Cloud-SDK extraction — Phase A: host-side IaCStateBackend resolution + security guards#670

Merged

intel352 merged 40 commits into

mainfrom

feat/cloud-sdk-extraction-pa-host

May 14, 2026

Commits on May 14, 2026

docs(plans): cloud-SDK extraction design — workflow core → strict-contract plugins

intel352
and
claude
committed
docs(plans): cloud-SDK extraction design — adversarial review cycle 1 revisions

intel352
and
claude
committed
docs(plans): cloud-SDK extraction design — adversarial review cycle 2 revisions

intel352
and
claude
committed
docs(plans): fix stale Phase A/B refs + Status line post-cycle-2

intel352
and
claude
committed
docs(plans): cloud-SDK extraction design — adversarial review cycle 3 revisions

intel352
and
claude
committed
docs(plans): cloud-SDK extraction design — adversarial review cycle 4 revisions

intel352
and
claude
committed
docs(plans): cloud-SDK extraction design — adversarial review cycle 5 revisions

intel352
and
claude
committed
docs(plans): cloud-SDK extraction design — adversarial review cycle 6 revisions

intel352
and
claude
committed
docs(plans): cloud-SDK extraction design — adversarial review cycle 7 revisions

intel352
and
claude
committed
docs(plans): cloud-SDK extraction design — cycle-8 re-baseline against post-#653 main

intel352
and
claude
committed
docs(plans): cloud-SDK extraction design — cycle-9 re-baseline + audit script

intel352
and
claude
committed
docs(plans): cloud-SDK extraction design — cycle-10 re-baseline, AWS scope boundary explicit

intel352
and
claude
committed
docs(plans): cloud-SDK extraction design — cycle-11 PASS, minor cleanups

intel352
and
claude
committed
fix(scripts): audit-cloud-symbols single-line-import grep poisoned the pipe

intel352
and
claude
committed
docs(plans): cloud-SDK extraction implementation plan (Phase 0 + Phase A)

intel352
and
claude
committed
docs(plans): cloud-SDK extraction plan — address plan-phase adversarial review

intel352
and
claude
committed
docs(plans): cloud-SDK extraction plan — plan-review cycle 2 fixes

intel352
and
claude
committed
docs(plans): cloud-SDK extraction plan — plan-review cycle 3 PASS + minor cleanups

intel352
and
claude
committed
chore: lock scope for cloud-sdk-extraction (alignment passed)
intel352
committed
refactor(module): split platform_kubernetes_kind.go into _core + _gke
intel352
committed
docs(module): add file-purpose headers to platform_kubernetes _core/_gke
intel352
committed
docs(module): fix stale 'Requires the Azure SDK' comment on aksBackend
intel352
committed
ci(audit): enforce k8s-backend init() partition + run audit on every PR
intel352
committed
docs(plans): IaCStateBackend transport benchmark result — decision pending

intel352
and
claude
committed
docs(plans): Task 6 resolved — unary IaCStateBackend LOCKED (operator-confirmed)

intel352
and
claude
committed
Revert "chore: lock scope for cloud-sdk-extraction (alignment passed)"
intel352
committed
docs(plans): amend cloud-sdk-extraction plan — PR 6 (ctx) + de-gate PR 4

intel352
and
claude
committed
chore: re-lock scope for cloud-sdk-extraction (amended — alignment re-passed)
intel352
committed
feat(proto): add IaCStateBackend service to iac.proto
intel352
committed
test(module): add IaCStateBackend gRPC-vs-in-process benchmark harness
intel352
committed
test(wftest): add IaCStateBackend to iacServiceChecks coverage table
intel352
committed
feat(module): IaCState proto converters + grpcIaCStateStore client adapter
intel352
committed
docs(module): note context.Background() follow-up on grpcIaCStateStore
intel352
committed
feat(module): engine-side iac.state plugin-backend registry + dispatch
intel352
committed
feat(module): exempt *_ref keys from redaction; lock in credentials: redaction
intel352
committed
refactor(module): name the _ref redaction-exemption suffix as a const
intel352
committed
test(plugin/external): guard against gRPC body-logging interceptors
intel352
committed
test(plugin/external): broaden interceptor guard to Stream interceptors
intel352
committed
Merge remote-tracking branch 'origin/main' into feat/cloud-sdk-extraction-pa-host
intel352
committed
fix(iac-host): narrow _ref redaction exemption, validate registry input, harden guard test

intel352
and
claude
committed