Repository navigation

feat(approval): persist whole-tool trust grants - #40

Merged

senamakel merged 71 commits into

mainfrom

tinysecurity-tool-grants

Oct 22, 2026

Merged

feat(approval): persist whole-tool trust grants#40
senamakel merged 71 commits into
mainfrom
tinysecurity-tool-grants

Commits on Oct 21, 2026
- test(tinysecurity-module): cover whole-tool trust across a restart
  
  senamakel
  and
  medullabot
  committed
  c27a631
- chore(deps): downgrade zip and tinybus, add zopfli
  
  senamakel
  and
  medullabot
  committed
  e4584dc
- feat(bus): add durable whole-tool trust methods
  
  senamakel
  and
  medullabot
  committed
  92a94a4
- feat(approval): add durable whole-tool trust grants
  
  senamakel
  and
  medullabot
  committed
  78be2bb
- feat(adapter): expose tool trust grant, revoke and list methods
  
  senamakel
  and
  medullabot
  committed
  9bb6eb3
- test(module): cover approval consumption and trust listing after restart
  
  senamakel
  and
  medullabot
  committed
  7345a41
- test(tinysecurity-module): use typed tool trust requests in adapter gap tests
  
  senamakel
  and
  medullabot
  committed
  d407714
- fix(approval): recheck whole-tool trust at the consume boundary
  
  senamakel
  and
  medullabot
  committed
  86b073c
- docs: document durable tool trust for contract 1.25
  
  senamakel
  and
  medullabot
  committed
  28eb78a
- feat(approval): add durable whole-tool trust grants
  
  senamakel
  and
  medullabot
  committed
  d069ec6
- refactor(tinysecurity-approval): rename live_trust to live_tool_trust
  
  senamakel
  and
  medullabot
  committed
  8150fed
- test(approval): filter fixture load by requested scope
  
  senamakel
  and
  medullabot
  committed
  366bcf9
- test(approval): add error context to engine gap test failures
  
  senamakel
  and
  medullabot
  committed
  5980dd4
- fix(approval): honour durable tool grants for grant-only rules
  
  senamakel
  and
  medullabot
  committed
  8f5688a
- fix(approval): accept tool-trust-grant in lifecycle validation
  
  senamakel
  and
  medullabot
  committed
  d43f4f5
- fix(approval): hold tool trust lock during auto tool-grant redemption
  
  senamakel
  and
  medullabot
  committed
  5a04db7
- test(approval): cover whole-tool trust validation and store failures
  
  senamakel
  and
  medullabot
  committed
  6862e50
- test(approval): assert empty list instead of error for other agent
  
  senamakel
  and
  medullabot
  committed
  2c62d3d
- test(module): cover imported trust staying revoked across restart
  
  senamakel
  and
  medullabot
  committed
  0e17076
- feat(tool_trust): add imported-source trust receipts
  
  senamakel
  and
  medullabot
  committed
  492cecd
- feat(approval): accept imported trust rows and expose trust helpers
  
  senamakel
  and
  medullabot
  committed
  fcccde8
- fix(approval): match imported trust rows by content hash and tool name
  
  senamakel
  and
  medullabot
  committed
  b5bdfba
- fix(approval): match imported trust rows by tool name
  
  senamakel
  and
  medullabot
  committed
  9141c92
- chore(approval): register import trust engine module
  
  senamakel
  and
  medullabot
  committed
  a7b088a
- feat(adapter): add ImportTrustSource2 host-only method
  
  senamakel
  and
  medullabot
  committed
  df61f3a
- fix(bus): register tool trust methods in the methods list
  
  senamakel
  and
  medullabot
  committed
  ebe85f8
- fix(approval): include workspace in import trust source marker
  
  senamakel
  and
  medullabot
  committed
  a977de2
- refactor(approval): move trust key computation earlier
  
  senamakel
  and
  medullabot
  committed
  9e87c59
- refactor(approval): route trust pair validation through engine method
  
  senamakel
  and
  medullabot
  committed
  f53d807
- test(approval): cover retrying a partial trust source import
  
  senamakel
  and
  medullabot
  committed
  273b345
- fix(approval): match trust rows on content hash and tool name
  
  senamakel
  and
  medullabot
  committed
  d46c98d
- docs(specs): document ImportTrustSource2 migration receipts
  
  senamakel
  and
  medullabot
  committed
  fed11e8
- fix(approval): count imported trust rows when checking scope capacity
  
  senamakel
  and
  medullabot
  committed
  539aba8
- test(tinysecurity-module): cover explicit tool and flow grants after reimport
  
  senamakel
  and
  medullabot
  committed
  e6f071d
- test(approval): cover expired import receipts not recreating trust
  
