Includes all pending changes needed for nixos-anywhere:
- fiberlb: L7 policy, rule, certificate types
- deployer: New service for cluster management
- nix-nos: Generic network modules
- Various service updates and fixes
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Pre-check key existence before delete to return accurate deleted count.
This unblocks integration tests while proper RaftResponse propagation
is deferred to T053.
- Single key: check exists via state_machine.kv().get()
- Range: count keys via state_machine.kv().range()
- Returns deleted=1 if key existed, deleted=0 otherwise
Integration tests now pass: 3/3 ✓
Refs: T059.S2 Option A (approved by PeerA)
- Replace form_urlencoded with RFC 3986 compliant URI encoding
- Implement aws_uri_encode() matching AWS SigV4 spec exactly
- Unreserved chars (A-Z,a-z,0-9,-,_,.,~) not encoded
- All other chars percent-encoded with uppercase hex
- Preserve slashes in paths, encode in query params
- Normalize empty paths to '/' per AWS spec
- Fix test expectations (body hash, HMAC values)
- Add comprehensive SigV4 signature determinism test
This fixes the canonicalization mismatch that caused signature
validation failures in T047. Auth can now be enabled for production.
Refs: T058.S1
- Remove gitlinks (160000 mode) for chainfire, flaredb, iam
- Add workspace contents as regular tracked files
- Update flake.nix to use simple paths instead of builtins.fetchGit
This resolves the nix build failure where submodule directories
appeared empty in the nix store.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
