Develop - #476
Merged
Merged
Conversation
* feat: add rulebook assessment backend What changed: - Added NIS2 baseline rulebook assessment models, service, and plugin endpoints. - Persisted assessment CIDs in job metadata and mutable reviewer state/audit in CStore. - Added purge cleanup for rulebook artifacts and review rows. - Added focused backend tests for generation, redaction, review semantics, eligibility failures, and purge cleanup. Why: - Implements RM-029 Phase 1 backend contract for RedMesh evidence-readiness assessments. Checks: - python3 -m py_compile changed backend files: passed - python3 -m unittest extensions.business.cybersec.red_mesh.tests.test_rulebook_assessment -q: passed - python3 -m pytest extensions/business/cybersec/red_mesh/tests/test_rulebook_assessment.py -q: blocked, pytest is not installed in this environment * feat: add NIS2 assessment ensure contract What changed: - Added idempotent force=false ensure behavior for rulebook assessments. - Relaxed assessment eligibility to completed pass evidence and added richer run metadata. - Covered historical rulebook artifact purge and failure status behavior. Why: - RM-030 needs default-on NIS2 readiness generation without duplicate same-pass artifacts. Checks: - python3 -m unittest extensions.business.cybersec.red_mesh.tests.test_rulebook_assessment -v: passed - python3 -m py_compile extensions/business/cybersec/red_mesh/services/rulebook_assessment.py extensions/business/cybersec/red_mesh/services/control.py extensions/business/cybersec/red_mesh/pentester_api_01.py extensions/business/cybersec/red_mesh/tests/test_rulebook_assessment.py: passed - python3 -m pytest extensions/business/cybersec/red_mesh/tests/test_rulebook_assessment.py -q: not run, pytest is not installed * feat: run NIS2 ensure after completed passes What changed: - Added a best-effort NIS2 rulebook ensure hook after pass report persistence. - Kept finalization and continuous scheduling non-blocking when NIS2 ensure fails. - Added tests for singlepass, failed ensure, and continuous pass refresh behavior. Why: - RM-030 requires default-on NIS2 readiness generation after eligible scan evidence exists. Checks: - python3 -m unittest extensions.business.cybersec.red_mesh.tests.test_api.TestPhase2PassFinalization -v: passed - python3 -m py_compile extensions/business/cybersec/red_mesh/services/finalization.py extensions/business/cybersec/red_mesh/tests/test_api.py: passed * feat: add rulebook submission storage models What changed: - added review revisions and typed pending/reference/registry submission models - added the dedicated CStore submission registry helpers - bumped assessment schema to 1.1.0 with artifact_kind metadata - excluded mutable drafts from persisted generated assessments and invalidated unsafe legacy cache reuse Why: - establish the durable and privacy-safe storage boundary before submission operations Checks: - python3 -m py_compile ... - python3 -m unittest extensions.business.cybersec.red_mesh.tests.test_rulebook_assessment -v (12 passed) - git diff --check * feat: add versioned rulebook review submission What changed: - added revisioned draft save, idempotent submit, and guarded reopen operations - implemented recoverable pending transitions across CStore and R1FS - exposed native history, staleness, and legacy revision-zero compatibility - extended purge and force-purge to formal/pending submission CIDs with shared-reference safety - added plugin endpoints and failure/concurrency/redaction coverage Why: - make explicit NIS2 review submission immutable, retryable, and purge-safe Checks: - python3 -m py_compile on changed backend modules - python3 -m unittest extensions.business.cybersec.red_mesh.tests.test_rulebook_assessment (24 passed) - python3 -m unittest extensions.business.cybersec.red_mesh.tests.test_api (165 passed) - git diff --check * test: cover two-revision submission purge smoke * fix: purge R1FS artifacts beyond unpinning * fix: harden rulebook submission recovery and purge * fix: fence submission inputs during cleanup and retry * fix: preserve submission integrity in legacy compatibility * fix: align purge with relay deletion semantics Treat acknowledged R1FS unpin and garbage-collection requests as purge completion without immediate CID read-back. Keep force and orphan cleanup fail-closed, prevent report reads from pinning content, and cover the relay acknowledgement boundary.
