Repository navigation

Promote graph context and I/O hardening from dev - #56

Merged

eldonm merged 68 commits into

mainfrom

dev

Oct 11, 2026

Merged

Promote graph context and I/O hardening from dev#56
eldonm merged 68 commits into
mainfrom
dev

Commits on May 26, 2026
- feat(db): add PostgreSQL backend with serverless-tuned pooling
  
  eldonm
  and
  claude
  committed
  d1edd79
Commits on Jun 3, 2026
- docs(spec): reusable OAuth 2.1 service design (M1)
  
  eldonm
  and
  claude
  committed
  1a0feff
- docs(plan): M1a OAuth foundation implementation plan
  
  eldonm
  and
  claude
  committed
  426f80e
- build(oauth): add cryptography dependency for RS256
  eldonm
  committed
  9482667
- feat(oauth): OAuthClient + AuthorizationCode storage models
  
  eldonm
  and
  claude
  committed
  f4d53e3
- feat(oauth): RS256 signing-key store + JWKS
  
  eldonm
  and
  claude
  committed
  9183fb6
- feat(oauth): AuthConfig OAuth fields (off by default)
  
  eldonm
  and
  claude
  committed
  7cb380a
- docs(spec): M1b design addendum — Authlib AS integration + jvspatial wiring map
  eldonm
  committed
  bed4089
- docs(plan): M1b-1 OAuth core authorization server plan
  
  eldonm
  and
  claude
  committed
  38b3f69
- build(oauth): add authlib dependency
  eldonm
  committed
  4f85283
- feat(oauth): anyio sync/async bridge + Starlette OAuth2Request wrapper
  
  eldonm
  and
  claude
  committed
  822deaa
- feat(oauth): ClientMixin adapter over OAuthClient
  
  eldonm
  and
  claude
  committed
  c0e92e3
- feat(oauth): authorization-code+PKCE server issuing RS256 tokens (anyio-bridged)
  
  eldonm
  and
  claude
  committed
  b887458
- fix(oauth): enforce mandatory S256 PKCE for all clients (security)
  
  eldonm
  and
  claude
  committed
  fc785cb
- docs(plan): M1b-2 refresh grant + scope-intersection + token hardening
  
  eldonm
  and
  claude
  committed
  52f08d2
- feat(oauth): OAuthRefreshToken model + refresh store
  
  eldonm
  and
  claude
  committed
  3a7178f
- feat(oauth): issue + persist refresh tokens on auth-code flow
  
  eldonm
  and
  claude
  committed
  b7692d9
- feat(oauth): refresh-token grant with rotation + revocation
  
  eldonm
  and
  claude
  committed
  31265d7
- fix(oauth): scope-permission intersection + nbf claim + atomic single-use code
  eldonm
  committed
  c751c22
- fix(oauth): consume auth code only after full validation (no retry lockout)
  eldonm
  committed
  23db9c5
- docs(plan): M1b-3a DCR + revocation + reuse-detection + metadata
  
  eldonm
  and
  claude
  committed
  c1b0f74
- feat(oauth): refresh-token reuse detection (family revocation)
  eldonm
  committed
  a8d329b
- feat(oauth): dynamic client registration (RFC 7591)
  
  eldonm
  and
  claude
  committed
  6d64033
- feat(oauth): token revocation endpoint (RFC 7009)
  
  eldonm
  and
  claude
  committed
  fba2382
- feat(oauth): RFC 8414 AS metadata builder
  eldonm
  committed
  68c1d8f
- fix(oauth): DCR requires https redirect URIs (loopback http allowed)
  
  eldonm
  and
  claude
  committed
  9618ca2
- docs(plan): M1b-3b OAuth HTTP wiring (routes + mount + consent + rate-limit)
  
  eldonm
  and
  claude
  committed
  4ecbbe8
- feat(oauth): mount OAuth routers + well-known metadata/jwks + startup key hook
  
  eldonm
  and
  claude
  committed
  a30c4b0
- docs: OAuth program resume handoff (M1b-3b Task 1 done; next steps + known metadata-prefix bug)
  
  eldonm
  and
  claude
  committed
  15a9cd1
- fix(oauth): metadata advertises api-prefixed endpoints; DCR-over-HTTP test
  
  eldonm
  and
  claude
  committed
  52fb3a3
- feat(oauth): /authorize consent + session-user permission resolution
  
  eldonm
  and
  claude
  committed
  eaae528
- fix(oauth): rate-limit dynamic client registration (open-DCR abuse, I-1)
  
  eldonm
  and
  claude
  committed
  b10adde
- fix(oauth): /authorize deny path validates redirect_uri (no open redirect)
  
  eldonm
  and
  claude
  committed
  dc9879d
- docs(plan): M1c resource server (JWKS verifier + PRM + accept_oauth_bearer)
  
