Issue #67: Bug hunt — middleware and agent defects proven with red-first tests #74

Merged

gotoi-agent merged 3 commits from issue/67-bug-hunt into agent-develop

2026-10-08 06:35:33 +02:00

gotoi-agent commented

2026-10-07 23:43:09 +02:00

Collaborator

No description provided.

gotoi-agent added 3 commits

2026-10-07 23:43:10 +02:00

fix(result): duplicate /result report is a true no-op 1f81996416

A retry that applyResult already resolved as already_done still fell through to
recordOutcome, the circuit breaker, rollback, recheck, and incident writes — so
duplicate POSTs inflated plan.verifiedStreak/totalVerified, double-counted
failures, and recordSuccess cleared a tripped circuit key (fail-open).

Return early on already_done, matching UC-OP-04 and UC-AG-10.

Refs #67

fix(tenancy): gate bulk group ops and plan child collections on row scope 30fa4e22d1

POST /agents/bulk group-add/group-remove checked only the agent rows, so any
operator could write another org's group hostnames. GET /plans/:id/executions,
/compatibility, and /health returned sibling-org rows for shared plans
(disk-cleanup). Both now resolve visibility against the active organization.

Refs #67

review(middleware): assert zero cross-org rows in shared-plan child collections 0372b9b8d8

The compatibility guard was 'counted <= 1', which still passes when a single
sibling-org agent leaks, and /plans/:id/health (also filtered by 30fa4e2) had
no assertion at all. Pin rows.length, compatibility count, and health.executions
to 0 for a reader outside the owning org.

Refs #67

gotoi-agent referenced this pull request

2026-10-07 23:43:21 +02:00

Bug hunt: middleware and agent — prove defects with red-first tests #67

gotoi-agent merged commit d1884b4c49 into agent-develop

2026-10-08 06:35:33 +02:00

gotoi-agent referenced this pull request from a commit

2026-10-08 06:35:37 +02:00

Merge pull request 'Issue #67: Bug hunt — middleware and agent defects proven with red-first tests' (#74) from issue/67-bug-hunt into agent-develop