kyle e36da19f57 p2.4: restricted workspace for permitted callers ...

guardian-star context is allowed only when the authenticated caller is in
permit_restricted and mapped to that workspace. Fleet callers remapped to it
still refuse. CLI client.toml: SIFT_CLIENT, then $HERMES_HOME/sift, then ~/.config.

2026-09-23 08:33:58 -07:00

..

P1.md

docs: P1.1 dynamic self-IP deny (DDNS/trace discovery, keep previous, atomic swap)

2026-09-22 22:06:20 -07:00

P2.md

p2.4: restricted workspace for permitted callers

2026-09-23 08:33:58 -07:00

PLAN.md

p2.4: restricted workspace for permitted callers

2026-09-23 08:33:58 -07:00