From c8c334a26f9028bf061067195c4172ca79e5f3d2 Mon Sep 17 00:00:00 2001 From: Antoine Toussaint <312536060+antoinetoussaint-byte@users.noreply.github.com> Date: Fri, 30 Oct 2026 20:09:58 -0400 Subject: [PATCH 1/6] chore(agents): go-grpc 0.1.72, so a process receives each configuration variable once go-grpc 0.1.58 put a native service's environment on the runner environment and handed it to the process again, so every configuration variable arrived twice; platform-core's gate refused saas/accounts with a 992,926-byte environment. go-grpc 0.1.72 (service-go-grpc#220) delivers it once. `codefly update workspace` moved accounts and auth-gateway to 0.1.72. It also moved nextjs and postgres; those moves are left for their own change. 0.1.72's Sync keeps a custom-adapter service's marked main.go current and renders plugins/registry_gen.go from plugins/plugins.yaml only with the full scaffold. Accounts has no single AccountsService, so 0.1.58 never touched either file, and both are hand-maintained (main serves the module authority listener and finishes work wiring before any listener opens). Say so: main.go drops the generated-code marker, the registry becomes plugins/registry.go, and the plugins.yaml no agent ever read (it used `import:`) is deleted. Sync is now clean for both services. Runnables regenerated: the three accounts runnable packages record the agent version, so their digests move. Contracts and generated libraries unchanged. Co-Authored-By: Claude Fable 5.1 --- module/AGENTS.md | 2 +- .../runnable-package.json | 2 +- .../runnable-package.json | 2 +- .../ReconcileSource/runnable-package.json | 2 +- module/contracts/runnables/index.json | 6 ++--- module/services/accounts/code/main.go | 24 +++++-------------- .../code/pkg/permissionsplugin/plugin.go | 14 ++++------- .../accounts/code/plugins/plugins.yaml | 8 ------- .../plugins/{registry_gen.go => registry.go} | 12 +++++----- module/services/accounts/service.codefly.yaml | 5 +++- .../auth-gateway/service.codefly.yaml | 2 +- 11 files changed, 28 insertions(+), 51 deletions(-) delete mode 100644 module/services/accounts/code/plugins/plugins.yaml rename module/services/accounts/code/plugins/{registry_gen.go => registry.go} (61%) diff --git a/module/AGENTS.md b/module/AGENTS.md index 60c64480e..024b6ee59 100644 --- a/module/AGENTS.md +++ b/module/AGENTS.md @@ -95,7 +95,7 @@ together. Accounts and auth-gateway use released SDK v0.4.1, which owns tracing startup and shutdown. Never ship a host release on an untagged Core candidate: these services move to a tagged Core that contains that commit before one. Run qualification with `GOWORK=off` so a workspace cannot mask the pins. -Accounts requires Go 1.27.3. All go-grpc services pin released agent 0.1.58, +Accounts requires Go 1.27.3. All go-grpc services pin released agent 0.1.72, whose builder uses Go 1.27.3 under `GOTOOLCHAIN=local`; CI uses the same patch. Go 1.27.0 is affected by [GO-2026-6613](https://pkg.go.dev/vuln/GO-2026-6613), and Go 1.27.2 by [GO-2026-6809](https://pkg.go.dev/vuln/GO-2026-6809). diff --git a/module/contracts/runnables/accounts/connect/InvokeSourceOperation/runnable-package.json b/module/contracts/runnables/accounts/connect/InvokeSourceOperation/runnable-package.json index c7af8ad79..5d993d840 100644 --- a/module/contracts/runnables/accounts/connect/InvokeSourceOperation/runnable-package.json +++ b/module/contracts/runnables/accounts/connect/InvokeSourceOperation/runnable-package.json @@ -1 +1 @@ -{"agent":{"kind":"SERVICE","name":"go-grpc","publisher":"codefly.dev","version":"0.1.58"},"contract":{"input":{"fields":[{"name":"orgId","optional":true,"type":"STRING"},{"name":"sourceId","optional":true,"type":"STRING"},{"name":"operation","optional":true,"type":"STRING"},{"name":"inputJson","optional":true,"type":"STRING"},{"name":"effectId","optional":true,"type":"STRING"},{"name":"expectedDeclarationDigest","optional":true,"type":"STRING"}]},"output":{"fields":[{"name":"outputJson","optional":true,"type":"STRING"},{"fields":[{"name":"effectId","optional":true,"type":"STRING"},{"name":"committedAt","optional":true,"type":"STRING"},{"name":"status","optional":true,"type":"STRING"},{"name":"providerStatus","optional":true,"type":"INTEGER"},{"name":"outputJson","optional":true,"type":"STRING"}],"name":"receipt","optional":true,"type":"OBJECT"}]