Skip to content

Harden controlled Lark pilot credentials - #67

Merged
pearjelly merged 43 commits into
mainfrom
codex/loop-40-controlled-pilot
Aug 4, 2026
Merged

Harden controlled Lark pilot credentials#67
pearjelly merged 43 commits into
mainfrom
codex/loop-40-controlled-pilot

Conversation

@pearjelly

Copy link
Copy Markdown
Owner

Summary

  • exchange a short-lived Feishu tenant access token from the Vault-provided app secret only for an explicitly approved live task
  • fail closed after a live connector failure so subsequent approvals require a new private pilot workspace
  • document the credential boundary and add coverage for token exchange, redaction, and stop-rule behavior

Validation

  • PYTHONPATH=src python3 -m unittest discover -s tests -v (335 passed)
  • python3 scripts/secret_hygiene.py examples/workflows
  • git diff --check

pearjelly added 30 commits July 11, 2026 17:08
@pearjelly
pearjelly marked this pull request as ready for review August 4, 2026 06:03
@pearjelly
pearjelly merged commit ba2fa4c into main Aug 4, 2026
2 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant