v1.6: audit-mode onboarding, managed audit window, agent tooling + WebSocket exec fallback#20

Merged

SoulKyu merged 148 commits into

masterfrom

v1.6-audit-onboarding

Jul 23, 2026

Commits on Jul 22, 2026

docs: start milestone v1.6 Audit-Mode Onboarding & cpg-Dedicated Agent Tooling
SoulKyu
committed
docs: synthesize v1.6 milestone research
SoulKyu
committed
docs: define milestone v1.6 requirements
SoulKyu
committed
docs: create milestone v1.6 roadmap (5 phases)
SoulKyu
committed
docs(20): research --include-audit verdict ingestion phase
SoulKyu
committed
docs(phase-20): add validation strategy
SoulKyu
committed
docs(20): create phase plan
SoulKyu
committed
test(20-01): add failing test for AUDIT diagnostic counter
SoulKyu
committed
feat(20-01): add includeAudit gate field and AUDIT diagnostic counter
SoulKyu
committed
test(20-01): add failing test for classification gate AUDIT widening
SoulKyu
committed
feat(20-01): widen classification gate to include AUDIT verdicts
SoulKyu
committed
docs(20-01): complete aggregator includeAudit gate + counter plan
SoulKyu
committed
docs(20-01): append self-check results to SUMMARY.md
SoulKyu
committed
merge: bring 20-01 aggregator includeAudit gate into master
SoulKyu
committed
docs(phase-20): update tracking after wave 1
SoulKyu
committed
feat(20-02): widen FlowSource interface + filter sites 1-4, thread IncludeAudit through pipeline
SoulKyu
committed
test(20-02): update 15 test-double locations for widened FlowSource interface
SoulKyu
committed
test(20-02): pin buildFilters widened output with 4 _WithAudit tests
SoulKyu
committed
docs(20-02): complete FlowSource interface widening + filter sites 1-4 plan
SoulKyu
committed
docs(20-02): append self-check results to SUMMARY.md
SoulKyu
committed
merge: bring 20-02 FlowSource interface widening into master
SoulKyu
committed
docs(phase-20): update tracking after wave 2
SoulKyu
committed
test(20-03): add with_audit.jsonl fixture (1 DROPPED + 1 AUDIT)
SoulKyu
committed
test(20-03): add pipeline_audit_test.go — 5 E2E tests for --include-audit
SoulKyu
committed
feat(20-04): register --include-audit CLI flag on generate/replay
SoulKyu
committed
feat(20-04): thread include_audit MCP arg through StartArgs to PipelineConfig
SoulKyu
committed
docs(20-03): complete include-audit E2E regression proof plan
SoulKyu
committed
docs(20-03): append self-check results to SUMMARY.md
SoulKyu
committed
merge: bring 20-03 include-audit E2E regression proof into master
SoulKyu
committed
docs(20-04): document --include-audit (Flags table) and include_audit (MCP)
SoulKyu
committed
docs(20-04): add plan summary
SoulKyu
committed
docs(20-04): append self-check results to SUMMARY.md
SoulKyu
committed
merge: bring 20-04 include-audit CLI/MCP surface into master
SoulKyu
committed
docs(phase-20): update tracking after wave 3
SoulKyu
committed
docs(20): add code review report
SoulKyu
committed
fix(20): surface AuditVerdictCount through SessionStats and StopResult (WR-01)
SoulKyu
committed
docs(20): mark WR-01 resolved in code review report
SoulKyu
committed
docs(20): add code review fix report
SoulKyu
committed
docs(phase-20): complete phase execution
SoulKyu
committed
docs(phase-20): evolve PROJECT.md after phase completion
SoulKyu
committed
docs(phase-20): add security threat verification
SoulKyu
committed
docs(21): research Cilium compatibility matrix + runtime detection
SoulKyu
committed
docs(phase-21): add validation strategy
SoulKyu
committed
docs(21): create phase plan (4 plans, 2 waves) for Cilium compat matrix + runtime detection
SoulKyu
committed
docs(21): finalize phase plan
SoulKyu
committed
docs(21-02): add Supported Cilium versions section, fix proxy-visibility boundary
SoulKyu
committed
test(21-02): add readme_compat_test.go golden consistency test
SoulKyu
committed
test(21-02): pin merged-PR citations in readme_compat_test.go
