[jmecom]

Close four security findings at their existing authorization and data-validation owners:

• AST-D117-C01 — workflow authority: Claude, Codex, Pi, and Goose reject workflow-generated mentions before creating or steering sessions. Rendered output does not authenticate which text came from the owner’s template versus trigger data. This intentionally stops automatic activation from existing workflow mentions, including static templates; the owner or a directly attested agent must send a separate request. Workflow display and ordinary direct requests remain supported.
• AST-D135-C01 — development broker: reject effective non-loopback Vite host settings, including CLI overrides, before loading the signing identity. Unpinned fixtures retain their normal hosting options.
• AST-D130-C01 — attachment integrity: native successful upload descriptors must match the digest and size of the final uploaded bytes, including converted media. Preserve non-success HTTP responses and federated authorization behavior.
• AST-D120-C01 — Canvas query binding: require kind 40100 and exactly one canonical matching channel tag before selecting a Canvas head. Invalid newer results cannot suppress a valid returned head. This complements fix(canvas): keep todo edits from approving unrelated instructions #2350’s approval-preservation fix; it does not establish freshness against replay of an older valid Canvas at the same coordinates.

Validation

• Each finding has a regression that failed before its repair and passed afterward.
• Shared workflow authorization and all four runtime suites: 809 passed, one existing skip. Claude/Codex fixtures verify rejected workflow mentions start no process or session; a direct owner request still runs.
• Native relay owner tests: 95 passed, one existing ignored performance probe. Actual ffmpeg conversion, federated uploads, successful descriptors, and HTTP-error preservation exercised over loopback with synthetic identities.
• Canvas owner/project tests: 35 passed. Seven genuine signed wrong-kind/channel/tag-shape cases rejected.
• Broker checks use installed Vite configuration resolution and server construction; unsafe settings are rejected before identity access, and a real loopback endpoint succeeds with a synthetic identity.
• Combined pre-push gate at 43c880f: TypeScript, 9,244 JavaScript tests (16 existing skips), design checks, and workspace Clippy with warnings denied passed. Independent review of each repair found no blockers.

Production: +62/−129 lines; tests: +330/−451 lines. Removed tests covered deleted workflow delegation/profile-fetch machinery; direct authorization, cancellation, and workflow attribution coverage remain.

Deferred acceptance

Draft pending hosted CI and human acceptance. Packaged GUI/IPC journeys and Windows/Linux runtime acceptance have not been exercised. No browser journeys were added or removed. The workflow repair closes automatic promotion of workflow output into a request; it does not claim immunity to malicious history during a later owner-authorized turn.

[wpfleger96]

🤖 Reviewed at 43c880f. All four fixes close the stated holes without breaking the paths I traced: workflow-tagged events are rejected at the single fromOwner gate used by all four runtimes, before any session start or steer; the descriptor check binds to the hash and size of the final (post-conversion) bytes and matches the relay's BlobDescriptor shape, which never rewrites stored bytes; every Canvas writer in the app, CLI and harness emits exactly one h tag, so the stricter filter drops nothing legitimate; and the vite.config/Justfile dev path never sets a non-loopback host. LGTM.