fix(runtime): gate Draft admission and sandbox evidence - #2109

Draft

seonghobae wants to merge 40 commits into

codex/strix-trusted-binder-rootfrom

fix/draft-required-workflow-admission

Commits on Sep 11, 2026

fix(sandbox): separate trusted result evidence from stdout
seonghobae
committed
8436029

Commits on Sep 12, 2026

test(sandbox): require binary-safe trusted evidence bundle
seonghobae
committed
1ca7658
fix(sandbox): harden trusted result bundle handoff
seonghobae
committed
74d0154
test(queue): reject draft required-workflow admission
seonghobae
committed
cc545fd
fix(queue): skip heavy required jobs on Draft PRs
seonghobae
committed
b57a531
fix(sandbox): preserve causal failure status
seonghobae
committed
a4298cf
fix(git-data): restore complete queue contract blobs
seonghobae
committed
ca9311a
test(queue): preserve complete Draft-admission RED
seonghobae
committed
e64fb47
fix(queue): restore guarded exact-tree GREEN
seonghobae
committed
228116d
merge main into sandbox result handoff repair
seonghobae
committed
d960c67
test(queue): cover Draft gitleaks admission
seonghobae
committed
de7c1ca
fix(queue): skip Draft gitleaks admission
seonghobae
committed
2df3dbb
test(queue): prove Runtime Quality Ready re-entry RED
seonghobae
committed
fdf8555
fix(queue): reenter Runtime Quality on Ready
seonghobae
committed
719af93
docs(queue): record complete Draft admission boundary
seonghobae
committed
863c214
fix(sandbox): preserve forwarded output order
seonghobae
committed
f9c7a04
style(queue): normalize Runtime Ready contract EOF
seonghobae
committed
0c0e73d
test(sandbox): keep envelope hidden until streams complete
seonghobae
committed
bb42e0c
test(sandbox): require atomic envelope publication
seonghobae
committed
5a85d0a
fix(sandbox): publish completed envelope atomically
seonghobae
committed
eda9319
test(sandbox): cover atomic publication edges
seonghobae
committed
f111da9
test(runtime): require sandbox evidence path admission
seonghobae
committed
5e768ac
fix(runtime): admit sandbox evidence changes
seonghobae
committed
ad6fec5
test(runtime): reject vacuous sandbox path admission
seonghobae
committed
3648b84
merge: integrate atomic sandbox evidence into runtime owner
seonghobae
committed
dc4291f
fix(runtime): execute sandbox evidence suite
seonghobae
committed
d147388
test(runtime): reject vacuous trigger slice
seonghobae
committed
b671555
fix(runtime): slice exact trigger block
seonghobae
committed
2c00900
docs(runtime): bind non-vacuous sandbox admission
seonghobae
committed
cc6e39f

Commits on Sep 18, 2026

merge(main): resolve #2109 conflicts; keep Draft admission and sandbox evidence

seonghobae
and
cursoragent
committed
9781003

Commits on Sep 19, 2026

test(runtime): align Semgrep admission contract with Draft guard
seonghobae
committed
ce8c630
merge(main): adopt protected GitHub API authority foundation
seonghobae
committed
813aa75
test(runtime): bind Semgrep Draft guard to real job
seonghobae
committed
db84349
merge: stack Draft admission on canonical Strix owner
seonghobae
committed
5bd73be
fix(runtime): admit stacked Ready pull requests
seonghobae
committed
6c32c7e
test(ci): require Draft transition cancellation generation
seonghobae
committed
0f821ed
fix(ci): cancel Ready runs on Draft transition
seonghobae
committed
4bcbe95

Commits on Sep 20, 2026