feat(agent,agent-installer): add transactional policy store - #1963

Draft

Benoît Cortier (CBenoit) wants to merge 45 commits into

cbenoit-phase-2-policy-store

Commits on Aug 17, 2026

feat(agent): expose active package policy

Benoît Cortier (CBenoit)
and
Copilot
committed
3b0a260

Commits on Aug 18, 2026

fix(agent): hide policy source details

Benoît Cortier (CBenoit)
and
Copilot
committed
4c6dc53

Commits on Aug 26, 2026

fix(agent): align policy contract integration

Benoît Cortier (CBenoit)
and
Copilot
committed
03b3710
build(agent): refresh policy dependency lock

Benoît Cortier (CBenoit)
and
Copilot
committed
ab7591b

Commits on Aug 28, 2026

refactor(agent): localize policy API alias

Benoît Cortier (CBenoit)
and
Copilot
committed
2a3f0b6
refactor(agent): simplify policy match expression

Benoît Cortier (CBenoit)
and
Copilot
committed
d67d895
test(agent): move policy routes to testsuite

Benoît Cortier (CBenoit)
and
Copilot
committed
04f7486
test(agent): exercise policy endpoint end to end

Benoît Cortier (CBenoit)
and
Copilot
committed
23ce150
chore: merge origin/master

Benoît Cortier (CBenoit)
and
Copilot
committed
1ee9a37
test(agent): run policy E2E as LocalSystem

Benoît Cortier (CBenoit)
and
Copilot
committed
29b74aa
ci: preserve Agent policy build failures

Benoît Cortier (CBenoit)
and
Copilot
committed
c760e37

Commits on Sep 4, 2026

build(agent): adopt published policy crates

Benoît Cortier (CBenoit)
and
Copilot
committed
1abdba0
fix(agent): advertise allowed policy methods

Benoît Cortier (CBenoit)
and
Copilot
committed
8fe3eea
fix(agent): report missing policy as not found

Benoît Cortier (CBenoit)
and
Copilot
committed
8e9cc98
feat(agent,agent-installer): add transactional policy store

Benoît Cortier (CBenoit)
and
Copilot
committed
e5b3803
fix(agent): stabilize policy validation on CI

Benoît Cortier (CBenoit)
and
Copilot
committed
721d7d5
fix(agent): capture restricted E2E output

Benoît Cortier (CBenoit)
and
Copilot
committed
1a785d7
fix(agent): persist restricted E2E diagnostics

Benoît Cortier (CBenoit)
and
Copilot
committed
63149e4
fix(agent): assert effective write authorization

Benoît Cortier (CBenoit)
and
Copilot
committed
2268fa0
build(deps): refresh package policy contract

Benoît Cortier (CBenoit)
and
Copilot
committed
1a02ce6
build(deps): update package policy contract

Benoît Cortier (CBenoit)
and
Copilot
committed
a94670e
build(deps): update package policy contract

Benoît Cortier (CBenoit)
and
Copilot
committed
a43707f
build(deps): update package policy contract

Benoît Cortier (CBenoit)
and
Copilot
committed
d77de66
fix(agent): use policy draft schema identity

Benoît Cortier (CBenoit)
and
Copilot
committed
ef978b8
fix(dgw,agent,agent-installer): harden policy management

Benoît Cortier (CBenoit)
and
Copilot
committed
c526ff8
fix(agent-installer): marshal file disposition correctly

Benoît Cortier (CBenoit)
and
Copilot
committed
d90a198
fix(dgw,agent): embed event catalogs in production

Benoît Cortier (CBenoit)
and
Copilot
committed
a9f3a0b
fix(agent-installer): skip unsafe policy migration

Benoît Cortier (CBenoit)
and
Copilot
committed
5fdb283
fix(agent): reject ineffective policy matches

Benoît Cortier (CBenoit)
and
Copilot
committed
6109172
fix(agent): clarify policy attempt auditing

Benoît Cortier (CBenoit)
and
Copilot
committed
82a2f96
fix(agent,agent-installer): bind security checks

Benoît Cortier (CBenoit)
and
Copilot
committed
76d9fb7
test(miri): skip native crypt handle tests

Benoît Cortier (CBenoit)
and
Copilot
committed
721eb2f
fix(agent,agent-installer): close policy security gaps

Benoît Cortier (CBenoit)
and
Copilot
committed
ccd7aef
fix(agent): bound pipe identity capture

Benoît Cortier (CBenoit)
and
Copilot
committed
13099eb
build(deps): use published policy crates

Benoît Cortier (CBenoit)
and
Copilot
committed
4629e9f
fix(agent): harden broker caller authentication

Benoît Cortier (CBenoit)
and
Copilot
committed
bdfe604
fix(agent-installer): pin migration commit marker

Benoît Cortier (CBenoit)
and
Copilot
committed
d3e5f6d
test(agent): accept DACL herpaderping rejection

Benoît Cortier (CBenoit)
and
Copilot
committed
70142ce
fix(agent): make policy replacement conditional

Benoît Cortier (CBenoit)
and
Copilot
committed
f93e539
test(agent): align stacked policy routes

Benoît Cortier (CBenoit)
and
Copilot
committed
cd77124
chore: reconcile stacked lint expectations

Benoît Cortier (CBenoit)
and
Copilot
committed
04d6e47
fix(agent): reject junctions before directory creation

Benoît Cortier (CBenoit)
and
Copilot
committed
e2da9e1
fix(agent): secure policy directory transitions

Benoît Cortier (CBenoit)
and
Copilot
committed
5cef56d
fix(agent): secure policy filesystem transitions

Benoît Cortier (CBenoit)
and
Copilot
committed
642f90f
fix(agent,agent-installer): bind process identity safely

Benoît Cortier (CBenoit)
and
Copilot
committed
085bd09