},"protocol":"codefly.runnable.service/v1"},"digest":"21ee90ad38e4da6ac0d27d75ebc866a26e2ccf2c3bba34ecd9208c3210faafe8","execution":{"cancellation":"CANCELLATION_NONE","completion":"COMPLETION_CALL","facilities":[{"kind":"SERVICE"}],"max_input_bytes":"65536","max_output_bytes":"1048576","recovery":"RECOVERY_RECEIPT","timeout":"600s"},"identity":{"module":"saas-starter","name":"accounts-connect-invoke-source-operation","version":"0.2.0","workspace":"saas-starter-dev"},"schema":"codefly.runnable-package/v1","service_operations":[{"adaptation":"ADAPTATION_BOUNDED_JSON_V1","endpoint":"connect","input_message":"saas.accounts.v1.InvokeSourceOperationRequest","module":"saas-starter","name":"accounts","operation":"/saas.accounts.v1.DatasourceService/InvokeSourceOperation","output_message":"saas.accounts.v1.InvokeSourceOperationResponse"}]} +{"agent":{"kind":"SERVICE","name":"go-grpc","publisher":"codefly.dev","version":"0.1.72"},"contract":{"input":{"fields":[{"name":"orgId","optional":true,"type":"STRING"},{"name":"sourceId","optional":true,"type":"STRING"},{"name":"operation","optional":true,"type":"STRING"},{"name":"inputJson","optional":true,"type":"STRING"},{"name":"effectId","optional":true,"type":"STRING"},{"name":"expectedDeclarationDigest","optional":true,"type":"STRING"}]},"output":{"fields":[{"name":"outputJson","optional":true,"type":"STRING"},{"fields":[{"name":"effectId","optional":true,"type":"STRING"},{"name":"committedAt","optional":true,"type":"STRING"},{"name":"status","optional":true,"type":"STRING"},{"name":"providerStatus","optional":true,"type":"INTEGER"},{"name":"outputJson","optional":true,"type":"STRING"}],"name":"receipt","optional":true,"type":"OBJECT"}]},"protocol":"codefly.runnable.service/v1"},"digest":"77e2b2a2c13a0a4d215cfb94c406b1b878102816127bae7b51bee5fc769d8b31","execution":{"cancellation":"CANCELLATION_NONE","completion":"COMPLETION_CALL","facilities":[{"kind":"SERVICE"}],"max_input_bytes":"65536","max_output_bytes":"1048576","recovery":"RECOVERY_RECEIPT","timeout":"600s"},"identity":{"module":"saas-starter","name":"accounts-connect-invoke-source-operation","version":"0.2.0","workspace":"saas-starter-dev"},"schema":"codefly.runnable-package/v1","service_operations":[{"adaptation":"ADAPTATION_BOUNDED_JSON_V1","endpoint":"connect","input_message":"saas.accounts.v1.InvokeSourceOperationRequest","module":"saas-starter","name":"accounts","operation":"/saas.accounts.v1.DatasourceService/InvokeSourceOperation","output_message":"saas.accounts.v1.InvokeSourceOperationResponse"}]} diff --git a/module/contracts/runnables/accounts/connect/PruneSourceOperationReceipts/runnable-package.json b/module/contracts/runnables/accounts/connect/PruneSourceOperationReceipts/runnable-package.json index 0be0280c5..d04322bd5 100644 --- a/module/contracts/runnables/accounts/connect/PruneSourceOperationReceipts/runnable-package.json +++ b/module/contracts/runnables/accounts/connect/PruneSourceOperationReceipts/runnable-package.json @@ -1 +1 @@ -{"agent":{"kind":"SERVICE","name":"go-grpc","publisher":"codefly.dev","version":"0.1.58"},"contract":{"input":{"fields":[{"name":"orgId","optional":true,"type":"STRING"},{"name":"sourceId","optional":true,"type":"STRING"},{"name":"effectId","optional":true,"type":"STRING"}]},"output":{"fields":[{"name":"effectId","optional":true,"type":"STRING"},{"format":"int64","name":"receipts","optional":true,"type":"STRING"},{"name":"status","optional":true,"type":"STRING"}]},"protocol":"codefly.runnable.service/v1"},"digest":"c86b2550cb0510641dafb788697238cbfc44dad34ec27eaf18abdd270f3bc9f1","execution":{"cancellation":"CANCELLATION_NONE","completion":"COMPLETION_CALL","facilities":[{"kind":"SERVICE"}],"max_input_bytes":"4096","max_output_bytes":"4096","recovery":"RECOVERY_RECEIPT","timeout":"600s"},"identity":{"module":"saas-starter","name":"accounts-connect-prune-source-operation-receipts","version":"0.2.0","workspace":"saas-starter-dev"},"schema":"codefly.runnable-package/v1","service_operations":[{"adaptation":"ADAPTATION_BOUNDED_JSON_V1","endpoint":"connect","input_message":"saas.accounts.v1.PruneSourceOperationReceiptsRequest","module":"saas-starter","name":"accounts","operation":"/saas.accounts.v1.DatasourceService/PruneSourceOperationReceipts","output_message":"saas.accounts.v1.PruneSourceOperationReceiptsResponse"}]} +{"agent":{"kind":"SERVICE","name":"go-grpc","publisher":"codefly.dev","version":"0.1.72"},"contract":{"input":{"fields":[{"name":"orgId","optional":true,"type":"STRING"},{"name":"sourceId","optional":true,"type":"STRING"},{"name":"effectId","optional":true,"type":"STRING"}]},"output":{"fields":[{"name":"effectId","optional":true,"type":"STRING"},{"format":"int64","name":"receipts","optional":true,"type":"STRING"},{"name":"status","optional":true,"type":"STRING"}]},"protocol":"codefly.runnable.service/v1"},"digest":"87ee2c2e88a71f8ce870f86aca8deb4c26866840dcf56e7ab0fb46ac881bf893","execution":{"cancellation":"CANCELLATION_NONE","completion":"COMPLETION_CALL","facilities":[{"kind":"SERVICE"}],"max_input_bytes":"4096","max_output_bytes":"4096","recovery":"RECOVERY_RECEIPT","timeout":"600s"},"identity":{"module":"saas-starter","name":"accounts-connect-prune-source-operation-receipts","version":"0.2.0","workspace":"saas-starter-dev"},"schema":"codefly.runnable-package/v1","service_operations":[{"adaptation":"ADAPTATION_BOUNDED_JSON_V1","endpoint":"connect","input_message":"saas.accounts.v1.PruneSourceOperationReceiptsRequest","module":"saas-starter","name":"accounts","operation":"/saas.accounts.v1.DatasourceService/PruneSourceOperationReceipts","output_message":"saas.accounts.v1.PruneSourceOperationReceiptsResponse"}]} diff --git a/module/contracts/runnables/accounts/connect/ReconcileSource/runnable-package.json b/module/contracts/runnables/accounts/connect/ReconcileSource/runnable-package.json index 1bf4e8116..837ef14d7 100644 --- a/module/contracts/runnables/accounts/connect/ReconcileSource/runnable-package.json +++ b/module/contracts/runnables/accounts/connect/ReconcileSource/runnable-package.json @@ -1 +1 @@ -{"agent":{"kind":"SERVICE","name":"go-grpc","publisher":"codefly.dev","version":"0.1.58"},"contract":{"input":{"fields":[{"name":"orgId","optional":true,"type":"STRING"},{"name":"sourceId","optional":true,"type":"STRING"},{"name":"effectId","optional":true,"type":"STRING"}]},"output":{"fields":[{"name":"effectId","optional":true,"type":"STRING"},{"name":"status","optional":true,"type":"STRING"},{"name":"jobId","optional":true,"type":"STRING"}]},"protocol":"codefly.runnable.service/v1"},"digest":"b31aee937d20516fa09c454b358942cb6d5da2deda3382eaf1f2133bc62c3711","execution":{"cancellation":"CANCELLATION_NONE","completion":"COMPLETION_CALL","facilities":[{"kind":"SERVICE"}],"max_input_bytes":"4096","max_output_bytes":"4096","recovery":"RECOVERY_RECEIPT","timeout":"600s"},"identity":{"module":"saas-starter","name":"accounts-connect-reconcile-source","version":"0.2.0","workspace":"saas-starter-dev"},"schema":"codefly.runnable-package/v1","service_operations":[{"adaptation":"ADAPTATION_BOUNDED_JSON_V1","endpoint":"connect","input_message":"saas.accounts.v1.ReconcileSourceRequest","module":"saas-starter","name":"accounts","operation":"/saas.accounts.v1.DatasourceService/ReconcileSource","output_message":"saas.accounts.v1.ReconcileSourceResponse"}]} +{"agent":{"kind":"SERVICE","name":"go-grpc","publisher":"codefly.dev","version":"0.1.72"},"contract":{"input":{"fields":[{"name":"orgId","optional":true,"type":"STRING"},{"name":"sourceId","optional":true,"type":"STRING"},{"name":"effectId","optional":true,"type":"STRING"}]},"output":{"fields":[{"name":"effectId","optional":true,"type":"STRING"},{"name":"status","optional":true,"type":"STRING"},{"name":"jobId","optional":true,"type":"STRING"}]},"protocol":"codefly.runnable.service/v1"},"digest":"285bbe54a7286659e09da65dc6d721dbce2bfda127267a365175340477dce6e9","execution":{"cancellation":"CANCELLATION_NONE","completion":"COMPLETION_CALL","facilities":[{"kind":"SERVICE"}],"max_input_bytes":"4096","max_output_bytes":"4096","recovery":"RECOVERY_RECEIPT","timeout":"600s"},"identity":{"module":"saas-starter","name":"accounts-connect-reconcile-source","version":"0.2.0","workspace":"saas-starter-dev"},"schema":"codefly.runnable-package/v1","service_operations":[{"adaptation":"ADAPTATION_BOUNDED_JSON_V1","endpoint":"connect","input_message":"saas.accounts.v1.ReconcileSourceRequest","module":"saas-starter","name":"accounts","operation":"/saas.accounts.v1.DatasourceService/ReconcileSource","output_message":"saas.accounts.v1.ReconcileSourceResponse"}]} diff --git a/module/contracts/runnables/index.json b/module/contracts/runnables/index.json