[audit-high] Gateway receipts accept bad outcomes and charged denials by PetrefiedThunder · Pull Request #38 · agentmiddleware/agent-middleware

PetrefiedThunder · 2026-10-09T03:37:35Z

What was wrong

Receipt creation accepted any outcome string and signed it into receipts that verified as valid, even though only seven outcomes have any defined meaning. Denied receipts could also claim a nonzero charge and still verify, which contradicts the ledger. Idempotent replays with different constraint evidence were silently adopted instead of rejected.

Why it matters

A signed receipt that verifies is treated as proof of what happened. Bad shapes that verify weaken that proof for budget, refund, and evidence checks.

How it was fixed

Added an outcome allowlist in create_receipt (seven governed outcomes), rejecting the rest with receipt_outcome_invalid
Rejected nonzero charges on denied and insufficient_funds receipts with receipt_denied_charge_invalid
Compared constraints_evaluated in the idempotent replay check, raising receipt_idempotency_conflict on mismatch

Tests

Added gateway/tests/test_receipt_shape_adversarial.py (3 tests). Confirmed all 3 fail with the checks disabled and pass with them enabled.
Ran receipt suites (74 passed) and receipt-adjacent suites including evidence, jev guard, permit v2, refund, mcp trust (163 passed). Ruff check and format clean.

Notes for the reviewer

No migrations, additive validation only with new error reasons. One open question in BREAK-REPORT.md: the verify endpoint returns different 403 errors for missing versus foreign receipt ids (low risk existence signal), left unchanged pending your call.

Draft PR from the Muse Code QA fleet (instance brk-gw-receipts), reviewed by Grok Bot. Not merged or deployed; needs C.Lee's yes.

Note

High Risk
Changes what gets signed and verified on governed receipts and dispatch reconciliation, directly affecting proof of charges, denials, and permit evidence.

Overview
Tightens signed MCP receipt integrity: create_receipt now allowlists outcomes, rejects nonzero charges on uncharged outcomes (denied, insufficient_funds, failed_refunded), and treats mismatched constraints_evaluated on idempotent replay as receipt_idempotency_conflict (canonical JSON). JEV guard metadata is merged via shared effective_constraints so signing and replay compare the same enriched evidence, including when the guard is later disabled but the stored receipt still carries jev_risk_guard.

Dispatch paths attach permit v2 constraint snapshots on receipt minting; reconciliation adoption verifies constraints (with a narrow legacy escape for pre-snapshot failure receipts) and refuses tampered signatures on race adoption. New adversarial and reconciliation tests cover these paths.

^{Reviewed by Cursor Bugbot for commit ba2cb03. Bugbot is set up for automated code reviews on this repo. Configure here.}

Audit fix by Muse Code fleet instance brk-gw-receipts (Grok Bot reviews before PR).

Preserve original PR head d017a13 and merged main 6f51d23 as parents. Keep the six reviewed repair blobs from checkpoint bba002530a8538f74790eeba9c51ff8a8ceab525 and retain the merged billing guards.

Check service-owned idempotent receipts before sign_payload can update signing-key metadata. Keep the transactional write-time replay and race checks, and cover matching and conflicting replays in both session modes.

chatgpt-codex-connector · 2026-10-19T05:50:21Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-19T05:54:40.141552Z	`48bf8b8`	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 48bf8b8564

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

cursor · 2026-10-19T06:21:54Z

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: eeac754a-c0e4-43bd-a3fd-ea659e9058a6)

