Commits
Click on a commit to change the comparison rangerefactor: address pre-PR review for governed external API access (#1991) fix: babysit round 2, 11 findings (8 coderabbit, 3 gemini) - approval one-shot/cross-principal hardening, external_api egress hardening, sensitive-flag boundary + tests fix: babysit round 4, 4 findings (4 coderabbit) - postgres consumed_at UTC-normalize (sqlite parity), exclude restricted headers from approval signature, strengthen upsert + cross-principal tests