index 26b0de9f5..b84083c44 100644 --- a/module/contracts/runnables/index.json +++ b/module/contracts/runnables/index.json @@ -6,7 +6,7 @@ { "name": "accounts-connect-invoke-source-operation", "version": "0.2.0", - "digest": "21ee90ad38e4da6ac0d27d75ebc866a26e2ccf2c3bba34ecd9208c3210faafe8", + "digest": "77e2b2a2c13a0a4d215cfb94c406b1b878102816127bae7b51bee5fc769d8b31", "service": "accounts", "endpoint": "connect", "method": "/saas.accounts.v1.DatasourceService/InvokeSourceOperation", @@ -17,7 +17,7 @@ { "name": "accounts-connect-prune-source-operation-receipts", "version": "0.2.0", - "digest": "c86b2550cb0510641dafb788697238cbfc44dad34ec27eaf18abdd270f3bc9f1", + "digest": "87ee2c2e88a71f8ce870f86aca8deb4c26866840dcf56e7ab0fb46ac881bf893", "service": "accounts", "endpoint": "connect", "method": "/saas.accounts.v1.DatasourceService/PruneSourceOperationReceipts", @@ -28,7 +28,7 @@ { "name": "accounts-connect-reconcile-source", "version": "0.2.0", - "digest": "b31aee937d20516fa09c454b358942cb6d5da2deda3382eaf1f2133bc62c3711", + "digest": "285bbe54a7286659e09da65dc6d721dbce2bfda127267a365175340477dce6e9", "service": "accounts", "endpoint": "connect", "method": "/saas.accounts.v1.DatasourceService/ReconcileSource", diff --git a/module/services/accounts/code/main.go b/module/services/accounts/code/main.go index d9dd550a7..3143e7374 100644 --- a/module/services/accounts/code/main.go +++ b/module/services/accounts/code/main.go @@ -1,23 +1,11 @@ package main -/* ----------------------------------------------------------------- - -⚠️ This code is generated by the agent. Do not edit this file! - -Recommendation: write your logic in the `work.go` file in the same directory. - - -// Register the work function - -func init() { - WithWork(doWork) -} - -func doWork(ctx context.Context) (Clean, error) { - // Your logic goes here -} - ------------------------------------------------------------------ */ +// This entrypoint is hand-written: it serves the module authority listener +// declared in service.codefly.yaml and finishes the work wiring before any +// listener opens, neither of which the go-grpc agent's entrypoint does. It +// carries no generated-code marker, so the agent's Sync leaves it alone, as it +// leaves this service's adapters and plugins/registry.go. Service logic goes +// in work.go, registered with WithWork. import ( "accounts/pkg/adapters" diff --git a/module/services/accounts/code/pkg/permissionsplugin/plugin.go b/module/services/accounts/code/pkg/permissionsplugin/plugin.go index 4ca8b1be8..2fde9e9d5 100644 --- a/module/services/accounts/code/pkg/permissionsplugin/plugin.go +++ b/module/services/accounts/code/pkg/permissionsplugin/plugin.go @@ -15,16 +15,10 @@ // // **Operator integration steps** (one-time, post this PR): // -// 1. Edit `plugins/plugins.yaml`: -// plugins: -// - name: permissions -// import: "accounts/pkg/permissionsplugin" +// 1. List New() in plugins.All (plugins/registry.go). Accounts owns +// its adapters, so that registry is hand-written, not rendered. // -// 2. Trigger codefly Sync to regenerate registry_gen.go (or -// update by hand to match the regen output — see -// plugins/registry.go in this PR). -// -// 3. Configure the signing secret via the Plugin's With* +// 2. Configure the signing secret via the Plugin's With* // helpers in main.go. package permissionsplugin @@ -49,7 +43,7 @@ type Plugin struct { // defaultPlugin is the singleton instance returned by New. // -// **Why a singleton.** registry_gen.go calls New() to populate +// **Why a singleton.** plugins/registry.go calls New() to populate // plugins.All(), but main.go also needs a handle to the plugin // to wire signing keys via WithHMACSecret / WithEd25519Key // before NewServer builds the generated transport registrations. A fresh diff --git a/module/services/accounts/code/plugins/plugins.yaml b/module/services/accounts/code/plugins/plugins.yaml deleted file mode 100644 index 2c33ee050..000000000 --- a/module/services/accounts/code/plugins/plugins.yaml +++ /dev/null @@ -1,8 +0,0 @@ -# Plugin registry — list active plugins here. -# The codefly agent regenerates registry_gen.go from this file during Sync. -plugins: - # M7/M8 agent permission system: PrincipalService + - # DelegationService gRPC + REST. Operator configures signing - # keys at plugin construction