p2.4: restricted workspace for permitted callers

guardian-star context is allowed only when the authenticated caller is in permit_restricted and mapped to that workspace. Fleet callers remapped to it still refuse. CLI client.toml: SIFT_CLIENT, then $HERMES_HOME/sift, then ~/.config.
2026-09-23 08:33:58 -07:00
parent 14eb7808ce
commit e36da19f57
10 changed files with 159 additions and 42 deletions
@@ -34,8 +34,9 @@ type Digest struct {
 }

 type Context struct {
-	Honcho     string   `toml:"honcho"`
-	Workspaces []string `toml:"workspaces"`
+	Honcho           string   `toml:"honcho"`
+	Workspaces       []string `toml:"workspaces"`
+	PermitRestricted []string `toml:"permit_restricted"`
 }

 // SelfIP is the [self_ip] block.