04f0417f4a
feat(P4): Wave I — Git adapters: GitHub + Gitea (REQ-022, REQ-023, REQ-027)
...
Read-only GitHub adapter (fine-grained PAT, D-006, 3 capabilities, rate-limit
handling, scope-via-403 per R-004) + read-only Gitea adapter (version-aware
scope validation per R-005, 2 capabilities, method blocklist backstop).
60s TTL inventory cache for list_repos (both). Write-blocklist wired.
Tests: 521 green. Coverage: 95% github, 93% gitea.
M1 non-regression: all M1 tests pass.
---ci---
phase: 4
milestone: v0.2
status: complete
wave: I
phase_role: execution
---/ci---
2026-08-25 05:40:40 +00:00
40066dfb0e
feat(P3): Wave H — SSH/Linux adapter via Relay Agent (REQ-021, REQ-026 full)
...
Read-only SSH/Linux adapter with defense-in-depth:
- Broker layer-1 whitelist validation (TS, 6-command subset, independent impl)
- Relay Agent layer-2 CheckCommand (Go, G-004 contract unchanged, deny list +rm)
- No-shell exec.Command (split argv, third enforcement layer)
- tool_call WebSocket message + reader goroutine restructure (G-021)
- Cross-layer divergence matrix (G-013): all 4 cases pass
- M1-relay-WS regression: register/ping/pong preserved
Tests: 396 TS + Go tests green. Coverage: 96.73% on ssh adapter.
M1 non-regression: all M1 tests pass.
---ci---
phase: 3
milestone: v0.2
status: complete
wave: H
phase_role: execution
---/ci---
2026-08-25 05:20:03 +00:00
bf975e7ab1
feat(P2): Wave G — Proxmox adapter (REQ-020, REQ-025)
...
Read-only Proxmox VE adapter: PVE API client (token auth, allowSelfSigned),
3 capabilities (list_vms inventory, get_vm_status live, get_node_metrics live),
PVEAuditor validation (R-002 introspection gap documented), 60s TTL inventory
cache, write-blocklist 403+audit wired end-to-end (P1 gap closed).
Tests: 323 green. Coverage: 94.7% on packages/mcp/adapters/proxmox.
M1 non-regression: all M1 tests pass.
---ci---
phase: 2
milestone: v0.2
status: complete
wave: G
phase_role: execution
---/ci---
2026-08-25 04:57:18 +00:00
28b8aa36c6
feat(P1): Wave F — MCP Gateway core (REQ-015,016,017,018,019,024)
...
MCP capability broker gateway with closed 9-tool registry, adapter router,
write-method blocklist (INV-7 backstop), token-bucket rate limiter (60/min user,
300/min tenant), SSE stream manager (ULID, per-call, 30s timeout), OpenAI↔MCP
translator, in-process custom transport + stdio, mcp_adapters table with RLS,
5 API routes, 4 stub adapters + McpAdapter interface, 7 MCP conformance tests.
G-012 (audit type widening), G-015 (INV-7 framing), G-016 (two enforcement models),
G-017 (stdio-interop 7th test), G-020 (McpAdapter interface) applied.
Tests: 254 green (224 unit + 32 conformance). Coverage: 88.7% on packages/mcp.
M1 non-regression: all M1 tests pass.
---ci---
phase: 1
milestone: v0.2
status: complete
wave: F
phase_role: execution
---/ci---
2026-08-25 04:43:45 +00:00
5caab5f48d
docs(P00): ship complete — v0.1.0 tagged, release created, phase/00 deleted
...
---ci---
phase: 0
milestone: v0.2
status: complete
phase_role: pre_execution
---/ci---
2026-08-25 03:54:28 +00:00
22ef116b15
docs(P00): complete M2 pre-execution — MCP Layer & Day 1 Adapters
...
Phase 0 pipeline complete: SPECIFY → CLARIFY → RESEARCH → PLAN → GRILL → MVP/UX.
