Repository navigation

ci: fan out Strix scans and collect exact run verdict - #2400

Draft

seonghobae wants to merge 161 commits into

codex/release-full-set-verdict-20260926from

codex/release-strix-fanout-workflow-20260926

Draft

ci: fan out Strix scans and collect exact run verdict#2400
seonghobae wants to merge 161 commits into
codex/release-full-set-verdict-20260926from
codex/release-strix-fanout-workflow-20260926

Commits on Sep 18, 2026
- fix(security): allowlist https://api.github.com before urllib urlopen
  
  seonghobae
  and
  cursoragent
  committed
  a83d6d3
- test(security): pin GitHub API redirect credential boundary
  seonghobae
  committed
  225260a
- fix(security): contain GitHub API redirects to admitted origin
  seonghobae
  committed
  0ae2204
- test(security): pin Strix redirect credential boundary
  seonghobae
  committed
  062663a
- fix(security): contain Strix GitHub API redirects
  seonghobae
  committed
  2708a6b
- chore(deps): bump anyio from 4.14.0 to 4.14.2
  dependabot[bot]
  authored
  3758b89
Commits on Sep 19, 2026
- test(security): align Strix transport seam with dedicated opener
  seonghobae
  committed
  4dcd25c
- test(security): bind authenticated openers at owned seams
  seonghobae
  committed
  834d285
- merge(security): carry #2269 urllib GitHub API opener into #2278
  seonghobae
  committed
  6d10002
- chore(deps): isolate AnyIO security owner delta
  seonghobae
  committed
  545648e
- merge: carry AnyIO lock update onto protected owner
  seonghobae
  committed
  c51c8d2
- fix(opencode): materialize every coverage lock input
  seonghobae
  committed
  e43a75b
- docs(gap): bind coverage repair to canonical PR
  seonghobae
  committed
  c4a73a1
Commits on Sep 20, 2026
- fix(deps): restore AnyIO owner isolation
  seonghobae
  committed
  8a5251b
Commits on Sep 23, 2026
- repair(codeql): restore exact endpoint-set assertion
  seonghobae
  committed
  657d104
- chore(foundation): converge dependency and CodeQL repairs
  seonghobae
  committed
  f1a8dc8
Commits on Sep 24, 2026
- fix(opencode): adopt AnyIO security prerequisite
  seonghobae
  committed
  42e4198
- fix(test-gate): restore full branch coverage
  seonghobae
  committed
  38cfcae
- test(queue-health): scope permission assertion to workflow token
  seonghobae
  committed
  21247ef
- test(queue-health): isolate collector edge cases
  seonghobae
  committed
  57c168b
- fix(opencode): vendor all base Cargo lock roots
  seonghobae
  committed
  2e79155
- repair(foundation): converge CodeQL endpoint contract into coverage owner
  seonghobae
  committed
  f229816
Commits on Sep 25, 2026
- fix(security): update AnyIO lock for audit gate
  seonghobae
  committed
  3b3ce16
Commits on Sep 26, 2026
- fix(codeql): unblock CodeQL scan dispatch for all .github PRs
  seonghobae
  committed
  14fe2b6
- repair(foundation): converge coverage, dependency, and CodeQL owners
  seonghobae
  committed
  950ab88
- fix(ci): bind AnyIO security pin to Strix input
  seonghobae
  committed
  8e1aba9
- ci: fan out Strix scans and collect exact run verdict
  seonghobae
  committed
  c203246
- ci: recognize bound release scope evidence member
  seonghobae
  committed
  4bc9aeb
- ci: include dependency report with full-set verdict
  seonghobae
  committed
  43757f7
- Transport exact release scope archives into central gate
  seonghobae
  committed
  8789551
- Verify transported wheel metadata and locked closure
  seonghobae
  committed
  ce34a7f
- Pin helper revision containing scope verifier
  seonghobae
  committed
  cf61526
- Prescreen exact runtime archive licences
  seonghobae
  committed
  2748197
- Gate release runtime wheel licences before Strix
  seonghobae
  committed
  0647f4f
- Run runtime wheel prescreen before Strix matrix
  seonghobae
  committed
  7358be6
- Bind runtime wheel SHA variants to licence and Strix evidence
  seonghobae
  committed
  4283b53
- Run exact runtime wheel matrix with pinned gate helpers
  seonghobae
  committed
  4dab93c
- Seal verified scope artifact identities in full-set verdict
  seonghobae
  committed
  a1bb97f
- Use scope-sealing helper in release gate workflow