SoulKyu
committed
feat(21-01): add pkg/k8s/version.go Cilium version detection
SoulKyu
committed
docs(21-02): add plan 02 SUMMARY
SoulKyu
committed
docs(21-02): append self-check results to SUMMARY
SoulKyu
committed
merge: bring 21-02 supported-versions README + golden test into master
SoulKyu
committed
test(21-01): add pkg/k8s/version_test.go fake-clientset coverage
SoulKyu
committed
test(21-01): add TestParseAgentVersionString direct coverage
SoulKyu
committed
docs(21-01): complete Cilium version detection library plan
SoulKyu
committed
merge: bring 21-01 cilium version detection library into master
SoulKyu
committed
docs(phase-21): update tracking after wave 1
SoulKyu
committed
feat(21-03): add maybeRunVersionPreflight always-on preflight in generate.go
SoulKyu
committed
feat(21-04): add compat fields + detectVersionFn seam + resolveSetup wiring
SoulKyu
committed
test(21-03): guard replay.go against version detection
SoulKyu
committed
docs(21-03): add plan 03 SUMMARY
SoulKyu
committed
merge: bring 21-03 CLI version preflight into master
SoulKyu
committed
test(21-04): stub detectVersionFn seam, assert compat fields, prove wire round-trip
SoulKyu
committed
docs(21-04): add plan summary
SoulKyu
committed
merge: bring 21-04 MCP compat surfacing into master
SoulKyu
committed
docs(phase-21): update tracking after wave 2
SoulKyu
committed
docs(21): add code review report
SoulKyu
committed
fix(21): WR-01 bound CLI version preflight and suppress Ctrl+C warn
SoulKyu
committed
fix(21): WR-02 bound GetNodes RPC with versionDetectTimeout budget
SoulKyu
committed
docs(21): WR-03 clarify featureFloors covers floors only, ceiling is doc-only
SoulKyu
committed
docs(21): add code review fix report
SoulKyu
committed
docs(22): smart discuss context
SoulKyu
committed
docs(22): research + patterns + context correction (empty-rule stanza form)
SoulKyu
committed
docs(22): add phase plans, validation strategy, checker fixes + state update
SoulKyu
committed
feat(22-01): add BuildBootstrapPolicy default-deny CNP constructor
SoulKyu
committed
test(22-01): add named cilium#35558 default-deny acceptance test
SoulKyu
committed
docs(22-03): add bootstrap + audit-onboarding runbook with golden test
SoulKyu
committed
docs(22-03): cross-reference enableDefaultDeny compat row to cpg bootstrap
SoulKyu
committed
docs(22-01): complete bootstrap CNP builder plan
SoulKyu
committed
docs(22-03): add plan summary
SoulKyu
committed
merge: bring 22-01 bootstrap builder into master
SoulKyu
committed
merge: bring 22-03 runbook + README compat docs into master
SoulKyu
committed
feat(22-02): add cpg bootstrap CLI command + version gate
SoulKyu
committed
feat(22-02): add readonly get_bootstrap_policy MCP tool
SoulKyu
committed
fix(22-02): update pinned MCP tool-count tests for get_bootstrap_policy
SoulKyu
committed
docs(22-02): add plan summary
SoulKyu
committed
merge: bring 22-02 bootstrap CLI + MCP tool into master
SoulKyu
committed
fix(22-02): make cpg bootstrap stdout-only, restoring zero new SEC-01 allowlist entries
SoulKyu
committed
docs(22): add code review report
SoulKyu
committed
fix(22): review fixes — runbook -o drift + DNS-1123 namespace validation on both surfaces
SoulKyu
committed
docs(22): add code review fix report
SoulKyu
committed
docs(22): verification passed — mark phase 22 complete, sync traceability
SoulKyu
committed
docs(23): record AUD-03 CLI-only surface decision (user gate approval)
SoulKyu
committed
docs(23): smart discuss context (CLI-only surface per user gate decision)
SoulKyu
committed
docs(23): research + patterns
SoulKyu
committed
docs(23): validation strategy
SoulKyu
committed
docs(23): add phase plans + checker fixes, update state
SoulKyu
committed
feat(23-01): add SPDY exec primitive + node-to-agent-pod mapping
SoulKyu
committed
