Ben Barclay
0ddd21c74e
feat(relay): managed-boot self-provision client (Phase 3, gateway side) ( #48242 )
...
The gateway half of relay Phase 3. On a MANAGED boot with relay configured and
no secret pinned, the runtime self-provisions its relay credentials IN-PROCESS:
resolve the agent's own Nous access token (resolve_nous_access_token) -> POST
the connector's /relay/provision asserting its own endpoint + route keys ->
set GATEWAY_RELAY_ID/SECRET/DELIVERY_KEY into os.environ so the immediately-
following register_relay_adapter() reads them and dials out authenticated.
No human, no enrollment token, no disk write — the creds live only in process
memory (save_env_value refuses under managed anyway, and keeping the secret off
any volume is the stronger posture). Stateless: process-env creds don't survive
a restart, so a managed container re-provisions every boot; the connector's
rotation window covers a still-connected prior instance. An explicitly-pinned
GATEWAY_RELAY_SECRET is respected (skip). Self-hosted is unchanged: humans keep
using `hermes gateway enroll`.
Endpoint provenance is gateway-asserted (GATEWAY_RELAY_ENDPOINT +
GATEWAY_RELAY_ROUTE_KEYS, env or gateway.relay_* config) — uniform code path
whether the operator sets it (self-hosted) or NAS stamps it (hosted, the only
case NAS knows the public URL). Both absent -> outbound-only provisioning
(credentials, no inbound routes). The connector scopes the asserted endpoint to
the verified tenant, so it stays within the security model.
- gateway/relay/__init__.py: relay_endpoint(), relay_route_keys(),
_provision_url(), _post_provision(), self_provision_if_managed() (never
raises — a provision failure logs and boots without relay auth).
- gateway/run.py: call self_provision_if_managed() immediately before
register_relay_adapter() in the startup path.
Tests: 12 unit (trigger logic, respect-pinned-secret, in-process env wiring,
endpoint+routes vs outbound-only, fail-soft on token/connector failure);
mutation-checked (drop is_managed guard / pinned-secret guard -> tests fail).
Cross-repo live E2E driver lands on the connector side (depends on this).
EXPERIMENTAL: relay auth scheme may change until >=2 Class-1 platforms validate.
2026-06-18 15:25:29 +10:00
..
2026-05-20 13:00:57 -07:00
2026-06-18 15:25:29 +10:00
2026-05-28 22:26:25 -07:00
2026-06-10 14:01:34 +10:00
2026-05-28 22:26:25 -07:00
2026-06-13 06:38:29 -07:00
2026-06-08 11:29:53 -07:00
2026-06-06 09:00:10 -07:00
2026-06-16 03:35:24 +05:30
2026-05-28 22:26:25 -07:00
2026-05-17 02:29:41 -07:00
2026-05-28 22:26:25 -07:00
2026-06-07 10:04:57 -07:00
2026-06-14 03:25:49 -07:00
2026-05-28 22:26:25 -07:00
2026-05-28 22:26:25 -07:00
2026-06-07 18:38:54 -07:00
2026-05-28 22:26:25 -07:00
2026-05-28 22:26:25 -07:00
2026-06-14 05:10:39 -07:00
2026-06-07 18:05:58 -07:00
2026-06-02 16:55:25 -07:00
2026-05-28 22:26:25 -07:00
2026-05-24 01:31:45 -07:00
2026-06-01 18:52:05 -07:00
2026-05-18 21:38:05 -07:00
2026-06-03 20:30:59 +08:00
2026-05-28 22:26:25 -07:00
2026-06-15 05:51:47 -07:00
2026-05-28 22:26:25 -07:00
2026-05-28 22:26:25 -07:00
2026-05-18 10:19:40 -07:00
2026-06-08 06:32:23 -07:00
2026-06-13 04:51:59 -07:00
2026-06-07 22:39:51 -07:00
2026-06-14 03:20:21 -07:00
2026-06-13 07:18:54 -07:00
