Claude Fable 5
9b7acab294
All checks were successful
CI / Lint, typecheck, test (pull_request) Successful in 6m21s
CI / Build container images (pull_request) Successful in 3m59s
CI / Auth e2e pack (pull_request) Successful in 8m35s
CI / Import/export fidelity gate (pull_request) Successful in 1m1s
CD / Build and push images (push) Successful in 17s
CD / Deploy to Test (push) Successful in 14s
CD / Smoke tests against Test (push) Successful in 1m17s
CD / Promote to Int (push) Successful in 12s
CI / Build container images (push) Has been skipped
CI / Auth e2e pack (push) Successful in 8m27s
CI / Import/export fidelity gate (push) Successful in 58s
CI / Lint, typecheck, test (push) Successful in 6m30s
The install path records the SHA-256 of the delivered bundle ZIP (plugins.bundle_hash; pre-#232 installs show it as unknown until reinstalled). plugins.allowlist in instance_settings names permitted ids with their pinned hashes: empty (default) = not enforced, existing instances unchanged; non-empty = installs of unlisted or deviating bundles are rejected (plugin_not_pinned / plugin_hash_mismatch, 403), and an installed plugin outside the list or with a deviating hash does not load — absent from pond mount lists, frame/assets 404. Every rejection is audited (plugin.rejected, catalogue v1.5). A version bump changes the hash and therefore requires an explicit re-pin — the intended friction (ADR 0025). Admin UI shows observed vs pinned hash per plugin with pin/re-pin/unpin. Scope stated honestly in plugin-architecture.md: the pin answers "is this the reviewed bundle"; post-install disk tampering is platform integrity (ADR 0019), sandbox containment stays the sandbox's job. Hardening guide row + catalog advisory triage; residual risk R-03 resolved. e2e: empty-allowlist compatibility, pinned load, unpinned and tampered installs rejected and audited, pin drift blocks loading while the admin still sees the mismatch, version bump needs re-pin. Full api suite 101 files / 561 green. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AUtYMxwTCMHG9mVHnwbFg8 |
||
|---|---|---|
| .. | ||
| editor-schema | ||
| permissions | ||
| admin-users.ts | ||
| api-error.ts | ||
| api-tokens.ts | ||
| auth.test.ts | ||
| auth.ts | ||
| backup-set.ts | ||
| backup-status.ts | ||
| backup-target-policy.test.ts | ||
| backup-target-policy.ts | ||
| collab-token.test.ts | ||
| collab-token.ts | ||
| comments.ts | ||
| conversion.ts | ||
| env.test.ts | ||
| env.ts | ||
| favorites.ts | ||
| feed-tokens.ts | ||
| files.ts | ||
| fonts.test.ts | ||
| fonts.ts | ||
| health.test.ts | ||
| health.ts | ||
| home.ts | ||
| i18n-tools.test.ts | ||
| i18n-tools.ts | ||
| index.ts | ||
| labels.test.ts | ||
| labels.ts | ||
| legal.ts | ||
| links.ts | ||
| members.ts | ||
| notifications.ts | ||
| pages.ts | ||
| plugins.ts | ||
| ponds.ts | ||
| public-api.ts | ||
| quotas.ts | ||
| search.test.ts | ||
| search.ts | ||
| secret-store.ts | ||
| setup.ts | ||
| system.ts | ||
| text-diff.test.ts | ||
| text-diff.ts | ||
| theme.test.ts | ||
| theme.ts | ||
| token-crypto.crossruntime.test.ts | ||
| token-crypto.ts | ||
| tree.ts | ||
| users.ts | ||
| vs-nfd-profile.test.ts | ||
| vs-nfd-profile.ts | ||
| watches.ts | ||
| webdav.test.ts | ||
| webdav.ts | ||