Add validated repository patch transport

.gitea/workflows/azeroth-ops.yml

@@ -0,0 +1,45 @@
+name: AzerothAI Host Operations
+
+on:
+  workflow_dispatch:
+    inputs:
+      operation:
+        description: Approved AzerothAI operation
+        required: true
+        default: status
+
+jobs:
+
+  azeroth:
+
+    runs-on: azerothai-host
+
+    timeout-minutes: 60
+
+    env:
+      AZEROTH_OPERATION: ${{ inputs.operation }}
+      AZEROTH_ACTOR: ${{ gitea.actor }}
+      AZEROTH_REPOSITORY: ${{ gitea.repository }}
+
+    steps:
+
+      - name: Verify authorized request
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          if [ "$AZEROTH_REPOSITORY" != "richard/AzerothAI" ]; then
+            echo "Rejected repository: $AZEROTH_REPOSITORY"
+            exit 1
+          fi
+
+          if [ "$AZEROTH_ACTOR" != "richard" ]; then
+            echo "Rejected actor: $AZEROTH_ACTOR"
+            exit 1
+          fi
+
+      - name: Execute approved operation
+        shell: bash
+        run: |
+          set -euo pipefail
+          sudo -n /usr/local/bin/azerothai-ops "$AZEROTH_OPERATION"

.gitea/workflows/azeroth-validated-patch.yml

@@ -0,0 +1,71 @@
+---BEGIN WORKFLOW---
+ ame: AzerothAI Validated Patch
+
+on:
+  workflow_dispatch:
+    inputs:
+      patch_file:
+        description: Patch file under ops/patches/
+        required: true
+
+jobs:
+  patch:
+    runs-on: azerothai-host
+    timeout-minutes: 10
+
+    env:
+      PATCH_FILE: ${{ inputs.patch_file }}
+      AZEROTH_ACTOR: ${{ gitea.actor }}
+      AZEROTH_REPOSITORY: ${{ gitea.repository }}
+
+    steps:
+      - name: Verify authorized request
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          [ "$AZEROTH_ACTOR" = "richard" ] || {
+            echo "Unauthorized actor: $AZEROTH_ACTOR"
+            exit 1
+          }
+
+          [ "$AZEROTH_REPOSITORY" = "richard/AzerothAI" ] || {
+            echo "Wrong repository: $AZEROTH_REPOSITORY"
+            exit 1
+          }
+
+          base="${PATCH_FILE#ops/patches/}"
+
+          [ "$base" != "$PATCH_FILE" ] || {
+            echo "Patch must be under ops/patches/"
+            exit 1
+          }
+
+          [[ "$base" != */* ]] || {
+            echo "Nested patch paths are not allowed"
+            exit 1
+          }
+
+          [[ "$base" =~ ^[A-Za-z0-9][A-Za-z0-9._-]*\.patch$ ]] || {
+            echo "Invalid patch filename"
+            exit 1
+          }
+
+      - name: Check out patch source
+        uses: actions/checkout@v4
+
+      - name: Apply validated patch
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          [ -f "$PATCH_FILE" ] || {
+            echo "Patch file not found: $PATCH_FILE"
+            exit 1
+          }
+
+          sha="$(sha256sum "$PATCH_FILE" | awk '{print $1}')"
+          payload="$(base64 -w0 "$PATCH_FILE")"
+
+          sudo -n /usr/local/bin/azerothai-ops "apply-patch:${sha}:${payload}"
+---END WORKFLOW---

ops/patches/recovery-bridge-timeout-30s.patch

@@ -0,0 +1,6 @@
+diff --git a/app-staging/core/connectors/index.ts b/app-staging/core/connectors/index.ts
+--- a/app-staging/core/connectors/index.ts
++++ b/app-staging/core/connectors/index.ts
+@@ -36,1 +36,1 @@
+-const response=await fetch(`${url.href.replace(/\/$/,'')}/v1${path}`,{method:body?'POST':'GET',headers:{Authorization:`Bearer ${this.config.BRIDGE_TOKEN}`,'Content-Type':'application/json'},...(body?{body:JSON.stringify(body)}:{}),signal:AbortSignal.timeout(12000),redirect:'error'});
++const response=await fetch(`${url.href.replace(/\/$/,'')}/v1${path}`,{method:body?'POST':'GET',headers:{Authorization:`Bearer ${this.config.BRIDGE_TOKEN}`,'Content-Type':'application/json'},...(body?{body:JSON.stringify(body)}:{}),signal:AbortSignal.timeout(30_000),redirect:'error'});