v0.13.0 - #20

Merged

dzikowski merged 86 commits into

mainfrom

Aug 6, 2026

Commits on Jul 30, 2026

Feat: make overnight qa/simplifier/security_review loop-safe

dzikowski
and
cursoragent
committed
e57af31
Test: fill QA coverage gaps for CLI, compiler, e2e

dzikowski
and
claude
committed
31c79af
Refactor: apply safe simplifier-pass cleanups across src

dzikowski
and
claude
committed
541203f
Test: fill QA gap-report coverage for CLI, e2e, compiler

dzikowski
and
claude
committed
61ccb30
Refactor: apply safe simplifier-pass cleanups across src
dzikowski
committed
369c7b1
Test: fill QA gap-report coverage for CLI init and compiler

dzikowski
and
claude
committed
4db1b62
Refactor: extract shared SINGLE_QUOTE_MESSAGE parse constant

dzikowski
and
claude
committed
66cbb30
Refactor: extract shared errText and run-meta helpers

dzikowski
and
claude
committed
0ae6795
Docs: queue security-review HIGH/MEDIUM findings as dev-ready tasks
dzikowski
committed
0886be9

Commits on Jul 31, 2026

Docs: queue security-review LOW findings as #dev-ready tasks

dzikowski
and
cursoragent
committed
071bb5c
Fix: shell-quote values interpolated into workflow shell steps

dzikowski
and
claude
committed
2eb3951
Fix: exclude host-only JAIPH_SERVE_* keys from sandbox env forward

dzikowski
and
claude
committed
ffc0bbc
Fix: key and verify the run audit journal to resist tampering

dzikowski
and
claude
committed
b2378bb
Refactor: split engineer into queue and task-parameter entries

dzikowski
and
cursoragent
committed
e870111
Feat: pin and signature-verify jaiph install registry entries

dzikowski
and
cursoragent
committed
652c29f
Docs: document registry scheme allowlist and install integrity checks

dzikowski
and
cursoragent
committed
1c1c234
Docs: finalize install/registry integrity docs and e2e coverage

dzikowski
and
claude
committed
16f153a
Feat: treat docker_image/docker_network as host-controlled

dzikowski
and
claude
committed
41ee7aa
Feat: gate entry-file trusted_envs behind operator opt-in

dzikowski
and
claude
committed
4a11d6c
Feat: harden image jaiph-presence probe and drop login shell

dzikowski
and
claude
committed
ef1cfb1
Feat: reject or distinctly identify sub-less OIDC tokens

dzikowski
and
claude
committed
0656c14
Feat: gate project-local hooks behind workspace-trust opt-in

dzikowski
and
claude
committed
ccbfaf6
Feat: fail-closed release install and runtime toolchain verification

dzikowski
and
claude
committed
7142be8
Feat: broaden and canonicalise credential redaction

dzikowski
and
claude
committed
2da46ad
Feat: self-host Swagger UI assets for jaiph serve /docs

dzikowski
and
claude
committed
2d4346f
Chore: run security_review on Claude fable

dzikowski
and
cursoragent
committed
15d6571
Feat: redact credentials in durable log/logwarn/logerr journal lines

dzikowski
and
claude
committed
1123ec0
Feat: add host-mode run timeout and optional max-step circuit breaker

dzikowski
and
claude
committed
611c214
Feat: pin explicit OIDC JWT algorithms allowlist in jwtVerify
dzikowski
committed
6a859fb
Fix: skip empty JAIPH_MINISIGN_PUBLIC_KEY in installer bad-checksum e2e test
dzikowski
committed
21b5641
Fix: leave JAIPH_MINISIGN_PUBLIC_KEY unset in e2e setup-action test when no throwaway key exists
dzikowski
committed
6f2348a
Fix: re-export CI env inside WSL install step and pin Docker e2e test image
dzikowski
committed
4cf2835
Fix: use npm ci and exact-pin jose in local builds

dzikowski
and
claude
committed
74e2195
Docs: queue #dev-ready tasks for security review MEDIUM findings

dzikowski
and
claude
committed
17bfd77
Docs: queue security-review LOW findings except L-1

dzikowski
and
cursoragent
committed
d53b2f6
Fix: require explicit unsafe consent for mcp/serve host-only mode

dzikowski
and
claude
committed
4eb8f73

Commits on Aug 1, 2026

Fix: stop otlp/sentry export integration tests from hanging test:ci

dzikowski
and
cursoragent
committed
4db0d1d
Feat: kill a leaf script step after an idle-output timeout

dzikowski
and
claude
committed
0ab3313
Feat: pin registry entries to a commit and enforce on install
dzikowski
committed
871ee55
Feat: require signature verification in CI installer and action

dzikowski
and
claude
committed
969c45f
Feat: pin runtime image by digest and verify on every run

dzikowski
and
claude
committed
c5fc832
Fix: redact credentials in generic step params in run journal

