Repository navigation

GEN-2824 add bounded bearer forwarding - #375

Merged

exe-dev-github-integration[bot] merged 158 commits into

mainfrom

GEN-2824-proxy-forwarding

Nov 12, 2026

Merged

GEN-2824 add bounded bearer forwarding#375
exe-dev-github-integration[bot] merged 158 commits into
mainfrom
GEN-2824-proxy-forwarding

Commits on Nov 11, 2026
- feat(credential-proxy): add bounded bearer forwarding
  
  exe.dev user
  authored and
  exe.dev user
  committed
  2c56c36
- feat(credential-proxy): stream authorized tunnel requests
  
  exe.dev user
  authored and
  exe.dev user
  committed
  41d09a3
- feat(credential-proxy): connect authenticated VM tunnel
  
  exe.dev user
  authored and
  exe.dev user
  committed
  f00b2f0
- Bind enrollment acceptance to proxy boot epoch
  
  exe.dev user
  authored and
  exe.dev user
  committed
  08fddf2
- Bind tunnel enrollment to authenticated VM peer
  
  exe.dev user
  authored and
  exe.dev user
  committed
  adfefc5
- Add authenticated proxy boot registration
  
  exe.dev user
  authored and
  exe.dev user
  committed
  5b44328
- Add secure proxy bootstrap provisioning boundary
  
  exe.dev user
  authored and
  exe.dev user
  committed
  1ed566e
- Provision credential proxy with isolated bootstrap
  
  exe.dev user
  authored and
  exe.dev user
  committed
  edf98ea
- Retry proxy tunnel enrollment before forwarding
  
  exe.dev user
  authored and
  exe.dev user
  committed
  e631553
- Add authenticated proxy enrollment control API
  
  exe.dev user
  authored and
  exe.dev user
  committed
  545d9e7
- Wire proxy-side run enrollment into tunnel auth
  
  exe.dev user
  authored and
  exe.dev user
  committed
  f1ff6ad
- Wire proxy control enrollment into tunnel startup
  exe.dev user
  committed
  b4462a2
- Merge remote-tracking branch 'origin/main' into GEN-2824-proxy-forwarding
  exe.dev user
  committed
  a96a584
- Retain proxy control credential after boot registration
  exe.dev user
  committed
  ef4b952
- Authenticate tunnel enrollment with run credential
  exe.dev user
  committed
  59e6bea
- Keep run credential out of consume request
  exe.dev user
  committed
  2188c7d
- Cover invalid run enrollment bindings
  exe.dev user
  committed
  78b86ee
- Narrow active run identity before enrollment
  exe.dev user
  committed
  c46c3a2
- Close proxy tunnels when a run is revoked
  exe.dev user
  committed
  fd74010
- Add decrypted run integration grant resolver
  exe.dev user
  committed
  68d348e
- Expose selected integrations to authenticated proxy
  exe.dev user
  committed
  eb90329
- Merge remote-tracking branch 'origin/main' into GEN-2824-proxy-forwarding
  exe.dev user
  committed
  3e79721
- Fix encrypted snapshot proxy test fixture
  exe.dev user
  committed
  6f13d7b
- Wire proxy snapshots into local grant resolution
  exe.dev user
  committed
  fea379c
- Preserve grant resolver selection boundaries
  exe.dev user
  committed
  b765691
- Resolve empty and locked grants safely
  exe.dev user
  committed
  15335fa
- Match snapshot control request contract
  exe.dev user
  committed
  32414a2
- Bind tunnel VM identity to certificate SAN
  exe.dev user
  committed
  c22a412
- GEN-2824 provision mTLS identities and revoke tunnels
  exe.dev user
  committed
  3ed3f07
- GEN-2824 include selected model account snapshot
  exe.dev user
  committed
  a3aad85
Commits on Nov 12, 2026
- GEN-2824 update snapshot fixture for model selection
  exe.dev user
  committed
  463ce53
- GEN-2824 add isolated Codex auth helper
  exe.dev user
  committed
  44c5bde
- GEN-2824 persist encrypted Codex account refreshes
  exe.dev user
  committed
  69f05bc
- GEN-2824 encrypt Codex account caches in proxy
  exe.dev user
  committed
  454232c
- GEN-2824 restore encrypted Codex caches on unlock
  exe.dev user
  committed
  28f8f1c
- GEN-2824 persist encrypted model caches by revision
  exe.dev user
  committed
  d27d95a
- GEN-2824 compose model cache lifecycle into proxy startup
  exe.dev user
  committed
  df221e5
- GEN-2824 add private browser model authorization control
  exe.dev user
  committed
  a20d434
- GEN-2824 issue paired model account browser capabilities
  exe.dev user
  committed
  c876176
- GEN-2824 connect model account browser authorization
  exe.dev user
  committed
  dd266cc
- GEN-2824 cover capability endpoint in browser test
  exe.dev user
  committed
  2ccb27b
- GEN-2824 add model account create and delete
  exe.dev user
  committed
  87341ad
- GEN-2824 recover stale model account cache writes
  exe.dev user
  committed
  4e4a5c0
- GEN-2824 clear deleted model caches on unlock
  exe.dev user
  committed
  e5a6a97
- GEN-2824 cover model cache key rotation race
  exe.dev user
  committed
  29cd548
- GEN-2824 cover model reset refresh race
  exe.dev user
  committed
  7a4fdfa
- GEN-2824 cover reset during refresh retry
  exe.dev user
  committed
  5a5f01a
- GEN-2824 invalidate refresh retries after model rotation
  exe.dev user
  committed
  8960123
- GEN-2824 define portable proxy launch gates
  exe.dev user
  committed
  e627df1
- GEN-2824 disable Fly job machine restarts
  exe.dev user
  committed
  e85bf4a
- GEN-2824 persist proxy launch blocks and manual retry
  exe.dev user
  committed
  1f25532
- Merge origin/main into GEN-2824 proxy launch work
  exe.dev user
  committed
  eda72e9
- feat(credential-proxy): add bounded bearer forwarding
  
  exe.dev user
  authored and
  exe.dev user
  committed
  eca2eca
- feat(credential-proxy): stream authorized tunnel requests
  
  exe.dev user
  authored and
  exe.dev user
  committed
  a6a282f
- feat(credential-proxy): connect authenticated VM tunnel
  
  exe.dev user
  authored and
  exe.dev user
  committed
  f1d2c84
- Bind enrollment acceptance to proxy boot epoch
  
  exe.dev user
  authored and
  exe.dev user
  committed
  8c6be50
- Bind tunnel enrollment to authenticated VM peer
  
  exe.dev user
  authored and
  exe.dev user
  committed
  1ec0345
- Add authenticated proxy boot registration
  
  exe.dev user
  authored and
  exe.dev user
  committed
  4ae0b74
- Add secure proxy bootstrap provisioning boundary
  
  exe.dev user
  authored and
  exe.dev user
  committed
  56fd6c2
- Provision credential proxy with isolated bootstrap
  
  exe.dev user
  authored and
  exe.dev user
  committed
  6df5360
- Retry proxy tunnel enrollment before forwarding
  
  exe.dev user
  authored and
  exe.dev user
  committed
  207d68f
- Add authenticated proxy enrollment control API
  
  exe.dev user
  authored and
  exe.dev user
  committed
  497f4bd
- Wire proxy-side run enrollment into tunnel auth
  
  exe.dev user
  authored and
  exe.dev user
  committed
  516938c
- Wire proxy control enrollment into tunnel startup
  
  exe.dev user
  authored and
  exe.dev user
  committed
  8c35922
- Retain proxy control credential after boot registration
  
  exe.dev user
  authored and
  exe.dev user
  committed
  712f6fe
- Authenticate tunnel enrollment with run credential
  
  exe.dev user
  authored and
  exe.dev user
  committed
  f5fcd51
- Keep run credential out of consume request
  
  exe.dev user
  authored and
  exe.dev user
  committed
  3fcb724
- Cover invalid run enrollment bindings
  
  exe.dev user
  authored and
  exe.dev user
  committed
  62b0729
- Narrow active run identity before enrollment
  
  exe.dev user
  authored and
  exe.dev user
  committed
  9e85768
- Close proxy tunnels when a run is revoked
  
  exe.dev user
  authored and
  exe.dev user
  committed
  ced6454
- Add decrypted run integration grant resolver
  
  exe.dev user
  authored and
  exe.dev user
  committed
  184cd43
- Expose selected integrations to authenticated proxy
  
  exe.dev user
  authored and
  exe.dev user
  committed
  7457e58
- Fix encrypted snapshot proxy test fixture
  
  exe.dev user
  authored and
  exe.dev user
  committed
  af71a90
- Wire proxy snapshots into local grant resolution
  
  exe.dev user
  authored and
  exe.dev user
  committed
  69fa35e
- Preserve grant resolver selection boundaries
  
  exe.dev user
  authored and
  exe.dev user
  committed
  3467c03
- Resolve empty and locked grants safely
  
  exe.dev user
  authored and
  exe.dev user
  committed
  a3a74a2
- Match snapshot control request contract
  
