e07cd452a2
docs(audit): fix CHECKPOINT.json syntax + refresh STATE.md post-M2
...
Audit findings fixed:
- CHECKPOINT.json: missing closing brace (JSON invalid) — fixed
- STATE.md: stale M1-era content (referenced M2 as future) — refreshed to post-M2
---ci---
phase: 6
milestone: v0.2
status: complete
phase_role: final
audit: fixes_applied
---/ci---
2026-08-25 10:34:29 +00:00
9a276d62a1
docs(milestone): M2 complete — checkpoint cleared, next milestone M3
...
---ci---
phase: 6
milestone: v0.2
status: complete
phase_role: final
milestone_complete: true
---/ci---
2026-08-25 06:15:14 +00:00
0c15d3d0b2
docs(milestone): complete M2 — MCP Layer & Day 1 Adapters (v0.2)
...
M2 delivers the read-only MCP capability broker gateway and four Day-1
infrastructure adapters (Proxmox, SSH/Linux, GitHub, Gitea). 13 REQs (015-027)
all pass. 656 tests green. M1 non-regression verified.
MCP spec 2025-06-18 conformance verified (PROTOCOL.md + 7 tests).
Defense-in-depth SSH (broker layer 1 + Relay Agent layer 2 + no-shell exec).
Two-track LLM smoke (Track A mock-path P0 gate passes).
CI: Gitea Actions (.gitea/workflows/ci.yml) with Postgres 16 + RLS verification.
Phases shipped:
P0 pre-execution v0.1.0
P1 Wave F — MCP gateway v0.1.1
P2 Wave G — Proxmox v0.1.2
P3 Wave H — SSH/Linux v0.1.3
P4 Wave I — Git adapters v0.1.4
P5 Wave J — SSE+smoke+UI v0.1.5
P6 Final — review+ship v0.1.6 ← milestone release
---ci---
phase: 6
milestone: v0.2
status: complete
phase_role: final
milestone_complete: true
requirements:
covered: [REQ-015, REQ-016, REQ-017, REQ-018, REQ-019, REQ-020, REQ-021, REQ-022, REQ-023, REQ-024, REQ-025, REQ-026, REQ-027]
partial: []
---/ci---
2026-08-25 06:14:21 +00:00
21724d0300
docs(ship): upstream release complete — Gitea repo + 7 releases + binaries
...
Upstream ship complete:
- Created Gitea repo: coreci/coreci-chat at https://git.cloudinit.dev
- Pushed main + 7 tags (v0.0.1 through v0.0.7)
- Created 7 Gitea releases with release notes
- Built + uploaded Relay Agent binaries (linux amd64 + arm64) to v0.0.7
- Uploaded install.sh, ssh-whitelist.json, sha256sums.txt to v0.0.7
- v0.0.7 = M1 milestone release
---ci---
phase: 6
milestone: v0.1
status: complete
---/ci---
2026-08-25 02:35:31 +00:00
33207ab89a
docs(milestone): complete CoreCI Chat v0.1 — Read-Only Diagnostic MVP
...
M1 acceptance gate PASSED (spec §2.3):
- SSO signup via WorkOS (REQ-001, 002)
- BYOM endpoint config + green validation (REQ-006, 007)
- Relay Agent install via curl|bash on Ubuntu/Debian (REQ-010)
- Outbound WebSocket + registration + heartbeat (REQ-011, 012, 013)
- Green status in admin dashboard (REQ-014)
- Audit logging, RLS, secret manager operational (REQ-038, 039, 040)
All 17 M1 REQs complete. 189 tests green (148 TS + 17 Go + 24 install).
DB coverage 98%. All 10 grill fixes applied.
Review deliverables in .ciagent/M1-REVIEW.md:
1. Per-REQ pass/fail test report (17/17 PASS)
2. Demo path: SSO → BYOM green → install → register → green dashboard
3. Cross-tenant isolation pen test (zero leakage)
4. Install logs: Ubuntu 24.04 pass, Debian 12+ pass, ≥2 unsupported OS abort
---ci---
phase: 6
milestone: v0.1
status: complete
requirements:
covered: [REQ-001, REQ-002, REQ-003, REQ-004, REQ-005, REQ-006, REQ-007, REQ-008, REQ-009, REQ-010, REQ-011, REQ-012, REQ-013, REQ-014, REQ-026-partial, REQ-038, REQ-039, REQ-040]
partial: [REQ-026]
---/ci---
2026-08-25 02:25:23 +00:00
be70f56657
feat(P1): Wave A foundations — monorepo, DB+RLS, audit, secrets, runtime
...
