fix(agent): harden package broker caller identity - #1977

Merged

Benoît Cortier (CBenoit) merged 10 commits into

cbenoit-policy-caller-hardening

Sep 16, 2026

Commits on Sep 16, 2026

fix(agent): retain broker caller identity

Benoît Cortier (CBenoit)
and
Copilot
committed
0146b9c
fix(agent): bind broker caller to its image

Benoît Cortier (CBenoit)
and
Copilot
committed
e95fa94
fix(agent): verify retained caller provenance

Benoît Cortier (CBenoit)
and
Copilot
committed
43f6021
fix(agent): bound caller identity capture

Benoît Cortier (CBenoit)
and
Copilot
committed
7f0e85e
test(agent): align caller security coverage

Benoît Cortier (CBenoit)
and
Copilot
committed
96af594
docs(agent): clarify caller identity guarantees

Benoît Cortier (CBenoit)
and
Copilot
committed
fb3e28b
fix(agent): preserve executable path compatibility

Benoît Cortier (CBenoit)
and
Copilot
committed
9bd52e9
fix(agent): isolate caller provenance checks

Benoît Cortier (CBenoit)
and
Copilot
committed
eabe34f
fix(agent): enforce caller path security in dev

Benoît Cortier (CBenoit)
and
Copilot
committed
e2b86c8
test(agent): stage policy tester securely

Benoît Cortier (CBenoit)
and
Copilot
committed
cb1d999