Repository navigation
GEN-2824 add bounded bearer forwarding - #375
Merged
exe-dev-github-integration[bot] merged 158 commits intoNov 12, 2026
Merged
Conversation
asselstine
force-pushed
the
GEN-2824-proxy-forwarding
branch
from
November 11, 2026 20:33
8a4ca17 to
f1ff6ad
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
GEN-2824 — provider-independent integrations and credential proxy
Implements the local acceptance scope for provider-independent execution and user-unlocked credential forwarding. Existing branch history is preserved; current
mainis an ancestor of this head.Acceptance ledger
execution.fly_custom_images_configuration: verified complete — Fly execution/provisioning adapters, custom image launch checks, configuration boundaries, and local API/guest tests.credentials.encryption_setup_rotation_accounts_recovery: verified complete — browser-side encryption, setup/edit flows, rotation/reset, named model accounts, token refresh persistence, and cache recovery/fault tests.proxy.access_lifecycle_enrollment_transport: verified complete — distinct authenticated control credentials, boot registration/epoch, scoped per-run delivery, one-use run/VM enrollment bound to mTLS, scheduler gating/manual retry, lifecycle/revocation, transport restrictions, destination enforcement, reflection, and management authorization.packaging_docs_end_to_end: verified complete — runtime-only npm package, pinned credential-proxy OCI build with provenance/SBOM, documented setup/recovery/security boundaries, and synthetic end-to-end authorized/denied/reconnect coverage. Publication and deployment are not required by GEN-2824.repository_validation: verified complete — required root suite passed on590dbb79410232282c576b7eb8602574a678c44din 169.70s.Final validation
Node 24.12.0 / npm 11.19.0; clean
npm ci; isolated local PostgreSQL bootstrap;/usr/bin/time -p timeout --signal=TERM --kill-after=5s 590s npm testpassed. Results: backend 105 files / 696 passed / 5 skipped; compiled app/API/PostgreSQL integration 2 passed; Chromium functional 7 passed; app unit 104 passed / 1 skipped; proxy harness 4 passed; credential proxy 79 passed; generated contracts, boundaries, docs, runtime checks, and dry-run deploy checks passed. Synthetic credentials and local services only. Optional live Fly/ChatGPT checks were not run and are not acceptance gates.No publication, production deployment, or live account setup is required. GitHub Build Manager owns asynchronous PR check and merge monitoring; local validation is recorded above.