Repository navigation
Add typed Catalog metadata reads for v0.20.16 - #13
Merged
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Add a private, fixed Catalog metadata interface for the Engine's typed template and parent-bound version reads. Responses apply current project/global visibility, bounded SQL paging and logical identities without loading files, questions, defaults, credentials or readme. Existing public Catalog APIs and data remain unchanged.
The Engine remains responsible for active caller/current-project authorization and live Key platform Catalog read. This route trusts only the actual loopback peer; forwarded IP/role assertions cannot authorize it. Version metadata is not a compatibility or launch-readiness verdict.
Validation: 16 Catalog focused cases passed locally with Go1.26.6, including logical-ID cache rebuild/source replacement and version parent/cursor checks; 8 generated version-SQL cases passed on isolated SQLite. Separate Engine 21 focused and Web reader 9 focused evidence passed. Independent scoped review found no blocker. The original official Go1.27.3 full build/test/race/security/reproducibility and required CodeQL gates remain mandatory and pending on this exact source. No publication/deployment/runtime acceptance is claimed.
Candidate numeric version: v0.20.16. Previous published release remains v0.20.15.
Follow-up qualification: the first official security run correctly failed on CVE-2026-111497 in the frozen builder libbrotli1. The candidate now applies Ubuntu USN-8956-1 package 1.2.0-3ubuntu0.1 by exact SHA and verifies package/version/architecture plus installed readback; no VEX exception was added. Safe templateKey metadata also distinguishes duplicate display names without exposing cache paths. One new direct Catalog/Engine/reader DTO case per layer passed; the frontend selector case passed separately. The new exact head must pass the unchanged full official gate; the earlier failed run remains evidence.