Enforcement-core hardening (#41), stacked on the cleanup bundle#51
Merged
Conversation
Fail-open and policy-widening fixes across validatabl / limitabl / identifiabl / explicabl, plus removal of 16 stale compiled artifacts committed under src/. Rebased cleanly onto the merged cleanup (#50). - validatabl-core: schema-absent fail-open -> deny; hasScope regex-injection -> exact token match; policy widening (unanchored matches, in coercion, empty-conditions) closed. - limitabl: agent guard opt-out -> deny when configured but no key; server-derived workflow key; TTL sweep; per-invocation engine. - identifiabl-core: require exp; reject empty issuer/audience at factory. - explicabl: audit identity from ALS context (+warn-once); call the auth0 webhook factory (was dead/hanging); emit audit on client-abort. 228 tests green (30 new, incl. real-crypto JWT round-trips); build clean.
davidcrowe
force-pushed
the
fix/enforcement-on-cleanup
branch
from
July 24, 2026 04:24
767a8fe to
ccd9098
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Enforcement-core hardening (#41/#46), stacked cleanly on the cleanup bundle so it merges conflict-free right after it. Base is
chore/oss-cleanup-integration; it will retarget tomainonce the bundle merges.Same content as #46, re-integrated on top of the cleanup so there are no lockfile / package.json conflicts to hand-resolve, and kept as its own reviewable PR (a security change should not be buried in a docs/hygiene bundle).
Fixes across validatabl / limitabl / identifiabl / explicabl:
hasScoperegex-injection → exact token match; policy widening (matchesunanchored,incoercion, empty-conditions) closed.exp; reject empty issuer/audience at factory..js/.d.tsartifacts committed insidesrc/that shadowed these fixes.Verification
Stacked on the bundle:
npm ci && npm run buildclean · full suite 228 tests green (30 new, incl. real-crypto JWT round-trips) · no compiled artifacts remain under anysrc/.Versions intentionally not bumped — publish/versioning is your OTP step; coordinate the explicabl bump with #37 (already folded into the bundle).