85dce28ca3
docs(PDLC): lock M3 spec v1.2 Final — Chat, Orchestration, Hardening
...
15 REQs (028-037, 041-045) with REQ-035 amendment (auto-promote at step 21).
3 personas (Devon/Sam/Casey), 5 journeys + J-infra, no orphan REQs.
Decisions #1-#10 locked; OQ1-6 resolved, OQ7 open (control_state write-through).
Migrations 0004-0006 (chat/workflow/posture), per-table for rollback isolation.
STATE.md updated: M3 spec locked, implementation pending.
---ci---
phase: 3
stage: spec-lock
milestone: v0.2-M3
spec: .ciagent/steer-m3-spec.md
spec_version: v1.2
status: ready-for-handoff
reqs: [028,029,030,031,032,033,034,035,036,037,041,042,043,044,045]
req035_amended: true
invariants: [INV-1,INV-2,INV-3,INV-4,INV-5,INV-6,INV-7,INV-8]
release: none
2026-08-25 12:41:16 +00:00
e07cd452a2
docs(audit): fix CHECKPOINT.json syntax + refresh STATE.md post-M2
...
Audit findings fixed:
- CHECKPOINT.json: missing closing brace (JSON invalid) — fixed
- STATE.md: stale M1-era content (referenced M2 as future) — refreshed to post-M2
---ci---
phase: 6
milestone: v0.2
status: complete
phase_role: final
audit: fixes_applied
---/ci---
2026-08-25 10:34:29 +00:00
9a276d62a1
docs(milestone): M2 complete — checkpoint cleared, next milestone M3
...
---ci---
phase: 6
milestone: v0.2
status: complete
phase_role: final
milestone_complete: true
---/ci---
2026-08-25 06:15:14 +00:00
0c15d3d0b2
docs(milestone): complete M2 — MCP Layer & Day 1 Adapters (v0.2)
...
M2 delivers the read-only MCP capability broker gateway and four Day-1
infrastructure adapters (Proxmox, SSH/Linux, GitHub, Gitea). 13 REQs (015-027)
all pass. 656 tests green. M1 non-regression verified.
MCP spec 2025-06-18 conformance verified (PROTOCOL.md + 7 tests).
Defense-in-depth SSH (broker layer 1 + Relay Agent layer 2 + no-shell exec).
Two-track LLM smoke (Track A mock-path P0 gate passes).
CI: Gitea Actions (.gitea/workflows/ci.yml) with Postgres 16 + RLS verification.
Phases shipped:
P0 pre-execution v0.1.0
P1 Wave F — MCP gateway v0.1.1
P2 Wave G — Proxmox v0.1.2
P3 Wave H — SSH/Linux v0.1.3
P4 Wave I — Git adapters v0.1.4
P5 Wave J — SSE+smoke+UI v0.1.5
P6 Final — review+ship v0.1.6 ← milestone release
---ci---
phase: 6
milestone: v0.2
status: complete
phase_role: final
milestone_complete: true
requirements:
covered: [REQ-015, REQ-016, REQ-017, REQ-018, REQ-019, REQ-020, REQ-021, REQ-022, REQ-023, REQ-024, REQ-025, REQ-026, REQ-027]
partial: []
---/ci---
2026-08-25 06:14:21 +00:00
2a1e6ca698
docs(PDLC): add STATE.md — Phase 0 project state intake
...
Ground-truth state for PDLC Phase 0: M1 shipped (v0.0.7, 17 REQs, 189 tests,
98% db coverage), next initiative M2+M3 to complete v0.1. Five known tensions
documented (PGlite RLS gap, no cloud infra, G-001 proxy, G-006 audit
serialization, INV-7 enforcement model unspecified).
---ci---
phase: 6
milestone: v0.1
status: complete
---/ci---
2026-08-25 02:51:54 +00:00
21724d0300
docs(ship): upstream release complete — Gitea repo + 7 releases + binaries
...
