jif 61e23bc6a1 Bind Guardian async scores to target environment permissions (#47830) ...

## Why

Asynchronous Guardian scoring omitted the target environment's denied-read restrictions, and cached score authorization did not include that permission context. A score from one environment could therefore be reused for an action in another environment with different restrictions.

## What changed

- Share permission resolution between synchronous review and asynchronous scoring, including resolving `write_stdin` targets from the owning terminal session.
- Include environment identity and denied-read paths/globs in async scoring context and cached score authorization.
- Fall back to synchronous review when permission evidence cannot be resolved or exceeds the async limit of 3,000 bytes, rather than omitting restrictions.

## Testing

Add regression coverage for rejecting cached scores with different environments or denied paths, passing the target environment's restrictions to the classifier, and rejecting oversized async permission evidence.

GitOrigin-RevId: 14b6f3454bbea458be037560eb1da47d22874df1

2026-09-24 12:34:04 +00:00

..

capabilities.rs

Retire the unused Guardian extension prototype API (#45679)

2026-09-15 11:39:20 +00:00

registry.rs

Bind Guardian async scores to target environment permissions (#47830)

2026-09-24 12:34:04 +00:00

state.rs

Keep the latest Guardian risk score during concurrent sampling (#38580)

2026-08-14 13:44:51 +00:00