Skip to content

v2.4.2 — Sanity audit cleanups: enrollmentRole gate + farm draft slot

Choose a tag to compare

@ankurCES ankurCES released this 19 Apr 06:15
· 16 commits to main since this release

Post-v2.4.1 sanity audit cleanups

Cross-mode audit (Regular / Master / Slave-workforce / Slave-farm) surfaced two real gaps. Everything else — wake-dispatch farm guard, migration v71 copy, telemetry runtimes optional field, ConversationServiceImpl 'farm' case, command-type registry, AgentType exhaustive switches — checked out clean.

1. enrollmentRole gate on farm commands (defense in depth)

Neither team.farm_provision nor agent.execute verified the slave's enrolled role before executing. A workforce slave that somehow received one (misconfigured master, stale replay, or a compromised master assuming signed-envelope bypass) would silently materialize a mirror team it can't actually run. Both handlers now fast-skip with reason: 'not_farm_role' when ProcessConfig('fleet.enrollmentRole') isn't 'farm'. Signed envelope still verifies — this is a second-layer sanity gate so boundaries don't leak even if the first layer is wrong.

2. Missing 'farm' case in SendBoxDraftStore

The store.farm bucket was added in v2.2.0 but the setDraft / getDraft switches in useSendBoxDraft.ts still fell through to default. FarmSendBox uses local state today so it doesn't rely on the hook, but any future code path that does would silently drop all draft mutations. Both switches now handle 'farm' correctly.

Upgrade notes

  • Slave-only change #1 (enrollmentRole gate); renderer-only change #2 (draft store).
  • No DB migration.
  • Pre-v2.4.2 farm slaves keep working identically — the new gate returns skipped on workforce slaves, which v2.4.2 master audit picks up cleanly.