feat(iac/admin): v1.1 mutation surface + hardening + loadable stub provider + audit-viewer UI#807

Merged

intel352 merged 28 commits into

mainfrom

feat/infra-admin-v1.1-mutations-2026-05-31T1715

Jun 1, 2026

Commits on May 31, 2026

feat(iac/stubprovider): promote NoopProvider to a loadable package

intel352
and
claude
committed
feat(iac/admin/ui): mutation panels (plan/apply/destroy/drift)

intel352
and
claude
committed
feat(plugins/stubprovider): build-tagged loadable stub iac.provider

intel352
and
claude
committed
refactor(wfctlhelpers): promote DesiredStateHash (resolve+hash) for in-process TOCTOU

intel352
and
claude
committed
test(iac/admin/proto): apply code-review nits F1/F2/F3

intel352
and
claude
committed
fix(iac/admin/ui): T11 spec-review I-1 + S-1 + S-2

intel352
and
claude
committed
feat(module/infra_admin): #29 require auth_module + authz_module + subject propagation

intel352
and
claude
committed
fix(iac/admin/ui): code-review minor F1+F2 (T11 post-review)

intel352
and
claude
committed
feat(iac/admin/handler): PlanResource + DriftCheckResource

intel352
and
claude
committed
feat(iac/admin/handler): ApplyResource + DestroyResource (TOCTOU + allow_replace + RBAC)

intel352
and
claude
committed
feat(module/infra_admin): mutation routes + requireBearer + single-flight + 3-way audit + write RBAC

intel352
and
claude
committed
test(module/infra_admin): security regression suite (CSRF/spoof/TOCTOU/single-flight/audit)

intel352
and
claude
committed
test(module/infra_admin): mutation integration (apply->state->audit) via real engine path

intel352
and
claude
committed
fix(iac/stubprovider): code-review + spec-review fixes (OBS-1 + findings 1-3)

intel352
and
claude
committed
fix(wfctlhelpers): rename DesiredStateHash env param from _ to env (spec-review)

intel352
and
claude
committed
test(iac/admin/ui): serve mutation panels + audit-viewer assets

intel352
and
claude
committed
fix(iac/admin/handler): T6 spec-review fixes (FAIL-14 + FAIL-16)

intel352
and
claude
committed
fix(iac/admin/handler): T7 spec-review fixes (IMPORTANT-1 + IMPORTANT-2)

intel352
and
claude
committed
fix(iac/admin/ui): T12 spec-review — setInterval uses fetchAndCache + dead code removed

intel352
and
claude
committed
fix(module): adapt tests for T7 confirm_hash gate + T12 4th contribution

intel352
and
claude
committed
fix(module/infra_admin): infraSpecFromResolved: add DependsOn extraction (T8 spec-review)

intel352
and
claude
committed
fix(T10+handler): C-1/C-2/I-1/I-2/I-3 spec-review fixes

intel352
and
claude
committed
test(iac/admin/ui): code-review nits — io.ReadAll + pin setInterval(fetchAndCache,)

intel352
and
claude
committed
fix: code-reviewer minor findings (T6/T7/T9)

intel352
and
claude
committed
fix(T10): add Enforce call counter to integrationEnforcer (spec-reviewer note)

intel352
and
claude
committed
fix: code-reviewer minor findings (T3/T8)

intel352
and
claude
committed
fix(T10): code-reviewer minor findings F1/F2/F3

intel352
and
claude
committed
fix(wfctlhelpers): DesiredStateHash must NOT resolve env/secret refs

intel352
and
claude
committed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(iac/admin): v1.1 mutation surface + hardening + loadable stub provider + audit-viewer UI#807

feat(iac/admin): v1.1 mutation surface + hardening + loadable stub provider + audit-viewer UI#807
intel352 merged 28 commits into
mainfrom
feat/infra-admin-v1.1-mutations-2026-05-31T1715

Commits on May 31, 2026

feat(iac/stubprovider): promote NoopProvider to a loadable package

feat(iac/admin/ui): mutation panels (plan/apply/destroy/drift)

feat(plugins/stubprovider): build-tagged loadable stub iac.provider

refactor(wfctlhelpers): promote DesiredStateHash (resolve+hash) for in-process TOCTOU

test(iac/admin/proto): apply code-review nits F1/F2/F3

fix(iac/admin/ui): T11 spec-review I-1 + S-1 + S-2

feat(module/infra_admin): #29 require auth_module + authz_module + subject propagation

fix(iac/admin/ui): code-review minor F1+F2 (T11 post-review)

feat(iac/admin/handler): PlanResource + DriftCheckResource

feat(iac/admin/handler): ApplyResource + DestroyResource (TOCTOU + allow_replace + RBAC)

feat(module/infra_admin): mutation routes + requireBearer + single-flight + 3-way audit + write RBAC

test(module/infra_admin): security regression suite (CSRF/spoof/TOCTOU/single-flight/audit)

test(module/infra_admin): mutation integration (apply->state->audit) via real engine path

fix(iac/stubprovider): code-review + spec-review fixes (OBS-1 + findings 1-3)

fix(wfctlhelpers): rename DesiredStateHash env param from _ to env (spec-review)

test(iac/admin/ui): serve mutation panels + audit-viewer assets

fix(iac/admin/handler): T6 spec-review fixes (FAIL-14 + FAIL-16)

fix(iac/admin/handler): T7 spec-review fixes (IMPORTANT-1 + IMPORTANT-2)

fix(iac/admin/ui): T12 spec-review — setInterval uses fetchAndCache + dead code removed

fix(module): adapt tests for T7 confirm_hash gate + T12 4th contribution

fix(module/infra_admin): infraSpecFromResolved: add DependsOn extraction (T8 spec-review)

fix(T10+handler): C-1/C-2/I-1/I-2/I-3 spec-review fixes

test(iac/admin/ui): code-review nits — io.ReadAll + pin setInterval(fetchAndCache,)

fix: code-reviewer minor findings (T6/T7/T9)

fix(T10): add Enforce call counter to integrationEnforcer (spec-reviewer note)

fix: code-reviewer minor findings (T3/T8)

fix(T10): code-reviewer minor findings F1/F2/F3

fix(wfctlhelpers): DesiredStateHash must NOT resolve env/secret refs