feat(managed): add standalone hosted node adoption and control runtime - #450
Merged
Conversation
…unbind + test fixes Preservation snapshot of uncommitted working-tree work (repo survey 2026-08-02). WIP branch — do NOT push directly; split into reviewed PRs first. Build scratch excluded via .gitignore. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…config-dir default) L1: with fleet state sync enabled and state_directory empty, the scan root defaulted to '.', the directory holding enterprise-control.json — so scanFleetState shipped 256KB previews of any operator-added text file there to the authority as signed telemetry. Fail closed: require state_directory to be set explicitly and to be distinct from the config directory. SECURITY_REVIEW_v1.14 L1. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…i-replay) M2: a captured authority-signed restart/shutdown command could be replayed by a compromised or MITM'd authority connection every poll — and after the restart it caused — for up to its 24h TTL, because the daemon's result report goes to the attacker (who drops it) so the authority's server-side de-duplication never engages, yielding a fleet-wide shutdown/restart boot-loop. The signature is replayed, not forged. Persist a lifecycle guard (monotonic IssuedAt high-water + last command id) to the enterprise-control state dir and refuse any lifecycle command at or below it. The record is written BEFORE the daemon acts (and the write failing is fatal to the action — fail closed), so it survives the syscall.Exec restart and the replay is rejected on the next poll. Regression test covers replay, older issue-time, newer command, and restart survival. (Cert-pinning the authority channel — the other half of the MITM precondition — remains a tracked enhancement; this idempotency record already breaks the replay loop.) SECURITY_REVIEW_v1.14 M2 (idempotency). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
There was a problem hiding this comment.
gosec found more than 20 potential problems in the proposed changes. Check the Files changed tab for more details.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds the public node-side runtime required for secure hosted adoption and remote control while keeping hosted tenancy, persistence, semantic evaluation, billing, and fleet-management services private.
Public dependency releases
Validation
The optional pilotprotocol-mcp package remains a separate adapter; it does not own adoption, node identity, or the managed runtime.