- M2 spec saved and locked (steer-m2-spec.md, 9 open questions resolved)
- PROJECT.md/REQUIREMENTS.md/ARCHITECTURE.md rewritten for M2 (13 REQs 015-027)
- CLARIFY: D-001..D-005 carried, D-006 (GitHub scopes), D-007 (MCP transport) added
- RESEARCH: 9 areas (R-001..R-009), confidence 0.72-0.90, 7 flagged risks mitigated
- PLAN: 6 waves (F/G/H/I/J/final) on v0.1.x patch line, v0.1.6 = milestone release
- GRILL: 12 binding fixes G-011..G-022 applied (2 P0 blockers auto-resolved)
- MVP/UX: PASS (3 mandatory sections verified)
- CI: Gitea Actions (.gitea/workflows/) — repo forge is Gitea
---ci---
phase: 0
milestone: v0.2
status: complete
phase_role: pre_execution
---/ci---
2026-08-25 03:52:00 +00:00
2a1e6ca698
docs(PDLC): add STATE.md — Phase 0 project state intake
...
Ground-truth state for PDLC Phase 0: M1 shipped (v0.0.7, 17 REQs, 189 tests,
98% db coverage), next initiative M2+M3 to complete v0.1. Five known tensions
documented (PGlite RLS gap, no cloud infra, G-001 proxy, G-006 audit
serialization, INV-7 enforcement model unspecified).
---ci---
phase: 6
milestone: v0.1
status: complete
---/ci---
2026-08-25 02:51:54 +00:00
21724d0300
docs(ship): upstream release complete — Gitea repo + 7 releases + binaries
...
Upstream ship complete:
- Created Gitea repo: coreci/coreci-chat at https://git.cloudinit.dev
- Pushed main + 7 tags (v0.0.1 through v0.0.7)
- Created 7 Gitea releases with release notes
- Built + uploaded Relay Agent binaries (linux amd64 + arm64) to v0.0.7
- Uploaded install.sh, ssh-whitelist.json, sha256sums.txt to v0.0.7
- v0.0.7 = M1 milestone release
---ci---
phase: 6
milestone: v0.1
status: complete
---/ci---
2026-08-25 02:35:31 +00:00
bb85e833d0
Merge milestone/v0.1-bootstrap into main
...
CoreCI Chat v0.1 — Read-Only Diagnostic MVP complete.
Milestone: v0.1 (Feature). 17 M1 REQs complete. 189 tests green.
M1 acceptance gate PASSED (spec §2.3).
This is the first milestone release. Tags v0.0.1 through v0.0.7
record each phase; v0.0.7 IS the v0.1 milestone release.
---ci---
phase: 6
milestone: v0.1
status: complete
---/ci---
2026-08-25 02:25:33 +00:00
901536dd44
Merge phase/06-final-review-ship into milestone/v0.1-bootstrap
...
Final phase complete. M1 milestone release.
---ci---
phase: 6
milestone: v0.1
status: complete
---/ci---
2026-08-25 02:25:29 +00:00
33207ab89a
docs(milestone): complete CoreCI Chat v0.1 — Read-Only Diagnostic MVP
...
M1 acceptance gate PASSED (spec §2.3):
- SSO signup via WorkOS (REQ-001, 002)
- BYOM endpoint config + green validation (REQ-006, 007)
- Relay Agent install via curl|bash on Ubuntu/Debian (REQ-010)
- Outbound WebSocket + registration + heartbeat (REQ-011, 012, 013)
- Green status in admin dashboard (REQ-014)
- Audit logging, RLS, secret manager operational (REQ-038, 039, 040)
All 17 M1 REQs complete. 189 tests green (148 TS + 17 Go + 24 install).
DB coverage 98%. All 10 grill fixes applied.
Review deliverables in .ciagent/M1-REVIEW.md:
1. Per-REQ pass/fail test report (17/17 PASS)
2. Demo path: SSO → BYOM green → install → register → green dashboard
3. Cross-tenant isolation pen test (zero leakage)
4. Install logs: Ubuntu 24.04 pass, Debian 12+ pass, ≥2 unsupported OS abort
---ci---
phase: 6
milestone: v0.1
status: complete
requirements:
covered: [REQ-001, REQ-002, REQ-003, REQ-004, REQ-005, REQ-006, REQ-007, REQ-008, REQ-009, REQ-010, REQ-011, REQ-012, REQ-013, REQ-014, REQ-026-partial, REQ-038, REQ-039, REQ-040]
partial: [REQ-026]
---/ci---
2026-08-25 02:25:23 +00:00
f28769ee69
Merge phase/05-dashboard into milestone/v0.1-bootstrap
...
