Mark/mesh-seed
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

AUTH-006: Request Signing #142

New issue
Closed
opened 2026-04-11 05:48:39 +00:00 by Mark · 6 comments
Mark commented 2026-04-11 05:48:39 +00:00
Owner
Copy link

Required

  • HMAC-SHA256 signatures
  • Timestamp validation (prevent replay)
  • Webhook signature verification
  • Client SDK support

Acceptance Criteria

  • Signatures validated
  • Reject expired timestamps (>5min)
  • Webhook verification works
  • Python SDK implements signing
## Required - HMAC-SHA256 signatures - Timestamp validation (prevent replay) - Webhook signature verification - Client SDK support ## Acceptance Criteria - [ ] Signatures validated - [ ] Reject expired timestamps (>5min) - [ ] Webhook verification works - [ ] Python SDK implements signing
Mark commented 2026-05-21 04:54:07 +00:00
Author
Owner
Copy link

GSD VERIFY phase failed after 3 attempts.
═══ Gate: verify-passed (mesh-seed#142) ═══
Mode: Tier 1 (functional only)

GATE OK: All gates up to 'implement' pass
── Tier 1: Functional ────────────────────────────────
Running tests...
❌ Tests failed (exit 1)
============================= test session starts ==============================
platform linux -- Python 3.11.14, pytest-8.3.5, pluggy-1.6.0
rootdir: /home/b/Projects/mesh-seed
configfile: pytest.ini
plugins: asyncio-1.3.0, anyio-4.13.0, httpx-0.36.2, timeout-2.4.0, xdist-3.8.0, cov-7.1.0, split-0.11.0
asyncio: mode=Mode.STRICT, debug=False, asyncio_default_fixture_loop_scope=None, asyncio_default_test_loop_scope=function
collected 375 items

tests/e2e/test_mesh_node_e2e.py F

=================================== FAILURES ===================================
_____________ TestMeshNodeEndToEnd.test_full_intent_to_result_flow _____________
tests/e2e/test_mesh_node_e2e.py:232: in test_full_intent_to_result_flow
assert worker_info is not None, "Worker not found in spawner tracking"
E AssertionError: Worker not found in spawner tracking
E assert None is not None
=========================== short test summary info ============================
FAILED tests/e2e/test_mesh_node_e2e.py::TestMeshNodeEndToEnd::test_full_intent_to_result_flow
!!!!!!!!!!!!!!!!!!!!!!!!!! stopping after 1 failures !!!!!!!!!!!!!!!!!!!!!!!!!!!
============================== 1 failed in 0.53s ===============================
Running linter...
✅ Lint clean
Running type checker...
✅ Types check clean
Previous test count: unknown

❌ GATE FAIL: verify-passed
- Tests failed with exit code 1
GATE FAIL: verify — blocked at 2026-05-21T04:54:07Z
Class: test-failure
Evidence: Verification failed: 1 failures
Git tag: mesh-seed#142-gate-verify-fail-34afaa537002 (use gate-retry after fixing)

GSD VERIFY phase failed after 3 attempts. ═══ Gate: verify-passed (mesh-seed#142) ═══ Mode: Tier 1 (functional only) GATE OK: All gates up to 'implement' pass ── Tier 1: Functional ──────────────────────────────── Running tests... ❌ Tests failed (exit 1) ============================= test session starts ============================== platform linux -- Python 3.11.14, pytest-8.3.5, pluggy-1.6.0 rootdir: /home/b/Projects/mesh-seed configfile: pytest.ini plugins: asyncio-1.3.0, anyio-4.13.0, httpx-0.36.2, timeout-2.4.0, xdist-3.8.0, cov-7.1.0, split-0.11.0 asyncio: mode=Mode.STRICT, debug=False, asyncio_default_fixture_loop_scope=None, asyncio_default_test_loop_scope=function collected 375 items tests/e2e/test_mesh_node_e2e.py F =================================== FAILURES =================================== _____________ TestMeshNodeEndToEnd.test_full_intent_to_result_flow _____________ tests/e2e/test_mesh_node_e2e.py:232: in test_full_intent_to_result_flow assert worker_info is not None, "Worker not found in spawner tracking" E AssertionError: Worker not found in spawner tracking E assert None is not None =========================== short test summary info ============================ FAILED tests/e2e/test_mesh_node_e2e.py::TestMeshNodeEndToEnd::test_full_intent_to_result_flow !!!!!!!!!!!!!!!!!!!!!!!!!! stopping after 1 failures !!!!!!!!!!!!!!!!!!!!!!!!!!! ============================== 1 failed in 0.53s =============================== Running linter... ✅ Lint clean Running type checker... ✅ Types check clean Previous test count: unknown ❌ GATE FAIL: verify-passed - Tests failed with exit code 1 GATE FAIL: verify — blocked at 2026-05-21T04:54:07Z Class: test-failure Evidence: Verification failed: 1 failures Git tag: mesh-seed#142-gate-verify-fail-34afaa537002 (use gate-retry after fixing)
Mark commented 2026-06-20 20:45:39 +00:00
Author
Owner
Copy link

