fix(security): isolate tenant execution and outbound egress - #3285

Merged

kojiwakayama merged 26 commits into

mainfrom

codex/security-runtime-boundaries-20260802

Aug 3, 2026

Commits on Aug 3, 2026

fix(security): isolate remote project execution
kojiwakayama
committed
33a2e59
fix(security): enforce host outbound egress policy
kojiwakayama
committed
9a9d53b
docs(security): document host egress ceiling
kojiwakayama
committed
6f331f8
fix(security): close outbound module escape paths
kojiwakayama
committed
03f6e7f
fix(security): isolate tenant execution request boundaries
kojiwakayama
committed
1cfa47a
fix(security): close shared runtime execution paths
kojiwakayama
committed
5409c2e
fix(security): guard source-controlled host transports
kojiwakayama
committed
4bab373
fix(security): bind privileged transports to approved origins
kojiwakayama
committed
26f4819
fix(security): bound cloud blob response lifecycles
kojiwakayama
committed
cbac43c
fix(security): close privileged egress escape paths
kojiwakayama
committed
0c0cfea
fix(security): close runtime egress review gaps
kojiwakayama
committed
7fec2df
fix(security): preserve pinned transport parity in Node
kojiwakayama
committed
539311e
fix(security): preserve dedicated runtime execution boundaries
kojiwakayama
committed
c6d75aa
test(oauth): use routable dispatcher endpoints
kojiwakayama
committed
c6940f5
fix(data): bound isolated request exposure
kojiwakayama
committed
b1cc95b
test(security): exercise guarded egress deterministically
kojiwakayama
committed
77064e1
test(security): use routable guarded-egress fixtures
kojiwakayama
committed
97fb09b
test(embedding): use routable signed upload fixtures
kojiwakayama
committed
fc4481f
test(security): make guarded egress fixtures portable
kojiwakayama
committed
695cb70
fix(security): surface isolated middleware requirement
kojiwakayama
committed
d1abeaf
fix(security): preserve CSP provenance after rebase
kojiwakayama
committed
aaa38c8
fix(security): honor host execution denial
kojiwakayama
committed
ed780ba
fix(security): contain prepared API dependency reads
kojiwakayama
committed
45f8c24
fix(security): snapshot prepared API sources
kojiwakayama
committed
2104322
test(routing): ratchet security config typecheck
kojiwakayama
committed
24df369
test(cache): use guarded API transport fixture
kojiwakayama
committed
446a778

Navigation Menu

Uh oh!

fix(security): isolate tenant execution and outbound egress - #3285

fix(security): isolate tenant execution and outbound egress#3285
kojiwakayama merged 26 commits into
mainfrom
codex/security-runtime-boundaries-20260802

Commits on Aug 3, 2026

fix(security): isolate remote project execution

fix(security): enforce host outbound egress policy

docs(security): document host egress ceiling

fix(security): close outbound module escape paths

fix(security): isolate tenant execution request boundaries

fix(security): close shared runtime execution paths

fix(security): guard source-controlled host transports

fix(security): bind privileged transports to approved origins

fix(security): bound cloud blob response lifecycles

fix(security): close privileged egress escape paths

fix(security): close runtime egress review gaps

fix(security): preserve pinned transport parity in Node

fix(security): preserve dedicated runtime execution boundaries

test(oauth): use routable dispatcher endpoints

fix(data): bound isolated request exposure

test(security): exercise guarded egress deterministically

test(security): use routable guarded-egress fixtures

test(embedding): use routable signed upload fixtures

test(security): make guarded egress fixtures portable

fix(security): surface isolated middleware requirement

fix(security): preserve CSP provenance after rebase

fix(security): honor host execution denial

fix(security): contain prepared API dependency reads

fix(security): snapshot prepared API sources

test(routing): ratchet security config typecheck

test(cache): use guarded API transport fixture