Strict mode: judge sealed paths by their set's index; seal runs in strict mode by abrichr · Pull Request #1815 · OpenAdaptAI/OpenAdapt

fix: strict mode runs other sealed-ready commands on encrypted input only; read-only key resolver; post-run reports survive a ledger failure

abrichr

committed

78cd244

fix: strict mode resolves symlinks and plaintext copies inside sealed sets; seal runs in strict mode; clearer kept-report message

abrichr

committed

bc81415

fix: strict sealed-path check reads the set's header and index; refuse unresolved symlink arguments

abrichr

committed

8a2286b

test: planted plaintext, plaintext crops and broken links inside a sealed set

abrichr

committed

350dc82

test: Desktop notice queries and the compile-agent e2e use a test scrubber

abrichr

committed

03a34a8

Merge main

abrichr

committed

7e5e49b

Merge #1755 head

abrichr

committed

b3a93c1

Stat every string in the strict plaintext-input check

abrichr

committed

d2cbbec

Navigation Menu

Repository navigation

Strict mode: judge sealed paths by their set's index; seal runs in strict mode - #1815

Strict mode: judge sealed paths by their set's index; seal runs in strict mode#1815
abrichr wants to merge 15 commits into
mainfrom
fix/at-rest-followups

Commits on Nov 3, 2026

feat: encrypt recordings, bundles and checkpoints at rest by default

chore(desktop): release 0.26.0

fix: at-rest review fixes: recording key, missing-key error, mode check, strict gates

fix: interim at-rest policy: checkpoints by default, everything in strict mode

fix: bundle reads use the recording-only key; tests for redacted agent screenshots

style: ruff format

fix: at-rest review: strict allow-list, sealed runs for sealed bundles, deployment-key commands, ledger failures stop writes

Commits on Nov 4, 2026

fix: strict mode runs other sealed-ready commands on encrypted input only; read-only key resolver; post-run reports survive a ledger failure

fix: strict mode resolves symlinks and plaintext copies inside sealed sets; seal runs in strict mode; clearer kept-report message

fix: strict sealed-path check reads the set's header and index; refuse unresolved symlink arguments

test: planted plaintext, plaintext crops and broken links inside a sealed set

test: Desktop notice queries and the compile-agent e2e use a test scrubber

Merge main

Merge #1755 head

Stat every string in the strict plaintext-input check