fix(agent): harden package broker caller identity - #1977

Open

Benoît Cortier (CBenoit) wants to merge 10 commits into

cbenoit-complete-watcher-securityfrom

cbenoit-policy-caller-hardening

Commits on Sep 8, 2026

fix(agent): retain broker caller identity

Benoît Cortier (CBenoit)
and
Copilot
committed
9b6532c
fix(agent): bind broker caller to its image

Benoît Cortier (CBenoit)
and
Copilot
committed
c25a063
fix(agent): verify retained caller provenance

Benoît Cortier (CBenoit)
and
Copilot
committed
27fd94e
fix(agent): bound caller identity capture

Benoît Cortier (CBenoit)
and
Copilot
committed
eedbb26
test(agent): align caller security coverage

Benoît Cortier (CBenoit)
and
Copilot
committed
ff1f7c1
docs(agent): clarify caller identity guarantees

Benoît Cortier (CBenoit)
and
Copilot
committed
888ad88
fix(agent): preserve executable path compatibility

Benoît Cortier (CBenoit)
and
Copilot
committed
c954257
fix(agent): isolate caller provenance checks

Benoît Cortier (CBenoit)
and
Copilot
committed
0ced186
fix(agent): enforce caller path security in dev

Benoît Cortier (CBenoit)
and
Copilot
committed
66af85d
test(agent): stage policy tester securely

Benoît Cortier (CBenoit)
and
Copilot
committed
f19fee3