Jesús Pérez
|
e5e2244e04
|
feat(security): add SSRF protection and prompt injection scanning
Documentation Lint & Validation / Markdown Linting (push) Has been cancelled
Documentation Lint & Validation / Validate mdBook Configuration (push) Has been cancelled
Documentation Lint & Validation / Content & Structure Validation (push) Has been cancelled
Documentation Lint & Validation / Lint & Validation Summary (push) Has been cancelled
mdBook Build & Deploy / Build mdBook (push) Has been cancelled
mdBook Build & Deploy / Documentation Quality Check (push) Has been cancelled
mdBook Build & Deploy / Deploy to GitHub Pages (push) Has been cancelled
mdBook Build & Deploy / Notification (push) Has been cancelled
Rust CI / Security Audit (push) Has been cancelled
Rust CI / Check + Test + Lint (nightly) (push) Has been cancelled
Rust CI / Check + Test + Lint (stable) (push) Has been cancelled
- Add security module (ssrf.rs, prompt_injection.rs) to vapora-backend
- Block RFC 1918, link-local, cloud metadata URLs before channel registration
- Scan 60+ injection patterns on RLM (load/query/analyze) and task endpoints
- Fix channel SSRF: filter-before-register instead of warn-and-proceed
- Add sanitize() to load_document (was missing, only analyze_document had it)
- Return 400 Bad Request (not 500) for all security rejections
- Add 11 integration tests via Surreal::init() — no external deps required
- Document in ADR-0038, CHANGELOG, and docs/adrs/README.md
|
2026-02-26 18:20:07 +00:00 |
|
Jesús Pérez
|
765841b18f
|
feat(capabilities): add vapora-capabilities crate with in-process executor dispatch
Documentation Lint & Validation / Markdown Linting (push) Has been cancelled
Documentation Lint & Validation / Validate mdBook Configuration (push) Has been cancelled
Documentation Lint & Validation / Content & Structure Validation (push) Has been cancelled
Documentation Lint & Validation / Lint & Validation Summary (push) Has been cancelled
mdBook Build & Deploy / Build mdBook (push) Has been cancelled
mdBook Build & Deploy / Documentation Quality Check (push) Has been cancelled
mdBook Build & Deploy / Deploy to GitHub Pages (push) Has been cancelled
mdBook Build & Deploy / Notification (push) Has been cancelled
Rust CI / Security Audit (push) Has been cancelled
Rust CI / Check + Test + Lint (nightly) (push) Has been cancelled
Rust CI / Check + Test + Lint (stable) (push) Has been cancelled
- New vapora-capabilities crate: CapabilitySpec, Capability trait, CapabilityRegistry
(parking_lot RwLock), CapabilityLoader (TOML overrides), 3 built-ins
(code-reviewer, doc-generator, pr-monitor), 22 tests
- Move AgentDefinition to vapora-shared to break capabilities↔agents circular dep
- Wire system_prompt into AgentExecutor via LLMRouter.complete_with_budget
- AgentCoordinator: in-process task dispatch via DashMap<String, Sender<TaskAssignment>>
- server.rs: bootstrap CapabilityRegistry + LLMRouter from env, spawn executors per capability
- Landing page: 620 tests, 21 crates, Capability Packages feature box
- docs: capability-packages feature guide, ADR-0037, CHANGELOG, SUMMARY
EOF
|
2026-02-26 16:43:28 +00:00 |
|
Jesús Pérez
|
b9e2cee9f7
|
feat(workflow-engine): add saga, persistence, auth, and NATS-integrated orchestrator hardening
Documentation Lint & Validation / Markdown Linting (push) Has been cancelled
Documentation Lint & Validation / Validate mdBook Configuration (push) Has been cancelled
Documentation Lint & Validation / Content & Structure Validation (push) Has been cancelled
mdBook Build & Deploy / Build mdBook (push) Has been cancelled
Rust CI / Security Audit (push) Has been cancelled
Rust CI / Check + Test + Lint (nightly) (push) Has been cancelled
Rust CI / Check + Test + Lint (stable) (push) Has been cancelled
Documentation Lint & Validation / Lint & Validation Summary (push) Has been cancelled
mdBook Build & Deploy / Documentation Quality Check (push) Has been cancelled
mdBook Build & Deploy / Deploy to GitHub Pages (push) Has been cancelled
mdBook Build & Deploy / Notification (push) Has been cancelled
Key changes driving this: new saga.rs, persistence.rs, auth.rs in workflow-engine; SurrealDB migration 009_workflow_state.surql; backend
services refactored; frontend dist built; ADR-0033 documenting the hardening decision.
|
2026-02-22 21:44:42 +00:00 |
|
