plugin: harden authentication and health admission #1

Merged

linus merged 5 commits from workflow/feature/kernel-runtime-supervision.unhealthy-route-denial into dev

2026-07-29 07:18:38 -05:00

linus commented

2026-07-29 07:17:42 -05:00

Owner

Summary

bind bootstrap authentication to the exact accepted RPC connection while
spending the generation token atomically;
require a successful, healthy initial heartbeat before publishing a started
generation;
validate plugin and generation identity on every heartbeat, fencing and
poisoning a mismatched client;
deny new routed Echo work while a live generation is unhealthy, while
preserving Heartbeat inspection and Restart recovery.
close merge-admission drift by refreshing canonical coverage evidence,
enforcing cross-document connection-auth consistency, and proving the
failure-plugin build cache is independent of test order.

Commits

b1bf35b54a0733c4d94994cff841480f4d4c65bd — plugin: bind bootstrap auth to connection
cd3e74c445322c0299101d785910d001b983d8b6 — kernel: require heartbeat before healthy startup
815f47a5b81197fdbe84cfa770ef2d07ee89e68a — kernel: validate heartbeat response identity
155a02de116d3c6aeb338712dbdaa70583357826 — kernel: deny routed echo for unhealthy generations
7cdf84493783ce457732e4d682a1846a9a8ac272 — workflow: close trust-foundation merge gaps

Verification

focused fresh-process build-order matrix, 10 consecutive passes
focused race verification, 3 consecutive passes
make coverage — kernel and pkg/plugin 100%; repository total 97.9%
all eight negative protocol-document mutation checks failed closed
make test
go test -race -count=1 ./...
make build
go vet ./...
gofmt -l . returned no files
scripts/check-protocol-doc-honesty.sh
scripts/check-workflow-layout.sh
git diff --check gitea/main...HEAD
the reviewed feature worktree is clean and matches its live Forgejo branch
each slice retains its focused repetitions, race checks, expected-red
evidence, coverage accounting, and independent cold-admission records
two independent final cold reviews passed the corrected snapshot

Promotion

This is the required feature-branch to dev integration step. The new dev
branch is initialized exactly from current main
e94a13a57fa0d475a61ec3c0cfd557c769ab6647. This PR does not promote dev
to testing or testing to main.

Scope and non-goals

This PR admits four completed trust-foundation slices plus their bounded
merge-admission repair. It does not resolve or invent agent-keyring owner
decisions R01-R16, finish the public proof/liveness contract, claim full
A-grade admission, publish a release, or deploy anything.

## Summary - bind bootstrap authentication to the exact accepted RPC connection while spending the generation token atomically; - require a successful, healthy initial heartbeat before publishing a started generation; - validate plugin and generation identity on every heartbeat, fencing and poisoning a mismatched client; - deny new routed Echo work while a live generation is unhealthy, while preserving Heartbeat inspection and Restart recovery. - close merge-admission drift by refreshing canonical coverage evidence, enforcing cross-document connection-auth consistency, and proving the failure-plugin build cache is independent of test order. ## Commits - `b1bf35b54a0733c4d94994cff841480f4d4c65bd` — plugin: bind bootstrap auth to connection - `cd3e74c445322c0299101d785910d001b983d8b6` — kernel: require heartbeat before healthy startup - `815f47a5b81197fdbe84cfa770ef2d07ee89e68a` — kernel: validate heartbeat response identity - `155a02de116d3c6aeb338712dbdaa70583357826` — kernel: deny routed echo for unhealthy generations - `7cdf84493783ce457732e4d682a1846a9a8ac272` — workflow: close trust-foundation merge gaps ## Verification - focused fresh-process build-order matrix, 10 consecutive passes - focused race verification, 3 consecutive passes - `make coverage` — kernel and `pkg/plugin` 100%; repository total 97.9% - all eight negative protocol-document mutation checks failed closed - `make test` - `go test -race -count=1 ./...` - `make build` - `go vet ./...` - `gofmt -l .` returned no files - `scripts/check-protocol-doc-honesty.sh` - `scripts/check-workflow-layout.sh` - `git diff --check gitea/main...HEAD` - the reviewed feature worktree is clean and matches its live Forgejo branch - each slice retains its focused repetitions, race checks, expected-red evidence, coverage accounting, and independent cold-admission records - two independent final cold reviews passed the corrected snapshot ## Promotion This is the required feature-branch to `dev` integration step. The new `dev` branch is initialized exactly from current `main` `e94a13a57fa0d475a61ec3c0cfd557c769ab6647`. This PR does not promote `dev` to `testing` or `testing` to `main`. ## Scope and non-goals This PR admits four completed trust-foundation slices plus their bounded merge-admission repair. It does not resolve or invent agent-keyring owner decisions R01-R16, finish the public proof/liveness contract, claim full A-grade admission, publish a release, or deploy anything.

linus added 5 commits

2026-07-29 07:17:42 -05:00

plugin: bind bootstrap auth to connection b1bf35b54a

kernel: require heartbeat before healthy startup cd3e74c445

kernel: validate heartbeat response identity 815f47a5b8

kernel: deny routed echo for unhealthy generations 155a02de11

workflow: close trust-foundation merge gaps 7cdf844937

linus merged commit d363047475 into dev

2026-07-29 07:18:38 -05:00

linus referenced this pull request from a commit

2026-07-29 07:18:40 -05:00

Merge PR #1: Harden plugin authentication and health admission