Triage: decompose failed

Triage pipeline could not create a sub-issue for auto-decomposition (API error or repo permissions). Marking this blocked:needs-decision to prevent re-evaluation. Remove the label to retry.

## Triage: decompose failed Triage pipeline could not create a sub-issue for auto-decomposition (API error or repo permissions). Marking this `blocked:needs-decision` to prevent re-evaluation. Remove the label to retry.
Mark commented 2026-09-18 15:39:14 +00:00
Author
Owner
Copy link

kilo-gsd dispatch blocked on lint-cleanup prerequisite

This issue was queued on the fixit board for kilo-gsd to implement AUTH-006 Request Signing (HMAC-SHA256 + timestamp/replay protection + webhook verification + Python SDK signing).

However, the dispatch failed at kilo-gsd preflight: Mark/mesh-seed has 27,444 ruff lint errors on origin/master, and kilo-gsd refuses to dispatch on any issue in a repo with a dirty lint baseline. The whole-repo lint cleanup must complete first; this is a separate scope from #142 and needs its own initiative.

Once ruff check . exits 0 on Mark/mesh-seed's default branch, the kilo-gsd fixit pipeline can resume and #142 will be re-dispatched. Kanban card t_21a02d33 is blocked on capability grounds; the launcher log is at ~/.hermes/logs/kilo-monitor/mesh-seed-142.log.

Reference: launcher-failure on t_21a02d33 at 2026-09-18 08:37 PDT.

**kilo-gsd dispatch blocked on lint-cleanup prerequisite** This issue was queued on the fixit board for kilo-gsd to implement AUTH-006 Request Signing (HMAC-SHA256 + timestamp/replay protection + webhook verification + Python SDK signing). However, the dispatch failed at kilo-gsd preflight: `Mark/mesh-seed` has **27,444 ruff lint errors** on origin/master, and kilo-gsd refuses to dispatch on any issue in a repo with a dirty lint baseline. The whole-repo lint cleanup must complete first; this is a separate scope from #142 and needs its own initiative. Once `ruff check .` exits 0 on `Mark/mesh-seed`'s default branch, the kilo-gsd fixit pipeline can resume and #142 will be re-dispatched. Kanban card t_21a02d33 is blocked on capability grounds; the launcher log is at `~/.hermes/logs/kilo-monitor/mesh-seed-142.log`. Reference: launcher-failure on t_21a02d33 at 2026-09-18 08:37 PDT.
Mark commented 2026-09-18 23:32:41 +00:00
Author
Owner
Copy link

Launcher for t_bd0162c4 attempted dispatch at 2026-09-18 16:31:47; kilo-gsd preflight ruff check . exited 1 with 1549 unique errors in /home/b/Projects/mesh-seed. The runner hard-gates every kilo dispatch on clean lint per kilo-gsd.py:1805-1859, so #142 is held pending a lint-cleanup. The runner tried to open a lint-cleanup issue but Mark/mesh-seed has no lint-cleanup label definition (HTTP 422 on POST /repos/.../issues). Resolution requires: (1) seed lint-cleanup + blocked:preflight labels on Mark/mesh-seed, (2) land a separate lint-cleanup fixit — either fix all 1549 errors or add a [tool.ruff] per-file-ignore block to pyproject.toml to scope the pre-existing debt without behavior change. Once ruff check . exits 0, the dispatcher can resume t_bd0162c4 against this issue with the AUTH-006 plan and the hardened verify contract (5 items: HEAD commit with #142/AUTH-006 in subject, HMAC code in substrate/request_signing.py AND sdk/python/mesh_client/signing.py AND runtime/callback_dispatcher.py, pytest passes on the four named test files with named classes, no rc=0-wrapper-around-self-block sequence in monitor log, fresh gate-* tag pointing at the AUTH-006 commit not 34afaa5370).

