Skip to content

v0.10.7 — builder-scoped push grant + branch-bound gates

Choose a tag to compare

View all tags
@lodar lodar released this 19 Jul 00:06
v0.10.7
1903818

Finish the delegated-push rollout's last mile (DIVE-1462 / STEER-4):

  • fix(push): a cleared ship gate now binds to the task's OWN declared branch — _push_do + the 5dive push pre-flight refuse any branch that isn't the one the cited task declares (Branch: <name> in its body). Closes the hole where a granted agent could reuse one cleared gate to push an unrelated feature branch.
  • change(agent create): delegated-push grant is now BUILDER-SCOPED. New agent create --can-push grants a standard (builder) agent the exact-path _push_do NOPASSWD line; plain standard agents (QA/art) get only a2a/audit. Admin already has it; refused for sandboxed. Supersedes 0.10.6's all-standard grant.

push_unit 33/33; test-vm.sh smoke green (builder-push-grant row on real sudo-rs).

Assets 2
Loading