feat(credentials): add governed grants and purpose-limited observations - #554

Merged

Pal Lakatos-Toth (pallakatos) merged 105 commits into

kars-bridgefrom

public/pr10-credential-grants

Sep 14, 2026

Commits on Sep 8, 2026

feat(github): add bounded keyless service integration candidate
Pal Lakatos-Toth (pallakatos)
committed
d3dc3ce
Checkpoint governed credential integration before privacy ancestry

Pal Lakatos-Toth (pallakatos)
and
Copilot
committed
cd020a1
Merge qualified privacy ancestry into credential candidate

Pal Lakatos-Toth (pallakatos)
and
Copilot
committed
76db8e1
Checkpoint private credential issuers before GitHub integration

Pal Lakatos-Toth (pallakatos)
and
Copilot
committed
b3f6ca8
Merge qualified GitHub consumer into private credential candidate

Pal Lakatos-Toth (pallakatos)
and
Copilot
committed
4e2e107
Fence GitHub projection reuse by source revision

Pal Lakatos-Toth (pallakatos)
and
Copilot
committed
35411cf
Merge current qualified privacy closure into credential candidate

Pal Lakatos-Toth (pallakatos)
and
Copilot
committed
b3d0446
Gate Task readiness on live credential authority

Pal Lakatos-Toth (pallakatos)
and
Copilot
committed
93690ba

Commits on Sep 9, 2026

Commits on Sep 10, 2026

Commits on Sep 11, 2026

Commits on Sep 12, 2026

Commits on Sep 14, 2026

fix(cli): revalidate a conflicted reviewed sandbox pause

Pal Lakatos-Toth (pallakatos)
and
Copilot
committed
a82eec3
fix(cli): observe retirement independently of Task status timing

Pal Lakatos-Toth (pallakatos)
and
Copilot
committed
27a1444
fix(controller): allow enrolled observers to verify Kubernetes metadata

Pal Lakatos-Toth (pallakatos)
and
Copilot
committed
ebb602a
test(e2e): retain bounded port-forward failure details

Pal Lakatos-Toth (pallakatos)
and
Copilot
committed
6fad354
fix(controller): complete API namespace recheck and split regressions

Pal Lakatos-Toth (pallakatos)
and
Copilot
committed
344a371
fix(ci): verify bounded tool downloads before qualification

Pal Lakatos-Toth (pallakatos)
and
Copilot
committed
c19f9b5
chore(repo): enforce format-safe Microsoft MIT attribution

Pal Lakatos-Toth (pallakatos)
and
Copilot
committed
3a09cd7
fix(deps): require patched Rustls for RUSTSEC-2026-0285

Pal Lakatos-Toth (pallakatos)
and
Copilot
committed
4ed8636
fix(ci): preserve raw YAML and Helm document boundaries in headers

Pal Lakatos-Toth (pallakatos)
and
Copilot
committed
03174dc
test: make Cilium API-group equality explicit

Pal Lakatos-Toth (pallakatos)
and
Copilot
committed
9ee285b
docs: record governed GitHub privacy source closure

Pal Lakatos-Toth (pallakatos)
and
Copilot
committed
fbc24af
fix(ci): require new-scope audit records in core qualification

Pal Lakatos-Toth (pallakatos)
and
Copilot
committed
793f4bc
docs: attest scoped credential and GitHub integration review

Pal Lakatos-Toth (pallakatos)
and
Copilot
committed
390c60b
test(ci): retain bounded public CRD readiness errors

Pal Lakatos-Toth (pallakatos)
and
Copilot
committed
8798a57