Wave A (Phase 1) implements the M1 foundations for REQ-038, REQ-039, REQ-040:
Monorepo scaffold (pnpm workspaces, TS strict, NodeNext):
- apps/control-plane (Next.js App Router scaffold — Wave B adds routes)
- apps/relay-agent (Go module scaffold — Wave D adds WebSocket + install)
- packages/db, packages/secrets, packages/runtime, packages/config
packages/db (REQ-038, REQ-039):
- 0001_init.sql: tenants, users, tenant_memberships, targets, byom_endpoints,
invitations, audit_log (append-only hash-chain), runtime_health (not audited)
- RLS policies on all tenant-scoped tables + FORCE ROW LEVEL SECURITY
- withTenant(tenantId, fn): SET LOCAL app.tenant_id + transaction
- audit.ts: appendAudit with sha256(prev_hash || canonical(payload)) chain;
AuditWriteHaltError on write failure (Edge 7 — halts + rolls back)
- BEFORE INSERT trigger enforces chain integrity (G-006: per-tenant
concurrent-write serialization documented; M3 mitigation noted)
- create-db.ts: PGlite (dev/test) + pg Pool (prod) behind DbClient interface
- pen-test scaffold: cross-tenant isolation (PGlite RLS limitation documented;
prod RLS test runs at M1 review)
- 12 tests, 98% coverage
packages/secrets (REQ-040, G-005, G-010):
- SecretProvider interface: get/put/delete + SecretRef + SecretValue
(toString returns [REDACTED]; unwrap is the only read path)
- AwsSecretsManagerProvider (prod): coreci/<tenantId>/<name>, KMS-backed
- LocalEncryptedProvider (dev): AES-256-GCM, PBKDF2 from SECRET_MASTER_KEY_DEV
- relay-token.ts: JWT HS256 sign/verify/issue (G-005 contract — locked so
Wave B + Wave D parallelize without blocking)
- 24 tests (14 provider + 10 relay-token)
packages/runtime (G-002, G-003):
- Trigger.dev bootstrap (initRuntime) — pre-investment for M3 (G-003)
- runtimeHealthCheck task: writes to runtime_health, NOT audit_log (G-002)
- 6 tests
packages/config (G-010):
- Two-tier credential taxonomy: infra env vars (tier a) vs tenant creds
(SecretProvider only, tier b). PO's 'no env vars' applies to tenant creds.
Coverage: db 98%, secrets/runtime/config typecheck clean.
All 45 tests passing. Go relay-agent builds.
---ci---
phase: 1
milestone: v0.1
status: verify
---/ci---
2026-08-25 01:29:25 +00:00
61221222eb
docs(P00): apply grill fixes + MVP/UX check
...
Apply 10 binding grill fixes (G-001..G-010) to PLAN.md:
- G-001: /api/byom/test-inference flagged as M3-deprecation proxy for REQ-008
- G-002: Trigger.dev health writes to runtime_health, NOT audit_log
- G-003: Trigger.dev bootstrap + SSH whitelist hook annotated as M2/M3
pre-investments with expected payoff
- G-004: CheckCommand signature + whitelist JSON locked as M2 contract
- G-005: relay token contract (signed JWT, 24h) defined in Wave A so
B and D parallelize without blocking
- G-006: per-tenant audit hash-chain concurrent-write serialization
documented as known M1 limit; M3 mitigation noted
- G-007: shadow exec.Cmd integration test added to whitelist hook
- G-008: explicit Wave D scope statement - M1 ships REQ-026 partially
- G-009: unsupported-OS test matrix expanded to >=2 cases
- G-010: two-tier credential taxonomy (infra env vars vs tenant
SecretProvider-only) documented
MVP/UX check: all 3 sections present in PLAN.md (User-Facing Surface,
Happy Path, UX Acceptance Criteria). Gate PASS, EXECUTE unblocked.
Checkpoint: stage=mvp_ux_check.
---ci---
phase: 0
milestone: v0.1
status: mvp_ux_check
---/ci---
2026-08-24 22:41:17 +00:00
f18f507cb3
docs(P00): create phase plans
...
PLAN.md: M1 decomposed into 5 execution phases (Waves A-E) + final review:
- Phase 1 / Wave A: Foundations (REQ-038, 039, 040) - monorepo, Postgres+RLS,
audit hash-chain, SecretProvider, Trigger.dev bootstrap
- Phase 2 / Wave B: Identity & RBAC (REQ-001..005) - WorkOS SSO, tenant
provisioning, RBAC at gateway, invitations, role assignment
- Phase 3 / Wave C: BYOM (REQ-006..009) - endpoint registry, validate-on-save,
OpenAI-compatible routing shim, REQ-009 reject path
- Phase 4 / Wave D: Relay Agent (REQ-010..013, REQ-026 hook) - modular install
script, Go binary, WebSocket registration, heartbeat, SSH whitelist hook
- Phase 5 / Wave E: Dashboard surfacing (REQ-014) - status fan-out, green/
yellow/red, last 100 logs, RLS-scoped target views
- Phase 6 / Final: review + audit + milestone ship (v0.1.0 release)
Includes the 3 mandatory MVP/UX sections: User-Facing Surface (8 dashboard
surfaces), Happy Path (8 BDD steps = M1 demo), UX Acceptance Criteria (9).
Wave parallelism: A first, then B+C+D parallel, then E, then Final.
