audit fixes (P19): cap anonymous provider spend, bound the proxy claims token, scope eval capture - #2618

Merged

BigSimmo merged 9 commits into

mainfrom

claude/audit-fix-p19

Sep 5, 2026

Commits on Sep 4, 2026

security: cap total anonymous provider-backed generation (L42)
claude
committed
c165723
security: bound and re-key the proxy claims header (L27)
claude
committed
a476483
api: validate eval-capture chunk and file ownership (L23)
claude
committed
68126e5
docs: record why the iPhone Playwright projects stay release-only (L68)
claude
committed
984a3e6
tenancy: declare the eval-capture chunk lookup's ownership proof (L23)
claude
committed
d6a5eb9
Merge remote-tracking branch 'origin/main' into claude/audit-fix-p19
claude
committed
1a36662
Merge branch 'main' into claude/audit-fix-p19
BigSimmo
authored
e73e699

Commits on Sep 5, 2026