Anso 71595cb1ce feat(gitops): source controller follow-on (#1920) ...

* feat(gitops): revalidate candidates append-only and persist a settled outbox

Record the candidate digest and source-policy evidence at insert. Auto-accept remints a new generation when evidence changed, refuses missing hashes and fingerprint drift, and never updates a generation row. Settled history writes a versioned outbox so notification fanout survives a crash, with unique dedupe and unknown versions left undrained.

* feat(gitops): convert Git source to a SystemSheet and advertise controller controls

Move the Git source panel to the canonical right-side sheet, add suspend, resume, retry, and node polling, and register gitops-source-controller on both sides so the controls stay hidden until the node advertises them.

* fix(gitops): keep candidate compose reads inside the generation directory

Resolve each compose path against the candidate dir and refuse when it
escapes, both when recording the content digest and when revalidating
before auto-accept.

* fix(gitops): close audit gaps on digest reuse, suspend pull, and polling load

Pre-upgrade candidates without a content digest now mint anew instead of
reusing forever, Pull now hides while suspended with matching copy, and
Git polling skips GET for users without node:manage.

2026-09-16 18:19:28 -04:00

72 KiB

576x974px

Raw History