Oliver Kieselbach 0a8a6eabd7 feat(backend,agent): cert-reject visibility — structured backend warnings + V2 distress cert-context ...

Backend emits AgentCertRejected (with reason enum) at every cert-validation
failure path and AgentRequestRejected (with request-context) at every 401/403
return so operators can diagnose why mTLS auth was denied. V2 agent now
attaches a Thumbprint/Subject/Issuer/NotBefore/NotAfter snapshot plus a
DistressCertSourceState classifier to each distress report; correlates 1:1
with the backend warnings via tenant + serial + thumbprint.

Distress endpoint stays unauthenticated and security-restrictive: rate-limit
(3-layer) + sanitize + truncate + enum-validation unchanged; new fields are
hex-regex / IsDefined / hard-capped at 96 chars; MaxContentLength bumped from
1024 to 1536 to fit the cert-context payload. V1 agent untouched.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

2026-05-18 10:26:52 +02:00

..

Agent

feat(backend,agent): cert-reject visibility — structured backend warnings + V2 distress cert-context

2026-05-18 10:26:52 +02:00

Backend

feat(backend,agent): cert-reject visibility — structured backend warnings + V2 distress cert-context

2026-05-18 10:26:52 +02:00

McpServer

feat(agent/v2): DAD liveness + agent_shutting_down gap closure

2026-05-15 09:39:07 +02:00

Shared

feat(backend,agent): cert-reject visibility — structured backend warnings + V2 distress cert-context

2026-05-18 10:26:52 +02:00

Web

feat(backend,web): restore-browser tenant filter — only tenants with snapshot blobs

2026-05-15 15:39:57 +02:00