feat(autonomy): guardrail matrix, security binding, setup slice (WP5) - #377

Merged

kyle-sexton merged 45 commits into

mainfrom

feat/autonomy-guardrails

Jul 20, 2026

Commits on Jul 19, 2026

feat(autonomy): guardrail matrix hub + four policy leaves (WP5 Phase 1)

kyle-sexton
and
claude
committed
71fadee
feat(autonomy): guardrails security-binding schema + semantic validator (WP5 Phase 2)

kyle-sexton
and
claude
committed
0c00d1c
feat(autonomy): guided-setup guardrail slice - probe-before-bind, detect-diff-reconcile, fail-closed (WP5 Phase 3)

kyle-sexton
and
claude
committed
d528d72
ci(autonomy): one-off WP5 isolation-probe acceptance workflow (removed before merge)

kyle-sexton
and
claude
committed
b3c2184
fix(autonomy): security-binding checker review fixes - verified probe evidence, promotion epochs, encoding

kyle-sexton
and
claude
committed
d56ffc6
fix(autonomy): bind probe evidence to surface/level/substrate; harden demo probe assertions

kyle-sexton
and
claude
committed
ee93774
fix(autonomy): probe transcripts require non-zero integer exit codes

kyle-sexton
and
claude
committed
10ae236
fix(autonomy): probe transcripts must record their probed targets

kyle-sexton
and
claude
committed
539c033
fix(autonomy): strict ISO promotion timestamps, same-surface level-marker ambiguity rejected

kyle-sexton
and
claude
committed
18228fc
fix(autonomy): own-property marker comparisons - prototype keys cannot fake conflicts

kyle-sexton
and
claude
committed
8b39025
fix(autonomy): L3 probe evidence requires kernel-separated substrate class

kyle-sexton
and
claude
committed
680b077
fix(autonomy): promotion timestamps must be calendar-valid instants

kyle-sexton
and
claude
committed
1a1c4b9
fix(autonomy): bounded UTC offsets, local/private egress targets rejected

kyle-sexton
and
claude
committed
486bbb7
docs(topics): record canonical upstream references for the ai-adoption-ladder source artifact

kyle-sexton
and
claude
committed
9c9c394
fix(autonomy): normalize encoded loopback/private probe targets

kyle-sexton
and
claude
committed
3969492
fix(autonomy): credential-probe paths must be recognized host-credential locations

kyle-sexton
and
claude
committed
9b163fa
fix(autonomy): egress-target allow-list seam, special-use TLD rejection, transcript header validation

kyle-sexton
and
claude
committed
2c2673d
fix(autonomy): recognize cloud metadata endpoints as credential-probe targets

kyle-sexton
and
claude
committed
77eefce
fix(autonomy): bare-host egress targets only; component-wise credential matching

kyle-sexton
and
claude
committed
73c8c73
fix(autonomy): expand IPv6 literals before egress-target classification

kyle-sexton
and
claude
committed
7f7ee3d
fix(autonomy): known metadata endpoints only; non-global IP ranges rejected as egress targets

kyle-sexton
and
claude
committed
0294228
fix(autonomy): deny IETF protocol-assignment range; metadata credential evidence via known endpoint URLs only

kyle-sexton
and
claude
committed
b16b6b8
Merge branch 'main' into feat/autonomy-guardrails
kyle-sexton
authored
473e4c3
fix(autonomy): reject deprecated IPv4-compatible ::/96 literals as egress evidence
kyle-sexton
committed
e82a55e
chore(autonomy): remove one-off wp5-isolation-probe-demo workflow
kyle-sexton
committed
d109322
fix(autonomy): reject generic token path component as credential evidence
kyle-sexton
committed
3be6362
fix(autonomy): confine probe evidence to the configured --probe-evidence-root
kyle-sexton
committed
04024ce
fix(autonomy): reject sub-millisecond promotion timestamps the epoch cannot compare
kyle-sexton
committed
55e9ad7
fix(autonomy): metadata credential routes + anchored credential paths

kyle-sexton
and
claude
committed
b856121
fix(autonomy): DNS label syntax for egress targets; realpath confinement for probe evidence

kyle-sexton
and
claude
committed
72a4411
fix(autonomy): metadata route segment boundaries; per-target credential-absence exit codes

kyle-sexton
and
claude
committed
93b66be
fix(autonomy): metadata evidence requires plain HTTP default port; reject generic env token

kyle-sexton
and
claude
committed
e07514a
fix(autonomy): env-token path anchors restricted to OS home variables

kyle-sexton
and
claude
committed
4792ccd
fix(autonomy): credential paths must be rooted; fec0::/10 non-external

kyle-sexton
and
claude
committed
59cf306
fix(autonomy): token evidence by well-known names only; 6to4 relay range non-external

kyle-sexton
and
claude
committed
931771d
fix(autonomy): credential paths real-by-construction only; close IPv6 special-purpose registry

kyle-sexton
and
claude
committed
41f7840
docs(autonomy): advance WP5 PLAN Phase 4 tag to DONE

kyle-sexton
and
claude
committed
b44a5ea
ci: exclude security-binding fixtures from machine-specific-path lane

kyle-sexton
and
claude
committed
44578ad
fix(autonomy): egress needs outer reachability; credential tokens need host-side expansion

kyle-sexton
and
claude
committed
0a09794
fix(autonomy): evidence requires protected root; metadata probes connect-level; hosted L3 class

kyle-sexton
and
claude
committed
cca4d2c
fix(autonomy): credential probes need outer-side existence proof

kyle-sexton
and
claude
committed
6c940b6
fix(autonomy): reject dot-segment credential paths; validate egress hosts per entry

kyle-sexton
and
claude
committed
9e409d4
fix(autonomy): credential entries must end at a concrete secret file

kyle-sexton
and
claude
committed
474b63a
fix(autonomy): substrate class is a ratified binding-side assertion

kyle-sexton
and
claude
committed
918a8e5

Commits on Jul 20, 2026

fix(autonomy): credential recognition requires exact well-known locations

kyle-sexton
and
claude
committed
1f3dacf