Repository navigation
App-store audit: fixed submissions for Kinetic, Rent A Human, Dial, Dead Simple, Docker, AEGIS - #125
Draft
Alexgodoroja wants to merge 9 commits into
Draft
Alexgodoroja wants to merge 9 commits into
Alexgodoroja wants to merge 9 commits into
Conversation
…ed broker 1.0.0 shipped as a managed app, but the broker never had a Kinetic master key or registration, so every call failed with "unknown app". Kinetic submitted it as a bring-your-own-token app and issues self-serve kp_live_ tokens, so 1.0.1 goes direct to api.kineticpricing.com: - kinetic.set_key saves the account holder's token; calls made before it return a hint naming set_key instead of a 401 - kinetic.signup_start/status/complete drive Kinetic's agent-assisted signup - method_list, method_recommend, offer_list and research stay keyless - method_recommend takes the decision enum the API now requires; the old demo passed free text and failed validation - demo and next steps drop the Pilot $5 budget and kinetic.balance, which only exist for managed apps Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Docker shipped Linux bundles only, so every macOS install was refused. macOS can't run dockerd, so the darwin assets carry the official static docker CLI and a dockerctl that finds the running engine (Docker Desktop, OrbStack, colima, Rancher Desktop or /var/run/docker.sock). engine_start reports what it found or how to start one; engine_stop is a no-op. The Linux bundles are unchanged, and the version stays 29.6.1 to match upstream Docker. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
deadsimple.signup answered "address": "" because it read the default data.address; agent-signup returns the inbox at data.inbox.email. Agents had to call list_inboxes to learn the address they had just been given. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The app shipped AEGIS 0.1.3 for darwin/arm64 and linux only, so Intel Macs could not install it, and upstream has since released 0.1.4 (adversarial hardening). 0.1.4's official release binaries cover all four platforms; they are repackaged unmodified (Linux builds are static) on the artifact registry. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Upstream Docker 29.8.1, all four platforms. engine_start used to go straight to the bundled dockerd, which needs root, while the standard installer runs the pilot daemon as a normal user, so it failed on ordinary Linux hosts even when Docker was already running. It now uses a running engine first (system or rootless Docker, DOCKER_HOST, or on macOS Docker Desktop, OrbStack or colima), starts the bundled dockerd only as root, and otherwise says how to get an engine. engine_stop leaves engines it didn't start alone. The help text no longer embeds the builder's home directory, and the tarballs carry no macOS extended attributes. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
0.2.0 was built on Rent A Human's partner API through a managed broker entry that was never registered (no master key; partner access is enterprise-gated), so every call failed with "unknown app". 0.3.0 goes back to the surface the vendor submitted: the public REST API at rentahuman.ai/api with a self-serve X-API-Key. - rentahuman.set_key saves the user's rah_ key; calls made before it return a hint naming set_key instead of a 401 - search_humans, get_human, get_reviews, browse_services, availability and the new list_bounties are keyless - hiring, booking, escrow and QA methods are the vendor's, unchanged - new demo and next-steps graph (the vendor spec had neither) Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Dial now requires new accounts to verify a phone number a human owns before it issues an API key, so 0.1.0's signup -> verify stopped at a registrationId and every call stayed 401. 0.1.0 also returned keys to the agent in plain JSON and never stored them. - new dial.register_number and dial.verify_number complete new-account signup - dial.verify (sign-in to an existing account) and dial.verify_number save the key they issue on this host via http.save_key and redact it - dial.set_key saves an existing sk_live_ key - signup methods are public; other calls made before a key return a hint naming dial.signup - next steps route verify -> register_number -> verify_number -> status Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Submission updates from the app-store audit. Stacked on #124 (it uses
set_key,publicandsave_key). It's a draft until the bundles are on the prod registry: per UPDATING-BUNDLES, upload before merge.managed, but the broker has no Kinetic key or registration, so every call failed withunknown appkinetic.set_key, agent-assistedsignup_start/status/complete, keyless discovery;method_recommenduses the decision enum the API now requiresrentahuman.ai/api,X-API-Key), withset_key, keyless search/browse/bounties, and a new demo and next-stepsregistrationIdand every call returned 401. Keys were also returned in plain JSON and never storedregister_number+verify_number;verify/verify_numbersave the key viasave_keyand redact it;set_keysignupreturned"address": ""address_path: data.inbox.emailengine_startneeded a root daemon even when Docker was already runningTested
Every app was installed from a signed test catalogue and exercised with real calls on macOS arm64 (an isolated test daemon) and on linux amd64 + arm64 VMs:
set_keyhint, and afterset_keythe token reaches Kinetic.set_keybehave (the API rejects a fake key on format, which proves the header arrives).registrationIdagainst the live API. Finishingregister_numberneeds a phone a human owns.hello-worldon macOS via colima, on Linux as root with the bundled dockerd, and via system Docker for a non-root daemon. A clear error when neither is available.Gates:
verify-submissionOK on all 4 platforms for each app,TestAllSubmission*+TestSubmissionGatewaysAreReachablegreen, demo scores 94–100.Not verifiable without accounts: authenticated Rent A Human, Kinetic and Dial calls need real keys/phones.
🤖 Generated with Claude Code