Ankush Gupta 75e0b4088e Add opt-in Guardian trust for orchestrator connector identities (#52250) ...

## What changed

Add the disabled-by-default `guardian_trust_orchestrator_connectors` feature flag. When enabled, Guardian V2 accepts connectors with nonblank IDs from the host-owned plugin service orchestrator as a trusted source without requiring a matching user configuration declaration.

Distinguish orchestrator provenance from user configuration in trusted-tool context. Trust remains scoped to the exact server or connector identity and source; descriptions, outputs, other tools, and other connectors remain untrusted.

## Testing

Add coverage for host-owned connector context, rejection of extension-owned Apps lookalikes and blank connector IDs, source-specific trust metadata, and context token limits. Snapshot the connector approval request history.

GitOrigin-RevId: fbd87dd71110ca7b2b92d50eef02e1e739a74a02

2026-10-08 20:04:38 +00:00

..

src

Add opt-in Guardian trust for orchestrator connector identities (#52250)

2026-10-08 20:04:38 +00:00

BUILD.bazel

build: run buildifier from just fmt (#28125)

2026-06-13 21:43:39 -07:00

Cargo.toml

Support remote agent message boards in multi-agent sessions (#49267)

2026-09-29 13:52:04 +00:00