feat(security): harden runtime config, IPC ingress policy, and python artifact provenance#12

Merged

simonhagger merged 9 commits intomainfrom

chore/sprint4-security-runtime-hardening

Feb 14, 2026

Commits on Feb 13, 2026

docs(governance): roll sprint forward and reconcile backlog statuses
simonhagger
committed

Commits on Feb 14, 2026

feat(security): centralize privileged file ingress policy and token consumption
simonhagger
committed
feat(ipc): normalize unhandled handler failures with correlation-safe envelope
simonhagger
committed
feat(runtime): pin official python artifact source and harden bundle assertions
simonhagger
committed
docs(config): add packaged runtime config env/json examples
simonhagger
committed
feat(config): support packaged runtime config files with allowlisted keys
simonhagger
committed
test(contracts): sanitize tenant-specific auth fixture values
simonhagger
committed
ci(security): require no-secrets confirmation in PR checklist
simonhagger
committed
chore(ci): retrigger checks after PR checklist update
simonhagger
committed