Publish curated ITWorx_MCP_Hub source from 2a948b17b420decaa9eda9f5754647e4c518bf1e

PUBLIC_SOURCE_EXPORT.md

@@ -1,3 +1,3 @@
 # Public source export
 
-This source snapshot was generated from the private canonical repository at revision `6c7434368ce2a594005983c5a6601a31a639e7f1`. It contains no private Git history or operational evidence. Changes are published from the canonical repository.
+This source snapshot was generated from the private canonical repository at revision `2a948b17b420decaa9eda9f5754647e4c518bf1e`. It contains no private Git history or operational evidence. Changes are published from the canonical repository.

PUBLIC_SOURCE_MANIFEST.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "sourceRevision": "6c7434368ce2a594005983c5a6601a31a639e7f1",
+  "sourceRevision": "2a948b17b420decaa9eda9f5754647e4c518bf1e",
   "files": [
     {
       "path": ".dockerignore",
@@ -2064,7 +2064,7 @@
     },
     {
       "path": "infrastructure/images/install-base-security-updates.sh",
-      "sha256": "2eb0c60f78bbcbd24855dcce3f5269db95d345dc05ed93ad0cc5d71a4ba4e68a",
+      "sha256": "96437b1afe5f5539affb4824191c990416205da0148aa5ffa82204d6d3d74f1f",
       "bytes": 2083
     },
     {
@@ -3024,8 +3024,8 @@
     },
     {
       "path": "tests/fixtures/wp200-compose-config.env",
-      "sha256": "af66f571ad525deb80ae779e5d70f0e59299978cf49ab1fedf5e3a5ba7f7a288",
+      "sha256": "beb0865fd116bdf1fae350803735ec15f273f326b0806b5c9bbf330807673aa6",
-      "bytes": 2169
+      "bytes": 2208
     },
     {
       "path": "tests/test_appops_connector.py",
@@ -3069,8 +3069,8 @@
     },
     {
       "path": "tests/test_compose.py",
-      "sha256": "f90782fa6a5de558792acb0d2b0da2fd624cfe04c74888a7b98804cc281cf15b",
+      "sha256": "f38ebacf3c4a9fdb510a8adaf3043a1b542537a0afdf9c9a27aab0a90518bf0e",
-      "bytes": 12469
+      "bytes": 16265
     },
     {
       "path": "tests/test_contextforge.py",
@@ -3454,7 +3454,7 @@
     },
     {
       "path": "tests/test_wp280_runtime_quality.py",
-      "sha256": "dca6a2d4305aade1e7af210e343fb4cf372136d81cc0da3a1ca920b1dc30202f",
+      "sha256": "c379b1e54bedb776a95d14051cab1757960ba79d9171854743cf23bcbb907ac2",
       "bytes": 5442
     },
     {

infrastructure/images/install-base-security-updates.sh

@@ -5,9 +5,9 @@ set -eu
 # explicit: a release build must fail rather than silently consume newer OS
 # packages that were not scanned.
 gzip_version='1.13-1+deb13u1'
-pcre2_version='10.46-1~deb13u2'
+pcre2_version='10.46-1~deb13u3'
 sqlite3_version='3.46.1-7+deb13u2'
-openssl_version='3.5.7-1~deb13u2'
+openssl_version='3.5.7-1~deb13u3'
 perl_base_version='5.40.1-6+deb13u1'
 util_linux_version='2.41.5-0+deb13u1'
 bsdutils_version='1:2.41.5-0+deb13u1'

tests/fixtures/wp200-compose-config.env

@@ -21,3 +21,4 @@ NPM_NETWORK_NAME=itworx-mcp-hub-npm
 INSPECTOR_BIND_IP=127.0.0.1
 COMPOSE_PROFILES=observability
 DEMO_TOKEN_REVOCATIONS_DIR_HOST=/tmp
+APPOPS_BUILD_DATE=2026-10-01T18:00:00Z

tests/test_compose.py

@@ -228,6 +228,87 @@ class ComposeContractTests(unittest.TestCase):
                 f"{name} retains a build definition; local build fallback is possible",
             )
 
