- Version bump to 0.2.0, changelog with all new features
- Fix Quick Start ports (3000→31336)
- Fix architecture diagram ports (3000/8080→31336/31337)
- Add new features to list: key rotation, replay protection,
maintenance windows, supply chain checks
- Update Known Issues to be honest about gaps
- Update competitive position section
- New supply_chain service queries api.osv.dev/v1/query for known
vulnerabilities on npm and PyPI packages before approval
- Vulnerability results stored in metadata and returned as warnings
in the API response (approval never blocked — sovereignty principle)
- ApproveUpdateWithVulns stores supply chain data in metadata JSONB
The pre-v0.1.20 upgrade note had vented frustration in it. Same substance
(uninstall + reinstall is the supported path; reach out for large fleets),
without the curt phrasing.
The orphan security rewrite removed the bash systemd installer; bringing it
back so an unattended bootstrap path exists. THIRD_PARTY_LICENSES.md is
restored for legal completeness (will need a refresh as deps evolve).
.gitignore updated to allow THIRD_PARTY_LICENSES.md.
Three previously-disconnected histories are joined here so the project carries
its full provenance forward in one repo.
legacy lineage (root 55b7d030, Nov 2025 -> Mar 2026)
Original RedFlag GitHub project. Last tip 484a7f77 (2026-03-28).
Preserved on branch "legacy-archive" and reachable through this
merge commit.
Culurien rewrite (orphan, root f97d484b)
jpetree331 / Culurien did a one-day from-scratch security-first rebuild
on 2026-03-29: Ed25519 key rotation, replay protection, transactional
migrations, configurable timeouts, path traversal hardening, semver
version comparison, and grew the test suite from ~3 to 170 tests across
18 packages. Tagged v0.2.0.1 (2026-04-09) by Ani Tunturi.
Reflections continuation (extends the Culurien branch)
TD-001 main.go modular refactor, TD-002 panic recovery, TD-003 error
transparency, ISSUE-001/002/004 fixes, VULN-001 dependency cleanup.
Tip edadbd1 (2026-04-13).
Some interim history was lost to a hard-drive failure during development;
this merge brings together everything still recoverable.
Thank you, Culurien.
- Import internal/recovery package
- Add defer recovery.Recover() to runAgent() function
- Prevents Windows service crashes from unhandled panics
- Parity with Linux agent panic recovery (main.go:705)
- Fix version.Version -> version.AgentVersion in main.go
- Fix len() usage on int in circuit breaker reporting
Both server and agent now build successfully.
- Report circuit breaker states during each check-in
- Include all 7 subsystems: APT, DNF, Windows Update, Winget, Storage, System, Docker
- Non-blocking goroutine to avoid impacting check-in latency
- Logs success/failure for debugging
Refs #14
- Add ReportCircuitBreakerStats client method
- Add /api/v1/agents/:id/circuit-breakers POST endpoint
- Add server handler with open breaker detection and logging
- Enables monitoring and alerting for circuit breaker states
Refs #14
- Initialize BuildOrchestratorService with signingService and packageQueries
- Sign all pre-built agent binaries at server startup (linux-amd64, linux-arm64, windows-amd64, windows-arm64)
- Store signed packages in database for download with signature headers
- Add strings import for platform parsing
This ensures every binary distributed by the download handler is properly signed
before distribution, fixing the Ed25519 trust model compromise where binaries
were being served without signatures.
- Linux: Added Ed25519 signature verification using Python3 before binary install
- Windows: Added Ed25519 signature verification using .NET 5+ or BouncyCastle
- Both scripts now verify the binary against the TOFU server public key
- Fail installation if signature verification fails (tamper detection)
- Saves signature and public key for agent-side verification
Security: Install scripts now verify binary signatures before installation,
preventing compromised binaries from being installed even on first use.
- Added signature header (X-Content-Signature) to download responses
- Added server public key to install script template data
- Install script now saves signature and public key for TOFU verification
- Download handler now requires signingService for public key access
- Updated main.go to pass signingService to download handler
Fixes ISSUE-002: Ed25519 Build Orchestrator disconnected
Refs: gitea.wiuf.net/Fimeg/Fimeg-Reflections/issues/13
- Changed "already exists" error handling from silent skip to explicit error
- Now detects inconsistent state when migration recorded but failed
- Added schema_migrations_backup table for recovery
- Added MigrationHealth() endpoint for consistency checks
Fixes ISSUE-001: Database Transaction Poisoning
Refs: gitea.wiuf.net/Fimeg/Fimeg-Reflections/issues/12
- working-on-redflag: Full 4-phase workflow with ETHOS enforcement
- vanguard-triage: Route incoming requests to correct handler
- Includes state machine pattern, branch ancestry checks
- Fork-based verification for RAF queries and code exploration
Vanguard (agent-f7ddc5ce-6c27-4799-bcc4-99fb688eb222)
The agent needs to cache the server's Ed25519 public key for command
verification, but the installer wasn't creating the directory or
setting permissions.