Upstream ship complete:
- Created Gitea repo: coreci/coreci-chat at https://git.cloudinit.dev
- Pushed main + 7 tags (v0.0.1 through v0.0.7)
- Created 7 Gitea releases with release notes
- Built + uploaded Relay Agent binaries (linux amd64 + arm64) to v0.0.7
- Uploaded install.sh, ssh-whitelist.json, sha256sums.txt to v0.0.7
- v0.0.7 = M1 milestone release
---ci---
phase: 6
milestone: v0.1
status: complete
---/ci---
2026-08-25 02:35:31 +00:00
bb85e833d0
Merge milestone/v0.1-bootstrap into main
...
CoreCI Chat v0.1 — Read-Only Diagnostic MVP complete.
Milestone: v0.1 (Feature). 17 M1 REQs complete. 189 tests green.
M1 acceptance gate PASSED (spec §2.3).
This is the first milestone release. Tags v0.0.1 through v0.0.7
record each phase; v0.0.7 IS the v0.1 milestone release.
---ci---
phase: 6
milestone: v0.1
status: complete
---/ci---
2026-08-25 02:25:33 +00:00
901536dd44
Merge phase/06-final-review-ship into milestone/v0.1-bootstrap
...
Final phase complete. M1 milestone release.
---ci---
phase: 6
milestone: v0.1
status: complete
---/ci---
2026-08-25 02:25:29 +00:00
33207ab89a
docs(milestone): complete CoreCI Chat v0.1 — Read-Only Diagnostic MVP
...
M1 acceptance gate PASSED (spec §2.3):
- SSO signup via WorkOS (REQ-001, 002)
- BYOM endpoint config + green validation (REQ-006, 007)
- Relay Agent install via curl|bash on Ubuntu/Debian (REQ-010)
- Outbound WebSocket + registration + heartbeat (REQ-011, 012, 013)
- Green status in admin dashboard (REQ-014)
- Audit logging, RLS, secret manager operational (REQ-038, 039, 040)
All 17 M1 REQs complete. 189 tests green (148 TS + 17 Go + 24 install).
DB coverage 98%. All 10 grill fixes applied.
Review deliverables in .ciagent/M1-REVIEW.md:
1. Per-REQ pass/fail test report (17/17 PASS)
2. Demo path: SSO → BYOM green → install → register → green dashboard
3. Cross-tenant isolation pen test (zero leakage)
4. Install logs: Ubuntu 24.04 pass, Debian 12+ pass, ≥2 unsupported OS abort
---ci---
phase: 6
milestone: v0.1
status: complete
requirements:
covered: [REQ-001, REQ-002, REQ-003, REQ-004, REQ-005, REQ-006, REQ-007, REQ-008, REQ-009, REQ-010, REQ-011, REQ-012, REQ-013, REQ-014, REQ-026-partial, REQ-038, REQ-039, REQ-040]
partial: [REQ-026]
---/ci---
2026-08-25 02:25:23 +00:00
f28769ee69
Merge phase/05-dashboard into milestone/v0.1-bootstrap
...
Wave E (dashboard surfacing) complete. All 5 execution waves shipped.
---ci---
phase: 5
milestone: v0.1
status: complete
---/ci---
2026-08-25 02:22:30 +00:00
dfc6b8ff76
feat(P5): Wave E dashboard surfacing — agent status, health, logs, audit export
...
REQ-014: surface relay agent health (green/yellow/red), target hostname,
last 100 log lines in admin dashboard. Per-tenant view under RLS.
---ci---
phase: 5
milestone: v0.1
status: execute
---/ci---
2026-08-25 02:21:51 +00:00
d0465a4c71
Merge phase/04-relay-agent into milestone/v0.1-bootstrap
...
Wave D (relay agent) complete.
---ci---
phase: 4
milestone: v0.1
status: complete
---/ci---
# Conflicts:
# apps/control-plane/lib/auth.ts
# apps/control-plane/lib/db.ts
# apps/control-plane/tsconfig.json
# apps/control-plane/vitest.config.ts
# pnpm-lock.yaml
2026-08-25 02:04:35 +00:00
a7bce7e44a
Merge phase/03-byom into milestone/v0.1-bootstrap
...