Launcher for t_bd0162c4 attempted dispatch at 2026-09-18 16:31:47; kilo-gsd preflight `ruff check .` exited 1 with 1549 unique errors in /home/b/Projects/mesh-seed. The runner hard-gates every kilo dispatch on clean lint per kilo-gsd.py:1805-1859, so #142 is held pending a lint-cleanup. The runner tried to open a `lint-cleanup` issue but Mark/mesh-seed has no `lint-cleanup` label definition (HTTP 422 on POST /repos/.../issues). Resolution requires: (1) seed `lint-cleanup` + `blocked:preflight` labels on Mark/mesh-seed, (2) land a separate lint-cleanup fixit — either fix all 1549 errors or add a `[tool.ruff]` per-file-ignore block to pyproject.toml to scope the pre-existing debt without behavior change. Once `ruff check .` exits 0, the dispatcher can resume t_bd0162c4 against this issue with the AUTH-006 plan and the hardened verify contract (5 items: HEAD commit with #142/AUTH-006 in subject, HMAC code in substrate/request_signing.py AND sdk/python/mesh_client/signing.py AND runtime/callback_dispatcher.py, pytest passes on the four named test files with named classes, no rc=0-wrapper-around-self-block sequence in monitor log, fresh gate-* tag pointing at the AUTH-006 commit not 34afaa537002).
Mark commented 2026-09-19 19:31:04 +00:00
Author
Owner
Copy link

Substrate-fix landed: ruff check . exits 0 against origin/master HEAD (commit 88ff834). This unblocks kilo-gsd preflight (kilo-gsd.py:1805-1859) for this repo — Mark/mesh-seed#142 (AUTH-006), #285, and ~all held tickets can now dispatch.

Verification on the merged commit:

  • ruff check . → "All checks passed!"
  • pytest tests/unit/ → 1900 passed / 6 skipped / 23 pre-existing errors (huggingface-hub version mismatch in test_embedding_*) — IDENTICAL to origin/master baseline, no NEW failures.
  • Diff is style/safety fixes only: import sort (I001), multi-line import splitting, removal of now-unnecessary # noqa: E402 markers once imports were properly sectioned. No runtime/test semantics changed.

Kilo-gsd-runner card: t_c0dcb82a. Downstream #142 card (t_bd0162c4) will auto-promote on next dispatcher tick.

🤖 Generated with kilo-gsd-runner

**Substrate-fix landed**: `ruff check .` exits 0 against origin/master HEAD (commit 88ff834). This unblocks kilo-gsd preflight (kilo-gsd.py:1805-1859) for this repo — Mark/mesh-seed#142 (AUTH-006), #285, and ~all held tickets can now dispatch. Verification on the merged commit: - `ruff check .` → "All checks passed!" - `pytest tests/unit/` → 1900 passed / 6 skipped / 23 pre-existing errors (huggingface-hub version mismatch in test_embedding_*) — IDENTICAL to origin/master baseline, no NEW failures. - Diff is style/safety fixes only: import sort (I001), multi-line import splitting, removal of now-unnecessary `# noqa: E402` markers once imports were properly sectioned. **No runtime/test semantics changed.** Kilo-gsd-runner card: t_c0dcb82a. Downstream #142 card (t_bd0162c4) will auto-promote on next dispatcher tick. 🤖 Generated with kilo-gsd-runner
Mark commented 2026-09-21 03:09:30 +00:00
Author
Owner
Copy link

AUTH-006 landed — closing #142

HMAC-SHA256 request signing shipped via PR #304 → commit 07b1f89 (merged as 28c2cb8).

