Author	SHA1	Message	Date
Fimeg	517f1aca20	feat: pin complete mutation authority contract ... Cut 1 completes the dormant MutationEnvelope contract without changing any runtime path. Bind target_id to the provisioned agent identity, require canonical UUID v4 authorization IDs, cap authorization lifetime at the fleet TTL, and add an unsigned MutationReceipt carrying the audit join. Server, Agent, and helper share the same canonical bytes, key identity, receipt digest, and Ed25519 golden vectors. Current APT/DNF and Windows execution remains untouched.	2026-08-26 18:39:29 -04:00
Fimeg	5758b26875	swap uuid lib, windows installer pass, README/RAF copy ... - google/uuid -> gofrs/uuid/v5 across server + agent - windows.go: cross-platform binding cleanup - linux install template: disable sudo lecture for TTY-less service user - README: XZ/SolarWinds lede, stable-release note, single attack-surface block	2026-06-03 15:39:49 -04:00
Fimeg	ea068c2213	feat: supply-chain capability-token gate (executor, signing, mint/deliver, agent consumer) ... Server mints Ed25519-signed capability tokens authorizing one package operation over a resolved closure; a privileged network-less Rust executor verifies signature + artifact hashes and performs the op. Replaces the rs-helper socket-decision daemon's role with signed tokens (trust root off-host). - helper/: Rust executor keystone (stdin token -> window/bind/keyring/verify_strict -> artifact hash -> replay guard -> one op, no shell, env_clear, fail-closed) - capability/ (mirrored in server + agent): token type, canonical encoder, sign/verify; cross-language byte-identity proven by contract tests - server: SignCapabilityToken, CapabilityMinter (mint at approval after Layer-1 hash), capability_tokens queries, migration 042, delivery + receipt endpoints - agent: supplychain consumer (bind-check + allowlist + invoke executor + receipt), client methods, polled each check-in via loop.processCapabilityTokens	2026-05-28 14:53:05 -04:00