Fixes BUG-010, BUG-011 related issues:
- Creates /etc/redflag/server during install
- Sets ownership to redflag-agent user
- Adds to systemd ReadWritePaths
Also includes:
- command.go.full with RetryCount field (model fix)
These fixes ensure fresh installs work correctly without manual
intervention for public key caching.
When agent binary is downloaded to /tmp and moved to /usr/local/bin,
it retains the user_tmp_t SELinux context which prevents systemd from
executing it on RHEL/Fedora/CentOS systems with SELinux enforcing.
Fix adds restorecon after chmod to ensure proper bin_t context.
Fixes agent service failing to start with 'Permission denied' on first install.
Related: BUG-009 (install script issues)
Complete comparison of Fimeg's original vision against
current codebase state after culurien branch work.
- 9 sections covering architecture, features, backlog
- 10 deviations documented (VD-001 through VD-010)
- 27 backlog items tracked with current status
- Honest roadmap with prioritized next steps
- Executive summary for quick reference
Core: 9/10. Features: 5/10. Homelab ready: 7/10.
Fixed seam issues found during cross-series verification:
- Add path traversal guard to DownloadAgent signed-package path
- Replace fmt.Printf DEBUG/Warning in updates.go with log.Printf
- Replace 11 emoji in subsystem_handlers.go daemon logs with ETHOS format
All series verified to work together correctly.
170 tests pass. Full ETHOS compliance confirmed.
3 cross-platform builds pass (linux-amd64, linux-arm64, windows-amd64).
- Fix Windows config path in template (carry-over from Fix 1)
- Add runtime arch detection in Linux installer (uname -m)
- Add runtime arch detection in Windows installer
- Add ?arch= query param to install endpoint
- Serve X-Content-SHA256 header with binary downloads
- Verify checksum in Linux and Windows installers
- Warn (not fail) if server does not provide checksum
166 tests pass (106 server + 60 agent). No regressions.
All 6 timeout values configurable via DB settings.
Fallback to defaults confirmed for fresh installs.
Path traversal defense verified (403 + logging).
Fixed hardcoded duration references in timeout.go log output.
163 tests pass, no regressions.
E-1b: Fix 217 TypeScript strict errors to zero (tsc --noEmit clean).
- Remove unused vars/imports, fix type mismatches, widen interfaces
- TanStack Query v5 isLoading->isPending for mutations
- No @ts-ignore or as any introduced
E-1ab verification fixes:
- Fix audit table name mismatch (security_setting_audit -> security_settings_audit)
- Fix DockerContainer TS type (image_name->image, image_tag->tag) to match server
- Add 501 for empty binary_path in downloads
- Fix ETHOS log format in downloads error path
E-1c: Configurable timeouts + path sanitization
- Seed 6 operational timeout settings in DB (migration 030)
- Wire server to read timeout values from DB at startup
- Fallback to hardcoded defaults if DB settings missing
- Fix binary_path traversal risk in downloads handler
- Add BinaryStoragePath config (REDFLAG_BINARY_STORAGE_PATH)
- Log resolved timeout values at startup
163 tests pass (103 server + 60 agent). No regressions.
Vite build passes. TypeScript: 0 errors.
- Wire Install button to POST /updates/:id/install (F-E1-4)
Loading state, toast notifications, list refresh on success
- Wire Logs button to GET update logs endpoint (F-E1-5)
Expandable log panel with formatted output
- Wire downloads.go signed package lookup to DB (F-E1-1)
Queries GetSignedPackage when version parameter provided
- Implement GetSecurityAuditTrail with real DB query (F-E1-7)
Queries security_settings_audit table via service layer
- Resolve GetSecurityOverview placeholder (F-E1-8)
Raw pass-through confirmed correct design (dashboard uses
separate SecurityHandler.SecurityOverview endpoint)
All tests pass. No regressions from A/B/C/D series.
Zero emoji in non-exempt log statements.
Zero fmt.Printf used for background logging.
All [TAG] [system] [component] formats confirmed.
Exempt files untouched. All tests pass.
- Remove emoji from log statements across server and agent
- Replace fmt.Printf with log.Printf in queries and handlers
- Apply [TAG] [system] [component] format throughout
- Exempt: display/terminal.go, setup.go, main.go CLI sections
Total violations fixed: ~45 (emoji + fmt.Printf)
All tests pass. Zero regressions.
Full scan of emoji, fmt.Printf, log format, and banned word
violations that predate the A/B/C/D-1 fix series.
Findings:
- ~61 emoji violations in log statements (server+agent)
- ~23 emoji instances in UI/CLI (intentional, lower priority)
- ~12 fmt.Printf used as logging (should be log.Printf)
- 0 banned words (all cleaned in prior series)
- 0 silenced errors
Estimated effort: MEDIUM. Priority: fmt.Printf fixes first,
then emoji in log statements, CLI emojis last.
See docs/D2_ETHOS_Compliance_Audit.md for complete listing.
All 5 D-1 fixes verified. Registration 'unknown-' fallback removed,
clean abort on failure. Rebind endpoint operational with admin auth
and input validation. Dead code deleted. Windows retry removed.
106 tests pass. No regressions from A/B/C series.