feat(23-01): add read-before-flip, canonical flip, binary gate, daemon precondition
SoulKyu
committed
docs(23-01): add plan summary
SoulKyu
committed
merge: bring 23-01 exec plumbing into master
SoulKyu
committed
feat(23-02): add auditwindow.Manager scaffold + Open precondition/flip/UID bookkeeping
SoulKyu
committed
feat(23-02): add bounded revert fan-out for Close/Shutdown with per-endpoint reporting
SoulKyu
committed
feat(23-02): add new-endpoint watcher with bounded-backoff reconnect
SoulKyu
committed
docs(23-02): complete pkg/auditwindow Manager plan
SoulKyu
committed
merge: bring 23-02 auditwindow Manager into master
SoulKyu
committed
docs(23): README readonly-by-default + audit-window RBAC
SoulKyu
committed
feat(23): add cpg audit-window command
SoulKyu
committed
docs(23): runbook wires cpg audit-window + honest race
SoulKyu
committed
docs(23-04): add plan summary
SoulKyu
committed
test(23): SEC-01 tripwire proving exec path unreachable from MCP
SoulKyu
committed
docs(23-03): add plan summary
SoulKyu
committed
docs(23-03): append self-check results to plan summary
SoulKyu
committed
merge: bring 23-03 audit-window CLI + SEC-01 tripwire into master
SoulKyu
committed
merge: bring 23-04 README/runbook honesty docs into master
SoulKyu
committed
docs(23): add code review report
SoulKyu
committed
fix(23): CR-01/CR-02/WR-01 route audit-window revert through bounded Shutdown
SoulKyu
committed
fix(23): WR-02/WR-03 harden SEC-01 exec tripwire negative half
SoulKyu
committed
fix(23): report possibly-stuck endpoints when revert deadline expires
SoulKyu
committed
docs(23): add code review fix report (2 iterations)
SoulKyu
committed
docs(23): verification passed — mark phase 23 complete, sync tracking
SoulKyu
committed
docs(24): smart discuss context
SoulKyu
committed
docs(24): research + validation strategy
SoulKyu
committed
docs(24): add phase plans
SoulKyu
committed
feat(24): add cpg-operator agent + cpg-triage skill
SoulKyu
committed
feat(24): add cpg-audit-onboard + cpg-policy-review skills
SoulKyu
committed
feat(24): add cpg-health-report + cpg-mcp-smoke skills + README agent tooling
SoulKyu
committed
docs(24-01): add plan summary
SoulKyu
committed
merge: bring 24-01 skills + agent + README section into master
SoulKyu
committed
test(24): add skills/agent consistency tripwire
SoulKyu
committed
docs(24-02): add plan summary
SoulKyu
committed
merge: bring 24-02 consistency tripwire into master
SoulKyu
committed
fix(24): correct nonexistent 'cpg explain --output json' flag to --json (skill + tool descriptions)
SoulKyu
committed
docs(24): add code review fix report
SoulKyu
committed
fix(24): correct remaining --output json reference in README MCP table
SoulKyu
committed
docs(24): verification passed — mark phase 24 and all v1.6 phases complete
SoulKyu
committed
docs: close v1.6 audit doc-drift — README MCP table 9th tool row + REQUIREMENTS bookkeeping
SoulKyu
committed
docs(v1.6): milestone audit — passed
SoulKyu
committed
chore: archive v1.6 milestone
SoulKyu
committed
chore: archive v1.6 phase directories to milestones/v1.6-phases/
SoulKyu
committed

Commits on Jul 23, 2026

docs(quick): plan websocket-exec-fallback (AUD-FUT-01)
SoulKyu
committed
feat(quick): use WebSocket exec with SPDY fallback in audit-window exec path
SoulKyu
committed
test(quick): extend SEC-01 exec tripwire to WebSocket + fallback constructors
SoulKyu
committed
docs(quick): note WebSocket-first exec transport in README
SoulKyu
committed
docs(quick): websocket-exec-fallback summary
SoulKyu
committed
docs(quick): track websocket-exec-fallback completion (AUD-FUT-01 shipped)
SoulKyu
committed
fix: resolve new lint findings (errcheck Fprintln, QF1008 embedded ObjectMeta, QF1001 De Morgan)
SoulKyu
committed
docs: recommend audit-window-first order for live-traffic onboarding (zero real drops) + README onboarding section
SoulKyu
committed