Skip to content

g8e v1.6.4

Choose a tag to compare

View all tags
@github-actions github-actions released this 26 Jul 13:07
Immutable release. Only release title and notes can be modified.
v1.6.4
45950fb
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

[1.6.4] - 2026-07-25

Overview

Demo consolidation, L5 Actuator decomposition, error sentinel migration, and code quality cleanup. This release removes three underused demo environments (secure-data, dow, swarm) and their associated CLI commands, scenario files, and agent harness scenarios, reducing the demo surface from 9 to 6 environments. The L5 Actuator's monolithic Execute method is decomposed into focused helper methods (signAndLogReceipt, rehydratePayload, finalizeReceipt, signAndLogFinalReceipt) with fail-closed error handling on payload rehydration. Lattice adapter-local error sentinels and the LatticeEntityIDFilename constant are migrated to internal/constants/, and ErrCLISessionDenied is moved from l3_notary.go to internal/constants/. The ScrubbingService constructor now returns an error (fail-closed on persisted token load failure) and accepts context.Context throughout. The MCP gateway gains an AuditEventRecorder interface to eliminate nil-check branches at audit call sites. The InputSchema.ToMap() method is removed in favor of direct struct serialization. The DispatchToDownstream MCP tools/call request is fixed to properly envelope params. A demo L3 notary (G8E_L3_MOCK=true) is added for headless demo environments. A demo-verify Makefile target and CI job are added to build and run all 6 demos.

Removed

  • secure-data demo — demos/secure-data/ (deleted, 222-line compose.yml + config, doctrine, target-data, README): Removed along with demo_secure_data.go (245 lines), runSecureDataScenario dispatch, DemosOrgSecureData/DemosSecureDataDoctrineFile constants, 3 agent harness scenarios (secure_data.go, secure_data_test.go), and all references in docs, codemap, and troubleshooting.
  • dow demo — demos/dow/ (deleted, 245-line compose.yml + config, doctrine, target-data, sensor Python scripts, README): Removed along with demo_dow.go (331 lines), runDoWScenario dispatch, DemosOrgDoW/DemosDoWDoctrineFile constants, 3 agent harness scenarios (dow_cross_cue.go, dow_cross_cue_test.go), and all references in docs, codemap, and troubleshooting.
  • swarm demo — demos/swarm/ (deleted, 776-line compose.yml + config, doctrine, target-data, drone simulator, README): Removed along with demo_swarm.go (250 lines), runSwarmScenario dispatch, DemosOrgSwarm/DemosSwarmDoctrineFile constants, 3 agent harness scenarios (swarm.go, swarm_test.go), and all references in docs, codemap, and troubleshooting.
  • live-swarm demo — demos/live-swarm/ (deleted, README + drone_cmd.py + tribunal-bootstrap.json): Removed as part of swarm demo consolidation.
  • InputSchema.ToMap() — internal/services/mcp/registry.go: Removed 30-line method that manually converted InputSchema to map[string]interface{}. The Tool struct in internal/cli/cmd/mcp.go now uses *mcp.InputSchema directly, and handleToolsList passes nt.InputSchema() instead of nt.InputSchema().ToMap().
  • Lattice adapter-local errors — internal/adapters/lattice/errors.go (deleted, 31 lines): All 19 error sentinels (ErrLatticeConfigMissing through ErrLatticeAlreadyRunning) and LatticeEntityIDFilename constant moved to internal/constants/errors.go and internal/constants/paths.go.