* fix: make deeploy updates request-authoritative What changed: - deploy only the submitted plugin replacement set during updates - preserve plugin identity checks and emit bounded value-free replica drift warnings - cover omissions, drift, offline fallback, and identity safeguards Why: - update requests must be authoritative and live replica drift must not block safe replacement Checks: - focused Deeploy update tests: 47 passed - full Deeploy discovery: 204 passed - touched py_compile and git diff --check: passed * chore: inc ver
* chore(redmesh): remove API operation queue What changed: - removed the CStore-backed API operation service, config, endpoints, worker, and queue tests - kept synchronous analyze_job and unrelated model-testing/SOC behavior - added a regression for the reduced public surface Why: - roll back the rejected operation-ledger architecture before replacing analyze_job with PostponedRequest Checks: - Python compilation: passed - API/removal unittest suites: 167 passed - model-testing unittest suite: 88 passed * feat(redmesh): postpone manual analysis Move analyze_job provider work into one bounded executor and use the native PostponedRequest lifecycle while keeping persistence on the plugin loop. Add fail-closed bearer admission, explicit input/time bounds, sanitized failure contracts, busy-while-draining cleanup, stale-state checks, and native IPC responsiveness coverage. * fix(redmesh): harden postponed analysis boundaries Enforce monotonic total deadlines with a bounded aiohttp transport, contain bearer values across native error/debug paths, and reject detected stale or deleted job writes. Add real trickle and oversized-response transport tests, late-outcome and deletion-race regressions, plus a portable native-runtime fixture gate. * fix(redmesh): keep automatic analysis responsive What changed: - removed REDMESH_ANALYZE_TOKEN and restored unauthenticated analyze_job - moved automatic structured analysis onto the existing single-worker executor - resumed finalization from minimal job/pass/report future state on later turns - covered manual, automatic, cleanup, failure, and native IPC behavior Why: - prevent automatic model analysis from blocking the serialized plugin process loop Checks: - focused RedMesh suites: 220 passed, 2 skipped, 2 subtests - native postponed IPC: 2 passed - py_compile and git diff --check: pass * fix(redmesh): preserve soft stop during analysis Allow continuous jobs to schedule a soft stop while automatic model work is pending. Preserve that newer status when the future resumes so finalization ends the pass as STOPPED, with regression coverage for the responsive control window.
* fix: require identity for service updates What changed: - reject unresolved service plugin IDs after legacy backfill and job-type reconciliation - add four-replica CockroachDB identity and storage regressions - prove rejection occurs before payment, response-key reset, delete, or deploy Why: - prevent no-ID service edits from redeploying as a new logical container Checks: - focused Deeploy update/resource suite: 62 tests pass - full Deeploy suite: 206 tests pass - py_compile and git diff check: pass * chore: inc ver * fix: require explicit Deeploy update identity What changed: - require and normalize job_app_type on update requests - require canonical service instance IDs before backfill - add legacy CockroachDB and compatibility regressions Why: - prevent legacy service updates from being inferred as generic and redeployed under a new plugin identity Checks: - focused Deeploy update/resource suite: 65 passed - full Deeploy suite: 209 passed - py_compile and git diff --check: passed * docs: document explicit update contract Document mandatory update job_app_type and request-authoritative service identity on the public endpoint. Checks: - focused Deeploy update/resource suite: 65 passed - py_compile and git diff --check: passed * fix: preserve legacy service update identity What changed: - copy explicit top-level legacy update identity into the normalized plugin - reject conflicting legacy identity fields before discovery - document and test update-only compatibility without changing creates Why: - keep documented legacy service updates compatible with the fail-closed identity contract Checks: - focused update/create/stack suite: 127 passed - full Deeploy suite: 217 passed - py_compile and git diff --check: passed
* fix: harden model-test backend contracts What changed: - Require and validate a server bearer token for model-test launch and preflight. - Reject unresolved credential references before persistence and emit canonical complete results. - Include sanitized model-test workers in local job listings with legacy read compatibility. Why: - Direct backend calls must fail closed and frontend/backend status and credential contracts must be truthful. Checks: - focused model-testing and endpoint-auth unittests in rm3: 97 passed - Python compile checks: passed - git diff --check: passed * fix: enforce launcher-owned lifecycle writes * fix: normalize model-test terminal events * fix: enforce launcher ownership for stop requests Reject all shared job writes from non-launcher nodes and fail foreign stop-monitoring requests before worker, timeline, or CStore mutation. Add direct service and write-boundary regression coverage. * fix: guard destructive job control ownership Reject foreign stop/delete, purge, engagement-redaction, and triage mutations before side effects. Route remaining production top-level job writes through the launcher-owned boundary and cover destructive foreign control paths. * fix: preserve foreign jobs during bulk purge Treat launcher-ownership conflicts as non-recoverable bulk-purge failures instead of force-purge candidates. Preserve the foreign job, artifacts, and secondary rows for handling by its launcher. * chore: increment version
toderian
approved these changes
Jul 24, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.