Wave E (dashboard surfacing) complete. All 5 execution waves shipped.
---ci---
phase: 5
milestone: v0.1
status: complete
---/ci---
2026-08-25 02:22:30 +00:00
dfc6b8ff76
feat(P5): Wave E dashboard surfacing — agent status, health, logs, audit export
...
REQ-014: surface relay agent health (green/yellow/red), target hostname,
last 100 log lines in admin dashboard. Per-tenant view under RLS.
---ci---
phase: 5
milestone: v0.1
status: execute
---/ci---
2026-08-25 02:21:51 +00:00
d0465a4c71
Merge phase/04-relay-agent into milestone/v0.1-bootstrap
...
Wave D (relay agent) complete.
---ci---
phase: 4
milestone: v0.1
status: complete
---/ci---
# Conflicts:
# apps/control-plane/lib/auth.ts
# apps/control-plane/lib/db.ts
# apps/control-plane/tsconfig.json
# apps/control-plane/vitest.config.ts
# pnpm-lock.yaml
2026-08-25 02:04:35 +00:00
a7bce7e44a
Merge phase/03-byom into milestone/v0.1-bootstrap
...
Wave C (BYOM) complete.
---ci---
phase: 3
milestone: v0.1
status: complete
---/ci---
# Conflicts:
# apps/control-plane/package.json
# apps/control-plane/tsconfig.json
# pnpm-lock.yaml
2026-08-25 02:04:16 +00:00
ca87dbf4b1
Merge phase/02-identity-rbac into milestone/v0.1-bootstrap
...
Wave B (identity & RBAC) complete.
---ci---
phase: 2
milestone: v0.1
status: complete
---/ci---
2026-08-25 02:03:47 +00:00
86f7dcc10b
feat(P4): Wave D relay agent — Go binary, install script, WebSocket, SSH whitelist hook
...
REQ-010: modular install script (detect_os/install_binary/write_systemd_unit/register_target)
REQ-011: outbound WebSocket from relay agent to SaaS
REQ-012: register with tenant + target metadata
REQ-013: heartbeat + exponential backoff reconnect (max 5 → alert)
REQ-026 partial: SSH whitelist file + CheckCommand hook (G-004 contract lock,
G-007 shadow exec.Cmd test, G-008 scope statement)
G-009: unsupported-OS abort with actionable error
---ci---
phase: 4
milestone: v0.1
status: execute
---/ci---
2026-08-25 02:03:04 +00:00
3b8345dfe0
feat(P3): Wave C BYOM — endpoint registry, validate-on-save, routing shim
...
REQ-006: configure BYOM endpoint (URL in DB, key in secret manager)
REQ-007: validate-on-save test inference call (OpenAI-compatible)
REQ-008: route all inference to BYOM (G-001: test-inference proxy endpoint)
REQ-009: reject when unconfigured/unreachable (ByomUnconfiguredError/ByomUnreachableError)
---ci---
phase: 3
milestone: v0.1
status: execute
---/ci---
2026-08-25 01:54:20 +00:00
bcca7686ee
feat(P2): Wave B identity & RBAC — WorkOS SSO, tenant provisioning, RBAC at gateway
...
REQ-001: SSO session via WorkOS (getAuthorizationUrl + exchangeCodeForSession)
REQ-002: tenant provisioning on first signup (admin role)
REQ-003: invitations via single-use acceptance link
REQ-004: RBAC role assignment (admin/operator/viewer)
REQ-005: RBAC enforcement at API gateway from first endpoint (/api/me)
---ci---
phase: 2
milestone: v0.1
status: execute
---/ci---
2026-08-25 01:47:56 +00:00
3246442906
Merge phase/01-foundations into milestone/v0.1-bootstrap
...
Wave A (foundations) complete. Proceeding to Wave B (identity/RBAC), Wave C (BYOM), Wave D (relay agent).
---ci---
phase: 1
milestone: v0.1
status: complete
---/ci---
2026-08-25 01:34:19 +00:00
be70f56657
feat(P1): Wave A foundations — monorepo, DB+RLS, audit, secrets, runtime
...
Wave A (Phase 1) implements the M1 foundations for REQ-038, REQ-039, REQ-040:
Monorepo scaffold (pnpm workspaces, TS strict, NodeNext):
- apps/control-plane (Next.js App Router scaffold — Wave B adds routes)
- apps/relay-agent (Go module scaffold — Wave D adds WebSocket + install)
- packages/db, packages/secrets, packages/runtime, packages/config
packages/db (REQ-038, REQ-039):
- 0001_init.sql: tenants, users, tenant_memberships, targets, byom_endpoints,
invitations, audit_log (append-only hash-chain), runtime_health (not audited)
- RLS policies on all tenant-scoped tables + FORCE ROW LEVEL SECURITY
- withTenant(tenantId, fn): SET LOCAL app.tenant_id + transaction
- audit.ts: appendAudit with sha256(prev_hash || canonical(payload)) chain;
AuditWriteHaltError on write failure (Edge 7 — halts + rolls back)
- BEFORE INSERT trigger enforces chain integrity (G-006: per-tenant
concurrent-write serialization documented; M3 mitigation noted)
- create-db.ts: PGlite (dev/test) + pg Pool (prod) behind DbClient interface
- pen-test scaffold: cross-tenant isolation (PGlite RLS limitation documented;
prod RLS test runs at M1 review)
- 12 tests, 98% coverage
packages/secrets (REQ-040, G-005, G-010):
- SecretProvider interface: get/put/delete + SecretRef + SecretValue
(toString returns [REDACTED]; unwrap is the only read path)
- AwsSecretsManagerProvider (prod): coreci/<tenantId>/<name>, KMS-backed
- LocalEncryptedProvider (dev): AES-256-GCM, PBKDF2 from SECRET_MASTER_KEY_DEV
- relay-token.ts: JWT HS256 sign/verify/issue (G-005 contract — locked so
Wave B + Wave D parallelize without blocking)
- 24 tests (14 provider + 10 relay-token)
packages/runtime (G-002, G-003):
- Trigger.dev bootstrap (initRuntime) — pre-investment for M3 (G-003)
- runtimeHealthCheck task: writes to runtime_health, NOT audit_log (G-002)
- 6 tests
packages/config (G-010):
- Two-tier credential taxonomy: infra env vars (tier a) vs tenant creds
(SecretProvider only, tier b). PO's 'no env vars' applies to tenant creds.
Coverage: db 98%, secrets/runtime/config typecheck clean.
All 45 tests passing. Go relay-agent builds.
---ci---
phase: 1
milestone: v0.1
status: verify
---/ci---
2026-08-25 01:29:25 +00:00
8355490dd6
docs(P00): mark phase 0 complete in roadmap + traceability
...
Phase 0 shipped (v0.0.1). ROADMAP.md updated:
- Phase 0 marked complete with all 6 success criteria checked
- Phases 1-6 (Waves A-E + final) added with goals + REQ mappings
REQUIREMENTS.md traceability unchanged (44 REQs, 17 M1 pending).
---ci---
phase: 1
milestone: v0.1
status: execute
---/ci---
2026-08-24 22:42:00 +00:00
0e69832914
Merge phase/00-pre-execution into milestone/v0.1-bootstrap
...
Phase 0 (pre-execution) complete. All .ciagent/ reference files committed.
Proceeding to execution phases (Wave A: Foundations).
---ci---
phase: 0
milestone: v0.1
status: complete
---/ci---
2026-08-24 22:41:32 +00:00
61221222eb
docs(P00): apply grill fixes + MVP/UX check
...
Apply 10 binding grill fixes (G-001..G-010) to PLAN.md:
- G-001: /api/byom/test-inference flagged as M3-deprecation proxy for REQ-008
- G-002: Trigger.dev health writes to runtime_health, NOT audit_log
- G-003: Trigger.dev bootstrap + SSH whitelist hook annotated as M2/M3
pre-investments with expected payoff
- G-004: CheckCommand signature + whitelist JSON locked as M2 contract
- G-005: relay token contract (signed JWT, 24h) defined in Wave A so
B and D parallelize without blocking
- G-006: per-tenant audit hash-chain concurrent-write serialization
documented as known M1 limit; M3 mitigation noted
- G-007: shadow exec.Cmd integration test added to whitelist hook
- G-008: explicit Wave D scope statement - M1 ships REQ-026 partially
- G-009: unsupported-OS test matrix expanded to >=2 cases
- G-010: two-tier credential taxonomy (infra env vars vs tenant
SecretProvider-only) documented
MVP/UX check: all 3 sections present in PLAN.md (User-Facing Surface,
Happy Path, UX Acceptance Criteria). Gate PASS, EXECUTE unblocked.
