Skip to content

Mirror sync e8014c90 - #302

Merged
xuezhma merged 1 commit into
mainfrom
automated/mirror-sync-20261022T215223Z
Oct 22, 2026
Merged

Mirror sync e8014c90#302
xuezhma merged 1 commit into
mainfrom
automated/mirror-sync-20261022T215223Z

Conversation

@xuezhma

@xuezhma xuezhma commented Oct 22, 2026

Copy link
Copy Markdown
Collaborator

Automated mirror sync from the internal repository. Generated by the github-sync CI job; review the diff before merging.

@xuezhma
xuezhma requested a review from a team October 22, 2026 21:52
@xuezhma
xuezhma added this pull request to the merge queue Oct 22, 2026
Merged via the queue into main with commit 5c432ab Oct 22, 2026
5 checks passed
quixoticmonk added a commit to quixoticmonk/context-ontology-accelerator that referenced this pull request Oct 23, 2026
@quixoticmonk
fix(infrastructure): sync CR-A from v0.3.7 (P0 CDK parity, aws#301 aw…
88dac39 
…s#302)

Bundle libs/common into the aoss-proxy Lambda zip so the handler's
coa_common import resolves at cold start.

## Ported
- serve/lambdas/aoss-proxy/Makefile: copy libs/common/src into the zip
  and install the CDK serve-stack.ts pipDeps (opensearch-py,
  requests-aws4auth, cedarpy, cryptography, pydantic-settings, PyJWT,
  requests, structlog). Pre-existing bug, not introduced by v0.3.7:
  the zip previously failed with "No module named 'coa_common'".
- Same file carries certifi>=2026.10.19 (see CR-E); kept here so the
  Makefile lands in one commit.

## Hand-merged
- None

## Skipped
- infra/* (NG.1)

## Verified
- terraform fmt: no drift; terraform validate: 10/10 stacks
- pytest across 9 Python packages: 12,535 passed, 0 failed
- root tests/unit: 4 failures, identical on pre-sync HEAD 4b5fd11 (read
  infra/ and scripts/preflight-deploy.sh, removed on this branch)
- web-app vitest 1,508/1,508 + build OK; mcp-proxy 50/50
- rebuilt aoss-proxy.zip: contains coa_common and certifi>=2026.10.19

## Follow-up
- None

Upstream-Release: v0.3.7
quixoticmonk added a commit to quixoticmonk/context-ontology-accelerator that referenced this pull request Oct 23, 2026
@quixoticmonk
feat(sources+libs): sync from v0.3.7 (aws#301 aws#302, part 1/2)
d3d83ed 
Import upstream libs/common, Smithy models and packages/sources, and
regenerate the merged OpenAPI spec.

## Ported
- libs/common: idempotency, pagination and testing helpers
- models/: Smithy model changes (clientToken, contract bounds)
- packages/sources: contract bounds, client-safe errors, CreateSource
  idempotency
- infra-tf/artifacts/openapi/merged.json: regenerated (77 paths) per
  step 4A

## Hand-merged
- None (CLEAN/NEW imports, step 4)

## Skipped
- infra/* (NG.1)

## Verified
- terraform fmt: no drift; terraform validate: 10/10 stacks
- pytest across 9 Python packages: 12,535 passed, 0 failed
- root tests/unit: 4 failures, identical on pre-sync HEAD 4b5fd11 (read
  infra/ and scripts/preflight-deploy.sh, removed on this branch)
- web-app vitest 1,508/1,508 + build OK; mcp-proxy 50/50
- Smithy/API/web-app parity walked per step 4A: all operations wired
  except the 2 paths already left unrouted intentionally

## Follow-up
- None

Upstream-Release: v0.3.7
quixoticmonk added a commit to quixoticmonk/context-ontology-accelerator that referenced this pull request Oct 23, 2026
@quixoticmonk
feat(packages): sync backend packages from v0.3.7 (aws#301 aws#302, p…
65a1d53 
…art 2/2)

Import upstream changes to the remaining backend Python packages.

