Refs #117 (prerequisite for encrypted chat attachments). Stacked on #139; rebase/retarget after preceding squash merges.
Add an optional private boolean to run_job. Resolve the key internally using the node's existing SealingKey callback, shared with private-file uploads and explicit job submissions. Never accept or expose encryption key bytes as a model tool argument. Missing/erroring key providers reject before pool submission, with no public fallback; public jobs do not load keys. Explain private inputs and trusted-worker key access in planner instructions.
Four planner tests cover key propagation, fail-closed behavior, public-job compatibility and schema key isolation. go test ./apps/sisyphusd/planner and git diff --check passed with the pinned Go 1.27.1 dev shell. The broader go test ./apps/sisyphusd is still running locally at PR creation; no full-daemon success claimed yet.
This adds the backend prerequisite, not encrypted chat upload defaults, reference-safe attachment cleanup, real-model compliance or complete end-to-end acceptance. Those remain pending and #117 is not closed.
Refs #117 (prerequisite for encrypted chat attachments). Stacked on #139; rebase/retarget after preceding squash merges.
Add an optional private boolean to run_job. Resolve the key internally using the node's existing SealingKey callback, shared with private-file uploads and explicit job submissions. Never accept or expose encryption key bytes as a model tool argument. Missing/erroring key providers reject before pool submission, with no public fallback; public jobs do not load keys. Explain private inputs and trusted-worker key access in planner instructions.
Four planner tests cover key propagation, fail-closed behavior, public-job compatibility and schema key isolation. go test ./apps/sisyphusd/planner and git diff --check passed with the pinned Go 1.27.1 dev shell. The broader go test ./apps/sisyphusd is still running locally at PR creation; no full-daemon success claimed yet.
This adds the backend prerequisite, not encrypted chat upload defaults, reference-safe attachment cleanup, real-model compliance or complete end-to-end acceptance. Those remain pending and #117 is not closed.
Validation update: the broader ./apps/sisyphusd suite completed with failure (119s). One observed failure was TestAnAgentUsesThePoolThroughTheNode: cancel_job attempted to cancel a detached primes job that had already succeeded. This test goes through MCP rather than the changed planner. That does not yet establish it is unrelated; I am repeating it separately and will compare baseline if it reproduces. The focused planner tests passed. Keeping this PR draft; no full-daemon success claimed.
Validation update: the broader ./apps/sisyphusd suite completed with failure (119s). One observed failure was TestAnAgentUsesThePoolThroughTheNode: cancel_job attempted to cancel a detached primes job that had already succeeded. This test goes through MCP rather than the changed planner. That does not yet establish it is unrelated; I am repeating it separately and will compare baseline if it reproduces. The focused planner tests passed. Keeping this PR draft; no full-daemon success claimed.
Baseline comparison: the isolated TestAnAgentUsesThePoolThroughTheNode failed identically on both this branch and clean current dev (dca38b5), each ~4.26s: the detached primes job succeeded before cancel_job. Both runs used the same Nix Go 1.27.1 compiler. This establishes that specific cancellation-test failure predates this PR, but does not prove every full-suite failure is baseline. Continuing focused planner/private-file integration checks; draft status remains.
Baseline comparison: the isolated TestAnAgentUsesThePoolThroughTheNode failed identically on both this branch and clean current dev (dca38b5), each ~4.26s: the detached primes job succeeded before cancel_job. Both runs used the same Nix Go 1.27.1 compiler. This establishes that specific cancellation-test failure predates this PR, but does not prove every full-suite failure is baseline. Continuing focused planner/private-file integration checks; draft status remains.
Focused daemon integration checks passed: go test ./apps/sisyphusd -run '^(TestAQuestionIsPlannedComputedAndAnswered|TestTheDesktopSetsTheModelAndTheKeyStaysPut|TestTheDesktop|TestTheNodesSealingKey)' -count=1. This includes the existing private desktop file/job flow, planner compute loop and node-key persistence. It does not replace a full-suite green run or validate private chat attachment uploads (still unimplemented).
Focused daemon integration checks passed: go test ./apps/sisyphusd -run '^(TestAQuestionIsPlannedComputedAndAnswered|TestTheDesktopSetsTheModelAndTheKeyStaysPut|TestTheDesktop|TestTheNodesSealingKey)' -count=1. This includes the existing private desktop file/job flow, planner compute loop and node-key persistence. It does not replace a full-suite green run or validate private chat attachment uploads (still unimplemented).
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Refs #117 (prerequisite for encrypted chat attachments). Stacked on #139; rebase/retarget after preceding squash merges.
Add an optional private boolean to run_job. Resolve the key internally using the node's existing SealingKey callback, shared with private-file uploads and explicit job submissions. Never accept or expose encryption key bytes as a model tool argument. Missing/erroring key providers reject before pool submission, with no public fallback; public jobs do not load keys. Explain private inputs and trusted-worker key access in planner instructions.
Four planner tests cover key propagation, fail-closed behavior, public-job compatibility and schema key isolation. go test ./apps/sisyphusd/planner and git diff --check passed with the pinned Go 1.27.1 dev shell. The broader go test ./apps/sisyphusd is still running locally at PR creation; no full-daemon success claimed yet.
This adds the backend prerequisite, not encrypted chat upload defaults, reference-safe attachment cleanup, real-model compliance or complete end-to-end acceptance. Those remain pending and #117 is not closed.
Validation update: the broader ./apps/sisyphusd suite completed with failure (119s). One observed failure was TestAnAgentUsesThePoolThroughTheNode: cancel_job attempted to cancel a detached primes job that had already succeeded. This test goes through MCP rather than the changed planner. That does not yet establish it is unrelated; I am repeating it separately and will compare baseline if it reproduces. The focused planner tests passed. Keeping this PR draft; no full-daemon success claimed.
Baseline comparison: the isolated TestAnAgentUsesThePoolThroughTheNode failed identically on both this branch and clean current dev (
dca38b5), each ~4.26s: the detached primes job succeeded before cancel_job. Both runs used the same Nix Go 1.27.1 compiler. This establishes that specific cancellation-test failure predates this PR, but does not prove every full-suite failure is baseline. Continuing focused planner/private-file integration checks; draft status remains.Focused daemon integration checks passed: go test ./apps/sisyphusd -run '^(TestAQuestionIsPlannedComputedAndAnswered|TestTheDesktopSetsTheModelAndTheKeyStaysPut|TestTheDesktop|TestTheNodesSealingKey)' -count=1. This includes the existing private desktop file/job flow, planner compute loop and node-key persistence. It does not replace a full-suite green run or validate private chat attachment uploads (still unimplemented).