open-platform/mitosis

Fork 0

/goal /ultracode-workflows [SEC-2] attribute human identity into the secrets-sync audit trail #44

New issue

Closed

opened 2026-07-01 02:03:52 +00:00 by plat · 1 comment

plat commented

2026-07-01 02:03:52 +00:00

Owner

Track/Wave: SEC-2 · Wave G1 · Size S
Repos: mcp, _app-template
Depends on: none

Why

The secrets sync commit is currently attributed to CI/admin, not the human who set the secret. Cheap auditability win.

Scope

Thread Forgejo Actions run metadata (github.actor, run id/URL, SHA) from sync-env.yml through secrets-cli.ts into syncAppEnv()'s commit trailer, reusing the existing Caller/Tool commit-attribution pattern. Commit-message change only, no new store.

Acceptance

Triggering sync-env as two different org members yields gitops commits each carrying the distinct human actor (not CI/admin), verifiable via git log alone.

Notes

Seam B: isolated syncAppEnv region (~1728) of server.ts — tolerated concurrent; land by rebase. Overlappable with Horizon 1.

Part of the First Client Deploy → Governance roadmap. The owning agent may recurse into its own subagent team (ultracode workflow) if the task warrants. Honor the seam-serialization: land on a shared seam by rebase, and don't start a seam position until the prior one has merged.

**Track/Wave:** `SEC-2` · Wave **G1** · Size **S** **Repos:** `mcp`, `_app-template` **Depends on:** none ## Why The secrets sync commit is currently attributed to CI/admin, not the human who set the secret. Cheap auditability win. ## Scope Thread Forgejo Actions run metadata (github.actor, run id/URL, SHA) from sync-env.yml through secrets-cli.ts into syncAppEnv()'s commit trailer, reusing the existing Caller/Tool commit-attribution pattern. Commit-message change only, no new store. ## Acceptance Triggering sync-env as two different org members yields gitops commits each carrying the distinct human actor (not CI/admin), verifiable via `git log` alone. ## Notes **Seam B: isolated syncAppEnv region (~1728) of server.ts — tolerated concurrent; land by rebase. Overlappable with Horizon 1.** --- *Part of the **First Client Deploy → Governance** roadmap. The owning agent may recurse into its own subagent team (ultracode workflow) if the task warrants. Honor the seam-serialization: land on a shared seam by rebase, and don't start a seam position until the prior one has merged.*

plat added this to the Client Deploy → Governance Roadmap milestone

2026-07-01 02:03:52 +00:00

plat added the

goal

roadmap

horizon:governance

labels

2026-07-01 02:03:52 +00:00

plat added a new dependency

2026-07-01 02:04:53 +00:00

#45 /goal /ultracode-workflows [SEC-3] secrets threat-model + reviewer FAQ (no store code changes)

plat referenced this issue

2026-07-01 02:05:20 +00:00

[ROADMAP] First Client Deploy → Governance — tracker #47

plat referenced this issue from a commit

2026-07-01 02:15:14 +00:00

SEC-2: attribute human actor into secrets-sync audit trail (plat/mitosis#44)

plat referenced this issue from a commit

2026-07-01 02:15:14 +00:00

SEC-2: attribute human actor into secrets-sync audit trail (plat/mitosis#44)

plat referenced this issue from open-platform/app-template

2026-07-01 02:15:31 +00:00

SEC-2: attribute human actor into secrets-sync audit trail (plat/mitosis#44) #2

plat referenced this issue from a commit

2026-07-01 03:21:45 +00:00

SEC-2: attribute human actor into secrets-sync audit trail (plat/mitosis#44) (#4)

plat referenced this issue from a commit

2026-07-01 03:21:46 +00:00

SEC-2: attribute human actor into secrets-sync audit trail (plat/mitosis#44) (#2)

plat commented

2026-07-01 03:22:22 +00:00

Author

Owner

DONE — merged. plat/mcp PR #4 + plat/app-template PR #2 merged to main (squash; two accidental junk files stripped from #4 first). Wiring verified end-to-end on valid8b: sync-env.yml sets PLAT_ACTOR/PLAT_RUN_URL/PLAT_SHA and forwards them into the container; secrets-cli reads them (GITHUB* fallback) and syncAppEnv appends a Caller/Tool/Run/Commit trailer only when actor.login is set (byte-identical otherwise). 51/51 tests. Live Actions e2e not run (valid8b has no runner + idle CI); trailer format reproduced/verified by hand. Same propagation caveat as RBAC-1 (needs release + seed refresh, #14).

**DONE — merged.** plat/mcp PR #4 + plat/_app-template PR #2 merged to main (squash; two accidental junk files stripped from #4 first). Wiring verified end-to-end on valid8b: sync-env.yml sets PLAT_ACTOR/PLAT_RUN_URL/PLAT_SHA and forwards them into the container; secrets-cli reads them (GITHUB_* fallback) and syncAppEnv appends a Caller/Tool/Run/Commit trailer only when actor.login is set (byte-identical otherwise). 51/51 tests. Live Actions e2e not run (valid8b has no runner + idle CI); trailer format reproduced/verified by hand. Same propagation caveat as RBAC-1 (needs release + seed refresh, #14).

plat closed this issue

2026-07-01 03:22:22 +00:00

plat referenced this issue

2026-07-02 02:21:34 +00:00

[ROADMAP] First Client Deploy → Governance — tracker #47