Repository navigation
feat(kernel): bind connected reads to captured provider source - #295
Merged
helmut-hoffer-von-ankershoffen merged 8 commits intoOct 30, 2026
Merged
Conversation
Capture declared installed provider source before initialization, use a sealed host runtime for ordinary imports, and check continuity before and after connected reads. Access approval and publisher trust remain separate; this is not a Python sandbox.
…nected-providers # Conflicts: # docs/adr/README.md
helmut-hoffer-von-ankershoffen
marked this pull request as ready for review
October 30, 2026 09:03
Contributor
Coverage report
Click to see where and how coverage changed
This report was generated by python-coverage-comment-action |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
helmut-hoffer-von-ankershoffen
deleted the
feat/source-bound-connected-providers
branch
October 30, 2026 09:13
Merged
helmut-hoffer-von-ankershoffen
added a commit
that referenced
this pull request
Oct 31, 2026
The versionless launcher now installs and opens the verified standard app. Updates and plugin changes preserve supported installation constraints and daemon choices, report progress, and reload the UI. ### ✨ Features - **kernel:** Bind connected providers to captured source ([#295](#295)) ([8a6eb56](8a6eb56)) - **heinzel:** Review multiple chat sources before connected reads ([#299](#299)) ([dd3c76b](dd3c76b)) - **kernel:** Record verified installation continuity ([#300](#300)) ([61eae39](61eae39)) - **heinzel:** Review pause and resume in durable chat ([#269](#269)) ([0c3c6b1](0c3c6b1)) - **heinzel:** Propose playbook drafts in durable chat ([#303](#303)) ([9c4c3b6](9c4c3b6)) - **heads:** Launch and maintain verified standard apps ([#304](#304)) ([5d4a5e3](5d4a5e3)) ### 🐛 Bug fixes - **web:** Align status details and preserve button contrast ([#292](#292)) ([1f79b99](1f79b99)) - **kernel:** Keep tool changes within the running installation ([#297](#297)) ([57f4c62](57f4c62)) ### 🧪 Testing - **web:** Wait for chat readiness after schedule reloads ([#298](#298)) ([25e1730](25e1730)) - Make schedule and signal fixtures deterministic ([#301](#301)) ([6f9985a](6f9985a)) - **heads:** Verify native shutdown and owned harness cleanup ([#302](#302)) ([0b24918](0b24918)) ### Release validation Fresh standard apps select uv-managed Python; refreshes retain the verified existing interpreter and supported installation choices. Explicit system-only environment policies are refused before installation state begins. With `UV_PYTHON_DOWNLOADS=never` or `manual`, a new preflight rejects definite absence of a matching managed-Python version before creating the pending marker. It checks hash-verified wheel `Requires-Python` bounds and a bounded, non-executing directory inventory. Directory names are only necessary hints: ambiguous layouts, architecture differences, configuration-only policy, transitive resolution and later changes remain subject to uv and the existing conservative recovery path. Connected reads recheck the lease that produced the value and reobserve the approved connection after cleanup. Observed account, source, grant or caller changes discard the result before an input receipt or model response exposes it. These checks do not establish atomic provider state or defend against a malicious provider. Test diagnostics preserve the real assertions and deadlines: Electron records only fixed boolean observations after a failed click, E2E reports identify failed cases before teardown, and the mobile harness drains bounded server stderr and records its pre-cleanup exit status. Known startup tokens are redacted; the failure path avoids pytest rendering a token-bearing command. These diagnostics do not establish the cause of the earlier hosted connection reset. Normal full local preflight passed for the installer/mobile batch: Python tests 236.0s, frontend tests 53.8s, template validation 317.6s, build 8.6s, and all lint, types, generated documentation and managed-backend checks. The focused installer/diagnostic suite passed 64 tests. The subsequent test-only change generates its synthetic redaction marker at runtime; its five focused tests and normal commit hooks passed. The exact mobile sweep passed locally in 154.72s with the diagnostic changes; this did not reproduce the hosted reset. The E2E ordering hint starts the long mobile sweep in the initial batch only for the pinned xdist 3.8.0 three-worker load scheduler. It preserves the selected tests, relative order of unhinted tests, worker count and original shared 600-second deadline. Unknown scheduler settings retain the original order; generated plugin metadata omits this core-only hint. Controller-to-worker integration tests exercise both the active and fallback cases. Current head is `26884df1693056fffcffd2d37d0814fb6f8d2a4a`. Local Make E2E passed in 272.8s with unchanged selection and limits; full preflight and normal commit/push hooks passed. The previous head's canonical matrix failed when the mobile sweep passed late and left only 13 seconds for the next test. Local success does not prove hosted timing. Provider review data is now detached and revalidated before source binding and host review, including constructed model instances and mutable nested values. Invalid values produce fixed errors without serializer warnings exposing provider metadata. The public `ConnectedReadReview` validation method retains the kernel API boundary, and the import rule now enforces that boundary for connected-read internals. Six focused regressions cover refusal, copy isolation, finite values, warning privacy and valid provider round trips; evidence uses synthetic providers and does not establish a real-account breach. For this repair, full local `make check` passed (Python 194.1s, web 47.7s), followed by independent post-check source review with no Critical or Required findings. Release preflight passed (Python 213.5s, web 53.6s, template 302.1s, build 8.5s). Normal commit hooks passed. Fresh exact-head CI and paid source review are required; the complete canonical matrix remains required before merge. No earlier-head review is treated as approval of this head. Hooks, interpreter ownership checks, time limits and branch protections remain enforced. GitHub/PyPI publication, compatible theme/default composition, published install/update/plugin/uninstall verification and deployment are separate gates. This release PR does not establish complete Electron or durable-agent delivery. --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Helmut Hoffer von Ankershoffen né Oertel <helmuthva@googlemail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Connected-read approval must describe the provider code actually loaded, including when an installed plugin is updated or timestamp bytecode remains stale. Default boot now captures matching installed provider packages before initialization and checks the selected service, source and sealed host runtime before and after connected calls.
Declared providers use bounded pure-Python source and captured resources; unsupported or undeclared providers retain ordinary capabilities but cannot use this guarded read path. The public capture-context predicate lets compatible plugins keep that path inactive on older cores. Human account and operation approval remains separate. This establishes local continuity for owner-selected code, not publisher verification or a Python sandbox.
ADR 0106 describes the source boundary. The source boundary received independent security and architecture review, including review of the resource and capture-context changes. On the merged current-main port, 1,401 focused source, API, connected-read, schedule, documentation and standards tests passed. A prior port also passed full preflight; required current-head preflight and CI provide the integration check. No live Google access or complete workflow claim.