harness/core
5
0
Fork 1
Code Issues Pull requests 15 Projects Releases 251 Packages 1 Wiki Activity Actions

feat: native TLS for authenticated Harness API #187

Merged
randy-waterhouse merged 2 commits from feat/native-api-tls into main 2026-11-12 01:24:07 +00:00
Conversation 0 Commits 2 Files changed 4 +69 -3
randy-waterhouse commented 2026-10-31 19:35:28 +00:00
Member
Copy link

Scope

Optional native HTTPS for the existing authenticated API; paired PEM configuration fails startup on missing/unreadable/invalid material. Existing HTTP and bearer authentication preserved. No deployment or GitOps changes.

Verification

  • Typecheck and build pass on current main base 5660b6f.
  • API regression tests: 31/31 pass, including TLS authentication, invalid PEM without plaintext fallback, persistence and idempotent restart.
  • Independent focused review of exact staged diff 99cb2486: no P0/P1. Two optional follow-ups: automated CLI configuration matrix, empty-string env semantics.
  • Full parallel suite: 1099/1100 pass; cron-follow-through configured-mandate test saw waiting instead of completed under concurrency. Isolated baseline and candidate cron tests both pass 5/5. Not hidden or treated as resolved. Serial full suite attempt hit execution timeout before completion.
  • Actual AgentOS HarnessAdapter + Node fetch tested separately against native TLS with private CA, hostname/bearer rejection, persistent SQL journal and client/listener restart: same run, one callback delivery. This is transport evidence, not real model execution.

Delivery boundary

This PR does not activate TLS, restart the main instance, change existing bindings or establish a live development cycle. Existing required CI/review protection must be preserved. Image build and digest verification remain pending.

## Scope Optional native HTTPS for the existing authenticated API; paired PEM configuration fails startup on missing/unreadable/invalid material. Existing HTTP and bearer authentication preserved. No deployment or GitOps changes. ## Verification - Typecheck and build pass on current main base 5660b6f. - API regression tests: 31/31 pass, including TLS authentication, invalid PEM without plaintext fallback, persistence and idempotent restart. - Independent focused review of exact staged diff 99cb2486: no P0/P1. Two optional follow-ups: automated CLI configuration matrix, empty-string env semantics. - Full parallel suite: 1099/1100 pass; cron-follow-through configured-mandate test saw waiting instead of completed under concurrency. Isolated baseline and candidate cron tests both pass 5/5. Not hidden or treated as resolved. Serial full suite attempt hit execution timeout before completion. - Actual AgentOS HarnessAdapter + Node fetch tested separately against native TLS with private CA, hostname/bearer rejection, persistent SQL journal and client/listener restart: same run, one callback delivery. This is transport evidence, not real model execution. ## Delivery boundary This PR does not activate TLS, restart the main instance, change existing bindings or establish a live development cycle. Existing required CI/review protection must be preserved. Image build and digest verification remain pending.
Resolve README conflict by taking main's rewritten README; the native TLS
operator notes move to docs/configuration.md next to API_SERVER_KEY.
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
harness/core!187
No description provided.