kyle e36da19f57 p2.4: restricted workspace for permitted callers ...

guardian-star context is allowed only when the authenticated caller is in
permit_restricted and mapped to that workspace. Fleet callers remapped to it
still refuse. CLI client.toml: SIFT_CLIENT, then $HERMES_HOME/sift, then ~/.config.

2026-09-23 08:33:58 -07:00

..

sift.service

p1: ExecStart must invoke sift serve

2026-09-22 22:11:28 -07:00

sift.toml.example

p2.4: restricted workspace for permitted callers

2026-09-23 08:33:58 -07:00