feat(policy): make deployment policy capability-aware and isolate privileged roles - #14

Open

Nickfost wants to merge 14 commits into

mainfrom

feat/issue-11-capability-aware-policy

Commits on Aug 26, 2026

feat(policy): make deployment policy capability-aware and isolate privileged roles
Nickfost
committed
48201d4
fix(policy): address Codex review findings on capability gates and isolation
Nickfost
committed
882df10
fix(policy): close Codex round-2 findings on evidence matching, schema optionality, and enum guards
Nickfost
committed
0f37d36
fix(policy): preserve legacy v3 evidence omission, marker-word identities, and initializer approval locators
Nickfost
committed
ccbcd83
test(ci): pass --approval-evidence in the initializer workflow step
Nickfost
committed
89ede92
fix(policy): require initializer approval locator, close evidence-bypass holes, enforce explicit manual gates in every mode
Nickfost
committed
3f9ec52
fix(policy): close Codex round-5 findings on controller identities, explicit nulls, and evidence locators
Nickfost
committed
6416a5f
fix(policy): close Codex round-6 findings on evidence address and credential guards
Nickfost
committed
30f8c22

Commits on Aug 28, 2026