Added

  • Demo L3 notary — internal/services/governance/l3_notary.go: demoL3Notary struct and NewDemoL3Notary constructor for demo/test environments where WebAuthn passkey enrollment is not available (headless Docker containers). Auto-approves any non-nil proof. Gated by G8E_L3_MOCK=true environment variable. Must never be used in production.
  • AuditEventRecorder interface — internal/services/mcp/gateway.go: New interface implemented by storage.SQLAuditStore in production and noopAuditEventRecorder when no audit store is configured. Eliminates nil checks at all audit call sites in GatewayService. Added to Dependencies struct and wired in gateway_service.go via stores.AuditStore.
  • demo-verify Makefile target — Makefile: New target that builds the binary and runs all 6 demo environments (healthcare, gov, finance, dhs, fedramp, frontend) sequentially, tearing down each with volumes before starting the next.
  • Demo verification CI job — .github/workflows/build-and-test.yml: New demo-verify job that runs make demo-verify on Ubuntu, dependent on the ci job.
  • WorkloadIdentity.IsAppSAN / IsUserSAN — protocol/workload_identity.go: Two new methods that report whether a SPIFFE ID is an app (spiffe://<trust_domain>/app/...) or user (spiffe://<trust_domain>/user/...) workload identity.
  • Typed cloud metadata models — internal/services/mcp/models.go: 11 new typed structs for cloud metadata tool results (CloudMetadataRequest, CloudMetadataDetectResult, CloudMetadataInstanceResult, CloudMetadataRegionResult, CloudMetadataAvailabilityZoneResult, CloudMetadataInstanceTypeResult, CloudMetadataAllResult, CloudMetadataErrorResponse, AzureComputeMetadata, AzureInstanceMetadata), replacing map[string]interface{} usage.
  • Typed container inspect model — internal/services/mcp/sys_container_status.go: containerInspectData and containerStatusResult structs replace map[string]interface{} with typed field access. Removes getNestedMap, getString, getBool, getInt helpers.
  • Error sentinels — internal/constants/errors.go: New error sentinels for field path validation (ErrFieldPathInvalidCollection, ErrFieldPathInvalid, ErrFieldPathForbidden, ErrFieldPathSyntax, ErrFieldPathEmpty, ErrFieldPathEmptyCollection, ErrFieldPathDocumentNil, ErrFieldPathComponentNotFound, ErrFieldPathNotObject), gateway DB initialization (ErrGatewayDBAuditStoreInit, ErrGatewayDBSchemaInit, ErrGatewayDBStateRootInit), console (ErrConsoleStaticFS), MCP (ErrMCPContainerNameRequired, ErrMCPServiceNameRequired), transaction canonicalization (ErrTxCanonicalizeFailed), and all 19 Lattice adapter errors migrated from internal/adapters/lattice/errors.go.
  • Path constants — internal/constants/paths.go: PathSysClassDMIIDProductUUID, PathSysClassDMIIDSysVendor, LatticeEntityIDFilename.
  • KV key prefix — internal/constants/kv_keys.go: ScrubbingTokenKeyPrefix constant (uei_token_), replacing hardcoded string in boundary.go.
  • Auth constants — internal/constants/auth.go: DefaultBindingPersona, DefaultTenantID, BearerScheme, L3ApprovalWindow, ErrCLISessionDenied (migrated from l3_notary.go).

