Promote the 2026-08-30 review security fixes and supplies ordering to main

plugins/endpoints/models/endpoint.py

@@ -172,6 +172,19 @@ class EndpointCommand(db.Model):
     # Who queued it (userid) for audit; the agent never sees this.
     requestedby = db.Column(db.Integer, nullable=True)
 
+    # The content digest as it stood WHEN AN OPERATOR APPROVED THIS PUSH.
+    #
+    # Delivery descriptors are re-resolved at claim time, minutes or hours
+    # later, so without this the bytes an operator approved and the bytes the
+    # agent runs are two different lookups against mutable content. Whoever can
+    # replace a script body or an installer package could swap it in the gap
+    # and the digest would faithfully describe the new bytes.
+    #
+    # Set at enqueue for run_script and update_app; null for actions that
+    # deliver no content. The claim path refuses a command whose descriptor no
+    # longer matches, so a swap fails the command instead of shipping.
+    pinnedsha256 = db.Column(db.String(64), nullable=True)
+
     # Agent-reported outcome. resultjson holds structured detail (for example
     # the observed MTConnect running state); resultmessage is a short summary.
     resultmessage = db.Column(db.Text, nullable=True)