seon
b0ff118841
보안 리뷰 반영. 외부 응답은 곧 진단이고 자동 승인 아래서는 실행 조치가 되므로, /external/next·/external/reply 를 에이전트 포트에서 떼어 EXTERNAL_ADDR 리스너(기본 꺼짐, VM compose 는 127.0.0.1:8090 에만 매핑해 IAP SSH 터널로만 도달)로 옮기고, 턴 id 를 난수로 만들며, 응답마다 그 턴을 가져간 클라이언트만 아는 reply_token 을 요구해 상수 시간으로 비교한다. /selfcheck 는 리스너가 꺼져 있으면 external_responder: "off" 를 보인다.
selfheal-lab-apps
Application sources for the self-healing verification lab (VM + container mixed environment).
Infrastructure: seon-labs/selfheal-lab-terraform. Runtime configuration (compose, manifests):
selfheal-lab/selfheal-lab-gitops. This repository is public and contains no secrets.
| Directory | Runs on | Image |
|---|---|---|
legacy-api/ |
GCP MIG instances (docker compose) | Artifact Registry asia-northeast1-docker.pkg.dev/cms-d-414903/selfheal/legacy-api:<git sha> |
demo-app/ |
AWS Kubernetes (Argo CD, namespace demo) | Public Artifact Registry asia-northeast1-docker.pkg.dev/cms-d-414903/selfheal-public/demo-api:<git sha> (anonymous pull; kubeadm nodes have no cloud credentials) |
harness/ |
GCP harness VM (docker compose) | Public Artifact Registry selfheal-public/harness:<git sha> |
ai/ |
GCP AI VM (docker compose): cmd/agent (diagnosis, experiment design 6.2-6.4) and cmd/hitl (Discord approval bot, 6.5-6.6) |
Public Artifact Registry selfheal-public/ai-agent:<git sha>, selfheal-public/ai-hitl:<git sha> (gcloud builds submit ai --config ai/cloudbuild.yaml --substitutions=_TAG=<git sha>) |
Build (Cloud Build, from the repository root):
gcloud builds submit legacy-api --project cms-d-414903 --tag asia-northeast1-docker.pkg.dev/cms-d-414903/selfheal/legacy-api:$(git rev-parse --short HEAD)