Архив исходника Broker

Историческая копия до очистки репозитория 2026-10-16. Источник: mallexxx/execution-broker, commit ae92c15d31c8396789765cebf82f7971d6f4cb12, файл CHANGELOG.md. Старые статусы и deployment pins ниже не заменяют актуальную personal/projects/balda/execution-broker.

Changelog

0.1.0-rc.33 (candidate)

Deny ACP permission expansion in the Codex reviewer role. Keep reviewer-only write probes out of verifier assertions and record bounded actual tool output for the acceptance probe instead of accepting a model's copied claim.
On macOS, settle a zombie-only provider process group after EPERM only when an independent process observation confirms that no executable member remains. Retain the credential fence when observation fails or a live member remains.
Refresh the bundled workflow digest to the accepted reviewer policy.
Record accepted production Story/cancellation/restart checks, native provider refusals in isolated synthetic vaults, and independent recovery of all three working provider identities. Deliberate upstream revocation and browser login remain unverified under the operator-approved acceptance scope.
Keep an environment approval outside worker capacity until allocation, so an unrelated Story can run while the owner reviews the replacement.
Add immutable repository/commit Git bundle caching with scoped capabilities, durable holds, bounded storage, checksum-verified restartable transfer and guest-local checkouts without upstream credentials.
Add operator-authored environment checkpoints, raw source snapshots and separately approved continuation with unchanged scope/deadline, transactional single admission, bounded replacements and cancellation across the lineage. Require execution/v3 so older workers cannot replay or skip preparation.
Keep compiler temporary products in the private executable run directory while shared /tmp remains noexec. Verify real Go compilation/execution under that worker policy. Pass the declared tooling policy through macOS admission preflight and generated Docker executor configuration.
Add operator-owned tooling profiles with OS/architecture, exact recipe digest, pinned package/archive sources, isolated installation, readiness probes and retained observed versions. Replace the special macOS Go installer with the same declarative archive mechanism. Keep project and executor runtimes separate.
Add session-bound, digest-pinned artifact inputs with atomic retention holds, scoped worker download capabilities, resumable transfer and safe pre-execution restart. Retain input provenance; reject older worker protocol before execution.
Support the current Balda managed plugin lifecycle and native session waits. Recover uncertain run admission by its original key and atomically close late Start/retry requests when canceled; keep the original conversation identity. Remove retired webhook-session and plugin CLI installation examples.
Build pinned Callee with an explicit x/net v0.60.0 security override, retain the effective dependency/license manifest, and scan the built adapter in CI.
Require Go 1.26.9 so source and release builds include the standard-library security fixes. Exempt only the exact historical Mattermost post-ID scanner finding; credential detection remains enabled for every other finding.
Reject Docker daemon sockets/groups in worker profiles and remove the worker Docker CLI dependency. Keep Docker administrative access in the gateway.
Pin static and dynamically resolved images in durable acquisition handles; reject Broker/gateway drift before allocation and release an undelivered credential on that explicit rejection.
Repeat verifier assertions in the disposable reviewed checkout, retain actual exit codes/output, and reject source/index/commit changes during verification. Expected application errors must be wrapped in zero-exit assertions; a failed build or test suite cannot become success through expected_exit_code.
Add optional owner-only Telegram approval actions for Broker-managed workflow and ACP questions, enabled explicitly in configuration. Keep existing command authorization available, including after Telegram prompt expiry, with durable request binding, restart recovery and competing-channel deduplication.
Select a single approval channel: configured Telegram receives the question exclusively; otherwise use the original Balda conversation. Keep result delivery in that conversation and suppress duplicate questions during polling.
Configure macOS guests automatically for each registered Broker-managed repository, preserving package/workflow pins and limiting guest access to that run's repository. Reject incompatible packages before allocation and deliver permanent start failures through the original Balda conversation.
Provide a checksum-verified Go SDK automatically in disposable macOS workers and expose concrete failed-role explanations from verified Callee logs even when no quality report was produced.
Add session-bound repository creation, folder access and managed Git publication. Keep operator grants separate from agent MCP access.
Add selectable Virfield images and bounded Docker image configuration for approved worker profiles.
Allow bounded requirement amendments at the Human approval gate, then repair review and verification findings within the same run.
Expose quality findings through execution_diagnostics and classify Callee failures when a quality report is unavailable.
Tighten managed Git fetch routing, image watch authorization and deployment image selection after PR review.

