One toolchain across the estate. The tree carried 1.26.0, .1, .3, .4 and .5
at once, so which compiler built a binary depended on which repo it came
from.
Co-authored-by: Hanzo Dev <[email protected]>
hanzoai/ci keeps the reusable at .github/workflows/build.yml — the one path
both planes resolve, since github.com reads a reusable only from there and the
forge reads it too. The v1 tag moved with it, so a caller still naming
.hanzo/workflows/build.yml asks for a blob that is not in the tree:
InsertRun: read hanzoai/ci@v1:.hanzo/workflows/build.yml: object does not exist
The caller itself stays at .hanzo/workflows/cicd.yml on purpose: github.com has
no runner for these labels, so a caller placed there could never be scheduled.
Co-authored-by: Hanzo Dev <[email protected]>
IAM stamps `type` on a token the client_credentials grant minted and leaves it
off a person's, resolving it from the grant shape — a fact only the issuer holds
and no caller can ask for. This Claims never carried the field, so every
consumer reading these claims had to work the class out for itself.
Each available inference is wrong somewhere. The subject's shape is the tempting
one, since a machine subject reads `owner/name`; but GetUserBySubject resolves
that same form to a PERSON whenever the token names the account rather than its
id, so the inference reports those people as machines. A consumer that files the
two classes in two places — which a custody path must, or one principal's path
becomes another's — then files a person under a machine's name.
Field parity with what IAM emits is this package's whole reason to exist, so the
claim belongs here rather than being read a second time beside it.
github.com has no runner for hanzo-build-linux-amd64, so a caller under
.github/workflows is a gate that can never be scheduled. This is the ~7-line
caller on the plane that can (git.hanzo.ai git-runner fleet), pinned @v1.
Co-authored-by: Hanzo Dev <[email protected]>
This repo shipped with no LICENSE, which makes it legally ambiguous the moment
it is public: absent an explicit grant, default copyright reserves all rights,
so a reader may look but not use — the opposite of what publishing it is for.
Original Hanzo work (single initial commit, no upstream lineage), so the terms
are ours to set, and the fleet already has one answer: the HIP-0137 dual offer
carried verbatim from the canonical files rather than retyped.
Co-authored-by: Hanzo Dev <[email protected]>
One canonical Claims + User, one Signer (RS256/RS512/ES256/384/512/MLDSA65,
default RS256), one Parser/Verifier (cert + JWKS paths), one JWKS builder —
imported by iam2 (mints), cloud + gateway (validate), collapsing three
hand-synced JWT-validator copies into one. Clean leaf (go-jose + golang-jwt +
luxfi/crypto/mldsa only; zero hanzoai/* imports, no cycle). Ported the ML-DSA-65
signing method + Claims shape from hanzoai/iam v1 with field parity on every
validated field (owner/scope/project/azp/aud/iss/sub/email). 9/9 tests green
incl RS256+MLDSA65 round-trip, JWKS, and audience/issuer/expiry/wrong-key
rejection.
zeekayandHanzo Dev