feat(dev): mTLS enrollment dev loop; retire dev-insecure plain-WS #78

Merged

Claude-Run merged 1 commit from feat/VA-74-dev-mtls-enroll-bootstrap into main

2026-06-28 15:41:28 +02:00

Claude-Run commented

2026-06-28 15:36:23 +02:00

Member

Add just dev-enroll-bundle (and a private mint-bundle) that logs in to the dev server with the bootstrapped site-admin and mints a single-use enrollment bundle (POST /api/v1/enroll-tokens) into run/: the four PEMs the agent's VERVAIN_*_FILE env vars point at plus a bootstrap.json in the shape install --from consumes.
Rewire just dev / dev-detach / dev-host to bootstrap over mTLS: export VERVAIN_SERVER_DOMAIN + VERVAIN_*_FILE + VERVAIN_DB_KEY pointing at the bundle, auto-mint on first run, and reuse the identity stored in vervain-agent.db afterward. The container path reaches the server's in-network mTLS listener on :15443 with no host port-publish.
Remove the inert dev-insecure Cargo feature and its uses in compose.yml / justfile; drop the dead run/vervain-agent.vagent seed + template and the ws:// rendering (ensure-settings / ensure-settings-host).
Add a test-only regression guard (dev_loop_guard.rs) that fails the suite if dev-insecure or a plain ws:// dev transport reappears in Cargo.toml, justfile, or compose.yml.
Document the dev enrollment flow in docs/dev-enrollment.md and the README; refresh .env.example and .gitignore (the minted bundle is secret).

#VA-74

Co-Authored-By: Claude Opus 4.8 (1M context) noreply@anthropic.com

Restore a one-command local dev loop in which a freshly built agent enrolls against the local vervain-server over mTLS and comes online, replacing the dev-insecure plain-WS path that VA-67 made inert. - Add `just dev-enroll-bundle` (and a private `mint-bundle`) that logs in to the dev server with the bootstrapped site-admin and mints a single-use enrollment bundle (POST /api/v1/enroll-tokens) into run/: the four PEMs the agent's VERVAIN_*_FILE env vars point at plus a bootstrap.json in the shape `install --from` consumes. - Rewire `just dev` / `dev-detach` / `dev-host` to bootstrap over mTLS: export VERVAIN_SERVER_DOMAIN + VERVAIN_*_FILE + VERVAIN_DB_KEY pointing at the bundle, auto-mint on first run, and reuse the identity stored in vervain-agent.db afterward. The container path reaches the server's in-network mTLS listener on :15443 with no host port-publish. - Remove the inert `dev-insecure` Cargo feature and its uses in compose.yml / justfile; drop the dead run/vervain-agent.vagent seed + template and the ws:// rendering (ensure-settings / ensure-settings-host). - Add a test-only regression guard (dev_loop_guard.rs) that fails the suite if `dev-insecure` or a plain ws:// dev transport reappears in Cargo.toml, justfile, or compose.yml. - Document the dev enrollment flow in docs/dev-enrollment.md and the README; refresh .env.example and .gitignore (the minted bundle is secret). #VA-74 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Claude-Run added 1 commit

2026-06-28 15:36:23 +02:00

feat(dev): mTLS enrollment dev loop; retire dev-insecure plain-WS

Check / fmt + clippy + tests (pull_request) Successful in 5m1s

Details

Create release / Create release from merged PR (pull_request) Has been skipped

Details

28e7094fe3

Restore a one-command local dev loop in which a freshly built agent enrolls against the local vervain-server over mTLS and comes online, replacing the dev-insecure plain-WS path that VA-67 made inert.

- Add `just dev-enroll-bundle` (and a private `mint-bundle`) that logs in to the dev server with the bootstrapped site-admin and mints a single-use enrollment bundle (POST /api/v1/enroll-tokens) into run/: the four PEMs the agent's VERVAIN_*_FILE env vars point at plus a bootstrap.json in the shape `install --from` consumes.
- Rewire `just dev` / `dev-detach` / `dev-host` to bootstrap over mTLS: export VERVAIN_SERVER_DOMAIN + VERVAIN_*_FILE + VERVAIN_DB_KEY pointing at the bundle, auto-mint on first run, and reuse the identity stored in vervain-agent.db afterward. The container path reaches the server's in-network mTLS listener on :15443 with no host port-publish.
- Remove the inert `dev-insecure` Cargo feature and its uses in compose.yml / justfile; drop the dead run/vervain-agent.vagent seed + template and the ws:// rendering (ensure-settings / ensure-settings-host).
- Add a test-only regression guard (dev_loop_guard.rs) that fails the suite if `dev-insecure` or a plain ws:// dev transport reappears in Cargo.toml, justfile, or compose.yml.
- Document the dev enrollment flow in docs/dev-enrollment.md and the README; refresh .env.example and .gitignore (the minted bundle is secret).

#VA-74

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>