…und webhooks (#27) * Gateway: fail-closed webhook signature checks Audit fix by Muse Code fleet instance pat4-gw-webhooks (Grok Bot reviews before PR). * fix(webhooks): resolve signing secret at call time; doc-ref wording; adopt clean_database in webhook tests * [audit-high] Tampered receipt algorithm was called unsupported (#22) * QA: agent-middleware verifier/ Audit fix by Muse Code fleet instance qa5-am-verifier (Grok Bot reviews before PR). * Style: no em or en dashes in new files * spec: unsupported requires a verified signature (tampered bytes classify as invalid) * style: ruff-format receipt verifier test --------- Co-authored-by: PetrefiedThunder <petrefiedthunder@users.noreply.github.com> * SEL-295: Refresh burns the old token before checks/insert of the successor (#125) Linear: SEL-295 Refs #97 Engine: muse (fleet coding engine, Grok Bot dispatch) * fix(gateway): use current settings for identity webhook test * [audit-low] Gateway low audit fixes, CORS default, opaque blob refs, spec servers, health output, shutdown comment, permit allowlist (#23) * Gateway lows: same surface fixes as the API copy Audit fix by Muse Code fleet instance low4-gw-lows (Grok Bot reviews before PR). * fix(openapi): build_openapi_servers omits the field instead of advertising a placeholder domain * fix(evidence): empty/unset allowed_tools is deny-all, matching the authorization path --------- Co-authored-by: PetrefiedThunder <petrefiedthunder@users.noreply.github.com> * SEL-283: `framework_integrations` install line points at a requirements file that is not there (#135) Linear: SEL-283 Refs #109 Engine: muse (fleet coding engine, Grok Bot dispatch) * [foundation] Run the skipped Postgres proofs in CI and fail loudly on skips (#24) * Gateway: CI runs the real-database tests Audit fix by Muse Code fleet instance pat4-gw-ci-db (Grok Bot reviews before PR). * fix(ci): set ACTION_MIGRATION_DATABASE_URL in action proofs step (fixture imports the migration module's collection gate) * fix(ci): migrate the asyncpg driver proofs database too (schema gate fails closed on unmigrated DBs) * Fix strict Postgres proof gate and CI skip verification --------- Co-authored-by: PetrefiedThunder <petrefiedthunder@users.noreply.github.com> * SEL-293: Idempotent replay of a permit request fails once its expiry has passed (or approval is unconfigured) (#128) Linear: SEL-293 Refs #99 Engine: codex (fleet coding engine, Grok Bot dispatch) * SEL-273: Gateway runtime deps live only in requirements.txt; pyproject declares none (#129) * SEL-273: Gateway runtime deps live only in requirements.txt; pyproject declares none Linear: SEL-273 Refs #119 Engine: muse (fleet coding engine, Grok Bot dispatch) * Fix optional OpenAI type check and dependency sync guard * SEL-272: Type-checker version unpinned while the linter is pinned (#130) Linear: SEL-272 Refs #120 Engine: grok (fleet coding engine, Grok Bot dispatch) * SEL-274: TypeScript SDK: no lint/build scripts; exports points at .ts source (#131) * SEL-274: TypeScript SDK: no lint/build scripts; exports points at .ts source Linear: SEL-274 Refs #118 Engine: codex (fleet coding engine, Grok Bot dispatch) * Build TypeScript SDK before package export tests * SEL-278: require_scope wrapper mis-typed, hidden by ignore (#132) * SEL-278: require_scope wrapper mis-typed, hidden by ignore Linear: SEL-278 Refs #114 Engine: muse (fleet coding engine, Grok Bot dispatch) * fix(scopes): preserve coroutine return type in decorator * SEL-277: _UnimplementedBlob overrides drop all parameter annotations (#133) Linear: SEL-277 Refs #115 Engine: grok (fleet coding engine, Grok Bot dispatch) * SEL-279: AuthContext.scopes typed non-Optional but defaults to None (#134) Linear: SEL-279 Refs #113 Engine: grok (fleet coding engine, Grok Bot dispatch) * SEL-284: Documented SDK build command does not build this package (#136) Linear: SEL-284 Refs #108 Engine: muse (fleet coding engine, Grok Bot dispatch) * SEL-281: No lint/type hooks in pre-commit; CI gates run only on Python 3.12 (#138) Linear: SEL-281 Refs #111 Engine: codex (fleet coding engine, Grok Bot dispatch) * SEL-288: Python verifier vectors are outside CI coverage (#141) * SEL-288: Python verifier vectors are outside CI coverage Linear: SEL-288 Refs #104 Engine: grok (fleet coding engine, Grok Bot dispatch) * Fix Python SDK source distribution test collection * SEL-296: `b2a-verify-receipt` exits with the "tampered" code (1) when the bundle file is not UTF-8 (#144) * SEL-296: `b2a-verify-receipt` exits with the "tampered" code (1) when the bundle file is not UTF-8 Linear: SEL-296 Refs #96 Engine: muse (fleet coding engine, Grok Bot dispatch) * Format receipt verifier regression tests * Fix gateway mypy hook environment (#150) * fix: run gateway mypy hook with checkout dependencies Signed-off-by: Christopher <131207452+PetrefiedThunder@users.noreply.github.com> * ci: prove mypy hook rejects type errors Signed-off-by: Christopher <131207452+PetrefiedThunder@users.noreply.github.com> --------- Signed-off-by: Christopher <131207452+PetrefiedThunder@users.noreply.github.com> * SEL-294: Re-revoking a permit or API key overwrites the original revocation timestamp / reason (#146) * SEL-294: Re-revoking a permit or API key overwrites the original revocation timestamp / reason Linear: SEL-294 Refs #98 Engine: grok (fleet coding engine, Grok Bot dispatch) * SEL-294: fix CI and update with main (retry pass, muse) * [audit-high] operator docs pointed at missing key rotation and revocation steps (#59) * QA: agent-middleware gateway/docs/ Audit fix by Muse Code fleet instance qa5-am-gateway-docs (Grok Bot reviews before PR). * Format documentation reference contract * docs: correct release and receipt runbook claims Signed-off-by: Christopher <131207452+PetrefiedThunder@users.noreply.github.com> * docs: state API key rotation evidence limits Signed-off-by: Christopher <131207452+PetrefiedThunder@users.noreply.github.com> --------- Signed-off-by: Christopher <131207452+PetrefiedThunder@users.noreply.github.com> * [foundation] Money and permit services enforce caller ownership themselves (#25) * Gateway: owner checks inside service functions Audit fix by Muse Code fleet instance pat4-gw-tenant (Grok Bot reviews before PR). * Enforce key binding in permit service mutations * Update IGA cleanup test for caller identity * Deny unowned child reclaim before wallet state errors * SEL-277: _UnimplementedBlob overrides drop all parameter annotations (#133) Linear: SEL-277 Refs #115 Engine: grok (fleet coding engine, Grok Bot dispatch) * SEL-279: AuthContext.scopes typed non-Optional but defaults to None (#134) Linear: SEL-279 Refs #113 Engine: grok (fleet coding engine, Grok Bot dispatch) * SEL-284: Documented SDK build command does not build this package (#136) Linear: SEL-284 Refs #108 Engine: muse (fleet coding engine, Grok Bot dispatch) * SEL-281: No lint/type hooks in pre-commit; CI gates run only on Python 3.12 (#138) Linear: SEL-281 Refs #111 Engine: codex (fleet coding engine, Grok Bot dispatch) * SEL-288: Python verifier vectors are outside CI coverage (#141) * SEL-288: Python verifier vectors are outside CI coverage Linear: SEL-288 Refs #104 Engine: grok (fleet coding engine, Grok Bot dispatch) * Fix Python SDK source distribution test collection * SEL-296: `b2a-verify-receipt` exits with the "tampered" code (1) when the bundle file is not UTF-8 (#144) * SEL-296: `b2a-verify-receipt` exits with the "tampered" code (1) when the bundle file is not UTF-8 Linear: SEL-296 Refs #96 Engine: muse (fleet coding engine, Grok Bot dispatch) * Format receipt verifier regression tests * Fix gateway mypy hook environment (#150) * fix: run gateway mypy hook with checkout dependencies Signed-off-by: Christopher <131207452+PetrefiedThunder@users.noreply.github.com> * ci: prove mypy hook rejects type errors Signed-off-by: Christopher <131207452+PetrefiedThunder@users.noreply.github.com> --------- Signed-off-by: Christopher <131207452+PetrefiedThunder@users.noreply.github.com> * SEL-294: Re-revoking a permit or API key overwrites the original revocation timestamp / reason (#146) * SEL-294: Re-revoking a permit or API key overwrites the original revocation timestamp / reason Linear: SEL-294 Refs #98 Engine: grok (fleet coding engine, Grok Bot dispatch) * SEL-294: fix CI and update with main (retry pass, muse) * [audit-high] operator docs pointed at missing key rotation and revocation steps (#59) * QA: agent-middleware gateway/docs/ Audit fix by Muse Code fleet instance qa5-am-gateway-docs (Grok Bot reviews before PR). * Format documentation reference contract * docs: correct release and receipt runbook claims Signed-off-by: Christopher <131207452+PetrefiedThunder@users.noreply.github.com> * docs: state API key rotation evidence limits Signed-off-by: Christopher <131207452+PetrefiedThunder@users.noreply.github.com> --------- Signed-off-by: Christopher <131207452+PetrefiedThunder@users.noreply.github.com> --------- Signed-off-by: Christopher <131207452+PetrefiedThunder@users.noreply.github.com> * Break AMW gateway policy and governance (#37) Audit fix by Muse Code fleet instance brk-gw-policies (Grok Bot reviews before PR). * Break AMW gateway middleware (#35) Audit fix by Muse Code fleet instance brk-gw-middleware (Grok Bot reviews before PR). * Break AMW gateway MCP standard routes (#34) Audit fix by Muse Code fleet instance brk-gw-mcp (Grok Bot reviews before PR). * Break AMW gateway billing and wallets (#30) Audit fix by Muse Code fleet instance brk-gw-billing (Grok Bot reviews before PR). * SEL-286: Gateway images omit `b2a_sdk`, so app import crashes (#127) * SEL-286: Gateway images omit `b2a_sdk`, so app import crashes Linear: SEL-286 Refs #106 Engine: grok (fleet coding engine, Grok Bot dispatch) * ci: smoke-test gateway image imports * ci: keep local gateway state out of image contexts * ci: exclude nested local tooling from image context * SEL-276: Published Python SDK is never type-checked; default mypy finds 17 errors (#137) Linear: SEL-276 Refs #116 Engine: codex (fleet coding engine, Grok Bot dispatch) * [audit-high] Gateway receipts accept bad outcomes and charged denials (#38) * Break AMW gateway receipts Audit fix by Muse Code fleet instance brk-gw-receipts (Grok Bot reviews before PR). * Preflight receipt replay before signing Check service-owned idempotent receipts before sign_payload can update signing-key metadata. Keep the transactional write-time replay and race checks, and cover matching and conflicting replays in both session modes. * Reject charged failed-refunded receipts at creation * SEL-280: Money/ledger models excluded from type checking (#139) Linear: SEL-280 Refs #112 Engine: cursor (fleet coding engine, Grok Bot dispatch) * SEL-292: Ordinary test cleanup can erase an inherited database (#147) * SEL-292: Ordinary test cleanup can erase an inherited database Linear: SEL-292 Refs #100 Engine: codex (fleet coding engine, Grok Bot dispatch) * SEL-292: fix CI and update with main (retry pass, grok) * ci: mark CI Postgres database disposable via explicit env flag (SEL-292) * SEL-287: MCP extra's `serve` command does not match the pinned FastMCP API (#142) * SEL-287: MCP extra's `serve` command does not match the pinned FastMCP API Linear: SEL-287 Refs #105 Engine: codex (fleet coding engine, Grok Bot dispatch) * fix(sdk): route MCP tool handlers to mounted invoke endpoint (SEL-287 review fix, codex) * fix: preserve ownership denial replay response (#151) Signed-off-by: Christopher <131207452+PetrefiedThunder@users.noreply.github.com> --------- Signed-off-by: Christopher <131207452+PetrefiedThunder@users.noreply.github.com> Co-authored-by: PetrefiedThunder <petrefiedthunder@users.noreply.github.com>

