threadwire 0.1.26 → 0.1.27
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +5 -0
- package/docs/isolated-provider-runtime.md +13 -1
- package/package.json +1 -1
package/CHANGELOG.md
CHANGED
|
@@ -2,6 +2,11 @@
|
|
|
2
2
|
|
|
3
3
|
## Unreleased
|
|
4
4
|
|
|
5
|
+
- Require `THREADWIRE_KIMI_E2E_OUTER_BROKER_HOST` for
|
|
6
|
+
`npm run test:kimi-isolated-runtime-e2e`, publish the outer broker on a
|
|
7
|
+
Docker-assigned host port, and verify that exact endpoint from a task-DinD
|
|
8
|
+
container before launching the isolated runtime.
|
|
9
|
+
|
|
5
10
|
- Enforce per-run worker mutation boundaries in isolated runtime. `threadwire run
|
|
6
11
|
--relay-write` accepts a closed `--mutation-policy <json>` with
|
|
7
12
|
`{worktreeEdit, commit, push, githubWrite}` booleans; omitted capabilities
|
|
@@ -315,7 +315,19 @@ state makes health and preflight fail closed with redacted errors.
|
|
|
315
315
|
### Kimi validation and rollback
|
|
316
316
|
|
|
317
317
|
Run `npm run test:kimi-isolated-runtime-e2e` from an approved Docker supervisor
|
|
318
|
-
boundary after supplying the documented immutable image variables
|
|
318
|
+
boundary after supplying the documented immutable image variables and an
|
|
319
|
+
explicit outer broker address:
|
|
320
|
+
|
|
321
|
+
```sh
|
|
322
|
+
THREADWIRE_KIMI_E2E_OUTER_BROKER_HOST='<outer-host-ipv4>' \
|
|
323
|
+
npm run test:kimi-isolated-runtime-e2e
|
|
324
|
+
```
|
|
325
|
+
|
|
326
|
+
Replace `<outer-host-ipv4>` with an IPv4 address on the outer Docker host that
|
|
327
|
+
the outer daemon can bind and containers created by the task DinD can reach.
|
|
328
|
+
The E2E asks Docker to allocate the published broker host port, inspects that
|
|
329
|
+
exact binding, and probes it from a throwaway task-DinD container; do not infer
|
|
330
|
+
the address from a default gateway or reserve a fixed host port. A real
|
|
319
331
|
account smoke must then cover fresh execution, capture of exactly one native
|
|
320
332
|
session ID, exact resume with that ID, an approved non-default alias if used,
|
|
321
333
|
Telegram DM/topic routing, cancellation, and confirmation that service logs and
|