fix(notify): load config JWT secret and improve delivery diagnostics - #1137
Merged
Conversation
Nodes configured with `[auth].jwt_secret` could receive channel traffic while outbound notifications sent no Authorization header and failed with HTTP 401. Read the configured secret as a fallback to the environment for tool and completion notifications. Add per-gateway delivery diagnostics with retry, workstream, and tool-call context, safe delivery-status summaries, and explicit gateway authentication rejection reasons. Keep credentials and notification content out of the new diagnostics, and document troubleshooting. Validation: - 240 tests passed across `test_notify_tool.py`, `test_notify_http.py`, `test_notify_completion.py`, and `test_coordinator_tools.py` on the dev base. - The config-only gateway regression fails with the original helper and passes with this change. - Ruff lint/format checks and package-wide mypy passed. Refs #1136. The issue remains open for the reporter to confirm the fix or provide new logs.
![github-code-quality[bot]](https://avatars.githubusercontent.com/u/9919?s=60&v=4){kind=small}
| @pytest.fixture(autouse=True) | ||
| def auth_config(self, tmp_path, monkeypatch): | ||
| import turnstone.core.config as config | ||
| import turnstone.core.session as session |
| @pytest.fixture(params=["tool", "completion"]) | ||
| def notify_caller(self, request, monkeypatch): | ||
| """Exercise both outbound paths with the same gateway failures.""" | ||
| import turnstone.core.session as session_module |
eous
added a commit
that referenced
this pull request
Sep 9, 2026
…1137) Nodes configured with `[auth].jwt_secret` could receive channel traffic while outbound notifications sent no Authorization header and failed with HTTP 401. Read the configured secret as a fallback to the environment for tool and completion notifications. Add per-gateway delivery diagnostics with retry, workstream, and tool-call context, safe delivery-status summaries, and explicit gateway authentication rejection reasons. Keep credentials and notification content out of the new diagnostics, and document troubleshooting. Validation: - 240 tests passed across `test_notify_tool.py`, `test_notify_http.py`, `test_notify_completion.py`, and `test_coordinator_tools.py` on the dev base. - The config-only gateway regression fails with the original helper and passes with this change. - Ruff lint/format checks and package-wide mypy passed. Refs #1136. The issue remains open for the reporter to confirm the fix or provide new logs.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Nodes configured with
[auth].jwt_secretcould receive channel traffic while outboundnotifications sent no Authorization header and failed with HTTP 401. Read the configured
secret as a fallback to the environment for tool and completion notifications.
Add per-gateway delivery diagnostics with retry, workstream, and tool-call context, safe
delivery-status summaries, and explicit gateway authentication rejection reasons. Keep
credentials and notification content out of the new diagnostics, and document troubleshooting.
Validation:
test_notify_tool.py,test_notify_http.py,test_notify_completion.py, andtest_coordinator_tools.pyon the dev base.Refs #1136. The issue remains open for the reporter to confirm the fix or provide new logs.