Machine-auth: caller resolver for workflow-run children (CL-6286) - #35

Merged

TheGreatAxios merged 9 commits into

mainfrom

cl-6286-machine-auth

Aug 19, 2026

Commits on Aug 18, 2026

Add tests for machine-caller identity resolution (CL-6286)
TheGreatAxios
committed
42e014a
Machine-auth: resolve a host-supplied caller ahead of grantGuard (CL-6286)
TheGreatAxios
committed
9b6c44e
Update docs: machine-caller identity resolution (CL-6286)
TheGreatAxios
committed
c64d1f5

Commits on Aug 19, 2026

Add tests for resolver trust-boundary validation and cross-tenant reads (CL-6286)
TheGreatAxios
committed
2185d2e
Parse the resolved caller at the trust boundary; document :tenantId (CL-6286)
TheGreatAxios
committed
f8fa71b
Update docs: resolver validation and migration note (CL-6286)
TheGreatAxios
committed
311ed87
Add tests for whitespace-only resolved identity (CL-6286)
TheGreatAxios
committed
22573d3
Reject whitespace-only resolved identity, not just empty strings (CL-6286)
TheGreatAxios
committed
901ff41
Freeze ResolvedCaller's shape as a stated invariant (CL-6286)
TheGreatAxios
committed
bb0a31c