## Ported
- packages/context-manager, control-plane, data-layer, mcp-server,
  metric-service, ontology-engine, vkg: API contract conformance,
  contract bounds, idempotent creates, pagination, error-message
  hardening

## Hand-merged
- None (CLEAN/NEW imports, step 4)

## Skipped
- infra/* (NG.1)

## Verified
- terraform fmt: no drift; terraform validate: 10/10 stacks
- pytest across 9 Python packages: 12,535 passed, 0 failed
- root tests/unit: 4 failures, identical on pre-sync HEAD 4b5fd11 (read
  infra/ and scripts/preflight-deploy.sh, removed on this branch)
- web-app vitest 1,508/1,508 + build OK; mcp-proxy 50/50

## Follow-up
- None

Upstream-Release: v0.3.7
quixoticmonk added a commit to quixoticmonk/context-ontology-accelerator that referenced this pull request Oct 23, 2026
@quixoticmonk
feat(web-app+mcp-proxy): sync from v0.3.7 (aws#301 aws#302)
1c23456 
Import upstream web-app and mcp-proxy changes.

## Ported
- packages/web-app: i18n, language menu, breadcrumb trail, pagination
  utils, settings e2e specs
- packages/mcp-proxy: package.json bump

## Hand-merged
- None (CLEAN/NEW imports, step 4)

## Skipped
- infra/* (NG.1)

## Verified
- terraform fmt: no drift; terraform validate: 10/10 stacks
- pytest across 9 Python packages: 12,535 passed, 0 failed
- root tests/unit: 4 failures, identical on pre-sync HEAD 4b5fd11 (read
  infra/ and scripts/preflight-deploy.sh, removed on this branch)
- web-app vitest 1,508/1,508 + build OK; mcp-proxy 50/50

## Follow-up
- None

Upstream-Release: v0.3.7
quixoticmonk added a commit to quixoticmonk/context-ontology-accelerator that referenced this pull request Oct 23, 2026
@quixoticmonk
fix(infrastructure): sync CR-D from v0.3.7 (P1 idempotency table, aws…
0b20ba3 
…#301 aws#302)

Add the clientToken idempotency-record table and wire it to the five
create-serving Lambdas. Without it, create calls carrying a clientToken
return 503.

## Ported
- foundation/authnz: DynamoDB idempotency table; name and ARN outputs,
  name published to SSM by the module
- stacks/10-foundation: SSM /authnz/idempotency-table-arn
- stacks/20-namespace, 30-services, 40-sources: SSM data sources and
  module wiring
- namespace, metric-service, ontology (api-proxy), sources modules:
  IDEMPOTENCY_TABLE env var plus idempotency.tf granting Get/Put/Update/
  DeleteItem scoped to that table only (namespace covers namespace and
  grants Lambdas)

## Hand-merged
- None

## Skipped
- infra/* (NG.1)

## Verified
- terraform fmt: no drift; terraform validate: 10/10 stacks
- pytest across 9 Python packages: 12,535 passed, 0 failed
- root tests/unit: 4 failures, identical on pre-sync HEAD 4b5fd11 (read
  infra/ and scripts/preflight-deploy.sh, removed on this branch)
- web-app vitest 1,508/1,508 + build OK; mcp-proxy 50/50

## Follow-up
- None

Upstream-Release: v0.3.7
quixoticmonk added a commit to quixoticmonk/context-ontology-accelerator that referenced this pull request Oct 23, 2026
@quixoticmonk
fix(infrastructure): sync CR-E from v0.3.7 (P1 certifi pin + edge auth,
697e887 
aws#301 aws#302)

Pin certifi past the compromised emSign roots and add an optional
Lambda@Edge login gate for the web distribution.