Wave C (BYOM) complete.
---ci---
phase: 3
milestone: v0.1
status: complete
---/ci---
# Conflicts:
# apps/control-plane/package.json
# apps/control-plane/tsconfig.json
# pnpm-lock.yaml
2026-08-25 02:04:16 +00:00
ca87dbf4b1
Merge phase/02-identity-rbac into milestone/v0.1-bootstrap
...
Wave B (identity & RBAC) complete.
---ci---
phase: 2
milestone: v0.1
status: complete
---/ci---
2026-08-25 02:03:47 +00:00
86f7dcc10b
feat(P4): Wave D relay agent — Go binary, install script, WebSocket, SSH whitelist hook
...
REQ-010: modular install script (detect_os/install_binary/write_systemd_unit/register_target)
REQ-011: outbound WebSocket from relay agent to SaaS
REQ-012: register with tenant + target metadata
REQ-013: heartbeat + exponential backoff reconnect (max 5 → alert)
REQ-026 partial: SSH whitelist file + CheckCommand hook (G-004 contract lock,
G-007 shadow exec.Cmd test, G-008 scope statement)
G-009: unsupported-OS abort with actionable error
---ci---
phase: 4
milestone: v0.1
status: execute
---/ci---
2026-08-25 02:03:04 +00:00
3b8345dfe0
feat(P3): Wave C BYOM — endpoint registry, validate-on-save, routing shim
...
REQ-006: configure BYOM endpoint (URL in DB, key in secret manager)
REQ-007: validate-on-save test inference call (OpenAI-compatible)
REQ-008: route all inference to BYOM (G-001: test-inference proxy endpoint)
REQ-009: reject when unconfigured/unreachable (ByomUnconfiguredError/ByomUnreachableError)
---ci---
phase: 3
milestone: v0.1
status: execute
---/ci---
2026-08-25 01:54:20 +00:00
bcca7686ee
feat(P2): Wave B identity & RBAC — WorkOS SSO, tenant provisioning, RBAC at gateway
...
REQ-001: SSO session via WorkOS (getAuthorizationUrl + exchangeCodeForSession)
REQ-002: tenant provisioning on first signup (admin role)
REQ-003: invitations via single-use acceptance link
REQ-004: RBAC role assignment (admin/operator/viewer)
REQ-005: RBAC enforcement at API gateway from first endpoint (/api/me)
---ci---
phase: 2
milestone: v0.1
status: execute
---/ci---
2026-08-25 01:47:56 +00:00
3246442906
Merge phase/01-foundations into milestone/v0.1-bootstrap
...
Wave A (foundations) complete. Proceeding to Wave B (identity/RBAC), Wave C (BYOM), Wave D (relay agent).
---ci---
phase: 1
milestone: v0.1
status: complete
---/ci---
2026-08-25 01:34:19 +00:00
be70f56657
feat(P1): Wave A foundations — monorepo, DB+RLS, audit, secrets, runtime
...
