Ankush Gupta 75e0b4088e Add opt-in Guardian trust for orchestrator connector identities (#52250) ...

## What changed

Add the disabled-by-default `guardian_trust_orchestrator_connectors` feature flag. When enabled, Guardian V2 accepts connectors with nonblank IDs from the host-owned plugin service orchestrator as a trusted source without requiring a matching user configuration declaration.

Distinguish orchestrator provenance from user configuration in trusted-tool context. Trust remains scoped to the exact server or connector identity and source; descriptions, outputs, other tools, and other connectors remain untrusted.

## Testing

Add coverage for host-owned connector context, rejection of extension-owned Apps lookalikes and blank connector IDs, source-specific trust metadata, and context token limits. Snapshot the connector approval request history.

GitOrigin-RevId: fbd87dd71110ca7b2b92d50eef02e1e739a74a02

2026-10-08 20:04:38 +00:00

..

common

Add opt-in Guardian trust for orchestrator connector identities (#52250)

2026-10-08 20:04:38 +00:00

remote_env_windows

Bind capability roots to environment selections (#51493)

2026-10-06 22:39:32 +00:00

suite

Add opt-in Guardian trust for orchestrator connector identities (#52250)

2026-10-08 20:04:38 +00:00

all.rs

[codex] Use expect in integration tests (#28441)

2026-06-15 21:53:47 -07:00

mcp_trace_propagation.rs

Preserve MCP request trace context across transport workers (#47212)

2026-09-22 06:47:07 +00:00

responses_headers.rs

Add capability overrides for custom model providers (#50459)

2026-10-02 23:26:27 +00:00

windows_sandbox.rs

Move Windows sandbox tests into a dedicated integration binary (#51678)

2026-10-07 12:47:04 +00:00