Replace Air's kill-and-rerun loop in the debug image with the pilot
persistent-delve supervisor: src/dev/dlv-watch.sh owns one headless
`dlv exec --multiclient --continue` server, rebuilds ./tmp/main on save and
restarts only the debug target through the tiny rpc2 client in
src/dev/dlv-restart. An attached VS Code session (and its breakpoints) now
survives saves instead of reconnecting after every reload.
The debug compose builds locally with `pull_policy: build` and without
`build.network: host`: compose cannot grant the network.host entitlement, so
a cold `up` previously failed with "additional privileges requested"; the
default bridge reaches the dev Gitea for module resolution.
The hardened runner's job network has no internet access, so `apk add` and
downloading addlicense from GitHub cannot work. git, curl, jq and addlicense
are baked into the runner's job image (infra/gitea-runner/ci-tools.Dockerfile).
The license bot service (Dcntrlized/license-bot) is authoritative: it amends
missing AGPL headers into the PR head commit, including for fork PRs, and
reports the license-bot / addlicense commit status. This workflow now only
reports an honest advisory signal, holds no secrets and never writes.
Renames the server-side plaintext escape hatch from INSECURE_INTERNAL to
DCNTRLIZED_DEBUG in the debug compose and the listener log line; bumps the
shared auth module.
- go.mod: dcntrlized-auth v0.1.1 -> v0.1.2 (tlsutil.IsDev/AuthBaseURL and the
identity-mount client fallback).
- docker-compose.debug.yaml: DEV_MODE replaced by DCNTRLIZED_DEV=true (the
single dev selector); mount the devboot-issued identity at the shared-module
default /dcntrlized/pki so the authproxy edge is mTLS. INSECURE_INTERNAL=1
stays: the RN-facing listener must stay plaintext.
Serve the listener over TLS with ClientAuth=RequireAndVerifyClientCert
trusting the instance CA (shared tlsutil.ServerConfig): only Maestro can
drive actions (T4), and the peer edge is encrypted. INSECURE_INTERNAL=1
(dev debug compose) keeps the listener plaintext for the RN client's
direct mode and hot reload.
- handlers/auth/proxy.go: new MeHandler proxies GET /auth/me to the
shared auth service (boot revalidation for direct-mode clients).
- main.go: register /auth/me.
- actions/auth.go: Me proxies GET /action/me; Logout is method-aware
(POST revokes via {refreshToken}, GET stays a bodyless no-op).
- action dispatcher: GET case me, POST case logout.
- go build + go vet clean.
Admin