From 2186021b5405d11a2c59b4e75ca39ad36537fc3b Mon Sep 17 00:00:00 2001 From: trial Date: Fri, 18 Sep 2026 19:45:06 +0200 Subject: [PATCH 1/2] docs(project): record stg rollout and PR #21 re-derivation receipt Records the STG pin rollout (helm-charts !100, df-cloud-klickeruzh !598, Argo Synced/Healthy at 929ec4d) and the credential-free stg verification result, with the exact reason an authenticated exec cannot be run there: no synthetic token, no reachable signing key, and no sandbox capacity. Also records the dependabot dispositions and the PR #21 re-derivation as draft PR #28 with its green CI run. --- ...-09-18-upstream-v1.2.0-integration-plan.md | 50 +++++++++++++++++++ 1 file changed, 50 insertions(+) diff --git a/docs/project/2026-09-18-upstream-v1.2.0-integration-plan.md b/docs/project/2026-09-18-upstream-v1.2.0-integration-plan.md index 7b6be27d..577bbad1 100644 --- a/docs/project/2026-09-18-upstream-v1.2.0-integration-plan.md +++ b/docs/project/2026-09-18-upstream-v1.2.0-integration-plan.md @@ -191,6 +191,56 @@ image publication; any GitOps/deployment promotion. - 2026-09-18: terminal condition met. No further work is authorized in this package; every remaining action is a separately gated decision listed above. +## Follow-up receipt: STG rollout and PR #21 re-derivation (2026-09-18) + +Part (a) rollout: + +- GitOps pins merged: helm-charts !100 (ee880de, seven image tags in + codeapi/stg/values.yaml) and df-cloud-klickeruzh !598 (CODE_INTERPRETER_ + TARGET_REVISION = 929ec4d8220f969a3f049e3a134259befeed15d7). +- ArgoCD app-codeapi: Synced/Healthy; spec.sources[0].targetRevision is + 929ec4d8220f969a3f049e3a134259befeed15d7, second source ee880de. +- All six stg deployments (api, file-server, tool-call-server, egress-gateway, + service-worker, sandbox-runner) carry the pinned revision. PRD untouched. +- Live stg health re-checked at this revision: api /v1/health 200; + file-server /health 200; tool-call-server healthy with redis true; + egress-gateway /health 200. + +Part (a) e2e in stg: blocked, no credential-free path. + +- Every authenticated route returns 401 without a bearer token; an unknown + path also returns 401, so auth precedes routing. +- The deployed revision verifies EdDSA JWTs from issuer librechat with + audience codeapi, single-tenant legacy. Its JWKS advertises one key, + kid codeapi-stg-2026-06-29. +- No synthetic token is configured in stg (CODEAPI_SYNTHETIC_ACCESS_TOKEN is + absent from both api deployments), and no trust-entry override is present + (CODEAPI_JWT_TRUST_ENTRIES_JSON is unset). +- The private signing key is not reachable: the cluster secret carries only + the public JWKS, Infisical has no readable codeapi profile, and Key Vault + secret listing is forbidden for the available identities. +- Stg also has no sandbox capacity to complete an execute: the sandbox-runner + and pool-waker deployments are scaled to zero, the sandboxspot pool is + empty, and there is no KVM node. +- Consequence: an authenticated POST /v1/exec cannot be performed in stg + without an stg signing key or an enabled synthetic token. The + credential-free proof (health surface plus the auth-gate matrix) is what + this environment can demonstrate. +- Note: the deployed revision on main does support CODEAPI_JWT_TRUST_ENTRIES + _JSON, so enabling a synthetic token or a trust entry is a configuration + change rather than a rebuild. + +Part (b) dependabot dispositions and PR #21: + +- dependabot #4, #14, #16 closed with supersession comments (main already + carries newer versions). +- PR #21 was CONFLICTING against main (it predates the hosted-apps routes and + the public timeout field). It is re-derived on 929ec4d as draft PR #28, + branch rs/codeapi-public-contract-v2, head 43ed62c, eight files, +1045/-205. +- CI run 35372691427 on #28 completed success: all ten checks green. +- PR #21 is left open pending an explicit disposition decision. + + ## Post-merge receipt (2026-09-18) PR #26 merged into `main` as merge commit `7d77c61` (never squashed; From eba2436f4f1548f005cc2fd9a8fb0f3fb278587a Mon Sep 17 00:00:00 2001 From: trial Date: Fri, 18 Sep 2026 21:08:00 +0200 Subject: [PATCH 2/2] docs(project): record the PR #28 merge and #21 closure #28 merged into main as merge commit bb8359 (never squashed); #21 closed as superseded. The receipt now reflects the actual dispositions instead of the pending state recorded when the branch was opened. --- docs/project/2026-09-18-upstream-v1.2.0-integration-plan.md | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/docs/project/2026-09-18-upstream-v1.2.0-integration-plan.md b/docs/project/2026-09-18-upstream-v1.2.0-integration-plan.md index 577bbad1..febb6d80 100644 --- a/docs/project/2026-09-18-upstream-v1.2.0-integration-plan.md +++ b/docs/project/2026-09-18-upstream-v1.2.0-integration-plan.md @@ -238,7 +238,10 @@ Part (b) dependabot dispositions and PR #21: the public timeout field). It is re-derived on 929ec4d as draft PR #28, branch rs/codeapi-public-contract-v2, head 43ed62c, eight files, +1045/-205. - CI run 35372691427 on #28 completed success: all ten checks green. -- PR #21 is left open pending an explicit disposition decision. +- PR #28 merged into main as merge commit bb8359355273c71199d59dbacb1afe3299541cde + (never squashed; history preserved). +- PR #21 closed as superseded by #28, with the re-derivation rationale recorded + on the pull request. ## Post-merge receipt (2026-09-18)