Tags run on v0.0.x patch line; final phase patch v0.0.7 IS the v0.1 milestone
release. Merge to main at final phase.
---ci---
phase: 0
milestone: v0.1
status: plan
---/ci---
2026-08-24 22:36:50 +00:00
551d4d64af
docs(P00): research findings
...
7 research artifacts for M1 technologies:
- R-001: Trigger.dev bootstrap (runtime wired M1, tasks M3)
- R-002: WorkOS SSO + RBAC mapping + SCIM invitations
- R-003: Postgres RLS (withTenant) + per-tenant audit hash-chain
- R-004: AWS Secrets Manager (prod) + local-encrypted (dev) SecretProvider
- R-005: Go Relay Agent (modular install script, systemd, WebSocket,
heartbeat, SSH whitelist hook format + enforcement)
- R-006: Vanta evidence collection (M3 only - architectural note)
- R-007: Cross-tenant isolation pen test pattern (M1 gate)
PERSONAS.md: 6 personas for M1 (backend, data, frontend, lead-developer,
security-engineer, go-engineer [Wave D only]). Frameworks + territories
to be re-validated at Wave A start.
---ci---
phase: 0
milestone: v0.1
status: research
---/ci---
2026-08-24 22:35:29 +00:00
7075eae76d
docs(P00): clarify architectural decisions
...
Record 5 PO-approved architectural decisions (all confidence >=0.8):
- D-001: OpenAI-compatible BYOM contract for M1 (pluggable iface for M3)
- D-002: Relay Agent in Go (single static binary for curl|bash)
- D-003: AWS Secrets Manager (prod) + local-encrypted (dev) behind interface
- D-004: Postgres append-only + hash-chain audit for M1 (S3 WORM in M3)
- D-005: Next.js App Router + TypeScript single SPA
No escalations. Pipeline proceeds to RESEARCH.
---ci---
phase: 0
milestone: v0.1
status: clarify
---/ci---
2026-08-24 22:34:13 +00:00
6146e9bc76
docs(init): validate specification
...
Parse CoreCI Chat v0.1 Engineering Spec v1.1 (Sarah Chen, locked 2026-08-24).
Rewrite placeholder .ciagent/ files with spec-derived content:
- PROJECT.md: vision, M1 scope (17 REQs), constraints, key decisions
- REQUIREMENTS.md: M1 REQs 001-014+038/039/040 with verbatim acceptance
criteria, M2/M3 deferrals, traceability matrix, out-of-scope
- ARCHITECTURE.md: components, data flow, M1 build-order waves A-E
- steer-v0.1-spec.md: authoritative spec persisted
- CHECKPOINT.json: stage=specify
---ci---
phase: 0
milestone: v0.1
status: specify
---/ci---
2026-08-24 22:33:46 +00:00
2cf16ed091
docs(init): initialize coreci-chat (2 phases)
...
---ci---
project: default
phase: 0
milestone: v0.1
status: specify
autonomy: full
decisions:
- id: D-001
decision: Autonomy level set to "full"
rationale: User-selected; CI/CD automation without HITL after clarify
confidence: 1.00
alternatives: [supervised, guided]
- id: D-002
decision: Release forge = gitea (coreci/coreci-chat at https://git.cloudinit.dev )
rationale: No git origin detected; user chose self-hosted Gitea for releases
confidence: 1.00
alternatives: [github, gitlab, local-only]
- id: D-003
decision: Milestone version = v0.1 (branch milestone/v0.1-bootstrap)
rationale: No existing tags; computeMilestoneTag() returns v0.1.0 for a feature/nfr milestone
confidence: 0.95
alternatives: []
- id: D-004
decision: Phase 0 branch = phase/00-pre-execution (created from milestone)
rationale: Canonical phase-0 name per branch-strategy reference
confidence: 1.00
alternatives: []
- id: D-005
decision: Specification parsing deferred to a follow-up session
rationale: User stated the full spec will arrive separately; init only lands the scaffold
confidence: 1.00
alternatives: [expand the literal "Create a folder in ~/coreci-chat" argument into a synthetic spec]
- id: D-006
decision: Single-project mode (projects[] empty; files in .ciagent/)
rationale: Only one project being initialized; no multi-project need indicated
confidence: 0.90
alternatives: [register a "coreci-chat" slug in projects[]]
- id: D-007
decision: GITEA_TOKEN persisted to .ciagent/.env.secrets (mode 0600); .env* git-ignored
rationale: Credential collection gate; secrets never written to config.json or committed
confidence: 1.00
alternatives: []
---/ci---
Specification: Initialize a CIAgent project scaffold at ~/coreci-chat (full spec to follow in a separate session)
Requirements: [git-native branch hierarchy, .ciagent/config.json, release target, .gitignore, initial commit on phase/00]
Constraints: [branch gate before any file write, GITEA_TOKEN never committed, autonomy=full preset applied verbatim, single-project mode]
Out of scope: [implementation source code, remote git push, milestone release tag, full specification parsing]
2026-08-24 22:20:05 +00:00
CIAgent