Edit Issue - .issue.db

Title *

Description

EARS SPEC:
- If a tenant other than platform calls POST /api/v1/apps (create with its own publisher), POST /api/v1/apps/<id>/versions, or POST /api/v1/apps/<id>/versions/<vid>/publish, then the API shall return 403 with code APP_PUBLISHING_RESTRICTED and shall write nothing.
- If a workflow task resolves an app action whose version was published by a publisher other than platform, then the engine shall refuse to load or execute the source, fail the task with a non-retryable APP_PUBLISHER_NOT_ALLOWED error, and log the app, version and tenant.
- Installing and running platform-published apps from any tenant shall keep working (welcome_email etc.).
- The allowed publisher set shall be one platform-config value ([apps] allowed_publishers, default 'platform'), read at startup; an empty value shall mean no app executes, never all apps.
Reason: app source runs in a forked child of the worker with the worker's uid, environment and file access (#945, #1006), so any tenant publisher can read platform secrets. This closes the path until app isolation is redesigned (RunFlow-based or a dedicated runner, in the per-component review the owner scheduled). Owner approved 2026-10-22.

Due Date (YYYY-MM-DD)

Tags (comma separated)

Related Issues (IDs)

Enter IDs of issues related to this one. They will be linked as 'related'.

Edit Issue #1043