Commit graph

20 commits

Author SHA1 Message Date
rcourtman
e3dba105a7 Build control-plane image with embedded frontend assets 2026-07-04 14:46:53 +01:00
rcourtman
48e1efece7 Use patched Go toolchain for v6 release 2026-06-14 18:22:26 +01:00
rcourtman
a17882458a Rename CP_TRIAL_ACTIVATION_PRIVATE_KEY to CP_ENTITLEMENT_SIGNING_PRIVATE_KEY in the provider MSP bundle
The variable signs hosted entitlement leases; the trial-activation name is
left over from the retired trial era and reads as trial machinery to an
operator generating their licensing root key. The provider MSP bundle has
no installed base yet, so the canonical rename is free today and frozen
the moment the first design partner installs.

- Control plane reads CP_ENTITLEMENT_SIGNING_PRIVATE_KEY first and falls
  back to CP_TRIAL_ACTIVATION_PRIVATE_KEY, so existing Pulse-hosted cloud
  deployments (deploy/cloud, hibernated snapshot) keep working unchanged.
- deploy/provider-msp (.env.example, compose, setup.sh), MSP.md, and the
  install-test pins use the canonical name; error messages name it too.
- deploy/cloud intentionally keeps the legacy name: that stack historically
  signed hosted trial activations, and its snapshot predates the rename.
2026-06-10 14:08:52 +01:00
rcourtman
1f84fd3dd0 Harden v6 upgrade release proofs 2026-06-03 17:07:25 +01:00
rcourtman
c7e50d5602 Harden provider-hosted MSP isolation
Broker provider control-plane Docker access through a socket proxy, remove broad host mounts, align audit and rate-limit proxy trust, harden tenant runtime containers, restrict workspace report logo paths, and update provider deploy guardrails.
2026-06-02 21:10:13 +01:00
rcourtman
d729461cad Harden provider MSP tenant isolation
- isolate provider MSP tenant runtimes onto per-client Docker networks
- add adversarial proofs for workspace cap races, handoff retargeting, and org-bound agent report retargeting
- pin provider deploy proof to start Traefik before tenant network creation
2026-06-02 17:34:10 +01:00
rcourtman
473a0ddee6 Add provider MSP tenant rollout upgrade proof 2026-06-02 16:45:03 +01:00
rcourtman
a0f2fcf1fe Add provider MSP upgrade runner 2026-06-02 16:19:51 +01:00
rcourtman
e86143f07f Surface provider MSP backup readiness 2026-06-02 16:02:04 +01:00
rcourtman
42fb8eed3f Publish provider MSP control-plane image 2026-06-02 15:51:21 +01:00
rcourtman
25febfbf82 Fix provider MSP compose mount identity 2026-06-02 15:25:05 +01:00
rcourtman
f68d0ae079 Add provider MSP first-time setup artifact 2026-06-02 15:18:11 +01:00
rcourtman
5505f930c6 Add provider MSP compose install proof runner 2026-06-02 15:06:49 +01:00
rcourtman
4c31fa88f3 Add provider MSP install proof 2026-06-02 14:50:36 +01:00
rcourtman
e5a7300aff Add provider MSP workspace recovery 2026-06-02 14:28:16 +01:00
rcourtman
a2e860dc8c Add provider MSP backup restore 2026-06-02 14:14:07 +01:00
rcourtman
c9f84c5192 Add provider MSP backup command 2026-06-02 14:03:19 +01:00
rcourtman
f128c0b8cd Add provider MSP status command 2026-06-02 13:33:27 +01:00
rcourtman
c9c415d7a6 Require license-backed provider MSP proof 2026-06-02 13:22:15 +01:00
rcourtman
5134e36c28 Add provider-hosted MSP install path 2026-06-02 12:11:35 +01:00