fix(sdk)!: reclassify KAS 400 errors — distinguish tamper from misconfiguration#3166

Merged

marythought merged 12 commits intomainfrom

fix/dspx-2606-rewrap-error-classification

Apr 2, 2026

Commits on Apr 2, 2026

fix(sdk): reclassify ErrRewrapBadRequest away from ErrTampered

marythought
and
claude
committed
fix(sdk): wrap ErrRewrapForbidden under ErrKASRequestError

marythought
and
claude
committed
fix(sdk): distinguish policy binding tamper from KAS misconfiguration

marythought
and
claude
committed
Revert "fix(sdk): distinguish policy binding tamper from KAS misconfiguration"
marythought
committed
fix(sdk): use descriptive KAS errors for misconfiguration, keep generic for tamper

marythought
and
claude
committed
chore(docs): add security comments explaining generic vs descriptive KAS errors

marythought
and
claude
committed
fix(kas): keep generic error for corrupted policy and malformed binding

marythought
and
claude
committed
chore(sdk): add shared constant for generic KAS error and expand tests

marythought
and
claude
committed
docs(docs): add instructions for running xtests against feature branches

marythought
and
claude
committed
fix(sdk): anchor tamper detection to gRPC desc prefix and harden error messages

marythought
and
claude
committed
fix(kas): preserve per-KAO tamper signals on policy decode failure

marythought
and
claude
committed
fix(sdk): un-nest ErrRewrapForbidden from ErrKASRequestError

marythought
and
claude
committed