUID:user:agent:sorted_tags))), UI allowlists, append-only JSONL audit, path-scoped secret reads via a pluggable creds source (file | OWUI API), four-page admin UI, public zero-dependency client module, reference tools. Nothing deferred — REQ-01..REQ-20 all complete.

    Phases

    • P0 pre-execution → v0.1.0 (spec, D-001..D-015, research, 30-task plan, grill Proceed 0.85)
    • P1 core skeleton → v0.1.1 (config/store/audit/hasher/token/router/mounts; 618 lines)
    • P2 admin plane → v0.1.2 (session auth, allowlists CRUD, audit query, 4-page UI; AC1/2/3/9)
    • P3 tool auth plane → v0.1.3 (register w/ pepper rule, App-auth scan+cache, state endpoints; AC4/7/8/10/12)
    • P4 secrets + client ecosystem → v0.1.4 (creds adapter, scoped secrets endpoint, client module, reference tools; AC5/6)
    • P5 final review + ship → v0.1.5 (AC1-AC14 matrix, security review PASS, README, remediation)

    Verification

    • 295 tests green (stdlib unittest; AC1-AC14 acceptance matrix pinned)
    • Security: 3 P0s found+fixed across in-verify passes (static state-file disclosure CWE-552; full-secret-store static disclosure CWE-200; register-plane hardening), STRIDE/CWE reviews PASS at P3/P5
    • Audit: reconstruction clean, 0 unresolved escalations, branch hygiene clean
    • Owner approval recorded at the P5 gate (incl. line-cap chain ratification)

    Deployment

    See README: standalone (python3 coreci_broker.py) or OWUI workspace tool; first-boot admin pass discipline; post-ship live-OWUI smoke checklist (deployed v0.11.3) before migrating real tools; 90-day adoption criterion 2027-01-09 (proxmox tool on the client module).

    Downloads