0.1.0-rc.10 (candidate)

Enforce OpenCode role permissions in the isolated runtime: plan roles deny shell and edits, build roles route effects through ACP permission requests, and incompatible mode/permission pairs fail before inference. Disable repository plugins in the managed OpenCode ACP launcher and prevent injected environment variables from overriding the operator policy.
Accept a fresh macOS DeepSeek Story with six roles, Human approval, executed tests, quality gate, Broker/issuer restart, credential checkpoint and VM cleanup. An adversarial write probe reached Callee's ACP deny handler and left no file.
Clarify OpenCode's exact Callee control record in every role prompt so plan and pass are not mistaken for valid workflow outcomes.

0.1.0-rc.9 (candidate)

Add Docker worker credential issuer integration: issue at start after durable admission, checkpoint a stopped Runner before container/volume deletion, and keep the identity leased when a worker or checkpoint is lost.
Verify DeepSeek API-key reuse, changed-key rejection, capacity refusal and revoked lost-worker cleanup with synthetic tests. Live Docker provider and sandbox acceptance remain open.

0.1.0-rc.8 (candidate)

Preserve exponential retry backoff while a macOS VM is still provisioning. A credential snapshot alone no longer clears the delay after a proven image_in_use refusal, avoiding rapid issuer issue/abort cycles during Virfield image maintenance.

0.1.0-rc.7 (candidate)

Accept optional bounded notes in verifier JSON while still rejecting unknown fields, failed checks and unexecuted verification.
Document live macOS OpenCode/DeepSeek inference, two complete Stories and fresh-VM credential reuse after Broker and issuer restart. This acceptance is specific to the tested operator setup; denied-write and upstream revocation checks remain open.

0.1.0-rc.6 (candidate)

Complete Claude macOS Story acceptance with saved account reuse after issuer and Broker restart. Planning and review keep denied write permissions; the verifier runs checks before the reviewer evaluates them.
Save quality evidence in the private run directory when native Claude Keychain access requires the macOS account HOME.
OpenCode, Docker/remote credentials, provider revocation and managed-host deployment still require their own acceptance before a stable release.

0.1.0-rc.5 (candidate)

Add optional Codex/Claude browser sign-in before VM admission, durable Human waiting and private authorization-code completion.
Preserve the completed-onboarding marker alongside validated Claude account sessions in disposable workers.
Package verified portable executor runtimes with standalone Node 22 for automatic macOS bootstrap and Linux image builds.
Publish installed worker profile and OS constraints for model selection; reject incompatible macOS execution.
Add explicit Claude/OpenCode executor and model profiles, pinned optional runtimes, provider-specific workflow packs and private enrollment tooling.
Isolate provider credentials by identity, preserve the legacy Codex vault, validate checkpoint identity and include all identities in drained backup checks.
Probe real native executor/ACP compatibility in CI; real-provider Story and credential expiration acceptance remain required before enabling new profiles.
Package the execution skill and /execute command as an installable Balda plugin with a marketplace index.
Validate native release archives in fresh state on Linux/macOS ARM64 and AMD64.
Separate public operator documentation from private acceptance reports.
Build archives without local filesystem metadata or operational transcripts.

0.1.0-rc.3

Add encrypted persistent OAuth, macOS Keychain integration, exclusive run leases and credential checkpointing before VM cleanup.
Add execution-credentials, optional LaunchAgent deployment and coordinated stack backup with inert restore verification.
Support Virfield v2 lease-bound SSH tunnels and credential-free guest bootstrap.
Preserve quality-gate diagnostics and require executed verification evidence.

0.1.0-rc.2

Harden malformed-stream handling, cancellation artifacts, rollback, retention, event validation and cleanup recovery.
Add independent notification cursors, signed host-plan approval, SSH pinning and artifact integrity checks.

0.1.0-rc.1

Introduce durable Broker HTTP/MCP, Docker gateway, Callee Runner, Prism/Beads projection, Human approval and isolated runtime profiles.

10 KiB Executable File Raw Blame History