auth: validate the Forge Invocation Token as primary, binding control-Worker auth#2

Merged

MrCoder merged 3 commits into

fit-primary-auth

Jul 16, 2026

Commits on Jul 16, 2026

auth: enforce the FIT (iss/aud, binding) as primary control-Worker auth (ECOHELP-145889)

MrCoder
and
claude
committed
auth: route control calls via invokeRemote so Forge attaches the FIT (api.fetch egress carries none)

MrCoder
and
claude
committed
ci: self-heal dev control-Worker secret drift before the api E2E run

MrCoder
and
claude
committed