  exe.dev user
  authored and
  exe.dev user
  committed
  2872e4e
- Bind tunnel VM identity to certificate SAN
  
  exe.dev user
  authored and
  exe.dev user
  committed
  41f35d1
- GEN-2824 provision mTLS identities and revoke tunnels
  
  exe.dev user
  authored and
  exe.dev user
  committed
  434c008
- GEN-2824 include selected model account snapshot
  
  exe.dev user
  authored and
  exe.dev user
  committed
  41b91d2
- GEN-2824 update snapshot fixture for model selection
  
  exe.dev user
  authored and
  exe.dev user
  committed
  1411909
- GEN-2824 add isolated Codex auth helper
  
  exe.dev user
  authored and
  exe.dev user
  committed
  850e36a
- GEN-2824 persist encrypted Codex account refreshes
  
  exe.dev user
  authored and
  exe.dev user
  committed
  75f9df0
- GEN-2824 encrypt Codex account caches in proxy
  
  exe.dev user
  authored and
  exe.dev user
  committed
  32cc5b7
- GEN-2824 restore encrypted Codex caches on unlock
  
  exe.dev user
  authored and
  exe.dev user
  committed
  d5c433b
- GEN-2824 persist encrypted model caches by revision
  
  exe.dev user
  authored and
  exe.dev user
  committed
  4653583
- GEN-2824 compose model cache lifecycle into proxy startup
  
  exe.dev user
  authored and
  exe.dev user
  committed
  182b8bf
- GEN-2824 add private browser model authorization control
  
  exe.dev user
  authored and
  exe.dev user
  committed
  555656a
- GEN-2824 issue paired model account browser capabilities
  
  exe.dev user
  authored and
  exe.dev user
  committed
  96d8272
- GEN-2824 connect model account browser authorization
  
  exe.dev user
  authored and
  exe.dev user
  committed
  8a68534
- GEN-2824 cover capability endpoint in browser test
  
  exe.dev user
  authored and
  exe.dev user
  committed
  6e81b33
- GEN-2824 add model account create and delete
  
  exe.dev user
  authored and
  exe.dev user
  committed
  834e2b3
- GEN-2824 recover stale model account cache writes
  
  exe.dev user
  authored and
  exe.dev user
  committed
  b99aa42
- GEN-2824 clear deleted model caches on unlock
  
  exe.dev user
  authored and
  exe.dev user
  committed
  4883c88
- GEN-2824 cover model cache key rotation race
  
  exe.dev user
  authored and
  exe.dev user
  committed
  1d56983
- GEN-2824 cover model reset refresh race
  
  exe.dev user
  authored and
  exe.dev user
  committed
  6ed5e76
- GEN-2824 cover reset during refresh retry
  
  exe.dev user
  authored and
  exe.dev user
  committed
  4b67c2a
- GEN-2824 invalidate refresh retries after model rotation
  
  exe.dev user
  authored and
  exe.dev user
  committed
  3981a80
- GEN-2824 define portable proxy launch gates
  
  exe.dev user
  authored and
  exe.dev user
  committed
  3414c7b
- GEN-2824 disable Fly job machine restarts
  
  exe.dev user
  authored and
  exe.dev user
  committed
  6d29321
- GEN-2824 persist proxy launch blocks and manual retry
  
  exe.dev user
  authored and
  exe.dev user
  committed
  a5c6d8d
- Merge remote-tracking branch 'origin/main' into GEN-2824-proxy-forwarding
  exe.dev user
  committed
  cdf1d02
- GEN-2824 report proxy unlock state to scheduler
  exe.dev user
  committed
  28dd751
- Merge remote-tracking branch 'origin/GEN-2824-proxy-forwarding' into GEN-2824-proxy-forwarding
  exe.dev user
  committed
  02492a0
- GEN-2824 persist blocked proxy launch state
  exe.dev user
  committed
  f2ac3f9
- GEN-2824 cover proxy launch lifecycle states
  exe.dev user
  committed
  d529ab1
- GEN-2824 recheck proxy gate after manual retry
  exe.dev user
  committed
  542a82c
- GEN-2824 prepare restart-safe Fly job machines
  exe.dev user
  committed
  628b728
- GEN-2824 add initial Fly job backend
  exe.dev user
  committed
  2aa9963
- GEN-2824 select Fly backend in run scheduler
  exe.dev user
  committed
  3eead27
- GEN-2824 cover Fly scheduler lifecycle retries
  exe.dev user
  committed
  471e944
- GEN-2824 share the execution job launcher
  exe.dev user
  committed
  321f338
- GEN-2824 cover Fly scheduler recovery
  exe.dev user
  committed
  12c1d0b
- GEN-2824 cover revocation during control outage
  exe.dev user
  committed
  77e039d
- Refresh integration grants on active proxy connections
  exe.dev user
  committed
  2064250
- GEN-2824 reject delayed grants after revocation
  exe.dev user
  committed
  620a284
- GEN-2824 authorize provider-bound run grants
  exe.dev user
  committed
  9df3a14
- GEN-2824 keep revoked grants closed on reconnect
  exe.dev user
  committed
  7599378
- GEN-2824 deliver run credentials to proxy memory
  exe.dev user
  committed
  d0dce67
- GEN-2824 type Fly credential isolation test
  exe.dev user
  committed
  269e441
- GEN-2824 revoke credentials for terminal unconnected runs
  exe.dev user
  committed
  5cc9623
- GEN-2824 connect Fly guest proxy tunnel
  exe.dev user
  committed
  80b00a0
- test: exercise generated Fly guest tunnel helper
  exe.dev user
  committed
  0c745da
- GEN-2824 cover custom Fly Codex launch
  exe.dev user
  committed
  cee1750
- GEN-2824 cover Fly startup and cleanup lifecycle
  exe.dev user
  committed
  8042d6d
- test: type Fly machine mock arguments
  exe.dev user
  committed
  cd416c0
- fix: skip redundant Fly stop for stopped Machines
  exe.dev user
  committed
  acf87e8
- test: cover Fly start acknowledgement recovery
  exe.dev user
  committed
  62c195d
- GEN-2824 verify Fly artifact collection before cleanup
  exe.dev user
  committed
  8ff1ce9
- GEN-2824 cover Fly guest launch failures
  exe.dev user
  committed
  3c3af12
- GEN-2824 exercise shared agent job launcher
  exe.dev user
  committed
  6685ae5
- GEN-2824 test custom image launcher setup
  exe.dev user
  committed
  72c2869
- GEN-2824 validate Fly Codex image version
  exe.dev user
  committed
  e31e4fe
- GEN-2824 verify Fly proxy image configuration
  exe.dev user
  committed
  b4564e4
- GEN-2824 strengthen Fly image acceptance checks
  exe.dev user
  committed
  c34c2bc
- GEN-2824 restrict Fly proxy to reviewed image
  exe.dev user
  committed
  82fda0b
- GEN-2824 clean up Fly proxy on invalid boot identity
  exe.dev user
  committed
  768fd73
- GEN-2824 verify Fly proxy provisioning identity
  exe.dev user
  committed
  fc28b64
- GEN-2824 require complete returned Fly identity
  exe.dev user
  committed
  834ac1a
- GEN-2824 honor Fly proxy machine size
  exe.dev user
  committed
  0ea4cb2
- GEN-2824 cover Fly proxy size boundaries
  exe.dev user
  committed
  9e61833
- Merge remote-tracking branch 'origin/main' into GEN-2824-proxy-forwarding
  exe.dev user
  committed
  7d035ea
- GEN-2824 assert custom Fly code image configuration
  exe.dev user
  committed
  7db53e5
- Merge remote-tracking branch 'origin/main' into GEN-2824-proxy-forwarding
  exe.dev user
  committed
  7ccbd56
- GEN-2824 preserve failed guest process results
  exe.dev user
  committed
  3be9774
- GEN-2824 assert Fly process failure state
  exe.dev user
  committed
  c2e06c7
- Merge remote-tracking branch 'origin/main' into GEN-2824-proxy-forwarding
  exe.dev user
  committed
  9840956
- GEN-2824 gate proxy access on unlock reconciliation
  exe.dev user
  committed
  0d99bef
- Merge remote-tracking branch 'origin/main' into GEN-2824-proxy-forwarding
  exe.dev user
  committed
  b134980
- GEN-2824 add unlock key rotation and reset
  exe.dev user
  committed
  0903772
- GEN-2824 verify rotation preserves provider setup
  exe.dev user
  committed
  28ae6e2
- Bind model cache saves to key generation
  exe.dev user
  committed
  31c6136
- GEN-2824 add owner and VM reflection boundaries
  exe.dev user
  committed
  344d8d6
- GEN-2824 refresh proxy security docs export
  exe.dev user
  committed
  f772519
- test credential proxy reconnect and destination boundaries
  exe.dev user
  committed
  4f406ea
- GEN-2824 package proxy sources without test fixtures
  exe.dev user
  committed
  386381e
- Add credential proxy image and scoped e2e fixture
  exe.dev user
  committed
  590dbb7
- Stabilize proxy grant refresh E2E
  exe.dev user
  committed
  1b20d10

Commits

Commits on Nov 11, 2026

Commits on Nov 12, 2026