feat(safety-profile): lock boolean policy flags - #979

Merged

steipete merged 13 commits into

mainfrom

triage/t8-pr976

Aug 11, 2026

Commits on Aug 10, 2026

feat(safety-profile): pin flag values with locked-flags so a baked profile can fix output settings the command line cannot change
ronny-rentner
committed
69b851b
feat(safety-profile): add readonly-locked and pin no-input, extending the locked variants to the read path
ronny-rentner
committed
a2baa26
Merge remote-tracking branch 'origin/main' into feat/safety-profile-locked-flags
ronny-rentner
committed
0d1063d
docs(safety-profiles): document locked-flags, the locked presets, and which flags not to lock
ronny-rentner
committed
7cabd50
docs(safety-profiles): match the file's existing style in the locked-flags section
ronny-rentner
committed
438ad1a
docs(safety-profiles): correct how an unlocked flag's value is actually determined
ronny-rentner
committed
49ac92b
test(safety-profile): cover locked-flag bypass shapes, inertness, generator output; rebuild locked names per parse
ronny-rentner
committed
fee967b
fix(safety-profile): resolve output-mode precedence after locks so a locked json or plain wins over the competing mode
ronny-rentner
committed
fd24ccc
fix(safety-profile): refuse an explicit competing output mode against a locked one, override only environment defaults
ronny-rentner
committed
22e8ed9
fix(safety-profile): make locked flags count as provided, refuse names that match nothing, and refuse locks on --home or required flags
ronny-rentner
committed
b3a42d5

Commits on Aug 11, 2026

fix(safety-profile): harden locked flag enforcement

steipete
and
ronny-rentner
committed
6a7d1de
fix(safety-profile): validate locked flag injection

steipete
and
ronny-rentner
committed
a16e933
refactor(safety-profile): limit locked flags to booleans

steipete
and
ronny-rentner
committed
6d30196