You'll noticeTier: how much it should matter to you
2Useful: my rating, 1 to 5
2Signal: worth watching, 1 to 5
Remote ControlArea: what it touches
ImprovementsKind: in v2.1.275,
ImprovementsSection of the release
What
Remote/hosted-worker session transport now tracks a workerAttestationPolicy, set via a new setWorkerAttestationPolicySink callback, and reacts when that policy reports a fault.
A new unattested_request outcome was added: it appears in tool-call outcome tracking alongside unknown_call, no_approval, stale, queue_full, rate_limited, and duplicate_call, and is shown to users in Remote Control/device-linking error explanations when a machine's account requires sender attestation that the service couldn't verify.
The method that judges inbound session-channel frames (renamed from dropsUnverifiedSessionChannelFrame to sessionChannelFloorVerdict) now returns one of three outcomes, "passed", "dropped", or "refusal_rebuilt", instead of a plain true/false, and a new judgeInboundFrame step classifies frames against the attestation policy.
Why
This adds a way to detect and reject remote tool calls or session frames that can't be verified as coming from an attested sender, surfacing a clear reason instead of failing silently or ambiguously.
