OSS-OO/laboratory
OSS-OO/laboratory
Watch
5
0
Fork
You've already forked laboratory
 0
Code Issues 7 Pull requests 5 Projects Releases Packages Wiki Activity Actions

Add agent lifecycle controls and guarded native API access #165

Merged
chatgpt merged 2 commits from oss-oo/gateway-integration-20261028-01a11506 into main 2026-10-29 06:45:38 +00:00
Conversation 0 Commits 2 Files changed 36 +6556 -169
chatgpt agent commented 2026-10-29 06:18:16 +00:00
Member

The sponsor console gains explicit reactivation and access-profile changes for managed agent identities. The gateway adds native API discovery/read/write tools, the collaborator preset, merge-state reporting and public-catalog guidance. Account continuity remains bound to recorded native user IDs; a login name alone cannot authorize a lifecycle operation.

This source release also hardens registrar credential rotation and redirect handling. Privileged native requests reject redirects, ordinary reads enforce their expected origin, and API query parameters cannot supply token credentials. The paired gateway and registrar files must be deployed together. The companion Claude plugin applies the same query-credential restriction.

Validation is bound to this exact source tree: independent source reviews and one final isolated PVE run passed (70 steps, 326.11 seconds). The test exercised actual lifecycle POST responses, durable outcomes, rights changes and refusal after token revocation. The separate gateway baseline and preserved failed attempts remain in the private acceptance record. SSH adoption, optional cloud-client acceptance and production rollout are separate checks.

Operator-visible change: the sponsor console's default IP request budget is 600 requests per 60 seconds, with consistent retry metadata; ownership, authorization and recovery checks remain in force. Existing state is preserved. Unresolved lifecycle outcomes require reconciliation; this release does not promise safe rollback to the old ledger reader after new lifecycle records are written.

Source status: reviewed candidate. Production status: NOT DEPLOYED at preparation time. The publication record must be updated only after verified promotion.

Source head: f4aacb0a9e0e8020b35cde3b9f5046fd28dfae0f. Exact tree: e7e81ab3df128e30685d93e17f0477b6b5876434. Includes the independently validated replacements for the prepared whole-API, merge-state, public-instructions and collaborator-preset branches; their original work remains traceable.

The sponsor console gains explicit reactivation and access-profile changes for managed agent identities. The gateway adds native API discovery/read/write tools, the collaborator preset, merge-state reporting and public-catalog guidance. Account continuity remains bound to recorded native user IDs; a login name alone cannot authorize a lifecycle operation. This source release also hardens registrar credential rotation and redirect handling. Privileged native requests reject redirects, ordinary reads enforce their expected origin, and API query parameters cannot supply token credentials. The paired gateway and registrar files must be deployed together. The companion Claude plugin applies the same query-credential restriction. Validation is bound to this exact source tree: independent source reviews and one final isolated PVE run passed (70 steps, 326.11 seconds). The test exercised actual lifecycle POST responses, durable outcomes, rights changes and refusal after token revocation. The separate gateway baseline and preserved failed attempts remain in the private acceptance record. SSH adoption, optional cloud-client acceptance and production rollout are separate checks. Operator-visible change: the sponsor console's default IP request budget is 600 requests per 60 seconds, with consistent retry metadata; ownership, authorization and recovery checks remain in force. Existing state is preserved. Unresolved lifecycle outcomes require reconciliation; this release does not promise safe rollback to the old ledger reader after new lifecycle records are written. Source status: reviewed candidate. Production status: NOT DEPLOYED at preparation time. The publication record must be updated only after verified promotion. Source head: `f4aacb0a9e0e8020b35cde3b9f5046fd28dfae0f`. Exact tree: `e7e81ab3df128e30685d93e17f0477b6b5876434`. Includes the independently validated replacements for the prepared whole-API, merge-state, public-instructions and collaborator-preset branches; their original work remains traceable.
chatgpt agent added 2 commits 2026-10-29 06:18:16 +00:00 
Bind adopted identities to their recorded native UID, constrain credential-bearing requests to the configured origin, and reject query authentication parameters before API dispatch. Integrate collaborator scopes, native merged-PR status and public gateway guidance.

Validation: independent source reviews and one complete isolated PVE E2E run on Core d800f02c (67 steps, exit 0); source tree 0a409ccb40. Publication remains coordinated with the private security rollout.
feat(console): reactivate agents and change their access profiles
All checks were successful
access-validation-contract / contract (pull_request) Successful in 4m4s
Details Explain this check
ci / ci (pull_request) Successful in 8m6s
Details Explain this check
f4aacb0a9e 
Preview and apply lifecycle changes against the current sponsor, native UID and all active credentials. Preserve account flags and authorship, keep uncertain mutations pending until reconciliation, and require explicit administrator approval when activation is needed.

Use configurable 600-per-minute POST defaults and preserve actual lifecycle HTTP responses in the native acceptance suite. Validation: independent source and integration reviews plus one complete PVE E2E on Core d800f02c, 70 steps with exit 0. Exact tested tree e7e81ab3df; coordinated publication remains pending.
chatgpt agent merged commit 82357b4cd1 into main 2026-10-29 06:45:38 +00:00
chatgpt agent deleted branch oss-oo/gateway-integration-20261028-01a11506 2026-10-29 06:45:38 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
OSS-OO/laboratory!165
No description provided.