… headers (#73) * QA: agent-middleware sdk/python/ Audit fix by Muse Code fleet instance qa5-am-sdk-python (Grok Bot reviews before PR). * deps(py): update fastapi requirement in /gateway (#4) Updates the requirements on [fastapi](https://github.com/fastapi/fastapi) to permit the latest version. - [Release notes](https://github.com/fastapi/fastapi/releases) - [Commits](fastapi/fastapi@0.141.1...0.142.2) --- updated-dependencies: - dependency-name: fastapi dependency-version: 0.142.2 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Christopher <131207452+PetrefiedThunder@users.noreply.github.com> * fix(ci): pin pydantic<2.14 and scope gitleaks to HEAD to restore green main (#87) * fix(gateway): pin pydantic<2.14 so the permit credit JSON schema keeps its pattern pydantic 2.14.0 (resolved by unpinned CI installs since fastapi 0.143) no longer emits the string pattern for the permit credit decimal fields, which breaks tests/test_permit_numeric_storage.py on main after #4. Pin below 2.14 until the schema is updated for the new behaviour. * ci(secrets): scan only history reachable from HEAD on push/PR gitleaks defaults to --all and checkout fetches every branch, so test fixture keys on unmerged metacode/* draft branches failed the required gitleaks check on main and every PR. Scheduled/manual runs still scan --all. * deps(py): update uvicorn requirement in /gateway (#5) Updates the requirements on [uvicorn](https://github.com/Kludex/uvicorn) to permit the latest version. - [Release notes](https://github.com/Kludex/uvicorn/releases) - [Changelog](https://github.com/Kludex/uvicorn/blob/main/docs/release-notes.md) - [Commits](Kludex/uvicorn@0.53.0...0.54.0) --- updated-dependencies: - dependency-name: uvicorn dependency-version: 0.54.0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * deps(py): update pyjwt requirement from >=2.15.0 to >=2.15.1 in /gateway (#7) Updates the requirements on [pyjwt](https://github.com/jpadilla/pyjwt) to permit the latest version. - [Release notes](https://github.com/jpadilla/pyjwt/releases) - [Changelog](https://github.com/jpadilla/pyjwt/blob/master/CHANGELOG.rst) - [Commits](jpadilla/pyjwt@2.15.0...2.15.1) --- updated-dependencies: - dependency-name: pyjwt dependency-version: 2.15.1 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * deps(py): update python-dotenv requirement in /gateway (#9) Updates the requirements on [python-dotenv](https://github.com/theskumar/python-dotenv) to permit the latest version. - [Release notes](https://github.com/theskumar/python-dotenv/releases) - [Changelog](https://github.com/theskumar/python-dotenv/blob/main/CHANGELOG.md) - [Commits](theskumar/python-dotenv@v1.2.3...v1.2.4) --- updated-dependencies: - dependency-name: python-dotenv dependency-version: 1.2.4 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * deps(py): update mypy requirement from >=2.3.1 to >=2.4.0 in /gateway (#13) Updates the requirements on [mypy](https://github.com/python/mypy) to permit the latest version. - [Changelog](https://github.com/python/mypy/blob/master/CHANGELOG.md) - [Commits](python/mypy@v2.3.1...v2.4.0) --- updated-dependencies: - dependency-name: mypy dependency-version: 2.4.0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * deps(py): update stripe requirement in /gateway (#8) Updates the requirements on [stripe](https://github.com/stripe/stripe-python) to permit the latest version. - [Release notes](https://github.com/stripe/stripe-python/releases) - [Changelog](https://github.com/stripe/stripe-python/blob/master/CHANGELOG.md) - [Commits](stripe/stripe-python@v15.6.1...v16.0.0) --- updated-dependencies: - dependency-name: stripe dependency-version: 16.0.0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * deps(npm): bump @types/node from 22.20.5 to 26.6.4 in /sdk/typescript (#12) Bumps [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) from 22.20.5 to 26.6.4. - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) --- updated-dependencies: - dependency-name: "@types/node" dependency-version: 26.6.4 dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Christopher <131207452+PetrefiedThunder@users.noreply.github.com> * ci(gitleaks): allowlist 16 reviewed test-fixture/idempotency-key findings (CI-2026-10-16-001) (#121) * deps(py): update mcp requirement in /sdk/python (#94) Updates the requirements on [mcp](https://github.com/modelcontextprotocol/python-sdk) to permit the latest version. - [Release notes](https://github.com/modelcontextprotocol/python-sdk/releases) - [Changelog](https://github.com/modelcontextprotocol/python-sdk/blob/main/RELEASE.md) - [Commits](modelcontextprotocol/python-sdk@v1.29.0...v2.3.0) --- updated-dependencies: - dependency-name: mcp dependency-version: 2.3.0 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Christopher <131207452+PetrefiedThunder@users.noreply.github.com> * [audit-high] Fix gateway auth 500 on odd keys and expiry race in key validation (#29) * Break AMW gateway auth and keys Audit fix by Muse Code fleet instance brk-gw-auth (Grok Bot reviews before PR). * fix: review findings for #29 --------- Co-authored-by: fleet <fleet@local> * [audit-high] Failure lab fail-closed breaks: verifier counts, observation binding, fault-layer input handling (#31) * Break AMW gateway failure_lab scenarios Audit fix by Muse Code fleet instance brk-gw-failurelab (Grok Bot reviews before PR). * fix: review findings for #31 --------- Co-authored-by: fleet <fleet@local> * [audit-low] Default CORS is wildcard (#41) * [audit-low] Default CORS is wildcard Audit fix by Muse Code fleet instance w2-gw-l-029 (Grok Bot reviews before PR). * Muse verify fix r1: [audit-low] Default CORS is wildcard Audit fix by Muse Code fleet instance vfix1-w2-gw-l-029 (Grok Bot reviews before PR). * fix: review findings for #41 --------- Co-authored-by: fleet <fleet@local> * [qa] Money services QA: negative sponsor seed fix plus 72 gap tests (#53) * Gateway deep QA: money services Audit fix by Muse Code fleet instance qa4-gw-svc-money (Grok Bot reviews before PR). * fix: review findings for #53 * fix: review findings for #53 --------- Co-authored-by: fleet <fleet@local> * [audit-high] Block private addresses the URL guard treated as public (#64) * QA: agent-middleware gateway/tests/ Audit fix by Muse Code fleet instance qa5-am-gateway-tests (Grok Bot reviews before PR). * fix: review findings for #64 * fix: review findings for #64 --------- Co-authored-by: fleet <fleet@local> * [qa] Gateway: money-route auth and cross-wallet test matrix (#16) * Gateway: tests for money, auth and tenant paths Audit fix by Muse Code fleet instance gw-qa-suite-money (Grok Bot reviews before PR). * fix: review findings for #16 --------- Co-authored-by: fleet <fleet@local> * [audit-low] Close existence probing via uniform 404 error shapes (#42) * [audit-low] Error shapes differ between routers in ways that allow existence probing (telling whether Audit fix by Muse Code fleet instance w2-gw-l-037 (Grok Bot reviews before PR). * Muse verify fix r1: [audit-low] Error shapes differ between routers in ways that allow existence probing (telling whether Audit fix by Muse Code fleet instance vfix1-w2-gw-l-037 (Grok Bot reviews before PR). * fix: review findings for #42 --------- Co-authored-by: fleet <fleet@local> * [qa] Deep QA for gateway core and db: 134 new tests plus 4 small fixes (#47) * Gateway deep QA: core and db Audit fix by Muse Code fleet instance qa4-gw-core (Grok Bot reviews before PR). * fix: review findings for #47 * fix: review findings for #47 --------- Co-authored-by: fleet <fleet@local> * [qa] TypeScript receipt verifier: tests plus five small parity fixes (#51) * Gateway repo deep QA: TypeScript SDK Audit fix by Muse Code fleet instance qa4-gw-sdk-ts (Grok Bot reviews before PR). * fix: review findings for #51 --------- Co-authored-by: fleet <fleet@local> * [qa] Spec examples validated against schemas and gateway emissions (#52) * Gateway repo deep QA: spec Audit fix by Muse Code fleet instance qa4-gw-spec (Grok Bot reviews before PR). * fix: review findings for #52 * fix: review findings for #52 --------- Co-authored-by: fleet <fleet@local> * [audit-high] Honest money copy and one shared Stripe webhook check (#76) * GTM fix: 53-am-gateway-money Audit fix by Muse Code fleet instance fix-gtm-53-am-gateway-money (Grok Bot reviews before PR). * fix: review findings for #76 --------- Co-authored-by: fleet <fleet@local> * [audit-high] Fix SDK demo risks: localhost default URL, sync client, charge warning, TypeScript build (#81) * GTM fix: 58-am-sdks Audit fix by