feat(agents): lead-agent identities + canvas access — full #1800 set (slices 1-7)#1838

Merged

jaylfc merged 23 commits into

devfrom

Jul 15, 2026

Commits on Jul 14, 2026

feat(agents): add canvas_read and canvas_write scopes
jaylfc
committed
fix(agents): drop unused SCOPE_LABELS map in ConsentActions
jaylfc
committed
feat(agents): canvas routes join the agent-token allowlist (#1800 slice 2)
jaylfc
committed
Merge branch 'feat/lead-identity-mw-allowlist' into feat/lead-identity-base
jaylfc
committed
feat(agents): consent approval sets registry handle from sanitized identity claim
jaylfc
committed
fix(agents): reject blank project_id for project-scoped grants
jaylfc
committed
feat(canvas): agent scope + permission gating and honest attribution
jaylfc
committed
fix(agents): escape the dot in the canvas snapshot allowlist regexes
jaylfc
committed
fix(canvas): fold adversarial review findings 1, 2, 4 into route gating
jaylfc
committed
feat(projects): members canvas checkboxes + exclusive Lead (#1800 slice 6)
jaylfc
committed
feat(canvas): payload cap + agent write rate limit (#1800 slice 5)
jaylfc
committed
feat(canvas): gate stream + snapshot + keepalive recheck (#1800 slice 4)
jaylfc
committed
fix(agents): close consent handle-set TOCTOU and active-without-handle orphan window
jaylfc
committed
Docs-Reviewed: restore slice-3 enforcement tests dropped during slice 5 per lead-agent-identity-and-canvas-access.md
jaylfc
committed
test(agents): update ConsentActions test to the new project-picker label
jaylfc
committed

Commits on Jul 15, 2026