fix(sdk)!: reclassify KAS 400 errors — distinguish tamper from misconfiguration - #3166

Merged

marythought merged 12 commits into

mainfrom

fix/dspx-2606-rewrap-error-classification

Apr 2, 2026

Commits on Apr 2, 2026

fix(sdk): reclassify ErrRewrapBadRequest away from ErrTampered

marythought
and
claude
committed
e5144c5
fix(sdk): wrap ErrRewrapForbidden under ErrKASRequestError

marythought
and
claude
committed
c968853
fix(sdk): distinguish policy binding tamper from KAS misconfiguration

marythought
and
claude
committed
3464e5d
Revert "fix(sdk): distinguish policy binding tamper from KAS misconfiguration"
marythought
committed
a3dbdae
fix(sdk): use descriptive KAS errors for misconfiguration, keep generic for tamper

marythought
and
claude
committed
bdd77f0
chore(docs): add security comments explaining generic vs descriptive KAS errors

marythought
and
claude
committed
3dd9479
fix(kas): keep generic error for corrupted policy and malformed binding

marythought
and
claude
committed
3571082
chore(sdk): add shared constant for generic KAS error and expand tests

marythought
and
claude
committed
3a40427
docs(docs): add instructions for running xtests against feature branches

marythought
and
claude
committed
2b15967
fix(sdk): anchor tamper detection to gRPC desc prefix and harden error messages

marythought
and
claude
committed
311f2db
fix(kas): preserve per-KAO tamper signals on policy decode failure

marythought
and
claude
committed
48214c2
fix(sdk): un-nest ErrRewrapForbidden from ErrKASRequestError

marythought
and
claude
committed
8ec8182