Changed

  • L5 Actuator Execute decomposed — internal/services/governance/l5_actuator.go: The monolithic Execute method is split into signAndLogReceipt, rehydratePayload, finalizeReceipt, and signAndLogFinalReceipt helper methods. Payload rehydration is now fail-closed (returns error on RehydratePayload failure instead of logging a warning and continuing). The Rehydratable interface check is replaced with direct GetPayload/SetPayload calls on CommandMessage.
  • ScrubbingService constructor returns error — internal/services/scrubbing/boundary.go: NewScrubbingService now returns (*ScrubbingService, error) instead of *ScrubbingService. Returns error if loadPersistedTokens fails (fail-closed). All callers updated: gateway_service.go, g8eo.go, cli/serve/gateway.go.
  • ScrubbingService methods accept context.Context — internal/services/scrubbing/boundary.go: RehydrateText, RehydratePayload, GetTokenForValue, loadPersistedTokens, initializeScrubbers now accept context.Context. RehydrateText uses tokenPattern package-level regex instead of recompiling per call.
  • L3Notary signature change — internal/services/governance/l3_notary.go: NewGatewayL3Notary no longer takes suspendedStore parameter (the gateway notary delegates to the passkey verifier for suspended transaction access). ErrCLISessionDenied moved to internal/constants/. L3ApprovalWindow constant replaces hardcoded 30 * time.Minute.
  • ExecutionHandler interface typed — internal/services/governance/l4_warden.go, internal/services/pubsub/pubsub_commands.go, internal/tools/chaos/chaos.go: ExecuteVerifiedTransaction parameter changed from interface{} to governance.CommandMessage. Chaos handler uses *pubsub.PubSubCommandMessage (pointer) instead of value.
  • L4Warden.verifyStateful simplified — internal/services/governance/l4_warden.go: Returns error only instead of (time.Time, error). releaseNonceReservation helper method wraps ReleaseNonce with error logging.
  • GovernanceEnvelope canonicalization typed — internal/governance/envelope.go: canonicalizeMap renamed to canonicalizeStruct and operates on *structpb.Struct directly instead of map[string]interface{}. canonicalizeValue operates on *structpb.Value with typed kind switching instead of interface{} type assertions.
  • MCP DispatchToDownstream params envelope — internal/services/mcp/gateway.go: DispatchToDownstream now wraps tool name and arguments in a CallToolRequest struct before marshaling as Params, instead of sending raw toolArgs as Params. Fixes downstream servers failing tool name lookup.
  • MCP audit recording unconditional — internal/services/mcp/gateway.go: runMaintenanceSweep, StoreSuspendedTransaction, and DispatchToDownstream no longer nil-check g.auditStore before recording events. The noopAuditEventRecorder handles the no-audit-store case.
  • GatewayService constructor takes AuditStore — internal/services/gateway/gateway_service.go: Dependencies struct gains AuditStore field. NewGatewayL3Notary call updated to drop suspendedStore parameter. G8E_L3_MOCK env var check added to wire NewDemoL3Notary for demo environments.
  • AuthService constructor simplified — internal/services/gateway/gateway_auth.go: NewAuthService no longer takes secretsDir parameter. Hardcoded "default" strings replaced with constants.DefaultBindingPersona and constants.DefaultTenantID. "Bearer " prefix replaced with constants.BearerScheme. User validation refactored into getAndValidateUser helper.
  • GatewayDB uses RuntimeFileService — internal/services/gateway/gateway_db.go: Vault directory creation and key file writing now go through fileSvc.MkdirAll/fileSvc.WriteFile instead of os.MkdirAll/os.WriteFile. Error sentinels use constants.ErrDirCreateFailed, constants.ErrVaultKeyWriteFailed, constants.ErrGatewayDBAuditStoreInit, constants.ErrGatewayDBSchemaInit, constants.ErrGatewayDBStateRootInit.
  • G8eoService field cleanup — internal/services/g8eo.go: suspendedTxCloser field removed; suspendedTxStore field type changed from storage.SuspendedTransactionStore (interface) to *storage.SuspendedTransactionService (concrete). Stop calls suspendedTxStore.Close() directly.
  • Demo port/organization maps refactored — internal/cli/cmd/demos.go: demoHTTPPorts and demoHTTPSPorts map literals replace switch-case blocks. scenarioCounts map updated to remove secure-data, dow, swarm entries. switchDemoPosture uses --force-recreate flag. needsGovKit checks FedRAMPScenarioPrefix in addition to DhsScenarioPrefix.
  • Multi-member tribunal bootstrap — internal/cli/cmd/scenarios_run.go: setupGovKit now loads tribunal-bootstrap.json from the consensus seed directory to populate MemberKeyIDs for multi-member quorum support. Signer registration errors are non-fatal warnings instead of collected errors.
  • Cloud metadata context propagation — internal/services/mcp/cloud_metadata.go: detectCloudProvider, httpGetWithTimeout, and all metadata fetch functions now accept context.Context. HTTP requests use http.NewRequestWithContext instead of client.Get.
  • Container status typed model — internal/services/mcp/sys_container_status.go: getContainerStatus accepts context.Context. commandExecutor.CombinedOutput accepts context.Context. containerInspectData struct replaces map[string]interface{} for JSON unmarshaling.
  • sys_service_status context propagation — internal/services/mcp/sys_service_status.go: commandExecutor.CombinedOutput accepts context.Context. Error sentinels use constants.ErrMCPUnmarshalArguments, constants.ErrMCPMarshalResult, constants.ErrMCPServiceNameRequired.
  • field_parser error sentinels — internal/services/mcp/field_parser.go: Error returns use constants.ErrFieldPath* sentinels instead of fmt.Errorf with string messages.
  • L1Doctrine error handling — internal/services/governance/l1_doctrine.go: ValidatePayload now reports invalid regex patterns as violations instead of silently ignoring them. AnalyzeMCPArguments uses %w: %w for error wrapping.
  • gateway_http_router.go console path — internal/services/gateway/gateway_http_router.go: Console SPA route uses constants.APIPaths.ConsolePrefix instead of hardcoded "/console/".
  • Demo compose files — demos/dhs/compose.yml, demos/fedramp/compose.yml: Added G8E_L3_MOCK=true environment variable for headless L3 approval. demos/healthcare/compose.yml: Removed --posture consensus flag (now uses config file default of doctrine). demos/healthcare/config/gateway.yml, operator.yml: Default posture changed from consensus to doctrine.
  • Swagger generation updated — Makefile: swagger-generate target uses --parseDependencyLevel 1 and --packagePrefix instead of --parseDependency.
  • golangci vendor exclusion — .golangci.yml: Added vendor$ to lint and formatter exclusions.