time in main.go. - - name: permissions - import: "accounts/pkg/permissionsplugin" diff --git a/module/services/accounts/code/plugins/registry_gen.go b/module/services/accounts/code/plugins/registry.go similarity index 61% rename from module/services/accounts/code/plugins/registry_gen.go rename to module/services/accounts/code/plugins/registry.go index a8297af0d..ee94ff908 100644 --- a/module/services/accounts/code/plugins/registry_gen.go +++ b/module/services/accounts/code/plugins/registry.go @@ -1,10 +1,10 @@ -// Code generated by codefly agent. DO NOT EDIT. +// Package plugins is accounts' plugin registry, and it is hand-written. // -// This file is regenerated from plugins.yaml by the codefly agent -// during Sync. The current contents reflect the YAML state and -// match what the regenerator produces — hand-edits made here are -// expected to survive regeneration as long as plugins.yaml stays -// in sync. +// Accounts owns its adapters: no proto under proto/ declares a single +// AccountsService for the go-grpc scaffold to adapt, so the agent's Sync keeps +// only code/main.go current and never renders a plugin registry here (the +// agent renders one from plugins/plugins.yaml only alongside its scaffold, and +// refuses a plugins.yaml it cannot render). Add a plugin by adding it to All. package plugins import ( diff --git a/module/services/accounts/service.codefly.yaml b/module/services/accounts/service.codefly.yaml index b8376764f..499d607a6 100644 --- a/module/services/accounts/service.codefly.yaml +++ b/module/services/accounts/service.codefly.yaml @@ -12,7 +12,10 @@ agent: # service resolve its own address (service-go-grpc#165). # 0.1.58 builds with Go 1.27.3, including the GO-2026-6613 and GO-2026-6809 # fixes. - version: 0.1.58 + # 0.1.72 hands a native process each environment variable once + # (service-go-grpc#220); through 0.1.71 the inherited environment was + # appended twice, so accounts refused to start with a ~1 MB environment. + version: 0.1.72 publisher: codefly.dev service-dependencies: - name: cache diff --git a/module/services/auth-gateway/service.codefly.yaml b/module/services/auth-gateway/service.codefly.yaml index 8b2b77c24..d9e1233be 100644 --- a/module/services/auth-gateway/service.codefly.yaml +++ b/module/services/auth-gateway/service.codefly.yaml @@ -15,7 +15,7 @@ description: | agent: kind: codefly:service name: go-grpc - version: 0.1.58 + version: 0.1.72 publisher: codefly.dev service-dependencies: - name: accounts From 66a00c43863068633d6f7f97454fb265b24eb716 Mon Sep 17 00:00:00 2001 From: Antoine Toussaint <312536060+antoinetoussaint-byte@users.noreply.github.com> Date: Fri, 30 Oct 2026 20:26:34 -0400 Subject: [PATCH 2/6] chore(ci): expect go-grpc 0.1.72's build images go-grpc 0.1.72 builds on golang:1.27.3-alpine3.23@sha256:8a504649 and runs on alpine:3.23.7@sha256:ff7f0c72 (its build_images.go and AlpineDigest; 3.23.7 carries the OpenSSL 3.5.9 and musl 1.2.5-r24 fixes 3.23.5 lacked). The build-evidence gate refused accounts and auth-gateway on the old expectation, so the image contract moves with the agent, as RELEASE_GATES.md requires. Co-Authored-By: Claude Fable 5.1 --- scripts/ci/build-images.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/scripts/ci/build-images.json b/scripts/ci/build-images.json index ddec30be2..b097ed7b7 100644 --- a/scripts/ci/build-images.json +++ b/scripts/ci/build-images.json @@ -3,8 +3,8 @@ "source": "https://github.com/codefly-dev/service-go-grpc/blob/main/templates/builder/Dockerfile.tmpl", "images": [ "docker/dockerfile:1@sha256:ecfaec9ed6d810b56388c508f4121597bfbba70d41a6dfeee4d8cad5f295fc32", - "golang:1.27.3-alpine3.23@sha256:895e5feab11a4b3774d24ee3c9579028456b82ad37f42a9eb6f82adaf776a201", - "alpine:3.23.5@sha256:fd791d74b68913cbb027c6546007b3f0d3bc45125f797758156952bc2d6daf40" + "golang:1.27.3-alpine3.23@sha256:8a5046497cda39860b832ffdbe8dd66018a0f05bb01352f533a36e7e2ced66a0", + "alpine:3.23.7@sha256:ff7f0c727dd796aa36787bfcd9a64bf35a6ce72a73451b3359fde849b6703d63" ], "watch": [ "docker/dockerfile:1", From 8ea92193713f80a37b8d67e08709beee36a2b45d Mon Sep 17 00:00:00 2001 From: Antoine Toussaint <312536060+antoinetoussaint-byte@users.noreply.github.com> Date: Fri, 30 Oct 2026 20:45:49 -0400 Subject: [PATCH 3/6] fix(frontend): follow-redirects 1.16.2 and fast-uri 3.1.9, past their