Hanzo CI

merge origin/main

e2e: fix the token endpoint, and prove the auth gate with negative cases

build: typescript ^7.0.2 (native compiler)

ci(bootstrap): org secrets are inert on this org — needs a REPO secret

Revert "build: typescript ^7.0.2 (native compiler)"

web: our own router; chi is gone from this codebase

db: wire the at-rest encryption backfill — it had no caller

security(iam): stop hanzo-cloud and hanzo-console minting tenants for anonymous callers

security(signup): enforce a password floor no organization can opt out of

security(signup): enforce a password floor no organization can opt out of

fix: every error body linked to a 404

ci(bootstrap): org secrets are inert on this org — needs a REPO secret

build: typescript ^7.0.2 (native compiler)

web: our own router; chi is gone from this codebase

Revert "build: typescript ^7.0.2 (native compiler)"

db: wire the at-rest encryption backfill — it had no caller

security(iam): stop hanzo-cloud and hanzo-console minting tenants for anonymous callers

security(signup): enforce a password floor no organization can opt out of

security(signup): enforce a password floor no organization can opt out of

security(signup): enforce a password floor no organization can opt out of

security(signup): enforce a password floor no organization can opt out of

fix(docker): golang 1.26.4 -> 1.26.5, the version go.mod already requires

fix(docker): golang 1.26.4 -> 1.26.5, the version go.mod already requires

build: typescript ^7.0.2 (native compiler)

ci(bootstrap): org secrets are inert on this org — needs a REPO secret

Revert "build: typescript ^7.0.2 (native compiler)"

web: our own router; chi is gone from this codebase

db: wire the at-rest encryption backfill — it had no caller

security(iam): stop hanzo-cloud and hanzo-console minting tenants for anonymous callers

security(iam): stop hanzo-cloud and hanzo-console minting tenants for anonymous callers

ci: build this fork, so the cluster stops running upstream vanilla

ci: build this fork, so the cluster stops running upstream vanilla

fix(docker): golang 1.26.4 -> 1.26.5, the version go.mod already requires

fix(docker): golang 1.26.4 -> 1.26.5, the version go.mod already requires

build: typescript ^7.0.2 (native compiler)

ci(bootstrap): org secrets are inert on this org — needs a REPO secret

Revert "build: typescript ^7.0.2 (native compiler)"

web: our own router; chi is gone from this codebase

db: wire the at-rest encryption backfill — it had no caller

e2e: the console is cloud.hanzo.ai

e2e: the console is cloud.hanzo.ai

ci: stop citing the dead hanzoai/zip fork in the image example

db: wire the at-rest encryption backfill — it had no caller

fix(docker): golang 1.26.4 -> 1.26.5, the version go.mod already requires

fix(docker): golang 1.26.4 -> 1.26.5, the version go.mod already requires

fix(docker): golang 1.26.4 -> 1.26.5, the version go.mod already requires

build: typescript ^7.0.2 (native compiler)

ci(bootstrap): org secrets are inert on this org — needs a REPO secret

docker: never name a default auth profile that was not written

docker: never name a default auth profile that was not written

Revert "build: typescript ^7.0.2 (native compiler)"

cloud: restore S3_ADMIN_* — static hosting is 503 without it

web: our own router; chi is gone from this codebase

docker: never name a default auth profile that was not written

fix(docker): golang 1.26.4 -> 1.26.5, the version go.mod already requires

fix(docker): golang 1.26.4 -> 1.26.5, the version go.mod already requires

fix(docker): golang 1.26.4 -> 1.26.5, the version go.mod already requires

build: typescript ^7.0.2 (native compiler)

ci(bootstrap): org secrets are inert on this org — needs a REPO secret

Revert "build: typescript ^7.0.2 (native compiler)"

web: our own router; chi is gone from this codebase

fix(docker): golang 1.26.4 -> 1.26.5, the version go.mod already requires

fix(docker): golang 1.26.4 -> 1.26.5, the version go.mod already requires

fix(docker): golang 1.26.4 -> 1.26.5, the version go.mod already requires

build: typescript ^7.0.2 (native compiler)

ci(bootstrap): org secrets are inert on this org — needs a REPO secret

web: our own router; chi is gone from this codebase

Revert "build: typescript ^7.0.2 (native compiler)"

ci(bootstrap): org secrets are inert on this org — needs a REPO secret

Revert "build: typescript ^7.0.2 (native compiler)"

web: our own router; chi is gone from this codebase

feat(o11y): the Alertmanager receiver is a cloud surface, not a pod

docs: the release's last step writes to git, not the cluster

Merge remote-tracking branch 'origin/main' into admin-o11y-money

identity: a machine credential resolves its org from the subject

build: derive the plugin list from the composition root

identity: a machine credential resolves its org from the subject

Merge remote-tracking branch 'origin/main'

fix(compose): take HANZO_API_KEY from the environment, never inline

fix(compose): take HANZO_API_KEY from the environment, never inline

brand: the repo is hanzoai/index, so the product is Hanzo Index

chore: sync extension plugin versions to 2026.3.8

chore: sync extension plugin versions to 2026.3.8

chore(go): bump go directive to 1.26.5

chore(go): bump go directive to 1.26.5

hobby-installer: call the insights package by its name

fix(docker): build the crates this repo actually has

fix(docker): default EXTRA_ARGS — set -u aborted before cargo ran

fix(docker): rust:1.91 base — rust-toolchain.toml pins 1.91.1

ci: drop the Gitea mirror-sync nudge

ci: drop the Gitea mirror-sync nudge

ci: nudge git.hanzo.ai to pull on push

ci: remove GitHub CI — native git.hanzo.ai + cd.hanzo.ai only

ci: remove GitHub CI — native git.hanzo.ai + cd.hanzo.ai only

ci: remove GitHub CI — native git.hanzo.ai + cd.hanzo.ai only

fix: every error body linked to a 404

brand: the repo is hanzoai/index, so the product is Hanzo Index

treasury: anchor RPC docs/tests use /v1/, not the dead /ext/