feat(serveredition): generic OIDC provider, front door behind an ingress, telemetry v13 (Spec 107 PR-B) - #1292

Merged

Dumbris merged 37 commits into

mainfrom

107-b-oidc-front-door

Sep 18, 2026

Commits on Sep 16, 2026

docs(specs): Spec 107 — server edition SSO front door hardened for real IdPs
Dumbris
committed
9a079e2
test(spec-107): PR-A red tests, server-tag lint job and release notice
Dumbris
committed
9fdc58d
refactor(serveredition): freeze the latent credential-injection chain and normalise removed config keys (Spec 107 PR-A)
Dumbris
committed
43d301d
fix(storage): enforce the agent-token cap per owner, not per deployment (Spec 107 PR-A)
Dumbris
committed
c255986
fix(spec-107): address adversarial review of PR-A
Dumbris
committed
3bf4394
fix(spec-107): codex round 1 for PR-A
Dumbris
committed
36e0517
fix(spec-107): codex round 2 for PR-A
Dumbris
committed
e158121
fix(spec-107): codex round 3 for PR-A
Dumbris
committed
03ef19d
fix(spec-107): codex round 4 for PR-A
Dumbris
committed
7a4e8fe
Merge origin/main (b1777e865) into 107-a-freeze-cut
Dumbris
committed
fb389e6
docs(spec-107): PR-A verification and task ticks
Dumbris
committed
14611c9
docs(roadmap): link PR-A
Dumbris
committed
c741f82
test(oauthserver): fake OIDC identity provider and server-edition dev rig (Spec 107 PR-B)
Dumbris
committed
6cf5427
test(serveredition): red tests for the generic OIDC provider, subject binding and refusals (Spec 107 PR-B)
Dumbris
committed
412dc3a
feat(serveredition): generic OIDC provider with JWKS-verified ID tokens, groups capture and subject binding (Spec 107 PR-B)
Dumbris
committed
c74bfb2
test(serveredition): red tests for trusted proxies, public URL, cookie security and forced MCP auth (Spec 107 PR-B)
Dumbris
committed
1d88938
feat(serveredition): front door behind an ingress — public URL, trusted proxies, cookie security policy, forced MCP auth, provider probe (Spec 107 PR-B)
Dumbris
committed
07ff5c4
feat(config,telemetry): hot-reload clauses, docs and OAS for the PR-B keys; telemetry v13 server-edition fields (Spec 107 PR-B)
Dumbris
committed
45d302a
fix(spec-107): gate fixes for PR-B
Dumbris
committed
4b8baa3
docs(spec-107): PR-B automated-check evidence
Dumbris
committed
516606d
fix(spec-107): cross-review round 1 for PR-B
Dumbris
committed
fd27d27
fix(spec-107): cross-review round 2 for PR-B
Dumbris
committed
30a93bb
fix(spec-107): cross-review round 3 for PR-B
Dumbris
committed
732329c
fix(spec-107): cross-review round 3 for PR-B
Dumbris
committed
8666dab
fix(spec-107): cross-review round 4 for PR-B
Dumbris
committed
8f2e3d4
fix(spec-107): cross-review round 5 for PR-B
Dumbris
committed
1c976e7
fix(spec-107): cross-review round 6 for PR-B
Dumbris
committed
5ad3a08
docs(spec-107): PR-B real-instance verification, gate re-run, task ticks

Dumbris
and
claude
committed
873145b
docs(roadmap): link PR-B

Dumbris
and
claude
committed
f3103fd
fix(ci): pull forward the Windows heap-corruption + Pass-2 race fix (#1288)

Dumbris
and
claude
committed
717e580
docs(spec-107): record the CI red/fix cycle for PR-B

Dumbris
and
claude
committed
b4ab0f9
docs(spec-107): record PR-B CI green

Dumbris
and
claude
committed
152f5d5

Commits on Sep 17, 2026

fix(spec-107): cross-review round 7 for PR-B
Dumbris
committed
2c35085
fix(spec-107): cross-review round 8 for PR-B
Dumbris
committed
2fdb86b

Commits on Sep 18, 2026

Merge remote-tracking branch 'origin/main' into 107-b-oidc-front-door
Dumbris
committed
0dca9d2
fix(web-ui): update hard-reload auth-guard test for the FR-030 provider probe

Dumbris
and
claude
committed
6e24117
fix(test): match TestLoadConfig_ListenFlag to loadConfig's 3-value signature

Dumbris
and
claude
committed
4bd0dfa