Skip to content

feat: agent auth 2.0 with devices, robots, quorum approvals, core email and password, and security fixes #273

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
thegdsks merged 49 commits into from
Oct 19, 2026
Merged

feat: agent auth 2.0 with devices, robots, quorum approvals, core email and password, and security fixes #273

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
49 commits
Select commit Hold shift + click to select a range
08111c2
chore: leave the generated OpenAPI document out of the formatter
thegdsks Oct 18, 2026
dd6b30e
fix: make MySQL DDL valid and claim single use rows without RETURNING
thegdsks Oct 18, 2026
2d27ad0
fix: refuse banned users on JWT and stateless sessions and fail close…
thegdsks Oct 18, 2026
551240a
feat: make approvals a first class flow with distinct decision codes …
thegdsks Oct 18, 2026
7adfac0
feat: record input provenance in the audit chain and rotate pseudonyms
thegdsks Oct 18, 2026
be213ce
feat: add framework integration helpers as a core subpath export
thegdsks Oct 18, 2026
6fb281d
feat: add explain and revocation pages and revocation admin routes
thegdsks Oct 18, 2026
f197327
feat: generate the OpenAPI contract and bring the Go and Python clien…
thegdsks Oct 18, 2026
7132cde
feat: add theauth doctor security to lint a config for weak settings
thegdsks Oct 18, 2026
023756e
docs: add wave 8 upgrade notes and navigation entries
thegdsks Oct 18, 2026
96ae5ef
chore: add the database and SDK client CI jobs, widen peer ranges to …
thegdsks Oct 18, 2026
f5616dc
feat: export robot permissions to SROS2 and gate hazardous commands
thegdsks Oct 18, 2026
2fab7c3
feat: verify the Go audit head checkpoint in TypeScript to detect tai…
thegdsks Oct 18, 2026
fc2973b
fix: apply the whole MySQL migration chain on a real server and test …
thegdsks Oct 18, 2026
fe7e6c6
feat: add device identity, step up auth, DPoP agent tokens, keyed pro…
thegdsks Oct 18, 2026
31e5ae6
fix: wait for pre-registered MCP clients before answering lookups and…
thegdsks Oct 18, 2026
78a20ae
test: wait for async audit rows and decision events instead of fixed …
thegdsks Oct 18, 2026
d40c1b4
chore: leave the Go generated vector fixtures out of the formatter
thegdsks Oct 18, 2026
f02cd2d
feat: bring the Go and Python clients up to the wave 9 features
thegdsks Oct 18, 2026
84ebfb8
fix: make approval hashes and Go pseudonym checks agree across TypeSc…
thegdsks Oct 18, 2026
a7aa6e2
docs: check docs links in CI, mention devices and robots and regenera…
thegdsks Oct 18, 2026
3953479
feat: add a Devices page, path aware matching, API key scoping, OIDC …
thegdsks Oct 18, 2026
69f07c2
feat: add Python guards for LangGraph, CrewAI and the OpenAI Agents S…
thegdsks Oct 18, 2026
701a372
fix: give every exported ROS 2 node the endpoints it needs to start u…
thegdsks Oct 18, 2026
a8284dc
feat: add fleet doctor findings, default API key scope to org roles, …
thegdsks Oct 18, 2026
81bb584
docs: correct the better-auth and paid platform comparisons against t…
thegdsks Oct 18, 2026
b7fbe38
fix: client bindings call the routes core serves, add session refetch…
thegdsks Oct 18, 2026
7a9dfac
feat: signed revocation snapshots and Android Key Attestation for dev…
thegdsks Oct 18, 2026
3e3855c
feat: quorum approvals, database hooks, Drizzle instance adapter, sto…
thegdsks Oct 18, 2026
a7dfd2f
chore: rebuild the UI registry after the route fixes
thegdsks Oct 18, 2026
f7238b3
docs: add dated, sourced facts to the comparisons and a Keycloak page…
thegdsks Oct 19, 2026
2d1bd9a
feat: add Apple App Attest and TPM 2.0 quote verifiers tested on real…
thegdsks Oct 19, 2026
746da30
feat: single-use repositories for 20 claim sites, resumable GDPR eras…
thegdsks Oct 19, 2026
d6ce6fd
perf: add hot path indexes, reuse crypto keys, cheaper canonicalizati…
thegdsks Oct 19, 2026
8bff5af
fix: make the hourly call budget atomic, refuse empty attestation non…
thegdsks Oct 19, 2026
372a4ec
feat: add a SPIFFE bridge for X.509 and JWT SVIDs with mTLS bound age…
thegdsks Oct 19, 2026
1ec0e34
fix: regenerate the OpenAPI contract, anchor the browser entry import…
thegdsks Oct 19, 2026
d62a425
feat: add spiffe routes and audit, a device fleet conformance kit, a …
thegdsks Oct 19, 2026
b274a01
fix: give the core build a larger heap so the type declarations bundl…
thegdsks Oct 19, 2026
0e16567
fix: accept the libsql provider in the cli database target type
thegdsks Oct 19, 2026
0231034
test: add the four spiffe routes to the route parity table
thegdsks Oct 19, 2026
bd34fa9
fix: hide other owners' workloads on the admin spiffe routes and add …
thegdsks Oct 19, 2026
8a0aade
feat: fire database hooks on user updates and the remaining user crea…
thegdsks Oct 19, 2026
6bdec47
feat: add core email and password, attestation policy and deeper devi…
thegdsks Oct 19, 2026
db6791b
fix: add the email verification and reset members and the sign up res…
thegdsks Oct 19, 2026
c38a22c
fix: let the email claim skip credential tables of features that are …
thegdsks Oct 19, 2026
4dec0be
chore: version packages for 2.0
thegdsks Oct 19, 2026
f0d5bf9
chore: align core coverage provider with vitest 4
thegdsks Oct 19, 2026
8884a77
test: wait for the in flight read instead of a fixed sleep in the rev…
thegdsks Oct 19, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
The table of contents is too big for display.
Diff view
Diff view
  •  
  •  
  •  
15 changes: 0 additions & 15 deletions .changeset/adapter-astro-http-handler.md
View file
Open in desktop

