Add AST-based security middleware and enforcement wiring

2026-02-23 14:21:22 -05:00
parent 9b4216dda9
commit ef2a25b5fb
28 changed files with 1936 additions and 37 deletions
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -38,6 +38,15 @@
  - `AGENT_PORT_PRIMARY_OFFSET`
  - `AGENT_PORT_LOCK_DIR`
  - `AGENT_DISCOVERY_FILE_RELATIVE_PATH`
+- Security middleware controls:
+  - `AGENT_SECURITY_VIOLATION_MODE`
+  - `AGENT_SECURITY_ALLOWED_BINARIES`
+  - `AGENT_SECURITY_COMMAND_TIMEOUT_MS`
+  - `AGENT_SECURITY_AUDIT_LOG_PATH`
+  - `AGENT_SECURITY_ENV_INHERIT`
+  - `AGENT_SECURITY_ENV_SCRUB`
+  - `AGENT_SECURITY_DROP_UID`
+  - `AGENT_SECURITY_DROP_GID`

 ## Documentation Standards
 - Update `README.md` for user-facing behavior.