13 October: admin second factor, pinned worker keys, restore fixes

Several hardening steps and two restore fixes went live in the evening.

User impact: Not reviewed

Added on 23 October 2026 from the repository history. Tool-argument validation, a default reasoning level per model and a machine-readable versions guide, listed under 11 October in the commits, also went live on 13 October at 16:31 CEST.

Security

Admin rights can require a second factor from Keycloak. The default mode warns, and enforcement is a setting.
Connections from the core server to the worker servers check the worker's SSH host key. Sandbox runtimes are limited to an allowlist.
Pentest scans no longer start their own runc containers.
A claims registry checks public security statements against the live system after each deploy and daily.
Tool arguments are validated before a tool runs.

Fixed

Resuming an offloaded workspace no longer counts its disk twice against the account quota.
Restoring an offloaded workspace failed with "no_archive" because of NAS archive permissions.