Trusteed Agentic Commerce for Magento v1.1.0

Fix: checkout enforcement was skipped for organic (non-agent) checkouts

Merchant enforcement rules — maximum order amount, blocked countries, business-hours restrictions — were being skipped entirely whenever a checkout had no agent DID attached. These rules now run unconditionally regardless of agent presence.

This closes the same class of bug flagged in a Shopify App Store review of an unrelated checkout extension: a cross-platform audit confirmed the Magento module had a structurally similar gap.

Added: offline safety-valve evaluator

When the remote rules-evaluation API is unreachable, the module now enforces the same universal merchant rules locally (OfflineSafetyValveEvaluator) instead of falling back to a blanket allow/block policy.

Also included (previously unreleased security fixes)

• The enforcement snapshot fetched from the Trusteed backend is now cryptographically verified (Ed25519 signature check against the published JWKS) before being trusted.
• EnforcementClient no longer fabricates a placeholder dev-bypass signature when the HMAC secret is not yet configured — requests now fail safely open with a distinct log line.
• Fixed the support "Send diagnostics" endpoint calling the wrong backend path.

Testing

41/41 unit tests pass, including a cross-language conformance suite validated against the canonical rule definitions.

---

🤖 Generated with Claude Code