Wave A (Phase 1) implements the M1 foundations for REQ-038, REQ-039, REQ-040:
Monorepo scaffold (pnpm workspaces, TS strict, NodeNext):
- apps/control-plane (Next.js App Router scaffold — Wave B adds routes)
- apps/relay-agent (Go module scaffold — Wave D adds WebSocket + install)
- packages/db, packages/secrets, packages/runtime, packages/config
packages/db (REQ-038, REQ-039):
- 0001_init.sql: tenants, users, tenant_memberships, targets, byom_endpoints,
invitations, audit_log (append-only hash-chain), runtime_health (not audited)
- RLS policies on all tenant-scoped tables + FORCE ROW LEVEL SECURITY
- withTenant(tenantId, fn): SET LOCAL app.tenant_id + transaction
- audit.ts: appendAudit with sha256(prev_hash || canonical(payload)) chain;
AuditWriteHaltError on write failure (Edge 7 — halts + rolls back)
- BEFORE INSERT trigger enforces chain integrity (G-006: per-tenant
concurrent-write serialization documented; M3 mitigation noted)
- create-db.ts: PGlite (dev/test) + pg Pool (prod) behind DbClient interface
- pen-test scaffold: cross-tenant isolation (PGlite RLS limitation documented;
prod RLS test runs at M1 review)
- 12 tests, 98% coverage
packages/secrets (REQ-040, G-005, G-010):
- SecretProvider interface: get/put/delete + SecretRef + SecretValue
(toString returns [REDACTED]; unwrap is the only read path)
- AwsSecretsManagerProvider (prod): coreci/<tenantId>/<name>, KMS-backed
- LocalEncryptedProvider (dev): AES-256-GCM, PBKDF2 from SECRET_MASTER_KEY_DEV
- relay-token.ts: JWT HS256 sign/verify/issue (G-005 contract — locked so
Wave B + Wave D parallelize without blocking)
- 24 tests (14 provider + 10 relay-token)
packages/runtime (G-002, G-003):
- Trigger.dev bootstrap (initRuntime) — pre-investment for M3 (G-003)
- runtimeHealthCheck task: writes to runtime_health, NOT audit_log (G-002)
- 6 tests
packages/config (G-010):
- Two-tier credential taxonomy: infra env vars (tier a) vs tenant creds
(SecretProvider only, tier b). PO's 'no env vars' applies to tenant creds.
Coverage: db 98%, secrets/runtime/config typecheck clean.
All 45 tests passing. Go relay-agent builds.
---ci---
phase: 1
milestone: v0.1
status: verify
---/ci---
2026-08-25 01:29:25 +00:00
8355490dd6
docs(P00): mark phase 0 complete in roadmap + traceability
...
Phase 0 shipped (v0.0.1). ROADMAP.md updated:
- Phase 0 marked complete with all 6 success criteria checked
- Phases 1-6 (Waves A-E + final) added with goals + REQ mappings
REQUIREMENTS.md traceability unchanged (44 REQs, 17 M1 pending).
---ci---
phase: 1
milestone: v0.1
status: execute
---/ci---
2026-08-24 22:42:00 +00:00
0e69832914
Merge phase/00-pre-execution into milestone/v0.1-bootstrap
...
Phase 0 (pre-execution) complete. All .ciagent/ reference files committed.
Proceeding to execution phases (Wave A: Foundations).
---ci---
phase: 0
milestone: v0.1
status: complete
---/ci---
2026-08-24 22:41:32 +00:00
61221222eb
docs(P00): apply grill fixes + MVP/UX check
...
Apply 10 binding grill fixes (G-001..G-010) to PLAN.md:
- G-001: /api/byom/test-inference flagged as M3-deprecation proxy for REQ-008
- G-002: Trigger.dev health writes to runtime_health, NOT audit_log
- G-003: Trigger.dev bootstrap + SSH whitelist hook annotated as M2/M3
pre-investments with expected payoff
- G-004: CheckCommand signature + whitelist JSON locked as M2 contract
- G-005: relay token contract (signed JWT, 24h) defined in Wave A so
B and D parallelize without blocking
- G-006: per-tenant audit hash-chain concurrent-write serialization
documented as known M1 limit; M3 mitigation noted
- G-007: shadow exec.Cmd integration test added to whitelist hook
- G-008: explicit Wave D scope statement - M1 ships REQ-026 partially
- G-009: unsupported-OS test matrix expanded to >=2 cases
- G-010: two-tier credential taxonomy (infra env vars vs tenant
SecretProvider-only) documented
MVP/UX check: all 3 sections present in PLAN.md (User-Facing Surface,
Happy Path, UX Acceptance Criteria). Gate PASS, EXECUTE unblocked.
Checkpoint: stage=mvp_ux_check.