This file was deleted.

13 changes: 0 additions & 13 deletions .changeset/adapter-express-http-handler.md
View file
Open in desktop

This file was deleted.

13 changes: 0 additions & 13 deletions .changeset/adapter-fastify-http-handler.md
View file
Open in desktop

This file was deleted.

12 changes: 0 additions & 12 deletions .changeset/adapter-hono-http-handler.md
View file
Open in desktop

This file was deleted.

13 changes: 0 additions & 13 deletions .changeset/adapter-nestjs-http-handler.md
View file
Open in desktop

This file was deleted.

12 changes: 0 additions & 12 deletions .changeset/adapter-nextjs-http-handler.md
View file
Open in desktop

This file was deleted.

15 changes: 0 additions & 15 deletions .changeset/adapter-nuxt-http-handler.md
View file
Open in desktop

This file was deleted.

15 changes: 0 additions & 15 deletions .changeset/adapter-solidstart-http-handler.md
View file
Open in desktop

This file was deleted.

15 changes: 0 additions & 15 deletions .changeset/adapter-sveltekit-http-handler.md
View file
Open in desktop

This file was deleted.

15 changes: 0 additions & 15 deletions .changeset/adapter-tanstack-http-handler.md
View file
Open in desktop

This file was deleted.

5 changes: 0 additions & 5 deletions .changeset/agent-expiry-enforced.md
View file
Open in desktop

This file was deleted.

10 changes: 0 additions & 10 deletions .changeset/agent-token-prefix.md
View file
Open in desktop

This file was deleted.

18 changes: 0 additions & 18 deletions .changeset/audit-api-v2.md
View file
Open in desktop

This file was deleted.

5 changes: 0 additions & 5 deletions .changeset/audit-decision-code.md
View file
Open in desktop

This file was deleted.

9 changes: 0 additions & 9 deletions .changeset/audit-receipt-interop.md
View file
Open in desktop

This file was deleted.

11 changes: 0 additions & 11 deletions .changeset/audit-verify-hardening.md
View file
Open in desktop

This file was deleted.

Loading
Loading