  senamakel
  and
  medullabot
  committed
  414b323
- test(approval): cover source import receipt binding and fail-closed errors
  
  senamakel
  and
  medullabot
  committed
  300e313
- test(tool-trust): remove duplicate serde_json import
  
  senamakel
  and
  medullabot
  committed
  e016e96
- test(tinysecurity-bus): bump contract version expectations to 1.25
  
  senamakel
  and
  medullabot
  committed
  c36c867
- test(bus): bump expected contract version to 1.25
  
  senamakel
  and
  medullabot
  committed
  fe3d5f9
- refactor(approval): extract import trust planning into helpers
  
  senamakel
  and
  medullabot
  committed
  e5fde19
- refactor(approval): extract raw deny check into helper
  
  senamakel
  and
  medullabot
  committed
  1c78619
- refactor(approval): extract ttl resolution into begin_ttl helper
  
  senamakel
  and
  medullabot
  committed
  82577b7
- test(module): split adapter gap test into helper functions
  
  senamakel
  and
  medullabot
  committed
  9a0deeb
- test(tinysecurity-module): tighten adapter gap assertions and borrow import items
  
  senamakel
  and
  medullabot
  committed
  73dc7f3
- test(approval): simplify assertions and drop debug logging
  
  senamakel
  and
  medullabot
  committed
  57c70c0
- test(approval): reformat grant_tool call in engine gaps test
  
  senamakel
  and
  medullabot
  committed
  e844729
- test(tool-trust): compare serialized payloads without unwrapping
  
  senamakel
  and
  medullabot
  committed
  8cc6a77
- test(approval): cover scope row cap on regrant after revoke
  
  senamakel
  and
  medullabot
  committed
  34798a0
- fix(approval): reject reissue when scope row limit is reached
  
  senamakel
  and
  medullabot
  committed
  955b6df
- Merge pull request #39 from tinyhumansai/epic/7328-device-pairing
  
  senamakel
  and
  medullabot
  committed
  6635d9a
- test(approval): cover retry after audit failure on imported source
  
  senamakel
  and
  medullabot
  committed
  4ad8ade
- fix(approval): reconcile audit row for already-imported trust markers
  
  senamakel
  and
  medullabot
  committed
  2738138
- docs: renumber durable tool trust contract to 1.26
  
  senamakel
  and
  medullabot
  committed
  86bde7d
- chore(deps): bump tinybus to 0.1.6 and update lockfile
  
  senamakel
  and
  medullabot
  committed
  334a164
- test(approval): cover redacted tool labels in exact grant identity
  
  senamakel
  and
  medullabot
  committed
  ae2b287
- fix(tool-trust): match grants by digest instead of tool name
  
  senamakel
  and
  medullabot
  committed
  b391e44
- test(approval): cover redacted tool labels in flow grant identity
  
  senamakel
  and
  medullabot
  committed
  89f38f9
- docs(flow-trust): move durable flow trust details to a spec
  
  senamakel
  and
  medullabot
  committed
  6932303
- test(approval): cover stores that return rows outside the requested scope
  
  senamakel
  and
  medullabot
  committed
  5b53a83
- style: reformat approval engine tests to satisfy line width
  
  senamakel
  and
  medullabot
  committed
  295726e
- test(tool-trust): assert debug output redacts every trust payload field
  
  senamakel
  and
  medullabot
  committed
  11e020a
- fix(approval): serialize scope replacement with whole-tool trust mutations
  
  senamakel
  and
  medullabot
  committed
  d0ae5c3
- test(approval): await replace_scope calls in scope tests
  
  senamakel
  and
  medullabot
  committed
  c40af2e
- test(approval): cover scope replacement waiting on reservations
  
  senamakel
  and
  medullabot
  committed
  cd28b93
- test(approval): expect unchanged outcome for repeated scope registration
  
  senamakel
  and
  medullabot
  committed
  8e33571
- test(approval): simplify empty tool trust assertion
  
  senamakel
  and
  medullabot
  committed
  bc58cd8
- test(approval): cover revoke retry after a failed cancellation audit
  
  senamakel
  and
  medullabot
  committed
  073571c
- fix(approval): report revoked tool trust for cancelled grants
  
  senamakel
  and
  medullabot
  committed
  9ce382f
- test(approval): cover revoke retry for imported flow tools
  
  senamakel
  and
  medullabot
  committed
  88fa925
- fix(approval): report revoked flow trust for cancelled bindings
  
  senamakel
  and
  medullabot
  committed
  f1c72cc
- test(approval): reformat engine gap test assertions
  
  senamakel
  and
  medullabot
  committed
  2126ba9

Commits

Commits on Oct 21, 2026