advisories The supply-chain job's `npm audit --omit=dev --audit-level=high` on the frontend failed on follow-redirects 1.16.1 (GHSA-mrwp-f3q8-3g9p, high; fixed in 1.16.2) and reported fast-uri 3.1.8 (GHSA-w74x-v6f9-j3xg, GHSA-wjr9-j795-jxcr, GHSA-xhq7-xmqj-769h, GHSA-333x-w4r6-6crp; fixed in 3.1.9). follow-redirects moves in the lockfile only, inside axios's ^1.16.0. fast-uri moves through the override that already pinned it, now `<3.1.9 -> 3.1.9`. Nothing else in the lockfile changed. deepmerge 4.3.1 (GHSA-gcqx-w48m-w2h4, low, via swagger-client) has no patched release; it stays, below the job's high threshold. Co-Authored-By: Claude Fable 5.1 --- module/services/frontend/code/package-lock.json | 12 ++++++------ module/services/frontend/code/package.json | 2 +- 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/module/services/frontend/code/package-lock.json b/module/services/frontend/code/package-lock.json index 8f9369bb3..f5679667a 100644 --- a/module/services/frontend/code/package-lock.json +++ b/module/services/frontend/code/package-lock.json @@ -8776,9 +8776,9 @@ } }, "node_modules/fast-uri": { - "version": "3.1.8", - "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.8.tgz", - "integrity": "sha512-GZMtZUTNRpOVIECoXwLNZS5xUGE+mVNbTB8h/7Rwh2TFWcBQiPzTgyZi05BF9UMZKkLJv8XBRJTlU7zg8+ZfMg==", + "version": "3.1.9", + "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.9.tgz", + "integrity": "sha512-hS/0Wt3Ya043oKXs0sIxrMpKQITXhMLIrVAKKXi4gozGC9v7YRWVnXIZzjNPTO02M9BdxLCWqK1yRXgNziVyJQ==", "funding": [ { "type": "github", @@ -8905,9 +8905,9 @@ "license": "ISC" }, "node_modules/follow-redirects": { - "version": "1.16.1", - "resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.16.1.tgz", - "integrity": "sha512-FNvFGzoMLWmE6Yj9spb/zjd7yiNCHiAW9/Tg9CXrQ8wuu32HtlJOwWO11OJafl5FfY3DxTdQ0vj42zU1kvv5jg==", + "version": "1.16.2", + "resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.16.2.tgz", + "integrity": "sha512-/kVP2U8z596Ia0gwFrwyIeo74ta5aVmSeU1FfAUMAmcEP5EP7zydmag3SLiN64NaRKef3lxsq7i/g7ltJQDGow==", "funding": [ { "type": "individual", diff --git a/module/services/frontend/code/package.json b/module/services/frontend/code/package.json index 9c722c0c9..815db3fbb 100644 --- a/module/services/frontend/code/package.json +++ b/module/services/frontend/code/package.json @@ -99,7 +99,7 @@ }, "overrides": { "brace-expansion@>=4.0.0 <5.0.12": "5.0.12", - "fast-uri@>=3.0.0 <3.1.8": "3.1.8", + "fast-uri@>=3.0.0 <3.1.9": "3.1.9", "js-yaml": "$js-yaml", "nanoid@>=3.0.0 <3.3.18": "3.3.18", "postcss": "8.5.26", From 4ce393eeed7970cd6f4fdd16aade2bb7ff8ca47b Mon Sep 17 00:00:00 2001 From: Antoine Toussaint <312536060+antoinetoussaint-byte@users.noreply.github.com> Date: Fri, 30 Oct 2026 20:47:10 -0400 Subject: [PATCH 4/6] chore(accounts): mark the hand-maintained entrypoint and plugin registry as stopgaps The accounts main.go and plugins/registry.go should be go-grpc's generated output. They stay hand-maintained only because the agent cannot generate them for a multi-service, custom-adapter service: its main-only refresh drops the module authority listener and starts the server before work's wiring, and it renders no registry without a single AccountsService. Both files now say so and name codefly-dev/service-go-grpc#223, the request for that shape. Co-Authored-By: Claude Fable 5.1 --- module/services/accounts/code/main.go | 16 ++++++++++------ .../code/pkg/permissionsplugin/plugin.go | 5 +++-- .../services/accounts/code/plugins/registry.go | 13 +++++++------ 3 files changed, 20 insertions(+), 14 deletions(-) diff --git a/module/services/accounts/code/main.go b/module/services/accounts/code/main.go index 3143e7374..5c239bf58 100644 --- a/module/services/accounts/code/main.go +++ b/module/services/accounts/code/main.go @@ -1,11 +1,15 @@ package main -// This entrypoint is hand-written: it serves the module authority listener -// declared in service.codefly.yaml and finishes the work wiring before any -// listener opens, neither of which the go-grpc agent's entrypoint does. It -// carries no generated-code marker, so the agent's Sync leaves it alone, as it -// leaves this service's adapters and plugins/registry.go. Service logic goes -// in work.go, registered with WithWork. +// STOPGAP (codefly-dev/service-go-grpc#223): this entrypoint should be the +// go-grpc