Summary

• bind proxy shared-secret signatures to asserted identity headers so header swaps fail verification
• load proxy shared-secret and header override env vars through the normal provider registration path
• keep PHLO_PROJECT_PATH accepting explicit absolute roots while still rejecting raw path traversal segments
• preserve hook filter matching when filters.tags is unset

Root cause

The hardening patch only signed timestamp/remote/path, so trusted identity headers could be changed after signing, and the new shared secret was not wired into environment-driven provider setup. The project-root validation also overconstrained explicit absolute paths used by child processes and CI. Separately, hook filter tag matching used negated boolean logic that incorrectly rejected events when filters.tags was None.

Validation

• uv run pytest tests/test_authentication_provider.py
• uv run pytest tests/test_infrastructure_config.py
• uv run pytest tests/test_hook_bus.py
• make typecheck-python
• uv run ruff check src/phlo/capabilities/authentication.py src/phlo/infrastructure/config.py src/phlo/cli/commands/schema_migrate.py tests/test_authentication_provider.py tests/test_infrastructure_config.py docs/setup/security.md

Closes #338
Closes #339
Closes #344