mirror of
https://github.com/Studio-Saelix/sencho.git
synced 2026-10-26 13:40:26 +00:00
Anso
489e1a9a9a
* feat(blueprints): detect and enforce runtime digest drift Compare frozen expected artifact identity to live container digests so tag movement surfaces as drift, and Enforce repairs with digest pins (--pull never) without rewriting authored compose. Unreachable or incomplete observation stays unverified and never auto-corrects. * fix(security): keep digest overlay in tmpdir and sanitize observation logs Write Compose digest-pin overlays under os.tmpdir() instead of the stack directory so path expressions are not stack-name tainted, and log runtime observation failures with a fixed format string plus sanitized stack name. * fix(security): create digest overlay via exclusive mkdtemp Avoid CodeQL insecure-temporary-file by writing the Compose digest-pin overlay into an exclusive mkdtemp directory with wx create, then removing the whole directory after deploy. * fix: compare Blueprint digest drift by per-target platform identity Enforce now routes container repair separately from digest pins, keeps compose.override.yml on overlay deploys, and fails closed when the target platform is unknown. * test: expect platformVariants on single-platform digest resolve * test: drop unused seedApp binding in digest-repair suite * fix: drop redundant platformLabel nullish coalesce after guard * fix(blueprints): accept override-only services in apply-local pin guard * fix(blueprints): freeze and repair remote digests from the leaf Hub digest freeze and Enforce repair now fetch the target node's rendered Compose model and Docker platform over the authenticated proxy, so a remote compose_dir string is never treated as a hub-local path. apply-local pin validation runs after write against the rendered multi-file model.