2026-05-24 01:31:45 -07:00
2026-06-16 05:26:04 -07:00
2026-05-29 19:06:05 -07:00
2026-05-25 14:54:02 -07:00
2026-05-09 11:04:46 -07:00
2026-05-28 22:26:25 -07:00
2026-05-22 14:21:41 -07:00
2026-05-22 14:21:41 -07:00
2026-05-28 22:26:25 -07:00
2026-05-28 22:26:25 -07:00
2026-05-22 14:21:41 -07:00
2026-05-22 14:21:41 -07:00
2026-05-28 22:26:25 -07:00
2026-06-07 08:27:40 -07:00
2026-06-07 06:21:37 -07:00
2026-06-11 15:39:01 -04:00
2026-05-22 14:21:41 -07:00
2026-05-28 04:52:02 -07:00
2026-05-22 14:21:41 -07:00
2026-05-28 22:26:25 -07:00
2026-05-22 14:21:41 -07:00
2026-06-10 00:24:06 -07:00
2026-05-27 03:35:33 -07:00
2026-05-22 14:21:41 -07:00
2026-05-22 14:21:41 -07:00
2026-05-22 14:21:41 -07:00
2026-05-28 22:26:25 -07:00
2026-05-22 14:21:41 -07:00
2026-05-22 14:21:41 -07:00
2026-06-14 17:02:21 +07:00
2026-05-17 02:29:41 -07:00
2026-05-28 22:26:25 -07:00
2026-06-05 03:10:40 -07:00
2026-06-16 05:49:24 -07:00
2026-05-28 22:26:25 -07:00
2026-06-13 07:18:37 -07:00
2026-06-11 11:58:19 -07:00
2026-05-28 22:26:25 -07:00
2026-06-14 04:16:26 -07:00
2026-05-30 07:28:06 -07:00
2026-05-30 18:58:46 -07:00
2026-05-30 07:38:03 -07:00
2026-05-28 22:26:25 -07:00
2026-06-16 15:49:59 -07:00
2026-06-07 06:21:37 -07:00
2026-05-28 22:26:25 -07:00
2026-05-28 22:26:25 -07:00
2026-06-04 06:15:23 -07:00
2026-05-07 05:09:39 -07:00
2026-06-04 06:15:23 -07:00
2026-05-28 22:26:25 -07:00
2026-05-27 02:41:24 -07:00
2026-05-28 22:26:25 -07:00
2026-06-10 14:01:34 +10:00
2026-06-14 03:25:08 -07:00
2026-05-07 06:31:08 -07:00
2026-05-07 17:33:09 -07:00
2026-05-11 07:06:27 -07:00
2026-06-04 16:54:40 -07:00
2026-05-03 08:47:49 -07:00
2026-06-06 11:46:24 -07:00
2026-05-28 22:26:25 -07:00
2026-05-28 22:26:25 -07:00
2026-05-24 01:31:45 -07:00
2026-05-28 22:26:25 -07:00
2026-06-01 20:30:24 -07:00
2026-05-28 22:26:25 -07:00
2026-06-07 23:14:18 -07:00
2026-06-12 12:02:41 -07:00
2026-06-04 21:55:20 -07:00
2026-05-28 22:26:25 -07:00
2026-05-24 15:03:27 -07:00
2026-06-11 07:41:43 -04:00
2026-06-11 07:41:43 -04:00
2026-05-28 22:26:25 -07:00
2026-06-11 07:41:43 -04:00
2026-05-28 22:26:25 -07:00
2026-06-13 06:57:08 -07:00
2026-06-16 06:34:54 -07:00
2026-06-08 15:12:12 -07:00
2026-06-05 09:10:26 -07:00
2026-05-26 14:28:51 -07:00
2026-05-28 22:26:25 -07:00
2026-06-08 22:51:03 -07:00
2026-06-16 06:23:53 -07:00
2026-05-16 12:55:23 -07:00
2026-05-28 22:26:25 -07:00
2026-06-16 15:49:59 -07:00
2026-05-28 22:26:25 -07:00
2026-06-10 00:24:06 -07:00
2026-05-25 15:22:23 -07:00
2026-05-28 22:26:25 -07:00
2026-05-28 22:26:25 -07:00
2026-06-12 08:51:10 +00:00
2026-05-29 13:17:46 -07:00
2026-05-28 22:26:25 -07:00
2026-06-02 05:52:54 -07:00
2026-05-29 17:36:58 +00:00
2026-06-04 07:50:22 -07:00
2026-06-17 16:37:45 -07:00
2026-05-28 22:26:25 -07:00
2026-06-02 17:27:44 -07:00
2026-06-04 05:56:45 -07:00
2026-05-28 22:26:25 -07:00
2026-05-07 05:04:37 -07:00
2026-05-28 22:26:25 -07:00
2026-06-06 18:44:44 -07:00
2026-06-03 20:25:17 +08:00
2026-06-17 16:37:45 -07:00
2026-05-22 14:21:41 -07:00
2026-05-28 22:26:25 -07:00
2026-06-14 03:25:08 -07:00
2026-06-10 23:22:43 -07:00
2026-06-08 01:25:35 -07:00
2026-05-28 22:26:25 -07:00
2026-06-14 05:10:39 -07:00
2026-06-15 07:46:34 -07:00
2026-05-20 13:00:57 -07:00
2026-05-27 05:21:53 -07:00
2026-05-28 22:26:25 -07:00
