v3.1.7-rc.8

Pre-release v3.1.7-rc.8

Target release: v3.1.7 (patch bump)
Branch: staging
Commit: 5755bdf

Commits since v3.1.6

• Make the staging auto-close parser accept the PR template's own form (#158)
• Resolve the registry-host allowlist fail-closed at runtime, same as ingest (#162)
• Container-runner hardening remainder: cluster ownership, mount_path, route hygiene (#161)
• Make container (and every engine's) step output discoverable from the module (#159)
• RunModuleActionDialog: submit re-guard, reports invalidation on completion, escaping guards (#160)
• Set secret-file mode via fchmod on the open descriptor, not chmod by path (#157)
• Restore @pytest.mark.unit on TestRootUserGate; guard this file against it recurring (#156)
• Derive container time limits from the canonical step-set (#155)
• Stop SSOAuthDialog updating state after unmount; mock the real endpoint (#152)
• Never delete an interrupted-apply module without attempting a destroy (#151)
• Verify TLS on SSH-tunnelled clusters via tls-server-name (#150)
• Require an agent-class token on the benchmark ingest/register endpoints (#149)
• Bind the benchmark agent WS token to the agent identity (#41 F5) (#142)
• Report the flashed DPU's allocated tmfifo address, not a constant (#147)
• Resolve path-only module references through one canonical ordering (#146)
• Reset modules stuck in a transient state when their worker dies (#145)
• Release the helm advisory lock even from an aborted transaction (#144)
• Contain a failed initial blueprint sync in a SAVEPOINT (#143)
• Enforce risk_class at runtime for destructive MCP tools (#141)
• Destroy cli-bnkctl modules from the applied config, not the current form (#140)
• Pair the dist proxy conf with an unprivileged container port mapping (#139)
• Package the dist tarball from the tracked set, not the working tree (#138)
• Refuse project deletion while modules still own cloud resources (#129)
• Narrow the dist/nginx un-ignore rule to the two tracked confs (#132)
• Run the 746 integration tests CI never executed (#131)
• Container runner hardening: non-root gate bypass, outputs_file traversal, secret leaks, destroy/action time limits (#2)
• Merge pull request #126 from f5devcentral/fix/v2152-regression-test
• Merge pull request #123 from f5devcentral/fix/container-runner-hardening-2
• Merge pull request #1 from f5devcentral/fix/module-lifecycle-control
• docs: record the residual adoption race rather than shipping an unverified mitigation
• self-review fix: the derived-host patterns refused real provider endpoints
• self-review fix: a scratch-database failure must not skip past the required-tests guard
• review fixes: adopt in-flight destroys into the run, resolve the substrate, filter rather than raise
• fix(ci): scope the migration-test guard to its own job, and exclude the directory from the legacy suite
• review fixes: one canonical step resolver, canonical host comparison, derived-host constraint
• review fixes: give the migration tests their own database, and stop the CI step skipping silently
• safety: refuse to run the migration regression tests against a non-disposable database
• test: pin the v2_152 unique-index invariant, and correct its downgrade comment
• style: fix import ordering in the new hardening tests (ruff I001)
• review fixes: kill on the worker, scope from the executing run, fail closed on unknown scope, gate at the chokepoint