dzikowski
and
claude
committed
bcd1442
Feat: reject truncated audit journals via WORKFLOW_END terminal marker

dzikowski
and
claude
committed
34071b4
Feat: pin runtime Dockerfile base images and npm installs

dzikowski
and
claude
committed
b0b5d75
Fix: require explicit --allow-anonymous opt-in for serve's open loopback mode

dzikowski
and
claude
committed
9a6c2e9
Fix: refresh pinned SHA-256 for the rolling uv installer URL
dzikowski
committed
bc31cac
Fix: refresh pinned SHA-256 for AWS CLI v2 downloads
dzikowski
committed
e49f5db
Fix: disambiguate same-second run-directory collisions
dzikowski
committed
8a88d46

Commits on Aug 2, 2026

Docs: accept agent-analyzability ADR and queue enforcement tasks

dzikowski
and
cursoragent
committed
7023d77
Fix: verify per-library registry signatures against the embedded key only

dzikowski
and
claude
committed
f97fc49
Chore: enforce agent-analyzability import graph in CI

dzikowski
and
claude
committed
76e956a
Feat: enforce agent-analyzability fan-out and size caps via ESLint

dzikowski
and
claude
committed
efa7f15
Feat: make src/parser.ts the public parse entry, ban deep imports

dzikowski
and
claude
committed
463307e
Feat: make src/transpiler.ts the public transpile entry, ban deep imports

dzikowski
and
claude
committed
bf14d53
Feat: add runtime public entry, stop runtime importing CLI

dzikowski
and
claude
committed
24797ef
Feat: add format public entry, ban deep imports into format

dzikowski
and
claude
committed
fa2686c
Feat: enforce CLI slice isolation in dependency-cruiser

dzikowski
and
claude
committed
37d3c27
Refactor: clear parse/config layer-violation baselines

dzikowski
and
claude
committed
be2d71e
Fix: hard-kill wedged Docker presence probes so test:ci cannot hang

dzikowski
and
cursoragent
committed
7bcf561
Feat: enforce docs summary-first lead and 500-line body cap

dzikowski
and
cursoragent
committed
880869e
Feat: sync engineer code_philosophy with agent-analyzability ADR

dzikowski
and
cursoragent
committed
6fdc8fd
Fix: pin dependency-cruiser to 17.4.3 to unbreak CI
dzikowski
committed
2f6bd4f

Commits on Aug 3, 2026

Feat: render TTY log lines in blue

dzikowski
and
cursoragent
committed
e12642f
Docs: queue operator logging for mcp/serve and analyzability follow-ups

dzikowski
and
cursoragent
committed
e26e44d
Fix: skip flaky Docker e2e in engineer CI; land cycle-break

dzikowski
and
cursoragent
committed
43e1ab7
Feat: commands as composition root; queue Docker e2e harden

dzikowski
and
cursoragent
committed
cc18b02
Docs: orchestration owns QUEUE removal; harden Docker e2e helpers

dzikowski
and
cursoragent
committed
f743404
Fix: drop overnight Docker e2e skip; run hardened suite

dzikowski
and
claude
committed
0eec1a7
Docs: mark Docker e2e hardening done; remove queue task
dzikowski
committed
d8c7100

Commits on Aug 4, 2026

Fix: restore overnight Docker e2e skip; require full-suite evidence

dzikowski
and
cursoragent
committed
de7bfbf
Fix: Docker e2e flakes from probe misclassify and 74d leftover race

dzikowski
and
cursoragent
committed
d9ce9cd
Fix: drop overnight Docker e2e skip after full suite ×3 green

dzikowski
and
cursoragent
committed
92bcec0
Refactor: move MCP + workflow-call into cli/shared; clear peer-slice baseline

dzikowski
and
cursoragent
committed
87997c8
Fix: avoid false positive on overnight Docker skip guard

dzikowski
and
cursoragent
committed
64fd72b
Docs: record cleared peer CLI slice baseline

dzikowski
and
claude
committed
ef1ba69
Refactor: expose runtime test seams via src/runtime/testing.ts

dzikowski
and
claude
committed
88389c7
Refactor: collapse transpile to one public entry (src/transpiler.ts)

dzikowski
and
claude
committed
2ca546f
Refactor: split hotspot files, drop 12 ESLint grandfather overrides

dzikowski
and
claude
committed
adfcba6
Docs: refresh agent-analyzability ADR to landed enforcement

dzikowski
and
claude
committed
7a291aa
Feat: add operator log to jaiph mcp and serve

dzikowski
and
claude
committed
b4a8c8f
Fix: refresh pinned SHA-256 for AWS CLI v2 downloads
dzikowski
committed
e8ee59c

Commits on Aug 5, 2026

Docs: call out isolating sensitive data in Why Jaiph

dzikowski
and
cursoragent
committed
0afecc7

Commits on Aug 6, 2026