Harden Discord actor-scoped access and approvals - #27

Merged

michaelmwu merged 37 commits into

mainfrom

harden-discord-actor-access

Sep 8, 2026

Commits on Sep 8, 2026

feat: harden Discord actor-scoped workflows
michaelmwu
committed
8bf25d0
fix: make notification claims replay safe
michaelmwu
committed
707e774
Enforce Discord actor capability scopes
michaelmwu
committed
e3cf10c
Allow narrowed GitHub credential routes
michaelmwu
committed
6330eb0
fix: close Discord workflow authorization gaps
michaelmwu
committed
57e4606
fix: serialize actor policy and retry ingress claims
michaelmwu
committed
a6208ff
fix: close Discord continuation boundaries
michaelmwu
committed
a0ae20a
fix: preserve reviewed bot identities through dispatch
michaelmwu
committed
4e713a7
fix: persist reviewed Discord action boundaries
michaelmwu
committed
9f483a0
fix(discordbot): ignore replies addressed to other users (#28)
michaelmwu
committed
ccb5aa6
fix: bind Discord bot identities to policies
michaelmwu
committed
a67a816
fix: enforce Discord GitHub App repository scope
michaelmwu
committed
8b13787
fix: enforce Discord GitHub credential boundaries
michaelmwu
committed
24353d0
fix: preserve Discord actor credential policy
michaelmwu
committed
2c4071f
fix: reject noncanonical Discord GitHub secrets
michaelmwu
committed
8cab2fe
fix: validate Discord GitHub rule replacements
michaelmwu
committed
420c167
fix: reject CIDR rules in Discord policy roles
michaelmwu
committed
51fedc4
fix: enforce Discord GitHub policy for all credentials
michaelmwu
committed
c55a7fb
Keep Discord delivery claims provisional until dispatch
michaelmwu
committed
5fe7b3e
Recover failed Discord claim finalization
michaelmwu
committed
ff5156c
Finalize Discord admission after durable handoff
michaelmwu
committed
040dee1
Filter hoisted credentials through Discord policy
michaelmwu
committed
3df0eb3
Bind Discord capabilities to reviewed roles
michaelmwu
committed
6528a45
Keep Discord policy and execution claims durable
michaelmwu
committed
b9c5626
Enforce reviewed Discord capabilities on every update
michaelmwu
committed
8dee05a
Allow metadata updates for unassigned Discord actors
michaelmwu
committed
1036338
Normalize GitHub hosts at the policy boundary
michaelmwu
committed
b170249
Stabilize provisional Discord admission test
michaelmwu
committed
a07e419
Reconcile Discord actors after role changes
michaelmwu
committed
c036e1b
Keep Discord actor policy revocation atomic
michaelmwu
committed
523e1a2
Lock Discord policy through actor assignment
michaelmwu
committed
4a5d0a5
Reserve workflow approval idempotency keys
michaelmwu
committed
73b1adb
Apply Rust workflow formatting
michaelmwu
committed
4266584
Bump Centaur chart after parallel merges
michaelmwu
committed
d8d3903
Block GitHub broker token reuse in Discord roles
michaelmwu
committed
413bbd1
Clarify OAuth credential test fixtures
michaelmwu
committed
0ca08b8
Avoid persisting credential objects in policy tests
michaelmwu
committed
d542176