## Ported
- data-layer and ontology-api Lambda Makefiles: certifi>=2026.10.19,
  each spec quoted so >= is not read as a shell redirect (aoss-proxy
  pin landed with CR-A)
- foundation/web: edge_auth_version_arn (default null) attaches a
  viewer-request Lambda@Edge association to every cache behavior
- stacks/60-api-edge: edge_auth_version_arn variable passed to web.
  Default off, so existing deployments are unchanged

## Hand-merged
- None

## Skipped
- infra/* (NG.1)

## Verified
- terraform fmt: no drift; terraform validate: 10/10 stacks
- pytest across 9 Python packages: 12,535 passed, 0 failed
- root tests/unit: 4 failures, identical on pre-sync HEAD 4b5fd11 (read
  infra/ and scripts/preflight-deploy.sh, removed on this branch)
- web-app vitest 1,508/1,508 + build OK; mcp-proxy 50/50
- rebuilt data-layer and ontology-api zips: certifi>=2026.10.19 present

## Follow-up
- None

Upstream-Release: v0.3.7
quixoticmonk added a commit to quixoticmonk/context-ontology-accelerator that referenced this pull request Oct 23, 2026
@quixoticmonk
chore: sync CR-F sub-1 from v0.3.7 (P2 access-log principalId + non-c…
68702ef 
…ode drift, aws#301 aws#302)

Record the custom-authorizer caller in API access logs and bring over
upstream workspace, CI, script and doc drift.

## Ported
- services/api: access-log format adds
  principalId = $context.authorizer.principalId (identity.caller/user
  are always "-" behind a custom authorizer)
- .github workflows/actions, nx.json, package.json, pyproject.toml,
  uv.lock, VERSION, NOTICE, README.md
- scripts/setup-dev.sh, scripts/smithy-generate.sh, tests/unit
- connectors/databricks/cdk (connector code, not infra/)
- external-docs package.json and content pages (except deploying.md)

## Hand-merged
- DRIFT files merged keeping Terraform wording (step 5); pnpm-workspace
  .yaml and retired destroy-dev target kept ours (step 5A)

## Skipped
- infra/* (NG.1)
- 13 CDK deploy/destroy helper scripts and their tests (NG.1)
- AgentCore SG retain-on-destroy and (SO0376) stack description:
  CloudFormation-only, no Terraform equivalent

## Verified
- terraform fmt: no drift; terraform validate: 10/10 stacks
- pytest across 9 Python packages: 12,535 passed, 0 failed
- root tests/unit: 4 failures, identical on pre-sync HEAD 4b5fd11 (read
  infra/ and scripts/preflight-deploy.sh, removed on this branch)
- web-app vitest 1,508/1,508 + build OK; mcp-proxy 50/50
- pyproject.toml requires uv>=0.13.4; local uv upgraded 0.9.28 -> 0.13.5

## Follow-up
- None

Upstream-Release: v0.3.7
quixoticmonk added a commit to quixoticmonk/context-ontology-accelerator that referenced this pull request Oct 23, 2026
@quixoticmonk
feat(coa-skills): sync control-plane agent skill from v0.3.7 (aws#301 a…
e2d0609 
…ws#302)

Add upstream's control-plane agent skill, missed by the bulk import;
the README.md tree committed in 68702ef already lists coa-skills/.

## Ported
- coa-skills/control-plane/SKILL.md: control-plane lifecycle guide
  for agents (sources, induction, proposals, ontologies, grants)
- coa-skills/control-plane/scripts/coa_login.py: PKCE sign-in and
  token-cache helper for the web and mcp Cognito clients

## Hand-merged
- None (NEW files, byte-identical to v0.3.7, step 4)

## Skipped
- infra/* (NG.1)

## Verified
- Both files byte-identical to v0.3.7 (cmp)
- Not run against the TF deployment: Quick Start SSM names
  (/<prefix>/cognito-domain-prefix, userpool-client-id,
  mcp-client-id) are the CDK names and are unchecked against what
  the Terraform stacks publish

## Follow-up
- Adapt SKILL.md Quick Start to the Terraform SSM parameter names

Upstream-Release: v0.3.7
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@xuezhma