Repository navigation

security: isolate host agents and sanitize subprocesses - #303

Open

eshulman2 wants to merge 16 commits into

forge-sdlc:mainfrom

eshulman2:security/agent-hardening-phase-1

Open

security: isolate host agents and sanitize subprocesses#303
eshulman2 wants to merge 16 commits into
forge-sdlc:mainfrom
eshulman2:security/agent-hardening-phase-1

Commits on Oct 21, 2026
- security: isolate host agents and sanitize subprocesses
  eshulman2
  committed
  d7ae9c2
- style: format host agent middleware
  eshulman2
  committed
  bffb155
- docs: add baseline read-only MCP allowlist
  eshulman2
  committed
  7220946
- fix: preserve concurrent agent skill snapshots
  eshulman2
  committed
  9949efe
- fix: mount agent roots in Helm workloads
  eshulman2
  committed
  279dd66
- refactor: use shared isolated skill tree
  eshulman2
  committed
  a55ac38
- style: format isolated skill paths
  eshulman2
  committed
  9048266
- fix: enforce host agent isolation boundaries
  eshulman2
  committed
  f9d3256
- fix: support fsGroup-owned agent roots
  eshulman2
  committed
  8e7b426
- style: format agent root validation
  eshulman2
  committed
  689ca86
- fix: mount Kubernetes agent volume parent
  eshulman2
  committed
  4ca8b0e
- fix: prevent host tool shadowing and stale skills
  eshulman2
  committed
  cf3b5f9
- fix: restore container agent skill mounts
  eshulman2
  committed
  147e601
- fix: load virtual skills and enforce host tool allowlist
  eshulman2
  committed
  2ca9998
- test: verify host isolation with structured responses after rebase
  eshulman2
  committed
  713fed3
- test: prepare agent isolation real-environment canary
  eshulman2
  committed
  fd83f5f