---ci---
phase: 0
milestone: v0.1
status: mvp_ux_check
---/ci---
2026-08-24 22:41:17 +00:00
5fcd73be8e
docs(P00): grill M1 plan — adversarial review (PASS-WITH-FIXES)
...
9-axis red-team review of PLAN.md against 17 M1 REQs + 4 PO claims.
All axes ≥0.60 confidence; no escalations. 10 binding fixes (G-001..G-010).
---ci---
status: grill
decisions:
- G-001: Flag /api/byom/test-inference as plan-time proxy for REQ-008, mark M3 deprecation
- G-002: Stop writing Trigger.dev health ticks to audit_log (do not widen REQ-038 silently)
- G-003: Annotate Trigger.dev + whitelist hook as M2/M3 pre-investments with payoff
- G-004: Lock CheckCommand signature + whitelist JSON as M2 SSH adapter contract
- G-005: Resolve Wave B/D token-issuance ownership; define token contract in Wave A
- G-006: Document per-tenant hash-chain concurrent-write serialization; M3 mitigation
- G-007: Add shadow exec.Cmd integration test for CheckCommand (closes M2 rework risk)
- G-008: State M1 ships REQ-026 partially (whitelist+hook only); SSH exec is M2
- G-009: Unsupported-OS test matrix ≥2 cases (not single Fedora container)
- G-010: Add two-tier credential taxonomy (infra env vars vs tenant SecretProvider)
escalations: []
verdict: PASS-WITH-FIXES
---ci---
2026-08-24 22:39:28 +00:00
f18f507cb3
docs(P00): create phase plans
...
PLAN.md: M1 decomposed into 5 execution phases (Waves A-E) + final review:
- Phase 1 / Wave A: Foundations (REQ-038, 039, 040) - monorepo, Postgres+RLS,
audit hash-chain, SecretProvider, Trigger.dev bootstrap
- Phase 2 / Wave B: Identity & RBAC (REQ-001..005) - WorkOS SSO, tenant
provisioning, RBAC at gateway, invitations, role assignment
- Phase 3 / Wave C: BYOM (REQ-006..009) - endpoint registry, validate-on-save,
OpenAI-compatible routing shim, REQ-009 reject path
- Phase 4 / Wave D: Relay Agent (REQ-010..013, REQ-026 hook) - modular install
script, Go binary, WebSocket registration, heartbeat, SSH whitelist hook
- Phase 5 / Wave E: Dashboard surfacing (REQ-014) - status fan-out, green/
yellow/red, last 100 logs, RLS-scoped target views
- Phase 6 / Final: review + audit + milestone ship (v0.1.0 release)
Includes the 3 mandatory MVP/UX sections: User-Facing Surface (8 dashboard
surfaces), Happy Path (8 BDD steps = M1 demo), UX Acceptance Criteria (9).
Wave parallelism: A first, then B+C+D parallel, then E, then Final.
Tags run on v0.0.x patch line; final phase patch v0.0.7 IS the v0.1 milestone
release. Merge to main at final phase.
---ci---
phase: 0
milestone: v0.1
status: plan
---/ci---
2026-08-24 22:36:50 +00:00
551d4d64af
docs(P00): research findings
...
7 research artifacts for M1 technologies:
- R-001: Trigger.dev bootstrap (runtime wired M1, tasks M3)
- R-002: WorkOS SSO + RBAC mapping + SCIM invitations
- R-003: Postgres RLS (withTenant) + per-tenant audit hash-chain
- R-004: AWS Secrets Manager (prod) + local-encrypted (dev) SecretProvider
- R-005: Go Relay Agent (modular install script, systemd, WebSocket,
heartbeat, SSH whitelist hook format + enforcement)
- R-006: Vanta evidence collection (M3 only - architectural note)
- R-007: Cross-tenant isolation pen test pattern (M1 gate)
PERSONAS.md: 6 personas for M1 (backend, data, frontend, lead-developer,
security-engineer, go-engineer [Wave D only]). Frameworks + territories
to be re-validated at Wave A start.
