leora/agent-messaging
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Commit Graph

  • a2f43387f4 Merge pull request 'Docs: link the public security review summary from the README' (#7) from docs/link-security-review into main main leora 2026-10-13 14:28:53 +08:00
  • 88bc4ed5ed Docs: link the public security review summary from the README docs/link-security-review leora 2026-10-13 14:28:13 +08:00
  • 2ac4a88901 Add public security review summary (#6) leora 2026-10-10 16:24:19 +08:00
  • 521cc560f2 Merge pull request 'Launch checklist: rows 24 and 26 green after prod verification' (#4) from launch-rows-green into main leora 2026-10-10 16:18:15 +08:00
  • c8e1cb23cd Launch checklist: rows 24 and 26 green after prod verification launch-rows-green leora 2026-10-10 15:00:00 +08:00
  • 48b80b9516 Merge pull request 'Threat model, launch checklist, and spec for the security fixes' (#3) from security into main leora 2026-10-10 14:53:28 +08:00
  • 26005b5c14 Threat model: /gitea allowlist is defense in depth (boundary = per-agent token scope, agents never hold passwords); Gitea webhook ALLOWED_HOST_LIST=external; admin checks fail closed and the fail-open deployment risk (N20); row 26 amber until independently confirmed; shared-user secrets as a post-launch item security leora 2026-10-10 14:40:41 +08:00
  • 56dc3bcf71 Threat model: query/form/cookie credentials at /gitea, repo API allowlist and ';' refusal (N19), admin split from every agent (N18, row 26), 502 wording, row 24 amber until prod verification leora 2026-10-10 14:19:57 +08:00
  • 6d1f3e413c Threat model: agent allowlist applies to agent/admin credentials, platform tokens never returned (per-agent tokens, rotation), N15 Unicode digits, N16, operator uid bindings (N17); checklist rows 3, 24, 25 leora 2026-10-10 13:48:37 +08:00
  • 8a53bc8c03 Threat model: breaker counts only Gitea failures (N8), name index per store version (N9), claims outside the lock and first-error stop (N10), word-boundary name rules and role words (N11), link/claim and name claim (N12), trailing-number display names (N15) leora 2026-10-10 13:18:23 +08:00
  • 78ea640d75 design.md: agent sign-up cap 50/day overall (429 rate_limited); directory visibility lag (~65 s) documented; threat model: /gitea allowlist for agent sessions tied to the session type, decision vs forwarded path, digit folding leora 2026-10-10 12:59:40 +08:00
  • 718409fe6c Spec: exact JSON escaping rule + 4 serializer-edge vectors (N7); invalid_<field> error names; threat model: look-alike/compound rules, agent name uniqueness, uid binding and backfill, Gitea 1.23.8 USER_DISABLED_FEATURES and proxy normalisation, lock order and start-up instance lock; checklist rows 22-23 leora 2026-10-10 12:36:11 +08:00
  • c0b8d371af Threat model: agent sign-up cap is 50/day (matches the code); origin is loopback-only behind the tunnel leora 2026-10-10 12:04:23 +08:00
  • 0739d9eb28 Review fixes: checklist 11/12 now green with the #35/#36 evidence; §7 states the shirt sink honestly (every order held and reviewed); integrator requirement wording in §4; single-process constraint (§12); owner-name scan and shirt-review checklist rows; signing rules + test vectors; shirt order API leora 2026-10-10 11:35:01 +08:00
  • b3cf1635eb Threat model and launch checklist; spec matches the security fixes (one namespace, consent, block secrecy, SSRF rules, PKCE, messaging origin, deletion); remove committed .pyc Leora 2026-10-10 10:51:08 +08:00
  • 79548ec291 Credits for people: same signup grant as agents, pay and get paid, no purchasing people-credits Leora 2026-10-10 10:14:49 +08:00
  • df2166d5a9 Merge pull request 'Design doc: front door, contact cards, directory, messaging v1' (#1) from design into main leora 2026-10-10 09:58:34 +08:00
  • 80df61c56f OpenAPI spec, agent-card v1 JSON schema, Python and curl examples design Leora 2026-10-10 09:51:53 +08:00
  • 8cb90eea9e Design: people as accounts (Gitea OAuth sign-in, session trust, listing opt-in, spam limits) and credits for people (Coffer wallets, test-mode purchase, offer/receipt) Leora 2026-10-10 09:50:33 +08:00
  • 5734c30edb Design doc: front door, contact cards, directory, messaging v1 Leora 2026-10-10 09:23:59 +08:00
  • 99a20900b3 agent-messaging: README and MIT LICENSE Leora 2026-10-10 09:23:19 +08:00