5-item verify contract verdict:

# Item Result
1 Commit subject references #142 + AUTH-006 PASS — feat(#142): AUTH-006 HMAC-SHA256 request signing (sign, verify, replay window)
2 HMAC matches in substrate/request_signing.py + sdk/python/mesh_client/signing.py + runtime/callback_dispatcher.py PASS
3 pytest tests/unit/test_request_signing.py tests/unit/test_webhook_handler.py tests/unit/test_callback_dispatcher.py sdk/python/tests/test_client.py → exit 0 PASS — 112 tests pass, all 4 named classes (TestRequestSigning, TestVerifySignatureTimestamp, TestCallbackDispatcher, TestRequestSigner) collected and green
4 No Verify FAILED → Verify gates PASSED sequence in monitor log PASS — vacuous (monitor never reached verify phase; landed via sibling runner)
5 New mesh-seed#142-gate-* tag pointing at AUTH-006 commit PASS — mesh-seed#142-gate-verify-pass-07b1f89 pushed at 07b1f89

Closes #142.

## AUTH-006 landed — closing #142 HMAC-SHA256 request signing shipped via PR #304 → commit `07b1f89` (merged as `28c2cb8`). **5-item verify contract verdict:** | # | Item | Result | |---|------|--------| | 1 | Commit subject references `#142` + `AUTH-006` | PASS — `feat(#142): AUTH-006 HMAC-SHA256 request signing (sign, verify, replay window)` | | 2 | HMAC matches in `substrate/request_signing.py` + `sdk/python/mesh_client/signing.py` + `runtime/callback_dispatcher.py` | PASS | | 3 | `pytest tests/unit/test_request_signing.py tests/unit/test_webhook_handler.py tests/unit/test_callback_dispatcher.py sdk/python/tests/test_client.py` → exit 0 | PASS — 112 tests pass, all 4 named classes (TestRequestSigning, TestVerifySignatureTimestamp, TestCallbackDispatcher, TestRequestSigner) collected and green | | 4 | No `Verify FAILED` → `Verify gates PASSED` sequence in monitor log | PASS — vacuous (monitor never reached verify phase; landed via sibling runner) | | 5 | New `mesh-seed#142-gate-*` tag pointing at AUTH-006 commit | PASS — `mesh-seed#142-gate-verify-pass-07b1f89` pushed at `07b1f89` | Closes #142.
Mark closed this issue 2026-09-21 03:09:30 +00:00
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
mesh-seed#142-gate-verify-pass-07b1f89
Labels
Clear labels   
blocked:children

   
blocked:commit-ready-failed

   
blocked:depends-231

Depends on #231 (Discord Bot Foundation) landing first. Do not pick until #231 is closed.

  
blocked:depends-236

Depends on #236 (Phase 1) landing first. Do not pick until #236 is closed.

  
blocked:depends-237

Depends on #237 (Phase 2) landing first. Do not pick until #237 is closed.

  
blocked:depends-238

Depends on #238 (Phase 3) landing first. Do not pick until #238 is closed.

  
blocked:depends-239

Depends on #239 (Phase 4) landing first. Do not pick until #239 is closed.

  
blocked:gate-fetch

   
blocked:gate-fetch

   
blocked:gate-lint

   
blocked:gate-research

   
blocked:needs-attention

Janitor escalated: pipeline terminated without producing expected changes. Human review required.

  
blocked:needs-decision

   
blocked:no-changes

   
blocked:no-procedure

   
blocked:preflight

Preflight check failed

  
blocked:verify-failed

   
bug

Something is broken

  
enhancement

New feature or request

  
feature-request

   
high-priority

Critical path items

  
in-progress

Issue is currently being worked on by a quickfix runner

  
lint-cleanup

Repo lint baseline is dirty

  
needs-decompose

   
needs-triage

   
ops-retry

   
ops-task

Operations task — install, configure, deploy, API calls

  
phase-5

Phase 5 Self-Building Infrastructure

  
quickfix

Pipe to opencode for direct fix

  
security/medium

Medium severity security issue

  
self-building

Autonomous code generation and self-improvement

  
triage-approved

Approved by triage — queued for fixer pipeline

No labels
blocked:children
blocked:commit-ready-failed
blocked:depends-231
blocked:depends-236
blocked:depends-237
blocked:depends-238
blocked:depends-239
blocked:gate-fetch
blocked:gate-fetch
blocked:gate-lint
blocked:gate-research
blocked:needs-attention
blocked:needs-decision
blocked:no-changes
blocked:no-procedure
blocked:preflight
blocked:verify-failed
bug
enhancement
feature-request
high-priority
in-progress
lint-cleanup
needs-decompose
needs-triage
ops-retry
ops-task
phase-5
quickfix
security/medium
self-building
triage-approved
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
Mark/mesh-seed#142
No description provided.