Feat/elevate chunk1 - #251

Draft

aporcupine wants to merge 40 commits into

thand-io:mainfrom

aporcupine:feat/elevate-chunk1

Commits on Feb 21, 2026

feat(elevate): scaffold chunk 1 interface-first daemon layout
aporcupine
committed
9c80c08
chore(elevate): initialize standalone go module
aporcupine
committed
077805d

Commits on Feb 22, 2026

feat(elevate): implement unix ipc with injected deps and unit coverage
aporcupine
committed
c9f80e4
feat(elevate): add verifier with embedded rotated key support
aporcupine
committed
79cc7ba
elevate: implement linux grant engine with sudoers preflight
aporcupine
committed
194632a
elevate: require explicit linux grant config
aporcupine
committed
d7ce91e
elevate: add persistent state store and expiry cleanup
aporcupine
committed
0d76a7c
elevate: complete handler auth flow and harden logging/errors
aporcupine
committed
97c424c
elevate: fix cleanup test data race under -race
aporcupine
committed
7d8a32f
elevate: add socket gid config and signing tool
aporcupine
committed
2a5ce89
elevate: refine audit logging and cleanup logger wiring
aporcupine
committed
184d34b
remove committed keys and add keygen-based test flow
aporcupine
committed
2ed5abc
refactor platform wiring and add linux boot clock
aporcupine
committed
b3dc4e0
validate sudoers temp file before activation
aporcupine
committed
3fdd7eb
harden grant activation and cap ipc frame size
aporcupine
committed
7e62d63

Commits on Feb 23, 2026

refactor ipc access by os and switch socket ownership to names
aporcupine
committed
2541ddb

Commits on Feb 27, 2026

advance elevate windows support and clock refactor
aporcupine
committed
8ae7495
Merge branch 'feat/elevate-ipc-os-access' into feat/elevate-chunk1
aporcupine
committed
b98647d
fix cleanup expiry evaluation
aporcupine
committed
4971bfb
fix ipc frame reads across timeouts
aporcupine
committed
af528db
tighten elevate logging and grant validation
aporcupine
committed
745319f
retain completed elevate grants for safe revoke handling
aporcupine
committed
8115737
handle duplicate elevate requests safely
aporcupine
committed
b37f863
remove embedded manual test key
aporcupine
committed
e020e95

Commits on Feb 28, 2026

tighten username validation and split handler tests
aporcupine
committed
939387c
validate trusted key material at startup
aporcupine
committed
af4e469
support modern sudo includedir directives
aporcupine
committed
3457d72
make state request ID handling exact
aporcupine
committed
5123814
use powershell for windows group management
aporcupine
committed
c891ffe
stabilize cleanup periodic test
aporcupine
committed
2cff532
stabilize windows membership JSON parsing
aporcupine
committed
2da2741
align shared username validation with linux rules
aporcupine
committed
d939e88
validate config identities at startup
aporcupine
committed
7ae1455
make grant replay checks order-independent
aporcupine
committed
2a5db97

Commits on Mar 1, 2026

untangle grant constructors from handler
aporcupine
committed
0968ee6
ignore stale grants during admission
aporcupine
committed
f37cb09
harden revoke completion and cleanup shutdown
aporcupine
committed
cf8b9c6
centralize grant state lifecycle checks
aporcupine
committed
4d7b947
bind revoke requests to stored identity
aporcupine
committed
4017606
return protocol errors for unsupported actions
aporcupine
committed
a4f2d10