fix(runtime): isolate managed connector child environments

[tnunamak]

Why

Managed connector children inherited the full Core environment, including owner/operator and sibling connector secrets. The corrected boundary now admits only platform-safe values, connector-scoped declared secrets, explicitly approved proxy credentials, and run-controlled values.

What changed

• validates every binding source fail-closed, including malformed values, unsupported targets, duplicate targets, and host-specific case collisions
• blocks ambient proxy credentials unless the production operator policy explicitly approves the target
• wires the operator environment policy through startServer, controller, scheduler, and scheduler-manager into real managed children
• supports the shipped static-secret, provider-auth, manual-upload, nested auth-alternative, and legacy declaration forms without allowing arbitrary manifest-selected ambient lookup
• redacts child stderr before it reaches progress/result/terminal diagnostics
• preserves exact precedence between platform, approved ambient, connection-scoped, and run-controlled values

Status

Draft. Do not merge until the temporary base is transplanted/retargeted and the remaining repository-wide baseline failures are dispositioned.

The independent expert gate rejected the earlier bf6b6330 candidate. Exact corrected SHA 02826bf524753579c070dacaea1eb20ea5aa9a23 was then checked independently and returned SHIP for advancing this draft pointer. The correction does not erase the earlier rejection; it addresses its exact ambient-proxy, production-authority, fail-open binding, declaration-form, and secret-diagnostic findings.

Evidence

• real production child/security journey: 21/21
• operator-policy wiring, approved proxy delivery, unapproved proxy exclusion, sibling-secret isolation, malformed/case-colliding binding refusal, shipped declaration forms, and secret-free diagnostics: green
• reference-implementation typecheck: green
• mass ratchet and diff check: green
• accounting CLI suite: 207 assertions over 14 files; focused CLI 9/9
• clean-worktree repository pre-push hook: green; the exact lease-protected push reran it successfully
• test-accounting inventory: 1499 executable, 59 helpers, 1493 planned, 6 excluded

External residuals

• Full biome:policy is blocked by broad repository ledger/tool drift. Regenerating it changes 3,578 unrelated lines across the global exception ledger; that churn is not part of this one-change PR and was not committed.
• Full accounting authority remains red on a reference-implementation/test/cli.test.ts 120-second timeout reproduced at parent a697b8052, plus unrelated polyfill failures. Candidate-scoped CLI accounting is green.
• This does not claim hostile same-UID containment and does not change local-device/collector spawn boundaries.

Assisted-by: AI

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
pdpp	Ready	Preview	Aug 12, 2026 6:36am