  seonghobae
  committed
  9169432
- Reject scope artifacts reusing Strix binding IDs
  seonghobae
  committed
  1988e8f
- Pin release gate to collision-checked helper
  seonghobae
  committed
  56bfac9
- Merge foundation owner into Cargo materializer repair
  seonghobae
  committed
  4e29c11
- test: remove dead Cargo root probe
  seonghobae
  committed
  9fb9097
- fix(release): gate the wheel Cargo lock and accept build receipts
  seonghobae
  committed
  a929d6a
- ci(release): pin updated wheel-scope gate helper
  seonghobae
  committed
  70c1ce1
- test(ci): reject escaping Cargo target paths
  seonghobae
  committed
  93a8e08
- fix(ci): confine Cargo placeholder targets
  seonghobae
  committed
  00b9e25
- merge: integrate exact-set verifier into Strix release gate
  seonghobae
  committed
  28978ca
- ci(release): pin merged exact-set Strix helper
  seonghobae
  committed
  6386342
- test(release): model registry checksum fixture accurately
  seonghobae
  committed
  f8c4eed
- ci(release): require both sdist build receipts in scope transport
  seonghobae
  committed
  ea5f015
- ci(release): pin sdist receipt helper in gate workflow
  seonghobae
  committed
  de8e936
- test(release): expose premature PASS report
  seonghobae
  committed
  dbeb289
- fix(release): validate scope before PASS report
  seonghobae
  committed
  f588963
- ci(release): pin scope-first Strix helper before PASS
  seonghobae
  committed
  d8e029c
- ci(release): bind target sdist consumer wheels in scope transport
  seonghobae
  committed
  3634092
- Pin release gate to consumer scope verifier
  seonghobae
  committed
  8d45e81
- Bind sdist consumer installation to target runtime receipt
  seonghobae
  committed
  74fb980
- Pin release gate to consumer install verifier
  seonghobae
  committed
  616f584
- test(rust): keep mock materializer coverage toolchain-independent
  seonghobae
  committed
  fc9c8d2
- test(release): expose forged consumer receipt
  seonghobae
  committed
  132a167
- fix(release): rederive consumer wheel evidence
  seonghobae
  committed
  766aeeb
- test(release): expose split consumer metadata roots
  seonghobae
  committed
  379f808
- fix(release): bind consumer dist-info root
  seonghobae
  committed
  fde9c8c
- test(release): expose foreign Cargo path crate
  seonghobae
  committed
  ece13d6
- fix(release): bind local Cargo crates to workspace
  seonghobae
  committed
  e7755d9
- ci(release): pin repaired evidence verifier
  seonghobae
  committed
  8867d3d
- fix(release): bind installed build files to scope snapshots
  seonghobae
  committed
  e0af437
- ci(release): pin build snapshot verifier
  seonghobae
  committed
  95e4da9
- fix(release): licence and Strix review installed build packages
  seonghobae
  committed
  73fdcd8
- ci(release): pin installed build package review helper
  seonghobae
  committed
  8d76f3a
- fix(release): refuse ambiguous installed build identities
  seonghobae
  committed
  4953e66
- ci(release): pin strict build identity verifier
  seonghobae
  committed
  8b3bb11
- Bind reviewed maturin executable to release Strix evidence
  seonghobae
  committed
  bcdce9b
- Pin maturin review helper in release workflow
  seonghobae
  committed
  607a056
- test(release): expose unbound maturin provenance
  seonghobae
  committed
  304acd2
- fix(release): validate maturin source provenance
  seonghobae
  committed
  f976b17
- ci(release): pin provenance-validating helper
  seonghobae
  committed
  e5103dd
- Inventory native links in verified release wheels
  seonghobae
  committed
  dde3a44
- Gate both release paths on native link inventory
  seonghobae
  committed
  4e8212a
- Bound native wheel inspection memory and detect hidden binaries
  seonghobae
  committed
  0a7a950
- Pin bounded native scanner for release gate
  seonghobae
  committed
  abdef9d
- Seal recomputed native links in release verdict
  seonghobae
  committed
  a774db7
- Publish sealed native link inventory with full verdict
  seonghobae
  committed
  878a056
- test(release): expose unbound native analyzer
  seonghobae
  committed
  2684aef