+    def test_autodeploy_builds_every_owned_service_with_controller_provenance(self) -> None:
+        overlay = yaml.safe_load(
+            (ROOT / "infrastructure/compose/docker-compose.autodeploy.yml").read_text(
+                encoding="utf-8"
+            )
+        )
+        owned = {name for name, service in self.document["services"].items() if "build" in service}
+        self.assertTrue(owned)
+        for name in owned:
+            with self.subTest(service=name):
+                self.assertIn(name, overlay["services"])
+                service = overlay["services"][name]
+                self.assertIn("${GITEA_COMMIT_SHA:?", service["image"])
+                arguments = service["build"].get("args", {})
+                self.assertEqual(
+                    arguments.get("GIT_REVISION"),
+                    "${GITEA_COMMIT_SHA:?GITEA_COMMIT_SHA is required}",
+                )
+                self.assertEqual(
+                    arguments.get("BUILD_DATE"),
+                    "${APPOPS_BUILD_DATE:?APPOPS_BUILD_DATE is required}",
+                )
+                original_arguments = self.document["services"][name]["build"].get("args", {})
+                for key, value in original_arguments.items():
+                    self.assertEqual(arguments.get(key), value)
+
+    def test_real_autodeploy_preserves_intake_digest_and_owned_build_revision(self) -> None:
+        docker = shutil.which("docker")
+        if docker is None:
+            self.skipTest("docker CLI is not available in this environment")
+        revision = "a" * 40
+        built_at = "2026-10-01T18:00:00Z"
+        with tempfile.TemporaryDirectory() as secrets_dir:
+            for name in self.document["secrets"]:
+                (Path(secrets_dir) / name).write_text("test-fixture-secret\n", encoding="utf-8")
+            command = [docker, "compose", "--profile", "knowledge-intake"]
+            for filename in (
+                "docker-compose.yml",
+                "docker-compose.prod.yml",
+                "docker-compose.autodeploy.yml",
+                "docker-compose.ingestion.prod.yml",
+            ):
+                command.extend(["-f", str(COMPOSE.parent / filename)])
+            command.extend(
+                [
+                    "--env-file",
+                    str(ROOT / "tests/fixtures/wp200-compose-config.env"),
+                    "config",
+                    "--format",
+                    "json",
+                ]
+            )
+            completed = subprocess.run(  # noqa: S603
+                command,
+                capture_output=True,
+                text=True,
+                check=False,
+                env={
+                    **os.environ,
+                    "SECRETS_DIR": secrets_dir,
+                    "COMPOSE_PROFILES": "",
+                    "CONNECTOR_INGESTION_IMAGE": f"registry.example.test/intake@sha256:{'b' * 64}",
+                    "GITEA_COMMIT_SHA": revision,
+                    "APPOPS_BUILD_DATE": built_at,
+                },
+            )
+        self.assertEqual(completed.returncode, 0, completed.stderr)
+        rendered = json.loads(completed.stdout)
+        self.assertEqual(len(rendered["services"]), 17)
+        self.assertEqual(
+            rendered["services"]["connector-ingestion"]["image"],
+            f"registry.example.test/intake@sha256:{'b' * 64}",
+        )
+        self.assertNotIn("build", rendered["services"]["connector-ingestion"])
+        for name, service in rendered["services"].items():
+            if "build" not in service:
+                continue
+            self.assertEqual(service["build"]["args"]["GIT_REVISION"], revision, name)
+            self.assertEqual(service["build"]["args"]["BUILD_DATE"], built_at, name)
+            self.assertTrue(service["image"].endswith(f":{revision}"), name)
+
     def test_unraid_folder_view_groups_the_complete_production_stack(self) -> None:
         definition_path = ROOT / "infrastructure" / "unraid" / "folder-view3-itworx-mcp-hub.json"
         definition = json.loads(definition_path.read_text(encoding="utf-8"))

tests/test_wp280_runtime_quality.py

@@ -67,11 +67,11 @@ def test_base_security_layer_pins_and_verifies_staging_fixed_versions() -> None:
     )
     fixed_packages = {
         "gzip": ("gzip", "1.13-1+deb13u1"),
-        "libpcre2-8-0": ("pcre2", "10.46-1~deb13u2"),
+        "libpcre2-8-0": ("pcre2", "10.46-1~deb13u3"),
         "libsqlite3-0": ("sqlite3", "3.46.1-7+deb13u2"),
-        "libssl3t64": ("openssl", "3.5.7-1~deb13u2"),
+        "libssl3t64": ("openssl", "3.5.7-1~deb13u3"),
-        "openssl": ("openssl", "3.5.7-1~deb13u2"),
+        "openssl": ("openssl", "3.5.7-1~deb13u3"),
-        "openssl-provider-legacy": ("openssl", "3.5.7-1~deb13u2"),
+        "openssl-provider-legacy": ("openssl", "3.5.7-1~deb13u3"),
         "perl-base": ("perl_base", "5.40.1-6+deb13u1"),
     }
     for package, (variable, version) in fixed_packages.items():