2026-06-12 12:02:41 -07:00
2026-05-30 07:38:03 -07:00
2026-05-15 14:32:14 -07:00
2026-06-07 23:57:32 -07:00
2026-06-03 23:51:44 -06:00
2026-05-07 05:49:16 -07:00
2026-05-08 18:50:25 -07:00
2026-05-28 22:26:25 -07:00
2026-05-28 22:26:25 -07:00
2026-05-18 22:25:15 -07:00
2026-06-16 15:49:59 -07:00
2026-06-03 06:36:46 -07:00
2026-05-09 14:18:20 +03:00
2026-05-28 22:26:25 -07:00
2026-06-08 20:52:08 -07:00
2026-05-28 22:26:25 -07:00
2026-05-28 22:26:25 -07:00
2026-05-23 02:25:53 -07:00
2026-06-07 22:10:32 -07:00
2026-05-27 02:41:24 -07:00
2026-05-28 22:26:25 -07:00
2026-05-28 22:26:25 -07:00
2026-06-04 07:50:45 -07:00
2026-05-28 22:26:25 -07:00
2026-06-11 07:41:43 -04:00
2026-06-08 15:12:12 -07:00
2026-05-10 09:01:51 -07:00
2026-05-28 22:26:25 -07:00
2026-05-28 22:26:25 -07:00
2026-06-12 01:07:50 -07:00
2026-06-12 01:07:50 -07:00
2026-06-07 06:21:37 -07:00
2026-06-07 21:19:59 -07:00
2026-05-07 06:54:29 -07:00
2026-06-12 10:36:14 +05:30
2026-06-13 03:33:27 -07:00
2026-05-28 22:26:25 -07:00
2026-05-28 22:26:25 -07:00
2026-05-28 22:26:25 -07:00
2026-05-28 22:26:25 -07:00
2026-06-07 02:15:23 -07:00
2026-05-28 22:26:25 -07:00
2026-06-15 07:46:34 -07:00
2026-06-15 05:25:07 -07:00
2026-05-28 22:26:25 -07:00
2026-05-28 22:26:25 -07:00
2026-05-31 09:29:03 -07:00
2026-06-13 13:44:45 -07:00
2026-06-14 11:13:38 -07:00
2026-06-16 06:34:54 -07:00
2026-06-14 11:13:38 -07:00
2026-06-02 00:33:50 -07:00
2026-06-09 23:16:23 -07:00
2026-05-28 22:26:25 -07:00
2026-05-25 16:23:24 +00:00
2026-05-08 11:18:14 -07:00
2026-06-15 14:35:15 -04:00
2026-05-28 22:26:25 -07:00
2026-06-11 11:58:19 -07:00
2026-05-18 22:08:08 -07:00
2026-05-28 22:26:25 -07:00
2026-05-18 22:51:35 -07:00
2026-05-28 22:26:25 -07:00
2026-06-07 22:10:03 -07:00
2026-05-28 22:26:25 -07:00
2026-06-08 15:53:16 -07:00
2026-05-18 22:34:48 -07:00
2026-06-14 04:51:50 -07:00
2026-05-18 22:59:40 -07:00
2026-06-10 00:24:06 -07:00
2026-05-18 22:14:45 -07:00
2026-05-27 02:41:24 -07:00
2026-06-16 06:34:54 -07:00
2026-05-28 22:26:25 -07:00
2026-05-28 22:26:25 -07:00
2026-05-12 17:02:29 -07:00
2026-05-18 21:52:39 -07:00
2026-05-09 11:10:36 -07:00
2026-06-16 13:04:20 -07:00
2026-06-02 00:33:50 -07:00
2026-05-28 22:26:25 -07:00
2026-05-18 22:28:21 -07:00
2026-05-23 02:42:10 -07:00
2026-05-28 22:26:25 -07:00
2026-05-28 22:26:25 -07:00
2026-05-31 21:05:53 -07:00
2026-05-28 23:25:52 -07:00
2026-06-11 10:01:51 -04:00
2026-05-28 22:26:25 -07:00
2026-05-28 22:26:25 -07:00
2026-05-28 22:26:25 -07:00
2026-06-01 17:31:32 -07:00
2026-05-28 22:26:25 -07:00
2026-06-16 06:34:54 -07:00
2026-06-07 04:53:22 -07:00
2026-06-01 02:04:14 -07:00
2026-06-12 13:42:42 -04:00
2026-06-04 06:56:28 -07:00
2026-06-08 01:25:35 -07:00
2026-05-28 22:26:25 -07:00
2026-06-05 18:05:05 -07:00
2026-06-13 03:33:27 -07:00
2026-06-10 02:57:39 -07:00
2026-05-28 22:26:25 -07:00
2026-06-14 02:40:54 -07:00
2026-05-28 22:26:25 -07:00
2026-05-28 22:26:25 -07:00
2026-05-28 22:26:25 -07:00
2026-05-24 01:30:47 -07:00
2026-06-01 19:20:36 -07:00
2026-06-07 21:50:57 -07:00
2026-06-07 22:10:17 -07:00
2026-06-11 07:51:01 -07:00
2026-05-15 14:32:14 -07:00
2026-06-11 07:51:01 -07:00
2026-05-28 22:26:25 -07:00
2026-05-28 22:26:25 -07:00
2026-06-11 03:47:29 -07:00
2026-05-30 07:33:15 -07:00
2026-05-28 22:26:25 -07:00