Muse Code fleet instance fix-gtm-58-am-sdks (Grok Bot reviews before PR). * fix: review findings for #81 --------- Co-authored-by: fleet <fleet@local> * ci: bump the actions group with 5 updates (#88) Bumps the actions group with 5 updates: | Package | From | To | | --- | --- | --- | | [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) | `10.2.0` | `10.3.0` | | [actions/setup-node](https://github.com/actions/setup-node) | `7.0.0` | `7.1.0` | | [github/codeql-action/init](https://github.com/github/codeql-action) | `4.38.2` | `4.38.3` | | [github/codeql-action/analyze](https://github.com/github/codeql-action) | `4.38.2` | `4.38.3` | | [actions/upload-artifact](https://github.com/actions/upload-artifact) | `7.0.1` | `7.0.2` | Updates `astral-sh/setup-uv` from 10.2.0 to 10.3.0 - [Release notes](https://github.com/astral-sh/setup-uv/releases) - [Commits](astral-sh/setup-uv@c18668a...1c37ad0) Updates `actions/setup-node` from 7.0.0 to 7.1.0 - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](actions/setup-node@8207627...949feb2) Updates `github/codeql-action/init` from 4.38.2 to 4.38.3 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@2892aa5...24c5418) Updates `github/codeql-action/analyze` from 4.38.2 to 4.38.3 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@2892aa5...24c5418) Updates `actions/upload-artifact` from 7.0.1 to 7.0.2 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](actions/upload-artifact@043fb46...cf430e0) --- updated-dependencies: - dependency-name: astral-sh/setup-uv dependency-version: 10.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: actions/setup-node dependency-version: 7.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: github/codeql-action/init dependency-version: 4.38.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: github/codeql-action/analyze dependency-version: 4.38.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: actions/upload-artifact dependency-version: 7.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * deps(py): update sqlmodel requirement in /gateway (#89) Updates the requirements on [sqlmodel](https://github.com/fastapi/sqlmodel) to permit the latest version. - [Release notes](https://github.com/fastapi/sqlmodel/releases) - [Changelog](https://github.com/fastapi/sqlmodel/blob/main/docs/release-notes.md) - [Commits](fastapi/sqlmodel@0.0.47...0.0.48) --- updated-dependencies: - dependency-name: sqlmodel dependency-version: 0.0.48 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * deps(py): update asyncpg requirement in /gateway (#91) Updates the requirements on [asyncpg](https://github.com/MagicStack/asyncpg) to permit the latest version. - [Release notes](https://github.com/MagicStack/asyncpg/releases) - [Commits](MagicStack/asyncpg@v0.31.0...v0.32.0) --- updated-dependencies: - dependency-name: asyncpg dependency-version: 0.32.0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * deps(py): update fastapi requirement in /gateway (#92) Updates the requirements on [fastapi](https://github.com/fastapi/fastapi) to permit the latest version. - [Release notes](https://github.com/fastapi/fastapi/releases) - [Commits](fastapi/fastapi@0.142.2...0.143.0) --- updated-dependencies: - dependency-name: fastapi dependency-version: 0.143.0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * [qa] Offline receipt verifier rejects tampering, TS key-length fix (#55) * Gateway repo deep QA: verifier Audit fix by Muse Code fleet instance qa4-gw-verifier (Grok Bot reviews before PR). * fix: review findings for #55 * fix(ts): annotate implicit any in vectors.test.ts (TS7006) --------- Co-authored-by: fleet <fleet@local> * [audit-high] CrewAI tool dropped call fields and receipt ids (#67) * QA: agent-middleware integrations/crewai-agent-middleware/ Audit fix by Muse Code fleet instance qa5-am-integrations-crewai-agent-middleware (Grok Bot reviews before PR). * Style: no em or en dashes in new files * fix: review findings for #67 * fix: review findings for #67 * style: sort imports per ruff 0.16 isort (first-party crewai_b2a block) * style: sort imports per ruff 0.16 isort (first-party crewai_b2a block) * style: sort imports per ruff 0.16 isort (first-party crewai_b2a block) --------- Co-authored-by: fleet <fleet@local> * [audit-high] Fix buyer-facing examples: install path, golden demo, sample output, smoke tests (#84) * GTM fix: 61-am-ci-examples Audit fix by Muse Code fleet instance fix-gtm-61-am-ci-examples (Grok Bot reviews before PR). * fix: review findings for #84 --------- Co-authored-by: fleet <fleet@local> * deps(py): update pydantic requirement from <2.14,>=2.13.5 to >=2.14.1,<2.15 in /gateway (#90) * deps(py): update pydantic requirement in /gateway Updates the requirements on [pydantic](https://github.com/pydantic/pydantic) to permit the latest version. - [Release notes](https://github.com/pydantic/pydantic/releases) - [Changelog](https://github.com/pydantic/pydantic/blob/main/HISTORY.md) - [Commits](pydantic/pydantic@v2.13.5...v2.14.1) --- updated-dependencies: - dependency-name: pydantic dependency-version: 2.14.1 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> * fix(schemas): pin decimal-string JSON pattern dropped by pydantic 2.14 --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Christopher <131207452+PetrefiedThunder@users.noreply.github.com> * [audit-high] Prove Postgres race tests in CI and pin test posture gaps (#78) * GTM fix: 55-am-gateway-tests Audit fix by Muse Code fleet instance fix-gtm-55-am-gateway-tests (Grok Bot reviews before PR). * fix: review findings for #78 * fix(tests): tear down Postgres concurrency fixtures children-first; sweep refund receipts by permit_id (the retry under test issues a second receipt) * test: adopt clean_database in money auth matrix (autouse) per adoption gate * fix(tests): keep suite-wide receipt signing key; deleting it can roll back fixture cleanup --------- Co-authored-by: fleet <fleet@local> * [audit-high] Gateway: enforce policy risk-tier ceiling and fail closed on unknown daily spend (#14) * Gateway: enforce policy risk tier and fail closed on unknown daily spend Audit fix by Muse Code fleet instance gw-risk-tier (Grok Bot reviews before PR). * docs: document risk_tier_not_allowed and daily_spend_unknown denials * docs: document risk_tier_not_allowed and daily_spend_unknown denials * Gateway refuses to boot without all trust tables (#17) Audit fix by Muse Code fleet instance gw-m-boot-tables (Grok Bot reviews before PR). * [audit-high] Receipt test vectors miss revoked keys and lying envelopes (#20) * QA: agent-middleware spec/test-vectors/ Audit fix by Muse Code fleet instance qa5-am-spec-test-vectors (Grok Bot reviews before PR). * regenerate test vectors after merge * fix(vectors): emit canonicalization envelope member required by spec conformance gate * fix(vectors): canonicalization member on golden bundles; exempt intentional tamper cases in conformance gate * fix(vectors): drop payload_kid_downgrade case pending spec key-selection revision --------- Co-authored-by: PetrefiedThunder <petrefiedthunder@users.noreply.github.com> * chore: gitleaks-ignore Ed25519PrivateKey annotations in vector generator (#122) * chore: gitleaks-ignore Ed25519PrivateKey type annotations in test-vector generator (false positive blocking all PRs) * chore: scope gitleaks ignores to the introducing commit e1abe47 --------- Co-authored-by: PetrefiedThunder <petrefiedthunder@users.noreply.github.com> * [audit-medium] Gateway: pin validated IP for sandbox and browser fetches to stop DNS rebinding (#15) * Browser and sandbox fetches pin the validated address Audit fix by Muse Code fleet instance gw-m-dns-rebinding (Grok Bot reviews before PR). * docs: name httpx instead of aiohttp after sandbox proxy switch (doc-reference gate) * fix(sandbox): stream proxy fetch and close after headers; don't claim refused URL on session create --------- Co-authored-by: PetrefiedThunder <petrefiedthunder@users.noreply.github.com> * [audit-high] Gateway: Bind x402 settlements to the permit recipient (#18) * Gateway: check permit recipient limit on x402 payments Audit fix by Muse Code fleet instance gw-x402-recipient (Grok Bot reviews before PR). * fix(x402): verify permit ownership before recipient match (no oracle); compare EVM addresses case-insensitively --------- Co-authored-by: PetrefiedThunder <petrefiedthunder@users.noreply.github.com> * fix(ci): scope generic-api-key off test paths in gitleaks (line-scoped ignores cannot survive squash merges) (#123) Co-authored-by: PetrefiedThunder <petrefiedthunder@users.noreply.github.com> * [audit-high] SDK sent unsafe headers and trusted mismatched receipts (#19) * QA: agent-middleware sdk/ Audit fix by Muse Code fleet instance qa5-am-sdk (Grok Bot reviews before PR). * style+test: ruff-format SDK changes; fake trust plane echoes the invoked tool name * style: ruff-format governed flow test --------- Co-authored-by: PetrefiedThunder <petrefiedthunder@users.noreply.github.com> * QA: agent-middleware spec/ (#21) Audit fix by Muse Code fleet instance qa5-am-spec (Grok Bot reviews before PR). Co-authored-by: PetrefiedThunder <petrefiedthunder@users.noreply.github.com> * [audit-high] Tampered receipt algorithm was called unsupported (#22) * QA: agent-middleware verifier/ Audit fix by Muse Code fleet instance qa5-am-verifier (Grok Bot reviews before PR). * Style: no em or en dashes in new files * spec: unsupported requires a verified signature (tampered bytes classify as invalid) * style: ruff-format receipt verifier test --------- Co-authored-by: PetrefiedThunder <petrefiedthunder@users.noreply.github.com> * SEL-295: Refresh burns the old token before checks/insert of the successor (#125) Linear: SEL-295 Refs #97 Engine: muse (fleet coding engine, Grok Bot dispatch) * [audit-low] Gateway low audit fixes, CORS default, opaque blob refs, spec servers, health output, shutdown comment, permit allowlist (#23) * Gateway lows: same surface fixes as the API copy Audit fix by Muse Code fleet instance low4-gw-lows (Grok Bot reviews before PR). * fix(openapi): build_openapi_servers omits the field instead of advertising a placeholder domain * fix(evidence): empty/unset allowed_tools is deny-all, matching the authorization path --------- Co-authored-by: PetrefiedThunder <petrefiedthunder@users.noreply.github.com> * SEL-283: `framework_integrations` install line points at a requirements file that is not there (#135) Linear: SEL-283 Refs #109 Engine: muse (fleet coding engine, Grok Bot dispatch) * [foundation] Run the skipped Postgres proofs in CI and fail loudly on skips (#24) * Gateway: CI runs the real-database tests Audit fix by Muse Code fleet instance pat4-gw-ci-db (Grok Bot reviews before PR). * fix(ci): set ACTION_MIGRATION_DATABASE_URL in action proofs step (fixture imports the migration module's collection gate) * fix(ci): migrate the asyncpg driver proofs database too (schema gate fails closed on unmigrated DBs) * Fix strict Postgres proof gate and CI skip verification --------- Co-authored-by: PetrefiedThunder <petrefiedthunder@users.noreply.github.com> * SEL-293: Idempotent replay of a permit request fails once its expiry has passed (or approval is unconfigured) (#128) Linear: SEL-293 Refs #99 Engine: codex (fleet coding engine, Grok Bot dispatch) * SEL-273: Gateway runtime deps live only in requirements.txt; pyproject declares none (#129) * SEL-273: Gateway runtime deps live only in requirements.txt; pyproject declares none Linear: SEL-273 Refs #119 Engine: muse (fleet coding engine, Grok Bot dispatch) * Fix optional OpenAI type check and dependency sync guard * SEL-272: Type-checker version unpinned while the linter is pinned (#130) Linear: SEL-272 Refs #120 Engine: grok (fleet coding engine, Grok Bot dispatch) * SEL-274: TypeScript SDK: no lint/build scripts; exports points at .ts source (#131) * SEL-274: TypeScript SDK: no lint/build scripts; exports points at .ts source Linear: SEL-274 Refs #118 Engine: codex (fleet coding engine, Grok Bot dispatch) * Build TypeScript SDK before package export tests * SEL-278: require_scope wrapper mis-typed, hidden by ignore (#132) * SEL-278: require_scope wrapper mis-typed, hidden by ignore Linear: SEL-278 Refs #114 Engine: muse (fleet coding engine, Grok Bot dispatch) * fix(scopes): preserve coroutine return type in decorator * SEL-277: _UnimplementedBlob overrides drop all parameter annotations (#133) Linear: SEL-277 Refs #115 Engine: grok (fleet coding engine, Grok Bot dispatch) * SEL-279: AuthContext.scopes typed non-Optional but defaults to None (#134) Linear: SEL-279 Refs #113 Engine: grok (fleet coding engine, Grok Bot dispatch) * SEL-284: Documented SDK build command does not build this package (#136) Linear: SEL-284 Refs #108 Engine: muse (fleet coding engine, Grok Bot dispatch) * SEL-281: No lint/type hooks in pre-commit; CI gates run only on Python 3.12 (#138) Linear: SEL-281 Refs #111 Engine: codex (fleet coding engine, Grok Bot dispatch) * SEL-288: Python verifier vectors are outside CI coverage (#141) * SEL-288: Python verifier vectors are outside CI coverage Linear: SEL-288 Refs #104 Engine: grok (fleet coding engine, Grok Bot dispatch) * Fix Python SDK source distribution test collection * SEL-296: `b2a-verify-receipt` exits with the "tampered" code (1) when the bundle file is not UTF-8 (#144) * SEL-296: `b2a-verify-receipt` exits with the "tampered" code (1) when the bundle file is not UTF-8 Linear: SEL-296 Refs #96 Engine: muse (fleet coding engine, Grok Bot dispatch) * Format receipt verifier regression tests * Fix gateway mypy hook environment (#150) * fix: run gateway mypy hook with checkout dependencies Signed-off-by: Christopher <131207452+PetrefiedThunder@users.noreply.github.com> * ci: prove mypy hook rejects type errors Signed-off-by: Christopher <131207452+PetrefiedThunder@users.noreply.github.com> --------- Signed-off-by: Christopher <131207452+PetrefiedThunder@users.noreply.github.com> * SEL-294: Re-revoking a permit or API key overwrites the original revocation timestamp / reason (#146) * SEL-294: Re-revoking a permit or API key overwrites the original revocation timestamp / reason Linear: SEL-294 Refs #98 Engine: grok (fleet coding engine, Grok Bot dispatch) * SEL-294: fix CI and update with main (retry pass, muse) * [audit-high] operator docs pointed at missing key rotation and revocation steps (#59) * QA: agent-middleware gateway/docs/ Audit fix by Muse Code fleet instance qa5-am-gateway-docs (Grok Bot reviews before PR). * Format documentation reference contract * docs: correct release and receipt runbook claims Signed-off-by: Christopher <131207452+PetrefiedThunder@users.noreply.github.com> * docs: state API key rotation evidence limits Signed-off-by: Christopher <131207452+PetrefiedThunder@users.noreply.github.com> --------- Signed-off-by: Christopher <131207452+PetrefiedThunder@users.noreply.github.com> * [foundation] Money and permit services enforce caller ownership themselves (#25) * Gateway: owner checks inside service functions Audit fix by Muse Code fleet instance pat4-gw-tenant (Grok Bot reviews before PR). * Enforce key binding in permit service mutations * Update IGA cleanup test for caller identity * Deny unowned child reclaim before wallet state errors * SEL-277: _UnimplementedBlob overrides drop all parameter annotations (#133) Linear: SEL-277 Refs #115 Engine: grok (fleet coding engine, Grok Bot dispatch) * SEL-279: AuthContext.scopes typed non-Optional but defaults to None (#134) Linear: SEL-279 Refs #113 Engine: grok (fleet coding engine, Grok Bot dispatch) * SEL-284: Documented SDK build command does not build this package (#136) Linear: SEL-284 Refs #108 Engine: muse (fleet coding engine, Grok Bot dispatch) * SEL-281: No lint/type hooks in pre-commit; CI gates run only on Python 3.12 (#138) Linear: SEL-281 Refs #111 Engine: codex (fleet coding engine, Grok Bot dispatch) * SEL-288: Python verifier vectors are outside CI coverage (#141) * SEL-288: Python verifier vectors are outside CI coverage Linear: SEL-288 Refs #104 Engine: grok (fleet coding engine, Grok Bot dispatch) * Fix Python SDK source distribution test collection * SEL-296: `b2a-verify-receipt` exits with the "tampered" code (1) when the bundle file is not UTF-8 (#144) * SEL-296: `b2a-verify-receipt` exits with the "tampered" code (1) when the bundle file is not UTF-8 Linear: SEL-296 Refs #96 Engine: muse (fleet coding engine, Grok Bot dispatch) * Format receipt verifier regression tests * Fix gateway mypy hook environment (#150) * fix: run gateway mypy hook with checkout dependencies Signed-off-by: Christopher <131207452+PetrefiedThunder@users.noreply.github.com> * ci: prove mypy hook rejects type errors Signed-off-by: Christopher <131207452+PetrefiedThunder@users.noreply.github.com> --------- Signed-off-by: Christopher <131207452+PetrefiedThunder@users.noreply.github.com> * SEL-294: Re-revoking a permit or API key overwrites the original revocation timestamp / reason (#146) * SEL-294: Re-revoking a permit or API key overwrites the original revocation timestamp / reason Linear: SEL-294 Refs #98 Engine: grok (fleet coding engine, Grok Bot dispatch) * SEL-294: fix CI and update with main (retry pass, muse) * [audit-high] operator docs pointed at missing key rotation and revocation steps (#59) * QA: agent-middleware gateway/docs/ Audit fix by Muse Code fleet instance qa5-am-gateway-docs (Grok Bot reviews before PR). * Format documentation reference contract * docs: correct release and receipt runbook claims Signed-off-by: Christopher <131207452+PetrefiedThunder@users.noreply.github.com> * docs: state API key rotation evidence limits Signed-off-by: Christopher <131207452+PetrefiedThunder@users.noreply.github.com> --------- Signed-off-by: Christopher <131207452+PetrefiedThunder@users.noreply.github.com> --------- Signed-off-by: Christopher <131207452+PetrefiedThunder@users.noreply.github.com> * Break AMW gateway policy and governance (#37) Audit fix by Muse Code fleet instance brk-gw-policies (Grok Bot reviews before PR). * Break AMW gateway middleware (#35) Audit fix by Muse Code fleet instance brk-gw-middleware (Grok Bot reviews before PR). * Break AMW gateway MCP standard routes (#34) Audit fix by Muse Code fleet instance brk-gw-mcp (Grok Bot reviews before PR). * Break AMW gateway billing and wallets (#30) Audit fix by Muse Code fleet instance brk-gw-billing (Grok Bot reviews before PR). * SEL-286: Gateway images omit `b2a_sdk`, so app import crashes (#127) * SEL-286: Gateway images omit `b2a_sdk`, so app import crashes Linear: SEL-286 Refs #106 Engine: grok (fleet coding engine, Grok Bot dispatch) * ci: smoke-test gateway image imports * ci: keep local gateway state out of image contexts * ci: exclude nested local tooling from image context * SEL-276: Published Python SDK is never type-checked; default mypy finds 17 errors (#137) Linear: SEL-276 Refs #116 Engine: codex (fleet coding engine, Grok Bot dispatch) * [audit-high] Gateway receipts accept bad outcomes and charged denials (#38) * Break AMW gateway receipts Audit fix by Muse Code fleet instance brk-gw-receipts (Grok Bot reviews before PR). * Preflight receipt replay before signing Check service-owned idempotent receipts before sign_payload can update signing-key metadata. Keep the transactional write-time replay and race checks, and cover matching and conflicting replays in both session modes. * Reject charged failed-refunded receipts at creation * SEL-280: Money/ledger models excluded from type checking (#139) Linear: SEL-280 Refs #112 Engine: cursor (fleet coding engine, Grok Bot dispatch) * SEL-292: Ordinary test cleanup can erase an inherited database (#147) * SEL-292: Ordinary test cleanup can erase an inherited database Linear: SEL-292 Refs #100 Engine: codex (fleet coding engine, Grok Bot dispatch) * SEL-292: fix CI and update with main (retry pass, grok) * ci: mark CI Postgres database disposable via explicit env flag (SEL-292) * SEL-287: MCP extra's `serve` command does not match the pinned FastMCP API (#142) * SEL-287: MCP extra's `serve` command does not match the pinned FastMCP API Linear: SEL-287 Refs #105 Engine: codex (fleet coding engine, Grok Bot dispatch) * fix(sdk): route MCP tool handlers to mounted invoke endpoint (SEL-287 review fix, codex) * fix: preserve ownership denial replay response (#151) Signed-off-by: Christopher <131207452+PetrefiedThunder@users.noreply.github.com> * sdk: carry PR 73 boundary guards onto current main Port the reviewed PR 73 SDK boundary fixes from checkpoint 3afc3922b4ef217ff421fa8e0e1b591b68ee578d. Preserve the merged MCP gateway call shape and stdio behavior while adding encoded manifest categories, redirect blocking, and real CLI line breaks. Signed-off-by: Christopher <131207452+PetrefiedThunder@users.noreply.github.com> * [foundation] Fail-closed shared webhook signature checks for all inbound webhooks (#27) * Gateway: fail-closed webhook signature checks Audit fix by Muse Code fleet instance pat4-gw-webhooks (Grok Bot reviews before PR). * fix(webhooks): resolve signing secret at call time; doc-ref wording; adopt clean_database in webhook tests * [audit-high] Tampered receipt algorithm was called unsupported (#22) * QA: agent-middleware verifier/ Audit fix by Muse Code fleet instance qa5-am-verifier (Grok Bot reviews before PR). * Style: no em or en dashes in new files * spec: unsupported requires a verified signature (tampered bytes classify as invalid) * style: ruff-format receipt verifier test --------- Co-authored-by: PetrefiedThunder <petrefiedthunder@users.noreply.github.com> * SEL-295: Refresh burns the old token before checks/insert of the successor (#125) Linear: SEL-295 Refs #97 Engine: muse (fleet coding engine, Grok Bot dispatch) * fix(gateway): use current settings for identity webhook test * [audit-low] Gateway low audit fixes, CORS default, opaque blob refs, spec servers, health output, shutdown comment, permit allowlist (#23) * Gateway lows: same surface fixes as the API copy Audit fix by Muse Code fleet instance low4-gw-lows (Grok Bot reviews before PR). * fix(openapi): build_openapi_servers omits the field instead of advertising a placeholder domain * fix(evidence): empty/unset allowed_tools is deny-all, matching the authorization path --------- Co-authored-by: PetrefiedThunder <petrefiedthunder@users.noreply.github.com> * SEL-283: `framework_integrations` install line points at a requirements file that is not there (#135) Linear: SEL-283 Refs #109 Engine: muse (fleet coding engine, Grok Bot dispatch) * [foundation] Run the skipped Postgres proofs in CI and fail loudly on skips (#24) * Gateway: CI runs the real-database tests Audit fix by Muse Code fleet instance pat4-gw-ci-db (Grok Bot reviews before PR). * fix(ci): set ACTION_MIGRATION_DATABASE_URL in action proofs step (fixture imports the migration module's collection gate) * fix(ci): migrate the asyncpg driver proofs database too (schema gate fails closed on unmigrated DBs) * Fix strict Postgres proof gate and CI skip verification --------- Co-authored-by: PetrefiedThunder <petrefiedthunder@users.noreply.github.com> * SEL-293: Idempotent replay of a permit request fails once its expiry has passed (or approval is unconfigured) (#128) Linear: SEL-293 Refs #99 Engine: codex (fleet coding engine, Grok Bot dispatch) * SEL-273: Gateway runtime deps live only in requirements.txt; pyproject declares none (#129) * SEL-273: Gateway runtime deps live only in requirements.txt; pyproject declares none Linear: SEL-273 Refs #119 Engine: muse (fleet coding engine, Grok Bot dispatch) * Fix optional OpenAI type check and dependency sync guard * SEL-272: Type-checker version unpinned while the linter is pinned (#130) Linear: SEL-272 Refs #120 Engine: grok (fleet coding engine, Grok Bot dispatch) * SEL-274: TypeScript SDK: no lint/build scripts; exports points at .ts source (#131) * SEL-274: TypeScript SDK: no lint/build scripts; exports points at .ts source Linear: SEL-274 Refs #118 Engine: codex (fleet coding engine, Grok Bot dispatch) * Build TypeScript SDK before package export tests * SEL-278: require_scope wrapper mis-typed, hidden by ignore (#132) * SEL-278: require_scope wrapper mis-typed, hidden by ignore Linear: SEL-278 Refs #114 Engine: muse (fleet coding engine, Grok Bot dispatch) * fix(scopes): preserve coroutine return type in decorator * SEL-277: _UnimplementedBlob overrides drop all parameter annotations (#133) Linear: SEL-277 Refs #115 Engine: grok (fleet coding engine, Grok Bot dispatch) * SEL-279: AuthContext.scopes typed non-Optional but defaults to None (#134) Linear: SEL-279 Refs #113 Engine: grok (fleet coding engine, Grok Bot dispatch) * SEL-284: Documented SDK build command does not build this package (#136) Linear: SEL-284 Refs #108 Engine: muse (fleet coding engine, Grok Bot dispatch) * SEL-281: No lint/type hooks in pre-commit; CI gates run only on Python 3.12 (#138) Linear: SEL-281 Refs #111 Engine: codex (fleet coding engine, Grok Bot dispatch) * SEL-288: Python verifier vectors are outside CI coverage (#141) * SEL-288: Python verifier vectors are outside CI coverage Linear: SEL-288 Refs #104 Engine: grok (fleet coding engine, Grok Bot dispatch) * Fix Python SDK source distribution test collection * SEL-296: `b2a-verify-receipt` exits with the "tampered" code (1) when the bundle file is not UTF-8 (#144) * SEL-296: `b2a-verify-receipt` exits with the "tampered" code (1) when the bundle file is not UTF-8 Linear: SEL-296 Refs #96 Engine: muse (fleet coding engine, Grok Bot dispatch) * Format receipt verifier regression tests * Fix gateway mypy hook environment (#150) * fix: run gateway mypy hook with checkout dependencies Signed-off-by: Christopher <131207452+PetrefiedThunder@users.noreply.github.com> * ci: prove mypy hook rejects type errors Signed-off-by: Christopher <131207452+PetrefiedThunder@users.noreply.github.com> --------- Signed-off-by: Christopher <131207452+PetrefiedThunder@users.noreply.github.com> * SEL-294: Re-revoking a permit or API key overwrites the original revocation timestamp / reason (#146) * SEL-294: Re-revoking a permit or API key overwrites the original revocation timestamp / reason Linear: SEL-294 Refs #98 Engine: grok (fleet coding engine, Grok Bot dispatch) * SEL-294: fix CI and update with main (retry pass, muse) * [audit-high] operator docs pointed at missing key rotation and revocation steps (#59) * QA: agent-middleware gateway/docs/ Audit fix by Muse Code fleet instance qa5-am-gateway-docs (Grok Bot reviews before PR). * Format documentation reference contract * docs: correct release and receipt runbook claims Signed-off-by: Christopher <131207452+PetrefiedThunder@users.noreply.github.com> * docs: state API key rotation evidence limits Signed-off-by: Christopher <131207452+PetrefiedThunder@users.noreply.github.com> --------- Signed-off-by: Christopher <131207452+PetrefiedThunder@users.noreply.github.com> * [foundation] Money and permit services enforce caller ownership themselves (#25) * Gateway: owner checks inside service functions Audit fix by Muse Code fleet instance pat4-gw-tenant (Grok Bot reviews before PR). * Enforce key binding in permit service mutations * Update IGA cleanup test for caller identity * Deny unowned child reclaim before wallet state errors * SEL-277: _UnimplementedBlob overrides drop all parameter annotations (#133) Linear: SEL-277 Refs #115 Engine: grok (fleet coding engine, Grok Bot dispatch) * SEL-279: AuthContext.scopes typed non-Optional but defaults to None (#134) Linear: SEL-279 Refs #113 Engine: grok (fleet coding engine, Grok Bot dispatch) * SEL-284: Documented SDK build command does not build this package (#136) Linear: SEL-284 Refs #108 Engine: muse (fleet coding engine, Grok Bot dispatch) * SEL-281: No lint/type hooks in pre-commit; CI gates run only on Python 3.12 (#138) Linear: SEL-281 Refs #111 Engine: codex (fleet coding engine, Grok Bot dispatch) * SEL-288: Python verifier vectors are outside CI coverage (#141) * SEL-288: Python verifier vectors are outside CI coverage Linear: SEL-288 Refs #104 Engine: grok (fleet coding engine, Grok Bot dispatch) * Fix Python SDK source distribution test collection * SEL-296: `b2a-verify-receipt` exits with the "tampered" code (1) when the bundle file is not UTF-8 (#144) * SEL-296: `b2a-verify-receipt` exits with the "tampered" code (1) when the bundle file is not UTF-8 Linear: SEL-296 Refs #96 Engine: muse (fleet coding engine, Grok Bot dispatch) * Format receipt verifier regression tests * Fix gateway mypy hook environment (#150) * fix: run gateway mypy hook with checkout dependencies Signed-off-by: Christopher <131207452+PetrefiedThunder@users.noreply.github.com> * ci: prove mypy hook rejects type errors Signed-off-by: Christopher <131207452+PetrefiedThunder@users.noreply.github.com> --------- Signed-off-by: Christopher <131207452+PetrefiedThunder@users.noreply.github.com> * SEL-294: Re-revoking a permit or API key overwrites the original revocation timestamp / reason (#146) * SEL-294: Re-revoking a permit or API key overwrites the original revocation timestamp / reason Linear: SEL-294 Refs #98 Engine: grok (fleet coding engine, Grok Bot dispatch) * SEL-294: fix CI and update with main (retry pass, muse) * [audit-high] operator docs pointed at missing key rotation and revocation steps (#59) * QA: agent-middleware gateway/docs/ Audit fix by Muse Code fleet instance qa5-am-gateway-docs (Grok Bot reviews before PR). * Format documentation reference contract * docs: correct release and receipt runbook claims Signed-off-by: Christopher <131207452+PetrefiedThunder@users.noreply.github.com> * docs: state API key rotation evidence limits Signed-off-by: Christopher <131207452+PetrefiedThunder@users.noreply.github.com> --------- Signed-off-by: Christopher <131207452+PetrefiedThunder@users.noreply.github.com> --------- Signed-off-by: Christopher <131207452+PetrefiedThunder@users.noreply.github.com> * Break AMW gateway policy and governance (#37) Audit fix by Muse Code fleet instance brk-gw-policies (Grok Bot reviews before PR). * Break AMW gateway middleware (#35) Audit fix by Muse Code fleet instance brk-gw-middleware (Grok Bot reviews before PR). * Break AMW gateway MCP standard routes (#34) Audit fix by Muse Code fleet instance brk-gw-mcp (Grok Bot reviews before PR). * Break AMW gateway billing and wallets (#30) Audit fix by Muse Code fleet instance brk-gw-billing (Grok Bot reviews before PR). * SEL-286: Gateway images omit `b2a_sdk`, so app import crashes (#127) * SEL-286: Gateway images omit `b2a_sdk`, so app import crashes Linear: SEL-286 Refs #106 Engine: grok (fleet coding engine, Grok Bot dispatch) * ci: smoke-test gateway image imports * ci: keep local gateway state out of image contexts * ci: exclude nested local tooling from image context * SEL-276: Published Python SDK is never type-checked; default mypy finds 17 errors (#137) Linear: SEL-276 Refs #116 Engine: codex (fleet coding engine, Grok Bot dispatch) * [audit-high] Gateway receipts accept bad outcomes and charged denials (#38) * Break AMW gateway receipts Audit fix by Muse Code fleet instance brk-gw-receipts (Grok Bot reviews before PR). * Preflight receipt replay before signing Check service-owned idempotent receipts before sign_payload can update signing-key metadata. Keep the transactional write-time replay and race checks, and cover matching and conflicting replays in both session modes. * Reject charged failed-refunded receipts at creation * SEL-280: Money/ledger models excluded from type checking (#139) Linear: SEL-280 Refs #112 Engine: cursor (fleet coding engine, Grok Bot dispatch) * SEL-292: Ordinary test cleanup can erase an inherited database (#147) * SEL-292: Ordinary test cleanup can erase an inherited database Linear: SEL-292 Refs #100 Engine: codex (fleet coding engine, Grok Bot dispatch) * SEL-292: fix CI and update with main (retry pass, grok) * ci: mark CI Postgres database disposable via explicit env flag (SEL-292) * SEL-287: MCP extra's `serve` command does not match the pinned FastMCP API (#142) * SEL-287: MCP extra's `serve` command does not match the pinned FastMCP API Linear: SEL-287 Refs #105 Engine: codex (fleet coding engine, Grok Bot dispatch) * fix(sdk): route MCP tool handlers to mounted invoke endpoint (SEL-287 review fix, codex) * fix: preserve ownership denial replay response (#151) Signed-off-by: Christopher <131207452+PetrefiedThunder@users.noreply.github.com> --------- Signed-off-by: Christopher <131207452+PetrefiedThunder@users.noreply.github.com> Co-authored-by: PetrefiedThunder <petrefiedthunder@users.noreply.github.com> * sdk: bound shared permit traversal and type idempotency errors Track completed argument containers while keeping active-ancestor cycle detection. Reject non-string idempotency keys with ValueError before I/O. Add deterministic shared-DAG, deep nesting, cycle, forbidden-field, and zero-send regressions. Signed-off-by: Christopher <131207452+PetrefiedThunder@users.noreply.github.com> * ci: add trust release gate as non-required CI job (SEL-290) (#148) Adds scripts/trust_release_gate.sh as a separate 'Trust release gate (non-required)' job outside the CI result aggregate, so the gate's known coverage/OpenAPI-parity failures cannot block unrelated PRs (addresses P1 review). Python 3.12 / gateway failure was a ruff format --check miss in gateway/tests/test_suite_posture_defaults.py, fixed in 2427baf. * sdk: refresh PR 73 guards and traversal repair on current main Apply the nine reviewed SDK paths to main 31487ea. Preserve the trust-release and gateway changes merged through PR 148. Signed-off-by: Christopher <131207452+PetrefiedThunder@users.noreply.github.com> * test: type intentional invalid idempotency inputs for SDK mypy Cast only the negative-test value at the runtime validation boundary. Keep all non-string cases and pre-I/O assertions while preserving the public str API signatures. Signed-off-by: Christopher <131207452+PetrefiedThunder@users.noreply.github.com> --------- Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: Christopher <131207452+PetrefiedThunder@users.noreply.github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: fleet <fleet@local> Co-authored-by: PetrefiedThunder <petrefiedthunder@users.noreply.github.com>