  eldonm
  and
  claude
  committed
  cfe617f
- feat(oauth): resource-server access-token verifier
  
  eldonm
  and
  claude
  committed
  534eaf6
- feat(oauth): protected-resource metadata (RFC 9728) + 401 helper
  
  eldonm
  and
  claude
  committed
  b510f05
- feat(oauth): accept OAuth bearer tokens on protected endpoints (accept_oauth_bearer)
  
  eldonm
  and
  claude
  committed
  e38511f
- feat(oauth): emit WWW-Authenticate resource_metadata on 401 (RFC 9728 discovery)
  eldonm
  committed
  f06dcbe
- docs: OAuth handoff — M1 complete (AS+RS), next = merge + M2/M3
  
  eldonm
  and
  claude
  committed
  8d99c27
Commits on Jun 4, 2026
- feat(oauth): redirect unauthenticated GET /authorize to configured login SPA
  
  eldonm
  and
  claude
  committed
  7565955
- feat(oauth): supported-scope ceiling + empty-perms/wildcard scope hardening
  
  eldonm
  and
  claude
  committed
  8fe442a
- feat(oauth): DCR filters requested scope against supported scopes
  
  eldonm
  and
  claude
  committed
  2ea86cd
- fix(oauth): atomic auth-code consume (CAS) to close multi-worker TOCTOU
  
  eldonm
  and
  claude
  committed
  a3d5829
- feat(ratelimit): IP-only identifier + first-class pluggable backend
  
  eldonm
  and
  claude
  committed
  9edf957
- feat(oauth): jti denylist for access-token revocation (RFC 7009)
  
  eldonm
  and
  claude
  committed
  fab089b
- docs(oauth): M4 hardening completion record + holistic security review
  
  eldonm
  and
  claude
  committed
  0d6e05b
- docs(oauth): M4 record — cross-repo verification outcome (integral consent ceiling fix 1bb5f5a)
  
  eldonm
  and
  claude
  committed
  3a7beb6
- docs: keep jvspatial implementation-agnostic — generalize integral references
  
  eldonm
  and
  claude
  committed
  1f4302e
- test(oauth): use generic app.example.com fixtures (no app-specific names in jvspatial)
  
  eldonm
  and
  claude
  committed
  db89c2d
- docs(oauth): add M4 hardening implementation plan to .planning (companion to the COMPLETE record)
  
  eldonm
  and
  claude
  committed
  5675b8f
Commits on Jun 9, 2026
- feat: enable pretty printing for JSON serialization across both orjson and standard json backends
  Tharickv75
  committed
  e8a4283
Commits on Jun 14, 2026
- chore(release): clean up packaging for 0.0.9 PyPI release
  
  eldonm
  and
  claude
  committed
  b156766
- fix(security): stop unpickling untrusted Redis blobs in json mode; fix auth docs
  eldonm
  committed
  b8680c4
- fix(api): restore route introspection under Starlette >=0.52; fix CI
  eldonm
  committed
  f70ecf6
- fix(deps): lift Starlette cap to resolve PYSEC-2026-161
  eldonm
  committed
  2209937
Commits on Oct 5, 2026
- ci(deps): bump dawidd6/action-download-artifact from 25 to 27
  dependabot[bot]
  authored
  2a51d67
Commits on Oct 10, 2026
- feat: add bounded graph projections for model context (0.2.0)
  eldonm
  committed
  96a1667
- fix: make source-tree demo imports available to pytest CI
  eldonm
  committed
  f8cc40f
Commits on Oct 11, 2026
- chore: defer graph projection versioning to a release PR
  eldonm
  committed
  33666d6
- perf: bound query execution and batch graph persistence
  eldonm
  committed
  6e01953
- Merge current main into dev integration while preserving legacy dev history
  eldonm
  committed
  9831e33
- Merge PR #53: update artifact download action
  eldonm
  committed
  62cec92
- Merge PR #54: bounded graph projections
  eldonm
  committed
  49e813b
- Merge PR #55: query correctness and bounded I/O
  eldonm
  committed
  db109fe
- Harden integrated stream cancellation and enable live dev CI
  eldonm
  committed
  621b779
- feat(core): add configurable rich graph context
  eldonm
  committed
  7d0853c
- ci: add isolated TestPyPI release-candidate publishing
  eldonm
  committed
  fcd89ef
- fix: recover stalled index and validation hardening
  eldonm
  committed
  f45f8a0

Commits

Commits on May 26, 2026

Commits on Jun 3, 2026

Commits on Jun 4, 2026

Commits on Jun 9, 2026

Commits on Jun 14, 2026

Commits on Oct 5, 2026

Commits on Oct 10, 2026

Commits on Oct 11, 2026