p2.4: restricted workspace for permitted callers

guardian-star context is allowed only when the authenticated caller is in permit_restricted and mapped to that workspace. Fleet callers remapped to it still refuse. CLI client.toml: SIFT_CLIENT, then $HERMES_HOME/sift, then ~/.config.
2026-09-23 08:33:58 -07:00
parent 14eb7808ce
commit e36da19f57
10 changed files with 159 additions and 42 deletions
@@ -36,3 +36,4 @@ listen = "127.0.0.1:8890"
 # [context]
 # honcho = "http://rift.scylla-hammerhead.ts.net:8000"
 # workspaces = ["hermes-fleet"]
+# permit_restricted = []  # caller names allowed to query guardian-star