Phase 2 Week 3a — mTLS + executor JWT + HMAC heartbeat#12

Merged

l17728 merged 14 commits into

mainfrom

feat/phase-2-w3a-mtls-jwt-hmac

May 14, 2026

Commits on May 14, 2026

docs(spec): add Phase 2 Week 3a — mTLS + Executor JWT + HMAC Heartbeat design

l17728
and
claude
committed
docs(plan): add Phase 2 Week 3a implementation plan

l17728
and
claude
committed
feat(db): p2w3a deps (cryptography+pyjwt) + alembic hmac_seed_encrypted (W3a M1)

l17728
and
claude
committed
feat(auth): ca.py — self-signed CA + CSR signing + server cert (W3a M1)

l17728
and
claude
committed
feat(auth): jwt_signing (Ed25519 JWT) + hmac_nonce (NonceStore) (W3a M1)

l17728
and
claude
committed
feat(auth): mTLS + JWT + HMAC FastAPI deps; executor_epoch confused-deputy guard (W3a M2)

l17728
and
claude
committed
feat(api): /register + /renew endpoints + main bootstrap; delete /join (W3a M2)

l17728
and
claude
committed
feat(api): migrate executor + subtask endpoints + test setups to mTLS+JWT (W3a M3)

l17728
and
claude
committed
test(e2e): real-TLS register → heartbeat full flow (W3a M3)

l17728
and
claude
committed
feat(executor): cert.py + auth_lifecycle.py (register/renew/load) (W3a M4)

l17728
and
claude
committed
feat(executor): client + runner mTLS/JWT/HMAC auth + renew loop (W3a M4)

l17728
and
claude
committed
ci(lint): forbid bearer on executor routes + OpenAPI + operator runbook (W3a M4)
l17728
committed
chore: gitignore W3a runtime CA / cert dirs (.ca/ + .executor-certs/)

l17728
and
claude
committed
ci: .gitleaks.toml — allowlist ed25519 type-annotation false positives

l17728
and
claude
committed