mosaicstack/stack
1
0
Fork 0
Code Issues 74 Pull Requests 1 Actions Packages Projects Releases 15 Wiki Activity

feat(fleet): enforce generated environment boundary #772

Merged
jason.woltje merged 1 commits from feat/758-generated-env-boundary into main 2026-07-15 08:40:33 +00:00
Conversation 1 Commits 1 Files Changed 18 +2282 -785
jason.woltje commented 2026-07-15 08:33:13 +00:00
Owner
Copy Link

Summary

  • Adds deterministic roster-derived .env.generated and constrained .env.local parsing, legacy quarantine, and private projection permissions.
  • Makes the tmux launch path fail closed on unmanaged or contaminated named-socket servers using install-derived ownership identity validation.
  • Adds focused generated-boundary, fresh-install, loader-boundary, holder ownership, and shell/systemd regression coverage.

Verification

  • Package typecheck, lint, and full test suite (765 tests)
  • Root typecheck, lint, and format check
  • Systemd and launcher boundary suites

Refs #758

M2-001 exclusions

This card does not add general transaction locking, late-I/O rollback, reconciliation/lifecycle CRUD, migration, remote/connector mutation, site canaries, or deployment.

## Summary - Adds deterministic roster-derived `.env.generated` and constrained `.env.local` parsing, legacy quarantine, and private projection permissions. - Makes the tmux launch path fail closed on unmanaged or contaminated named-socket servers using install-derived ownership identity validation. - Adds focused generated-boundary, fresh-install, loader-boundary, holder ownership, and shell/systemd regression coverage. ## Verification - Package typecheck, lint, and full test suite (765 tests) - Root typecheck, lint, and format check - Systemd and launcher boundary suites Refs #758 ## M2-001 exclusions This card does not add general transaction locking, late-I/O rollback, reconciliation/lifecycle CRUD, migration, remote/connector mutation, site canaries, or deployment.
jason.woltje added 1 commit 2026-07-15 08:33:13 +00:00
feat(fleet): enforce generated environment boundary
All checks were successful
ci/woodpecker/pr/ci Pipeline was successful
Details
18b7ab96e7 
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
jason.woltje commented 2026-07-15 08:37:15 +00:00
Author
Owner
Copy Link

VERIFIED APPROVE — reviewer-of-record for FCM-M2-001 PR #772; exact head 18b7ab96e7, tree 794c7c0ae3. Independent committed-head full-delta review and security/authority regressions passed; no blocking findings. Merge remains held until exact-head pipeline 1826 is terminal green and queue guard passes.

VERIFIED APPROVE — reviewer-of-record for FCM-M2-001 PR #772; exact head 18b7ab96e7f15fd51c4d7818b48a075a8ad8632f, tree 794c7c0ae322629c5b199582d9a6737e6e586357. Independent committed-head full-delta review and security/authority regressions passed; no blocking findings. Merge remains held until exact-head pipeline 1826 is terminal green and queue guard passes.
jason.woltje merged commit 191efaefeb into main 2026-07-15 08:40:33 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
fleet-enhancement
Fleet-wide reliability/speed/cost improvements surfaced by the nightly enhance pass
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
jason.woltje
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: mosaicstack/stack#772
Delete Branch "feat/758-generated-env-boundary"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?