chore(sync): upstream protoAgent v0.16.0 — incl. roxy's own #595/#598 fixes#59

Merged

mabry1985 merged 21 commits into

mainfrom

chore/sync-upstream-v0160

Jun 6, 2026

Commits on Jun 6, 2026

docs: tighten for server/ package + config-driven identity (post #569-#572) (#579)

mabry1985
and
claude
authored
fix(deploy): launch the server/ package, not the deleted server.py (+ CI guard) (#580)
mabry1985
authored
security: default-bind 127.0.0.1; containers expose 0.0.0.0 explicitly (#581)

mabry1985
and
claude
authored
reliability: bound the LLM call (timeout + retries) + close the push client (#582)

mabry1985
and
claude
authored
security: default-on SSRF denylist for fetch_url + re-check redirects (#583)

mabry1985
and
claude
authored
deploy: wire the existing /healthz into a HEALTHCHECK + k8s probes (#584)

mabry1985
and
claude
authored
ci(release): make build-provenance attestation opt-in (fork-friendly) (#585)

mabry1985
and
claude
authored
ci: A2A live-smoke job — boot the real server vs a fake model, drive a turn (#586)

mabry1985
and
claude
authored
ci: enforce ruff + clean dead imports/vars (lint gate) (#587)

mabry1985
and
claude
authored
obs: audit log rotation + instance-scoping + tail reads; broaden redaction (#588)

mabry1985
and
claude
authored
data: WAL + busy_timeout on the telemetry/activity/inbox/beads stores (#589)

mabry1985
and
claude
authored
security: bearer-gate the operator/console + OpenAI-compat APIs (P0) (#591)

mabry1985
and
claude
authored
obs: A2A turn-outcome metrics for /metrics alerting (#592)

mabry1985
and
claude
authored
docs: fork upstream-sync guide — merge-not-squash + CHANGELOG merge=ours (closes #590) (#593)

mabry1985
and
claude
authored
feat(plugins): spawn CLI coding agents over ACP (code_with) — ADR 0024 (#596)

mabry1985
and
claude
authored
feat(coding_agent): by-kind permission policy + per-call consent gate — ADR 0024 (PR3) (#599)

mabry1985
and
claude
authored
feat(evals): requires_env skip + gated code_with delegation eval — ADR 0024 (PR4) (#600)

mabry1985
and
claude
authored
fix(mcp): a tool error degrades to a recoverable result, not a failed turn (#594) (#595)

authored
feat(a2a): opt-in deploy-time guard — refuse to start on a loopback card URL (#598)

authored
chore: release v0.16.0 (#601)

mabry1985
and
github-actions[bot]
authored
Merge remote-tracking branch 'upstream/main' into chore/sync-upstream-v0160
Josh (via Claude)
committed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(sync): upstream protoAgent v0.16.0 — incl. roxy's own #595/#598 fixes#59

chore(sync): upstream protoAgent v0.16.0 — incl. roxy's own #595/#598 fixes#59
mabry1985 merged 21 commits into
mainfrom
chore/sync-upstream-v0160

Commits on Jun 6, 2026

docs: tighten for server/ package + config-driven identity (post #569-#572) (#579)

fix(deploy): launch the server/ package, not the deleted server.py (+ CI guard) (#580)

security: default-bind 127.0.0.1; containers expose 0.0.0.0 explicitly (#581)

reliability: bound the LLM call (timeout + retries) + close the push client (#582)

security: default-on SSRF denylist for fetch_url + re-check redirects (#583)

deploy: wire the existing /healthz into a HEALTHCHECK + k8s probes (#584)

ci(release): make build-provenance attestation opt-in (fork-friendly) (#585)

ci: A2A live-smoke job — boot the real server vs a fake model, drive a turn (#586)

ci: enforce ruff + clean dead imports/vars (lint gate) (#587)

obs: audit log rotation + instance-scoping + tail reads; broaden redaction (#588)

data: WAL + busy_timeout on the telemetry/activity/inbox/beads stores (#589)

security: bearer-gate the operator/console + OpenAI-compat APIs (P0) (#591)

obs: A2A turn-outcome metrics for /metrics alerting (#592)

docs: fork upstream-sync guide — merge-not-squash + CHANGELOG merge=ours (closes #590) (#593)

feat(plugins): spawn CLI coding agents over ACP (code_with) — ADR 0024 (#596)

feat(coding_agent): by-kind permission policy + per-call consent gate — ADR 0024 (PR3) (#599)

feat(evals): requires_env skip + gated code_with delegation eval — ADR 0024 (PR4) (#600)

fix(mcp): a tool error degrades to a recoverable result, not a failed turn (#594) (#595)

feat(a2a): opt-in deploy-time guard — refuse to start on a loopback card URL (#598)

chore: release v0.16.0 (#601)

Merge remote-tracking branch 'upstream/main' into chore/sync-upstream-v0160