PetrefiedThunder added 3 commits October 8, 2026 16:30

Break AMW gateway receipts

d017a13

Audit fix by Muse Code fleet instance brk-gw-receipts (Grok Bot reviews before PR).

Merge current main into PR #38 receipt repair

b606a50

Preserve original PR head d017a13 and merged main 6f51d23 as parents. Keep the six reviewed repair blobs from checkpoint bba002530a8538f74790eeba9c51ff8a8ceab525 and retain the merged billing guards.

Preflight receipt replay before signing

48bf8b8

Check service-owned idempotent receipts before sign_payload can update signing-key metadata. Keep the transactional write-time replay and race checks, and cover matching and conflicting replays in both session modes.

PetrefiedThunder marked this pull request as ready for review October 19, 2026 05:50

chatgpt-codex-connector Bot reviewed Oct 19, 2026

View reviewed changes

Comment thread gateway/app/services/receipts.py Resolved

PetrefiedThunder added 2 commits October 18, 2026 23:04

Reject charged failed-refunded receipts at creation

2340f87

Merge current main into PR #38

ba2cb03

PetrefiedThunder merged commit 823f217 into main Oct 19, 2026
43 checks passed

PetrefiedThunder deleted the metacode/brk-gw-receipts branch October 20, 2026 11:11

PetrefiedThunder mentioned this pull request Oct 26, 2026

fix(api-keys)!: use salted, peppered scrypt digests #254

Merged

Navigation Menu

Repository navigation

[audit-high] Gateway receipts accept bad outcomes and charged denials - #38

[audit-high] Gateway receipts accept bad outcomes and charged denials#38
PetrefiedThunder merged 5 commits into
mainfrom
metacode/brk-gw-receipts

PetrefiedThunder commented Oct 9, 2026 •

edited by cursor Bot

Loading

Uh oh!

chatgpt-codex-connector Bot commented Oct 19, 2026 •

edited

Loading

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

Uh oh!

cursor Bot commented Oct 19, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

PetrefiedThunder commented Oct 9, 2026 • edited by cursor Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What was wrong

Why it matters

How it was fixed

Tests

Notes for the reviewer

Uh oh!

chatgpt-codex-connector Bot commented Oct 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

cursor Bot commented Oct 19, 2026

Bugbot couldn't run - usage limit reached

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

PetrefiedThunder commented Oct 9, 2026 •

edited by cursor Bot

Loading

chatgpt-codex-connector Bot commented Oct 19, 2026 •

edited

Loading