Fixed

  • MCP DispatchToDownstream params envelope — internal/services/mcp/gateway.go: The tools/call JSON-RPC request was sending raw toolArgs as Params, but the MCP protocol requires Params: {"name": toolName, "arguments": toolArgs}. Downstream servers could not look up the tool name from the request. Fixed by wrapping in CallToolRequest struct before marshaling.
  • L5 Actuator rehydration fail-closed — internal/services/governance/l5_actuator.go: Payload rehydration failures were previously logged as warnings and execution continued with scrubbed data. Now returns an error, preventing execution with incomplete data.
  • ScrubbingService token load fail-closed — internal/services/scrubbing/boundary.go: loadPersistedTokens failures were silently logged and ignored. Now NewScrubbingService returns an error if token loading fails, preventing the service from starting with a partial token map.
  • L1 doctrine regex error reporting — internal/services/governance/l1_doctrine.go: Invalid forbidden pattern regexes were silently skipped in ValidatePayload. Now reported as violations so operators can detect misconfigured doctrine patterns.

Tests

  • internal/services/governance/l3_notary_test.go — Expanded with demoL3Notary tests and ErrCLISessionDenied migration tests.
  • internal/services/governance/l4_warden_test.go — Updated for verifyStateful signature change and releaseNonceReservation helper.
  • internal/services/mcp/gateway_test.go — Updated for AuditEventRecorder interface and noopAuditEventRecorder.
  • internal/services/mcp/cloud_metadata_test.go — Updated for context propagation and typed result models.
  • internal/services/mcp/sys_container_status_test.go — Updated for typed containerInspectData/containerStatusResult models and context propagation.
  • internal/services/scrubbing/boundary_test.go — Updated for NewScrubbingService error return and context-aware methods.
  • internal/services/gateway/gateway_service_test.go — Updated for AuditStore dependency injection and G8E_L3_MOCK env var.
  • internal/services/gateway/gateway_auth_test.go — Updated for AuthService constructor change (no secretsDir).
  • internal/services/gateway/governance_controller_test.go — New tests for governance controller audit recording.
  • internal/services/g8eo_test.go — Updated for suspendedTxStore field type change.
  • internal/cli/cmd/demos_test.go — Updated for removed demo organizations and refactored port maps.
  • internal/cli/cmd/demos_helpers_test.go — Updated for removed demo organizations.
  • internal/cli/cmd/mcp_test.go — Updated for InputSchema direct serialization (no ToMap).
  • internal/tools/agent_harness/scenarios/scenario_test.go — Updated for removed scenario registrations.
  • internal/adapters/lattice/auth_test.go, config_test.go — Updated for migrated error sentinels.
Assets 23
Loading