jon/steve-os-orchestrator
Watch
1
0
Fork
You've already forked steve-os-orchestrator
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Phase 3: governed provisioning and bounded self-repair #3

Merged
jon merged 7 commits from phase/03-governed-self-repair into main 2026-08-18 18:37:13 +00:00
Conversation 0 Commits 7 Files changed 22 +1871 -37
jon commented 2026-08-18 15:37:04 +00:00
Owner
Copy link

Purpose

Add policy-governed dependency provisioning, isolated validation, and bounded autonomous self-repair.

Changes

  • Adds governed Python dependency provisioning.
  • Keeps repository source and control-plane secrets out of the dependency fetcher.
  • Restricts dependency egress to explicitly allowed package hosts.
  • Requires TLS and rejects private, loopback, and link-local destinations.
  • Allows wheel artifacts only and rejects source distributions.
  • Rejects direct URLs, VCS dependencies, local dependency paths, index overrides, and dynamic dependency metadata.
  • Validates downloaded dependency archives against traversal and link attacks.
  • Runs validation without network access.
  • Installs dependencies offline from a previously fetched wheelhouse.
  • Adds bounded autonomous repair after provisioning or validation failures.
  • Persists repair and validation attempt counters across restart.
  • Treats repair diagnostics as untrusted input.
  • Adds provisioning and repairing states to autonomous restart reconciliation.
  • Records repair and validation counts in phase completion manifests.

Governance

Provisioning and repair are autonomous only inside explicit policy and retry budgets.

Workers and validators do not receive Forgejo credentials, orchestrator credentials, or control-plane data access.

Deployment remains a separate explicit human gate.

Validation

  • 51 tests passed.
  • Python compile check passed.
  • git diff --check passed.
  • No production deployment performed.
  • Running orchestrator remains unchanged.

Remaining validation

The new provisioner and registry proxy still require integration testing against the dedicated sandbox Docker engine before Phase 3 is considered operational.

Deployment

None.

This PR changes source only.

## Purpose Add policy-governed dependency provisioning, isolated validation, and bounded autonomous self-repair. ## Changes - Adds governed Python dependency provisioning. - Keeps repository source and control-plane secrets out of the dependency fetcher. - Restricts dependency egress to explicitly allowed package hosts. - Requires TLS and rejects private, loopback, and link-local destinations. - Allows wheel artifacts only and rejects source distributions. - Rejects direct URLs, VCS dependencies, local dependency paths, index overrides, and dynamic dependency metadata. - Validates downloaded dependency archives against traversal and link attacks. - Runs validation without network access. - Installs dependencies offline from a previously fetched wheelhouse. - Adds bounded autonomous repair after provisioning or validation failures. - Persists repair and validation attempt counters across restart. - Treats repair diagnostics as untrusted input. - Adds provisioning and repairing states to autonomous restart reconciliation. - Records repair and validation counts in phase completion manifests. ## Governance Provisioning and repair are autonomous only inside explicit policy and retry budgets. Workers and validators do not receive Forgejo credentials, orchestrator credentials, or control-plane data access. Deployment remains a separate explicit human gate. ## Validation - 51 tests passed. - Python compile check passed. - git diff --check passed. - No production deployment performed. - Running orchestrator remains unchanged. ## Remaining validation The new provisioner and registry proxy still require integration testing against the dedicated sandbox Docker engine before Phase 3 is considered operational. ## Deployment None. This PR changes source only.
jon changed title from WIP: Phase 3: governed provisioning and bounded self-repair to Phase 3: governed provisioning and bounded self-repair 2026-08-18 18:36:28 +00:00
jon merged commit e985933468 into main 2026-08-18 18:37:13 +00:00
jon deleted branch phase/03-governed-self-repair 2026-08-18 18:37:13 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
jon/steve-os-orchestrator!3
No description provided.