---ci---
phase: 0
milestone: v0.1
status: research
---/ci---
2026-08-24 22:35:29 +00:00
7075eae76d
docs(P00): clarify architectural decisions
...
Record 5 PO-approved architectural decisions (all confidence >=0.8):
- D-001: OpenAI-compatible BYOM contract for M1 (pluggable iface for M3)
- D-002: Relay Agent in Go (single static binary for curl|bash)
- D-003: AWS Secrets Manager (prod) + local-encrypted (dev) behind interface
- D-004: Postgres append-only + hash-chain audit for M1 (S3 WORM in M3)
- D-005: Next.js App Router + TypeScript single SPA
No escalations. Pipeline proceeds to RESEARCH.
---ci---
phase: 0
milestone: v0.1
status: clarify
---/ci---
2026-08-24 22:34:13 +00:00
6146e9bc76
docs(init): validate specification
...
Parse CoreCI Chat v0.1 Engineering Spec v1.1 (Sarah Chen, locked 2026-08-24).
Rewrite placeholder .ciagent/ files with spec-derived content:
- PROJECT.md: vision, M1 scope (17 REQs), constraints, key decisions
- REQUIREMENTS.md: M1 REQs 001-014+038/039/040 with verbatim acceptance
criteria, M2/M3 deferrals, traceability matrix, out-of-scope
- ARCHITECTURE.md: components, data flow, M1 build-order waves A-E
- steer-v0.1-spec.md: authoritative spec persisted
- CHECKPOINT.json: stage=specify
---ci---
phase: 0
milestone: v0.1
status: specify
---/ci---
2026-08-24 22:33:46 +00:00
2cf16ed091
docs(init): initialize coreci-chat (2 phases)
...
---ci---
project: default
phase: 0
milestone: v0.1
status: specify
autonomy: full
decisions:
- id: D-001
decision: Autonomy level set to "full"
rationale: User-selected; CI/CD automation without HITL after clarify
confidence: 1.00
alternatives: [supervised, guided]
- id: D-002
decision: Release forge = gitea (coreci/coreci-chat at https://git.cloudinit.dev )
rationale: No git origin detected; user chose self-hosted Gitea for releases
confidence: 1.00
alternatives: [github, gitlab, local-only]
- id: D-003
decision: Milestone version = v0.1 (branch milestone/v0.1-bootstrap)
rationale: No existing tags; computeMilestoneTag() returns v0.1.0 for a feature/nfr milestone
confidence: 0.95
alternatives: []
- id: D-004
decision: Phase 0 branch = phase/00-pre-execution (created from milestone)
rationale: Canonical phase-0 name per branch-strategy reference
confidence: 1.00
alternatives: []
- id: D-005
decision: Specification parsing deferred to a follow-up session
rationale: User stated the full spec will arrive separately; init only lands the scaffold
confidence: 1.00
alternatives: [expand the literal "Create a folder in ~/coreci-chat" argument into a synthetic spec]
- id: D-006
decision: Single-project mode (projects[] empty; files in .ciagent/)
rationale: Only one project being initialized; no multi-project need indicated
confidence: 0.90
alternatives: [register a "coreci-chat" slug in projects[]]
- id: D-007
decision: GITEA_TOKEN persisted to .ciagent/.env.secrets (mode 0600); .env* git-ignored
rationale: Credential collection gate; secrets never written to config.json or committed
confidence: 1.00
alternatives: []
---/ci---
Specification: Initialize a CIAgent project scaffold at ~/coreci-chat (full spec to follow in a separate session)
Requirements: [git-native branch hierarchy, .ciagent/config.json, release target, .gitignore, initial commit on phase/00]
Constraints: [branch gate before any file write, GITEA_TOKEN never committed, autonomy=full preset applied verbatim, single-project mode]
Out of scope: [implementation source code, remote git push, milestone release tag, full specification parsing]
2026-08-24 22:20:05 +00:00
26fb8b04d5
chore: initialize repository
2026-08-24 22:15:01 +00:00
CIAgent