Checkpoint: stage=mvp_ux_check.
---ci---
phase: 0
milestone: v0.1
status: mvp_ux_check
---/ci---
2026-08-24 22:41:17 +00:00
5fcd73be8e
docs(P00): grill M1 plan — adversarial review (PASS-WITH-FIXES)
...
9-axis red-team review of PLAN.md against 17 M1 REQs + 4 PO claims.
All axes ≥0.60 confidence; no escalations. 10 binding fixes (G-001..G-010).
---ci---
status: grill
decisions:
- G-001: Flag /api/byom/test-inference as plan-time proxy for REQ-008, mark M3 deprecation
- G-002: Stop writing Trigger.dev health ticks to audit_log (do not widen REQ-038 silently)
- G-003: Annotate Trigger.dev + whitelist hook as M2/M3 pre-investments with payoff
- G-004: Lock CheckCommand signature + whitelist JSON as M2 SSH adapter contract
- G-005: Resolve Wave B/D token-issuance ownership; define token contract in Wave A
- G-006: Document per-tenant hash-chain concurrent-write serialization; M3 mitigation
- G-007: Add shadow exec.Cmd integration test for CheckCommand (closes M2 rework risk)
- G-008: State M1 ships REQ-026 partially (whitelist+hook only); SSH exec is M2
- G-009: Unsupported-OS test matrix ≥2 cases (not single Fedora container)
- G-010: Add two-tier credential taxonomy (infra env vars vs tenant SecretProvider)
escalations: []
verdict: PASS-WITH-FIXES
---ci---
2026-08-24 22:39:28 +00:00
f18f507cb3
docs(P00): create phase plans
...
PLAN.md: M1 decomposed into 5 execution phases (Waves A-E) + final review:
- Phase 1 / Wave A: Foundations (REQ-038, 039, 040) - monorepo, Postgres+RLS,
audit hash-chain, SecretProvider, Trigger.dev bootstrap
- Phase 2 / Wave B: Identity & RBAC (REQ-001..005) - WorkOS SSO, tenant
provisioning, RBAC at gateway, invitations, role assignment
- Phase 3 / Wave C: BYOM (REQ-006..009) - endpoint registry, validate-on-save,
OpenAI-compatible routing shim, REQ-009 reject path
- Phase 4 / Wave D: Relay Agent (REQ-010..013, REQ-026 hook) - modular install
script, Go binary, WebSocket registration, heartbeat, SSH whitelist hook
- Phase 5 / Wave E: Dashboard surfacing (REQ-014) - status fan-out, green/
yellow/red, last 100 logs, RLS-scoped target views
- Phase 6 / Final: review + audit + milestone ship (v0.1.0 release)
Includes the 3 mandatory MVP/UX sections: User-Facing Surface (8 dashboard
surfaces), Happy Path (8 BDD steps = M1 demo), UX Acceptance Criteria (9).
Wave parallelism: A first, then B+C+D parallel, then E, then Final.
Tags run on v0.0.x patch line; final phase patch v0.0.7 IS the v0.1 milestone
release. Merge to main at final phase.
---ci---
phase: 0
milestone: v0.1
status: plan
---/ci---
2026-08-24 22:36:50 +00:00
551d4d64af
docs(P00): research findings
...
7 research artifacts for M1 technologies:
- R-001: Trigger.dev bootstrap (runtime wired M1, tasks M3)
- R-002: WorkOS SSO + RBAC mapping + SCIM invitations
- R-003: Postgres RLS (withTenant) + per-tenant audit hash-chain
- R-004: AWS Secrets Manager (prod) + local-encrypted (dev) SecretProvider
- R-005: Go Relay Agent (modular install script, systemd, WebSocket,
heartbeat, SSH whitelist hook format + enforcement)
- R-006: Vanta evidence collection (M3 only - architectural note)
- R-007: Cross-tenant isolation pen test pattern (M1 gate)
PERSONAS.md: 6 personas for M1 (backend, data, frontend, lead-developer,
security-engineer, go-engineer [Wave D only]). Frameworks + territories
to be re-validated at Wave A start.
