Skip to content

feat(flowsafe): enforce physical deployment isolation - #53

Merged
gcharang merged 4 commits into
devfrom
single-tenant-isolation
Aug 10, 2026
Merged

feat(flowsafe): enforce physical deployment isolation#53
gcharang merged 4 commits into
devfrom
single-tenant-isolation

Conversation

@gcharang

Copy link
Copy Markdown
Contributor

Summary

  • complete Slice A of the single-tenant physical-isolation plan and remove the pooled tenant data-plane model
  • enforce deployment identity, canonical execution-principal provenance, resource ownership, target-verified schedules, Durable Object recovery, signal isolation, and approval-resume authority
  • ship the flowsafe-provision sentinel CLI, fresh per-deployment Wrangler topology, lifecycle/retention updates, and aligned starter/showcase examples
  • keep the release pre-v1: FlowSafe receives a minor 0.x bump; starter and showcase receive patches

Slice B remains intentionally out of scope.

Verification

  • pnpm lint
  • pnpm typecheck
  • pnpm test — 118 files, 2,544 tests
  • pnpm build
  • pnpm docs:check
  • pnpm docs:api — warning-free TypeDoc output
  • pnpm --filter @proofoftech/flowsafe exec vitest run — 86 files, 1,854 tests
  • pnpm --filter @proofoftech/flowsafe test:provisioning-export
  • pnpm --filter @proofoftech/flowsafe spike:verify
  • focused final QA — 19 files, 821 tests
  • provisioning CLI unit suite — 19 tests, including exact preview --remote --preview argv
  • pnpm exec changeset status — FlowSafe minor, no major releases
  • git diff --check
  • pre-push React Doctor — 0 errors, 0 warnings

Independent clean-code, architecture, and QA reviews all returned CLEAN.

gcharang and others added 4 commits August 10, 2026 13:03
Finish Slice A by replacing pooled tenant state with deployment-scoped identity, ownership, recovery, scheduling, signal, approval, retention, and provisioning boundaries across FlowSafe, the starter, and showcase.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Escape the generated preview guard newline so the fake consumer Wrangler parses and the packed provisioning gate exercises the intended argv contract.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
@cloudflare-workers-and-pages

Copy link
Copy Markdown

Deploying with  Cloudflare Workers  Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status Name Latest Commit Updated (UTC)
✅ Deployment successful!
View logs
anchorage-showcase e91e479 Aug 10 2026, 01:58 PM

@gcharang
gcharang merged commit e3d8e01 into dev Aug 10, 2026
2 of 3 checks passed
@gcharang
gcharang deleted the single-tenant-isolation branch August 10, 2026 14:05
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant