chore: MS23-P4-001 QA gate — lint/typecheck/test all green #739

jason.woltje · 2026-03-07T22:56:36Z

jason.woltje commented

2026-03-07 22:56:36 +00:00

Summary

run full QA gate for MS23 Phase 4 (lint, typecheck, scoped test) in isolated worktree branch
fix security gap found during P4-002 spot-check: OpenClaw provider tokens were not being encrypted on write
keep runtime compatibility by continuing to decrypt in OpenClaw provider path

QA Gate Evidence

All commands completed successfully with SKIP_ENV_VALIDATION=true:

pnpm turbo lint
pnpm turbo typecheck
pnpm turbo test --filter=@mosaic/web --filter=@mosaic/orchestrator --filter=@mosaic/api

Security Review (P4-002)

Mission Control endpoint auth: PASS
- MissionControlController is class-guarded with @UseGuards(AuthGuard).
Barge-in rate limiting: KNOWN GAP (non-blocking for this gate)
- POST /api/mission-control/sessions/:sessionId/inject has auth + validation but no throttling decorator/guard override.
Audit log delete protection: PASS
- No @Delete endpoint exists for Mission Control audit log routes.
OpenClaw token encryption at rest: PASS (fixed in this PR)
- OpenClaw credential token keys are encrypted on create/update in AgentProvidersService via EncryptionService.encryptIfNeeded.
- OpenClaw runtime still decrypts via OpenClawProvider/OpenClawProviderFactory.

Notes

Initial lint failures in a fresh worktree were caused by missing generated Prisma client types; resolved by running pnpm --filter @mosaic/orchestrator prisma:generate before QA reruns.

Closes #697

## Summary - run full QA gate for MS23 Phase 4 (`lint`, `typecheck`, scoped `test`) in isolated worktree branch - fix security gap found during P4-002 spot-check: OpenClaw provider tokens were not being encrypted on write - keep runtime compatibility by continuing to decrypt in OpenClaw provider path ## QA Gate Evidence All commands completed successfully with `SKIP_ENV_VALIDATION=true`: - `pnpm turbo lint` - `pnpm turbo typecheck` - `pnpm turbo test --filter=@mosaic/web --filter=@mosaic/orchestrator --filter=@mosaic/api` ## Security Review (P4-002) 1. Mission Control endpoint auth: PASS - `MissionControlController` is class-guarded with `@UseGuards(AuthGuard)`. 2. Barge-in rate limiting: KNOWN GAP (non-blocking for this gate) - `POST /api/mission-control/sessions/:sessionId/inject` has auth + validation but no throttling decorator/guard override. 3. Audit log delete protection: PASS - No `@Delete` endpoint exists for Mission Control audit log routes. 4. OpenClaw token encryption at rest: PASS (fixed in this PR) - OpenClaw credential token keys are encrypted on create/update in `AgentProvidersService` via `EncryptionService.encryptIfNeeded`. - OpenClaw runtime still decrypts via `OpenClawProvider`/`OpenClawProviderFactory`. ## Notes - Initial lint failures in a fresh worktree were caused by missing generated Prisma client types; resolved by running `pnpm --filter @mosaic/orchestrator prisma:generate` before QA reruns. Closes #697

jason.woltje added 1 commit 2026-03-07 22:56:37 +00:00

fix(orchestrator): encrypt OpenClaw provider tokens at rest

ci/woodpecker/push/ci Pipeline was successful

Details

d60165572a

jason.woltje merged commit fe55363f38 into main

2026-03-07 22:57:07 +00:00

jason.woltje referenced this issue from a commit

2026-03-07 22:57:09 +00:00

Merge pull request 'chore: MS23-P4-001 QA gate — lint/typecheck/test all green' (#739) from chore/ms23-p4-qa into main

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: mosaic/stack#739