feat(security): diff-scope assertion and credential withholding for delegates - #19

Merged

datj9 merged 15 commits into

mainfrom

feat/delegation-scope

Jul 26, 2026

Commits on Jul 26, 2026

feat(jobs): add scope_result and withheld_env to Job (S4 schema)
datj9
committed
8aa7468
feat(security): withhold credential env vars from the delegate (S4)
datj9
committed
782758f
feat(security): add git diff-scope assertion for delegated writes (S4)
datj9
committed
8a66275
feat(delegate): enforce scope and credential scrubbing in the worker (S4)
datj9
committed
66ca811
feat(jobs): fold independent-verification gate into the delegation verdict (S5)
datj9
committed
4ca08c5
feat(verify): fresh independent verification pass with graceful degradation (S5)
datj9
committed
7558cca
feat(escalate): re-dispatch failed delegations up a ladder as same-trace children (S5)
datj9
committed
a843b5a
feat(delegate): wire --verify-with and --escalate-to through start and the worker (S5)
datj9
committed
4d040e1
fix(escalate): scope escalation to finished delegates with a failed gate
datj9
committed
8a56cf7
fix(verify): make schema temp-file lifecycle exception-safe
datj9
committed
e4eaf28
fix(cli): scrub credentials on the foreground dispatch path
datj9
committed
a8777e6
style(verify,escalate): replace forbidden placeholder names obj and info
datj9
committed
d9c6313
refactor(verify): extract _interpret_run_outcome from run_verification
datj9
committed
fea3e17
refactor(escalate): extract eligibility guard, child Job build, and disk staging from maybe_escalate
datj9
committed
8291025
refactor(types): move gate-result shapes to dependency-free types module
datj9
committed
c6a81ea