Address audit findings: security hardening + ingress replay + 0.3.1#13

Merged

d0cd merged 72 commits into

mainfrom

address-audit-findings

May 29, 2026

Commits on May 18, 2026

Address audit findings + cut 0.3.0

d0cd
and
claude
committed
Update docs to match 0.3.0 surface

d0cd
and
claude
committed
Fix release blockers found while validating agent-hosting goal

d0cd
and
claude
committed
A2 + A3: pin gVisor + fix brig up false-positive proxy check

d0cd
and
claude
committed
A4 + B2 + B3 + B6 + B7: fresh-install test + reconciler rollback tests + coverage gates

d0cd
and
claude
committed
C2 + C5 + C6: brig policy test --method/--path, deprecate brig health, dedup matchers

d0cd
and
claude
committed
C1 + C4: brig build wrapper + canonical cells/hermes example doc

d0cd
and
claude
committed
B1 + B4 + B5: schema-pin podman + stream-passthrough e2e tests

d0cd
and
claude
committed
0.3.0 CLI restructure: noun-verb grouping + hermes-team build feedback

d0cd
and
claude
committed
Fix-up for v2 self-review: generic yaml merge + missing tests

d0cd
and
claude
committed
Audit fixes (HIGHs + MEDIUMs + cleanups) + re-land v2 hermes work

d0cd
and
claude
committed
Address feedback v3 + scrub project-specific references from brig

d0cd
and
claude
committed
Address feedback v4: surface safe-consumer guidance + long-life pattern

d0cd
and
claude
committed
Remove brig image load — speculative feature with no consumer

d0cd
and
claude
committed
Schema v2: drop workspace.host_path + add brig cell read

d0cd
and
claude
committed
Close 4 remaining security gaps

d0cd
and
claude
committed
Cell rootfs read-only by default + writable_rootfs opt-out

d0cd
and
claude
committed
Fix first-run UX footguns: diagnose silent-exit, restart, rm prompt

d0cd
and
claude
committed
First-run polish: suppress-warn flag, pull progress, bare-brig cheat-sheet

d0cd
and
claude
committed

Commits on May 19, 2026

Commits on May 20, 2026

Commits on May 23, 2026

Commits on May 26, 2026