security: close the four audit blockers, verify what the release signs - #16

Merged

jordonpeterson merged 11 commits into

mainfrom

fix/security-hardening

Aug 6, 2026

Commits on Aug 6, 2026

fix(policy): bound the policy-file parser (audit blocker 3)

jordonpeterson
and
claude
committed
90b675a
security(cli): contain the write, redact the token, guard the ref

jordonpeterson
and
claude
committed
c7ddf8d
fix(ghapi): escape URL path segments and the ref query

jordonpeterson
and
claude
committed
2d24f81
security(release): attest the build, and stop over-privileging the tap job

jordonpeterson
and
claude
committed
4c998e3
security(install): verify build provenance, not only the checksum

jordonpeterson
and
claude
committed
4bcd185
ci: gate every PR on the differential fuzz, and SHA-pin CI's actions

jordonpeterson
and
claude
committed
657fd90
docs: security policy, contributing guide, changelog, CODEOWNERS, dependabot

jordonpeterson
and
claude
committed
3efea4b
docs: regenerate BEHAVIOR.md

jordonpeterson
and
claude
committed
ebe1e8c
test(supplychain): fail on the missing file, not the missing property

jordonpeterson
and
claude
committed
e762565
docs: cut the added comments and prose to size

jordonpeterson
and
claude
committed
e8af2eb
docs: delete the comments rather than trimming them

jordonpeterson
and
claude
committed
8ab4cae