---ci---
phase: 0
milestone: v0.1
status: research
---/ci---
2026-08-24 22:35:29 +00:00
7075eae76d
docs(P00): clarify architectural decisions
...
Record 5 PO-approved architectural decisions (all confidence >=0.8):
- D-001: OpenAI-compatible BYOM contract for M1 (pluggable iface for M3)
- D-002: Relay Agent in Go (single static binary for curl|bash)
- D-003: AWS Secrets Manager (prod) + local-encrypted (dev) behind interface
- D-004: Postgres append-only + hash-chain audit for M1 (S3 WORM in M3)
- D-005: Next.js App Router + TypeScript single SPA
No escalations. Pipeline proceeds to RESEARCH.
---ci---
phase: 0
milestone: v0.1
status: clarify
---/ci---
2026-08-24 22:34:13 +00:00
6146e9bc76
docs(init): validate specification
...
Parse CoreCI Chat v0.1 Engineering Spec v1.1 (Sarah Chen, locked 2026-08-24).
Rewrite placeholder .ciagent/ files with spec-derived content:
- PROJECT.md: vision, M1 scope (17 REQs), constraints, key decisions
- REQUIREMENTS.md: M1 REQs 001-014+038/039/040 with verbatim acceptance
criteria, M2/M3 deferrals, traceability matrix, out-of-scope
- ARCHITECTURE.md: components, data flow, M1 build-order waves A-E
- steer-v0.1-spec.md: authoritative spec persisted
- CHECKPOINT.json: stage=specify
---ci---
phase: 0
milestone: v0.1
status: specify
---/ci---
2026-08-24 22:33:46 +00:00
2cf16ed091
docs(init): initialize coreci-chat (2 phases)
...
---ci---
project: default
phase: 0
milestone: v0.1
status: specify
autonomy: full
decisions:
- id: D-001
decision: Autonomy level set to "full"
rationale: User-selected; CI/CD automation without HITL after clarify
confidence: 1.00
alternatives: [supervised, guided]
- id: D-002
decision: Release forge = gitea (coreci/coreci-chat at https://git.cloudinit.dev )
rationale: No git origin detected; user chose self-hosted Gitea for releases
confidence: 1.00
alternatives: [github, gitlab, local-only]
- id: D-003
decision: Milestone version = v0.1 (branch milestone/v0.1-bootstrap)
rationale: No existing tags; computeMilestoneTag() returns v0.1.0 for a feature/nfr milestone
confidence: 0.95
alternatives: []
- id: D-004
decision: Phase 0 branch = phase/00-pre-execution (created from milestone)
rationale: Canonical phase-0 name per branch-strategy reference
confidence: 1.00
alternatives: []
- id: D-005
decision: Specification parsing deferred to a follow-up session
rationale: User stated the full spec will arrive separately; init only lands the scaffold
confidence: 1.00
alternatives: [expand the literal "Create a folder in ~/coreci-chat" argument into a synthetic spec]
- id: D-006
decision: Single-project mode (projects[] empty; files in .ciagent/)
rationale: Only one project being initialized; no multi-project need indicated
confidence: 0.90
alternatives: [register a "coreci-chat" slug in projects[]]
- id: D-007
decision: GITEA_TOKEN persisted to .ciagent/.env.secrets (mode 0600); .env* git-ignored
rationale: Credential collection gate; secrets never written to config.json or committed
confidence: 1.00
alternatives: []
---/ci---
Specification: Initialize a CIAgent project scaffold at ~/coreci-chat (full spec to follow in a separate session)
Requirements: [git-native branch hierarchy, .ciagent/config.json, release target, .gitignore, initial commit on phase/00]
Constraints: [branch gate before any file write, GITEA_TOKEN never committed, autonomy=full preset applied verbatim, single-project mode]
Out of scope: [implementation source code, remote git push, milestone release tag, full specification parsing]
2026-08-24 22:20:05 +00:00
26fb8b04d5
chore: initialize repository
2026-08-24 22:15:01 +00:00
CIAgent