fix(ocap-kernel): request only the URL the fetch caveat approved - #1026

Merged

sirtimid merged 7 commits into

mainfrom

sirtimid/fix-fetch-input-toctou

Aug 19, 2026

Commits on Aug 19, 2026

fix(ocap-kernel): request only the URL the fetch caveat approved

sirtimid
and
claude
committed
c0ea2b7
fix(ocap-kernel): check every hop, not just the pre-flight URL

sirtimid
and
claude
committed
fa094d2
docs: trim the fetch changelog entries to the consumer-facing change

sirtimid
and
claude
committed
615e223
fix(kernel-utils): close the guarded fetch's own input TOCTOU

sirtimid
and
claude
committed
461793e
fix(kernel-utils): spend the guarded fetch's integrity on the resource

sirtimid
and
claude
committed
5a9e6db
chore: rerun CI

sirtimid
and
claude
committed
282fbaf
docs: file the fetch confinement fix under Security

sirtimid
and
claude
committed
53aef6c