agent's generated output, and it is hand-maintained only until the +// agent can generate it for this service's shape. The agent's main-only +// refresh would drop the module authority listener declared in +// service.codefly.yaml (it resolves one listener per API), and it would start +// the server before work's wiring completes. So this file carries no +// generated-code marker, and the agent's Sync leaves it alone, as it leaves +// this service's adapters and plugins/registry.go. Restore the marker and +// adopt the generated main when #223 lands. Service logic goes in work.go, +// registered with WithWork. import ( "accounts/pkg/adapters" diff --git a/module/services/accounts/code/pkg/permissionsplugin/plugin.go b/module/services/accounts/code/pkg/permissionsplugin/plugin.go index 2fde9e9d5..3dd0b0b92 100644 --- a/module/services/accounts/code/pkg/permissionsplugin/plugin.go +++ b/module/services/accounts/code/pkg/permissionsplugin/plugin.go @@ -15,8 +15,9 @@ // // **Operator integration steps** (one-time, post this PR): // -// 1. List New() in plugins.All (plugins/registry.go). Accounts owns -// its adapters, so that registry is hand-written, not rendered. +// 1. List New() in plugins.All (plugins/registry.go). That registry is +// hand-written until codefly-dev/service-go-grpc#223 lets the agent +// render it from plugins.yaml. // // 2. Configure the signing secret via the Plugin's With* // helpers in main.go. diff --git a/module/services/accounts/code/plugins/registry.go b/module/services/accounts/code/plugins/registry.go index ee94ff908..d96d9a92a 100644 --- a/module/services/accounts/code/plugins/registry.go +++ b/module/services/accounts/code/plugins/registry.go @@ -1,10 +1,11 @@ -// Package plugins is accounts' plugin registry, and it is hand-written. +// Package plugins is accounts' plugin registry. // -// Accounts owns its adapters: no proto under proto/ declares a single -// AccountsService for the go-grpc scaffold to adapt, so the agent's Sync keeps -// only code/main.go current and never renders a plugin registry here (the -// agent renders one from plugins/plugins.yaml only alongside its scaffold, and -// refuses a plugins.yaml it cannot render). Add a plugin by adding it to All. +// STOPGAP (codefly-dev/service-go-grpc#223): this file should be the agent's +// plugins/registry_gen.go, rendered from plugins/plugins.yaml. The agent renders +// a registry only alongside its scaffold, and the scaffold needs a single +// AccountsService that this multi-service layout does not have. The agent +// refuses a plugins.yaml it cannot render, so the registry is hand-written +// until #223 lands. Add a plugin by adding it to All. package plugins import ( From 5912a207ccd3dd777471e3e0935b57305f87d8b7 Mon Sep 17 00:00:00 2001 From: Antoine Toussaint <312536060+antoinetoussaint-byte@users.noreply.github.com> Date: Fri, 30 Oct 2026 21:18:05 -0400 Subject: [PATCH 5/6] fix(accounts): the registry comment names the hand-written registry, not registry_gen.go Co-Authored-By: Claude Fable 5.1 --- module/services/accounts/code/plugins/registry.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/module/services/accounts/code/plugins/registry.go b/module/services/accounts/code/plugins/registry.go index d96d9a92a..a6d5113de 100644 --- a/module/services/accounts/code/plugins/registry.go +++ b/module/services/accounts/code/plugins/registry.go @@ -16,7 +16,7 @@ import ( // All returns the list of registered plugins. // // **Wiring note for operators.** The permissions plugin is -// constructed without signing keys here so registry_gen.go has +// constructed without signing keys here so this registry has // no dependency on operator config. main.go (or work.go) is // responsible for configuring the shared instance via // Plugin.WithHMACSecret / Plugin.WithEd25519Key before NewServer. From 97518d0c20283b4a179f1f3e5aec82428fe90cd2 Mon Sep 17 00:00:00 2001 From: Antoine Toussaint <312536060+antoinetoussaint-byte@users.noreply.github.com> Date: Fri, 30 Oct 2026 21:43:26 -0400 Subject: [PATCH 6/6] chore(accounts): authority libraries at the conformance fix Move authority-core, authority-client and the conformance suite from d0210535 (#62) to authority main dea37afa (#65). The suite at the old pin raced a one-second delegation against its parent session's whole-second expiry ("a standing one-second delegation does not issue ... parent session expired") and reddened the pinned conformance job; #65 fixes that case, and the authority-main job already ran it. Co-Authored-By: Claude Fable 5.1 --- module/services/accounts/code/go.mod | 6 +++--- module/services/accounts/code/go.sum | 12 ++++++------ 2 files changed, 9 insertions(+), 9 deletions(-) diff --git a/module/services/accounts/code/go.mod b/module/services/accounts/code/go.mod index 395632e57..74a0a12b6 100644 --- a/module/services/accounts/code/go.mod +++ b/module/services/accounts/code/go.mod @@ -7,9 +7,9 @@ require ( buf.build/go/protovalidate v1.4.0 connectrpc.com/connect v1.21.1 connectrpc.com/otelconnect v0.9.0 - github.com/codefly-dev/authority/libraries/authority-client/go v0.1.1-0.20261030153609-d0210535bc94 - github.com/codefly-dev/authority/libraries/authority-core/go v0.0.0-20261030153609-d0210535bc94 - github.com/codefly-dev/authority/libraries/conformance/go v0.0.0-20261030153609-d0210535bc94 + github.com/codefly-dev/authority/libraries/authority-client/go v0.1.1-0.20261030222015-dea37afac9ad + github.com/codefly-dev/authority/libraries/authority-core/go v0.0.0-20261030222015-dea37afac9ad + github.com/codefly-dev/authority/libraries/conformance/go v0.0.0-20261030222015-dea37afac9ad github.com/codefly-dev/authority/libraries/delivery/go v0.0.0-20261028224835-f82a98e093ef github.com/codefly-dev/authority/libraries/resources/go v0.0.0-20261028224835-f82a98e093ef github.com/codefly-dev/cli/contracts/deployment v0.0.0-20261006151622-5824cf5342fc diff --git a/module/services/accounts/code/go.sum b/module/services/accounts/code/go.sum index 2c558964c..07a49bfd2 100644 --- a/module/services/accounts/code/go.sum +++ b/module/services/accounts/code/go.sum @@ -56,12 +56,12 @@ github.com/clipperhouse/uax29/v2 v2.7.0 h1:+gs4oBZ2gPfVrKPthwbMzWZDaAFPGYK72F0NJ github.com/clipperhouse/uax29/v2 v2.7.0/go.mod h1:EFJ2TJMRUaplDxHKj1qAEhCtQPW2tJSwu5BF98AuoVM= github.com/cloudflare/circl v1.6.3 h1:9GPOhQGF9MCYUeXyMYlqTR6a5gTrgR/fBLXvUgtVcg8= github.com/cloudflare/circl v1.6.3/go.mod h1:2eXP6Qfat4O/Yhh8BznvKnJ+uzEoTQ6jVKJRn81BiS4= -github.com/codefly-dev/authority/libraries/authority-client/go v0.1.1-0.20261030153609-d0210535bc94 h1:DlfBy77hpY5SFrLWMmSGC9MSU1cAGFeFrw3ZxxSWQwA= -github.com/codefly-dev/authority/libraries/authority-client/go v0.1.1-0.20261030153609-d0210535bc94/go.mod h1:4hRjiWuJOKzrEk8AS87pbWCbpiEmhEvQBGQaJo5Hmkg= -github.com/codefly-dev/authority/libraries/authority-core/go v0.0.0-20261030153609-d0210535bc94 h1:IrHzbYmeXG7KLoAspBorG0amd8xgGdRNFQcpP/cfV1o= -github.com/codefly-dev/authority/libraries/authority-core/go v0.0.0-20261030153609-d0210535bc94/go.mod h1:Cdk+10ebRh0tZA9ze2dDIrfQC34E+Y7LMi6UjSQ2dQU= -github.com/codefly-dev/authority/libraries/conformance/go v0.0.0-20261030153609-d0210535bc94 h1:vmCiKG/XQZzmte9c+EeE9Fmk2DeBpgy3caKtqxcBbqw= -github.com/codefly-dev/authority/libraries/conformance/go v0.0.0-20261030153609-d0210535bc94/go.mod h1:or3dd9bqacXWMjke/n81l/QxRaLwq2lq/hL4V2qtAZo= +github.com/codefly-dev/authority/libraries/authority-client/go v0.1.1-0.20261030222015-dea37afac9ad h1:fFpOC3bErcM55ouVmz4B+ehyhP6jDQtYBWI2sVsLiG0= +github.com/codefly-dev/authority/libraries/authority-client/go v0.1.1-0.20261030222015-dea37afac9ad/go.mod h1:4hRjiWuJOKzrEk8AS87pbWCbpiEmhEvQBGQaJo5Hmkg= +github.com/codefly-dev/authority/libraries/authority-core/go v0.0.0-20261030222015-dea37afac9ad h1:evJ/d2Zi4nBXVc2NvMmWPphR7DN1cABwsfcy5LHjNjw= +github.com/codefly-dev/authority/libraries/authority-core/go v0.0.0-20261030222015-dea37afac9ad/go.mod h1:Cdk+10ebRh0tZA9ze2dDIrfQC34E+Y7LMi6UjSQ2dQU= +github.com/codefly-dev/authority/libraries/conformance/go v0.0.0-20261030222015-dea37afac9ad h1:DZt68NLXwaGYWXo1RUM0+JrvuXt/za/EyeHMGYFSix8= +github.com/codefly-dev/authority/libraries/conformance/go v0.0.0-20261030222015-dea37afac9ad/go.mod h1:or3dd9bqacXWMjke/n81l/QxRaLwq2lq/hL4V2qtAZo= github.com/codefly-dev/authority/libraries/delivery/go v0.0.0-20261028224835-f82a98e093ef h1:Mso6TDL7zLY5HwR+gq0pRSNN/zO8fv89F9kzcPf+qI4= github.com/codefly-dev/authority/libraries/delivery/go v0.0.0-20261028224835-f82a98e093ef/go.mod h1:XsOFnO2MQdr37vM3ULa0Uwi8ZWptyVx7hRSUyIdaZ1Q= github.com/codefly-dev/authority/libraries/hop/go v0.0.0-20261027154629-b57068f61a0f h1:llYwKOBeCB6kS4faxICrR5YYlwnhiV+0qXjuT3IwBd4=