Repository navigation

Harden reward lookup paths and permission identity checks - #295

Merged

BenCodez merged 71 commits into

masterfrom

security/reward-path-identity-hardening

Aug 25, 2026

Merged

Harden reward lookup paths and permission identity checks#295
BenCodez merged 71 commits into
masterfrom
security/reward-path-identity-hardening

Commits on Aug 24, 2026
- Reject reward path traversal names
  BenCodez
  committed
  5d4d5be
- Fix reward file name validation
  BenCodez
  committed
  1da8dd9
- Do not expose reward-file sub-sections as standalone rewards
  BenCodez
  committed
  8255a6d
- Require UUID match for permission name fallback
  BenCodez
  committed
  7e27e77
- Add reward path traversal regression tests
  BenCodez
  committed
  a17d8fd
- Add permission identity regression tests
  BenCodez
  committed
  580e806
- Fix isolated static mock setup in permission security test
  BenCodez
  committed
  b326bdd
- Keep file sub-rewards internal to dispatch
  BenCodez
  committed
  b02d96b
- Dispatch file sub-rewards without exposing lookup
  BenCodez
  committed
  6c9ab5d
- Test internal file-backed sub-reward discovery
  BenCodez
  committed
  9261525
- Keep internal sub-reward lookup null-safe
  BenCodez
  committed
  58d8385
- Fix PlayerManager security test isolation
  BenCodez
  committed
  9742af8
- Quarantine stale generated sub-reward files
  BenCodez
  committed
  c8bf25b
- Test stale sub-reward quarantine
  BenCodez
  committed
  53bfa8d
- Quarantine generated direct rewards during loading
  BenCodez
  committed
  072892c
- Test stale generated reward quarantine during load
  BenCodez
  committed
  e082e36
- Fix AdvancedRewards internal dispatch naming
  BenCodez
  committed
  398dff7
- Restrict queued generated rewards to referenced users
  BenCodez
  committed
  28a334d
- Preserve queued generated rewards without public bypass
  BenCodez
  committed
  0c08030
- Test queued generated reward preservation
  BenCodez
  committed
  e2ea1b6
- Test AdvancedRewards dispatch naming
  BenCodez
  committed
  5f87d56
- Fix queued reward security test fixture
  BenCodez
  committed
  2a954a3
- Avoid revalidating queued reward snapshots
  BenCodez
  committed
  cf64719
- Remove plugin singleton dependency from loader tests
  BenCodez
  committed
  fa1cf0f
- Keep generated rewards queue-only without user scans
  BenCodez
  committed
  1e7cb90
- Expose queue-only generated reward resolver
  BenCodez
  committed
  1c7d936
- Resolve generated snapshots only during queue replay
  BenCodez
  committed
  cf7d75b
- Test queue-only generated reward snapshots
  BenCodez
  committed
  ed27115
- Test queue-only generated reward dispatch
  BenCodez
  committed
  e194321
- Use safe lookup rules for queued reward names
  BenCodez
  committed
  0df49af
Commits on Aug 25, 2026
- Keep generated reward snapshots out of public registry
  BenCodez
  committed
  6dfb241
- Resolve queued snapshots before normal reward fallback
  BenCodez
  committed
  8d8c8dd
- Resolve timed queued snapshots through restricted loader
  BenCodez
  committed
  c052358
- Test queued snapshot precedence for offline and timed replay
  BenCodez
  committed
  2d72076
- Test generated snapshots stay out of public registry
  BenCodez
  committed
  b9bb9bd
- Qualify AdvancedPriority generated reward names
  BenCodez
  committed
  bc128a1
- Apply queued reward replay and registration fixes
  BenCodez
  committed
  a37279e
- Keep generated queue snapshots out of public lookup
  github-actions[bot]
  committed
  112ae9d
- Keep generated snapshot registry guard null-safe
  BenCodez
  committed
  db16731
- Apply Codex queue provenance fixes for PR 295
  BenCodez
  committed
  2373d9a
- Bind queued snapshots to persisted provenance
  github-actions[bot]
  committed
  0258b21
- Extend reward filename security regression coverage
  BenCodez
  committed
  be39e33
- Align queued reward tests with persisted provenance
  BenCodez
  committed
  9186bfa
- Fix queue provenance security test setup
  BenCodez
  committed
  d2f28b9
- Test exact generated filename suppression directly
  BenCodez
  committed
  056c06e
- Parse snapshot provenance only for queue replay
  BenCodez
  committed
  87491f7
- Test normal reward names containing snapshot marker
  BenCodez
  committed
  0ad6989
- Add versioned queued reward reference envelope
  BenCodez
  committed
  f51a06c
- Apply versioned queue-envelope fix for PR 295
  BenCodez
  committed
  e36bd7b
- Remove temporary queue-envelope patch workflow
  BenCodez
  committed
  cb18df5
- Remove unused queue envelope experiment
  BenCodez
  committed
  a973f81
- Add focused Codex 295 queue envelope patch
  BenCodez
  committed
  74d0509
- Use unambiguous persisted reward queue references
  github-actions[bot]
  committed
  b17f0a1
- Apply queued reward envelope cleanup
  BenCodez
  committed
  b213626
- Remove stale queued reward marker reference
  github-actions[bot]
  committed
  df4ea88
- Test versioned queued reward references
  BenCodez
  committed
  61af682
- Preserve queued file-backed sub rewards
  BenCodez
  committed
  cf3f2b2
- Preserve generated snapshot provenance on requeue
  BenCodez
  committed
  76748fd
- Test queued snapshot requeue provenance
  BenCodez
  committed
  bac6a72
- Track internal file subreward queue provenance
  BenCodez
  committed
  684451d
- Test deferred file-backed sub reward snapshots
  BenCodez
  committed
  61d5494
- Remove unused queue marker class
  BenCodez
  committed
  668fa6f
- Add one-shot queue provenance fix
  BenCodez
  committed
  f725011
- Require persisted queue provenance for snapshot replay
  github-actions[bot]
  committed
  0b12e2b
- Test forged timed queue options stay public
  BenCodez
  committed
  f364a07
- Update queue replay user tests
  BenCodez
  committed
  a7d534c
- Apply snapshot replacement fix
  BenCodez
  committed
  ab75b25
- Replace reused generated reward snapshots
  github-actions[bot]
  committed
  44ce975
- Strengthen reused snapshot regression
  BenCodez
  committed
  0d49297
- Isolate snapshot replacement regression
  BenCodez
  committed
  48d7e4d
- Test generated snapshot replacement semantics
  BenCodez
  committed
  9be2860

Commits

Commits on Aug 24, 2026

Commits on Aug 25, 2026