2 Commits

Author	SHA1	Message	Date
rcourtman	7791b35ae9	Add Go branch-coverage tests for canonical trust and recovery helpers ... Cover pure functions the recent canonical Operational Trust and protection posture work landed with no unit test: - recovery/model posture: enum Valid, struct Clone/Validate/Payload and the normalize/cloneTime/validOutcome/sortedUniqueStrings/compareProviderStates helpers (20 funcs, all 0%->100%) - operationaltrust contracts: EvidencePayloadRef/Acknowledgement/Suppression/ LifecycleTransition Validate plus LifecycleTransition/NotificationLink Clone - cloudcp/proxytrust: ClientIP, ExtractRemoteIP, rightMostUntrustedForwardedIP and IsTrustedProxyIP forwarded-header and CIDR parsing - mockmodel: NormalizeBlendWeight, SeriesForTimestamps, seriesForProfile, diskIOValue and flatValue deterministic seeded math - updatesignature: DecodePrivateKey and HasTrustedPublicKeys - recovery keys: ProxmoxPBSGuestLooseContinuityKey branch guards - vmware SourceID and truenas availableAppLogContainers formatting Test-only, contract-neutral. New *_branchcov0719_test.go files only; no source or existing test touched.	2026-07-19 15:11:01 +01:00
rcourtman	c7e50d5602	Harden provider-hosted MSP isolation ... Broker provider control-plane Docker access through a socket proxy, remove broad host mounts, align audit and rate-limit proxy trust, harden tenant runtime containers, restrict workspace report logo paths, and update provider deploy guardrails.	2026-06-02 21:10:13 +01:00