Skip to content

Commit 8ed1941

Browse files
hyperpolymathclaude
hyperpolymath
and
claude
committed
feat: AWS/GCP cartridge hardening, duckdb-mcp, federation expansion
- Fix Containerfile license label (MPL-2.0 → PMPL-1.0-or-later) - Migrate README.md → README.adoc - Harden AWS and GCP cartridge ABI proofs, FFI layers, and V adapters - Add duckdb-mcp cartridge with full ABI/FFI/adapter/panels stack - Expand federation Zig layer with multi-node consensus and routing - Expand MCP bridge with additional tool handlers - Add database FFI connection pooling and prepared statements - Add health-check and SELinux context scripts - Gitignore panic-attack scan reports Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
1 parent 1ac59d2 commit 8ed1941

40 files changed

Lines changed: 2582 additions & 463 deletions

‎.gitignore‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -135,3 +135,6 @@ zig-out/
135135

136136
# Cartridge minter build artifacts
137137
tools/cartridge-minter/target/
138+
139+
# panic-attack scan reports
140+
panic-attack-report*.json

‎Containerfile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ LABEL org.opencontainers.image.title="Bundle of Joy Server (MCP Bridge)" \
1818
org.opencontainers.image.url="https://github.com/hyperpolymath/boj-server" \
1919
org.opencontainers.image.source="https://github.com/hyperpolymath/boj-server" \
2020
org.opencontainers.image.vendor="hyperpolymath" \
21-
org.opencontainers.image.licenses="MPL-2.0" \
21+
org.opencontainers.image.licenses="PMPL-1.0-or-later" \
2222
org.opencontainers.image.authors="Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>"
2323

2424
WORKDIR /app

‎README.adoc‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
= boj-server
2+
:toc: preamble
3+
:icons: font
4+
5+

‎README.md‎

Lines changed: 0 additions & 123 deletions
This file was deleted.

‎cartridges/aws-mcp/README.adoc‎

Lines changed: 59 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -9,37 +9,79 @@ Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
99

1010
== Overview
1111

12-
AWS cloud cartridge for the BoJ server. Provides type-safe access to AWS
12+
AWS SDK cartridge for the BoJ server. Provides type-safe access to AWS
1313
services via Signature V4 authentication, with credentials proxied through
14-
vault-mcp. Supports S3, EC2, Lambda, SQS, and DynamoDB with configurable
15-
region and automatic service endpoint routing.
14+
vault-mcp. Supports 7 services and 21 actions with configurable region,
15+
automatic endpoint routing, rate-limit back-pressure, and mutability tracking.
1616

1717
=== State Machine
1818

1919
`Unauthenticated -> Authenticated -> RateLimited -> Authenticated` (normal flow)
2020

2121
`Authenticated -> Error -> Unauthenticated` (error recovery)
2222

23-
=== Actions (16)
23+
=== Services (7)
2424

25-
[cols="1,1"]
25+
[cols="1,1,2"]
2626
|===
27-
| Service | Actions
27+
| Service | Endpoint | Description
2828

2929
| S3
30-
| ListBuckets, GetObject, PutObject, DeleteObject
31-
32-
| EC2
33-
| ListInstances, StartInstance, StopInstance
30+
| `s3.{region}.amazonaws.com`
31+
| Object storage — list buckets, get/put/delete objects, presigned URLs
3432

3533
| Lambda
36-
| ListFunctions, InvokeFunction
34+
| `lambda.{region}.amazonaws.com`
35+
| Serverless compute — list functions, invoke
36+
37+
| DynamoDB
38+
| `dynamodb.{region}.amazonaws.com`
39+
| NoSQL database — query, scan, get/put items
3740

3841
| SQS
39-
| ListQueues, SendMessage, ReceiveMessage
42+
| `sqs.{region}.amazonaws.com`
43+
| Message queues — list queues, send/receive/delete messages
4044

41-
| DynamoDB
42-
| ListTables, PutItem, GetItem, QueryTable
45+
| CloudWatch
46+
| `monitoring.{region}.amazonaws.com`
47+
| Metrics — get metrics, put metric data
48+
49+
| IAM
50+
| `iam.amazonaws.com`
51+
| Identity management — list users, list roles (read-only)
52+
53+
| STS
54+
| `sts.{region}.amazonaws.com`
55+
| Security tokens — get caller identity, assume role
56+
|===
57+
58+
=== Actions (21)
59+
60+
[cols="1,1,1"]
61+
|===
62+
| Service | Action | Mutating?
63+
64+
| S3 | S3ListBuckets | No
65+
| S3 | S3GetObject | No
66+
| S3 | S3PutObject | Yes
67+
| S3 | S3DeleteObject | Yes
68+
| S3 | S3PresignedUrl | No
69+
| Lambda | LambdaListFunctions | No
70+
| Lambda | LambdaInvoke | Yes
71+
| DynamoDB | DynamoQuery | No
72+
| DynamoDB | DynamoScan | No
73+
| DynamoDB | DynamoPutItem | Yes
74+
| DynamoDB | DynamoGetItem | No
75+
| SQS | SqsListQueues | No
76+
| SQS | SqsSendMessage | Yes
77+
| SQS | SqsReceiveMessage | No
78+
| SQS | SqsDeleteMessage | Yes
79+
| CloudWatch | CwGetMetrics | No
80+
| CloudWatch | CwPutMetricData | Yes
81+
| IAM | IamListUsers | No
82+
| IAM | IamListRoles | No
83+
| STS | StsGetCallerIdentity | No
84+
| STS | StsAssumeRole | Yes
4385
|===
4486

4587
== Architecture
@@ -54,7 +96,7 @@ region and automatic service endpoint routing.
5496

5597
| FFI
5698
| Zig
57-
| C-compatible implementation with thread-safe session pool, service routing
99+
| C-compatible implementation with thread-safe session pool, service routing, mutability checks
58100

59101
| Adapter
60102
| V-lang
@@ -77,4 +119,5 @@ cd abi && idris2 --check aws_mcp.ipkg
77119

78120
== Status
79121

80-
Development — customised with AWS-specific state machine, auth, and service routing.
122+
Development -- v0.3.0: expanded to 7 services (S3, Lambda, DynamoDB, SQS, CloudWatch, IAM, STS)
123+
with 21 actions, presigned URL support, and mutability tracking.

0 commit comments

Comments
 (0)