- fix(release): bind native analyzer identity
  seonghobae
  committed
  5192d10
- ci(release): pin analyzer-bound helper
  seonghobae
  committed
  dcfb572
- test(release): cover native evidence boundaries
  seonghobae
  committed
  20d3259
- test(release): require complete native coverage
  seonghobae
  committed
  ea6c624
- test(release): cover runtime archive prescreen boundaries
  seonghobae
  committed
  27cf2f3
- test(release): cover distribution set fail-closed boundaries
  seonghobae
  committed
  eb8130c
- test(release): cover scope evidence fail-closed boundaries
  seonghobae
  committed
  e3b4645
- docs(gap): record release evidence coverage boundary
  seonghobae
  committed
  3a3eb40
- docs(gap): avoid self-referential exact-head claim
  seonghobae
  committed
  891057f
Commits on Sep 27, 2026
- test: close release gate trust boundaries
  seonghobae
  committed
  0ef663b
- test: close queue health coverage gap
  seonghobae
  committed
  ec4f949
- test: close Noema document reader coverage gap
  seonghobae
  committed
  4132b59
- merge: integrate canonical Rust materializer owner
  seonghobae
  committed
  0c557f7
- Inspect runtime wheel native links before release prescreen
  seonghobae
  committed
  84ba643
- Pin release workflow to native archive prescreen helper
  seonghobae
  committed
  89370d5
- Inspect native files in release build interpreter snapshots
  seonghobae
  committed
  99888dc
- Pin release gate to build snapshot native inspection
  seonghobae
  committed
  eaecbe1
- Review exact release native links before sealed verdict
  seonghobae
  committed
  f599a2c
- test(release): restore exact native prescreen coverage
  seonghobae
  committed
  39471f5
- Pin release workflow to reviewed native link policy
  seonghobae
  committed
  3b1f075
- Merge concurrent native prescreen coverage
  seonghobae
  committed
  ee6d8e2
- Verify maturin asset bytes and native links before licence gate
  seonghobae
  committed
  aea63e1
- Pin release workflow to verified maturin asset scanner
  seonghobae
  committed
  faac193
- test(release): close native-link current-head coverage
  seonghobae
  committed
  750875f
- Merge native-link coverage with maturin asset verification
  seonghobae
  committed
  ee0da13
- Review Intel macOS runtime archives in release gate
  seonghobae
  committed
  51db1d0
- fix(release): bind Intel wheel architecture
  seonghobae
  committed
  703c7e5
- Capture licence choices from immutable release source
  seonghobae
  committed
  7a3f397
- Load source licence choices in both release gate captures
  seonghobae
  committed
  8b8fc5c
- Review exact allocator licence texts and reject malformed choices
  seonghobae
  committed
  5185799
- Pin reviewed allocator licence evidence helper
  seonghobae
  committed
  bfc5c54
- Review exact Microsoft crate licence texts
  seonghobae
  committed
  d3f5602
- Pin exact Microsoft licence review helper
  seonghobae
  committed
  08517d4
- Review exact PyO3 GPU and shared Rust licence texts
  seonghobae
  committed
  1568ca1
- Pin grouped Rust licence review helper
  seonghobae
  committed
  53767c6
- Review eight exact shared MIT licence variants
  seonghobae
  committed
  870fb1b
- Pin reviewed shared MIT text variants
  seonghobae
  committed
  03d023c
- fix: reject oversized selection blobs before reading payload
  seonghobae
  committed
  db56e17
- ci: pin bounded selection capture helper
  seonghobae
  committed
  0c0037f
- fix: interpret reviewed Cargo legacy dual licence declarations
  seonghobae
  committed
  ceae674
- ci: pin Cargo legacy licence evidence helper
  seonghobae
  committed
  f9be69b
- test: register eight reviewed Cargo MIT notice variants
  seonghobae
  committed
  37c885f
- ci: pin reviewed Cargo MIT notice registry
  seonghobae
  committed
  ba01766
- fix: validate licence reference notices against full bundled grants
  seonghobae
  committed
  80c5f23
- ci: pin full-grant reference notice validation
  seonghobae
  committed
  0e81cfb
- test: register reviewed single-grant Cargo licence texts
  seonghobae
  committed
  b4b5341
- ci: pin reviewed single-grant licence registry
  seonghobae
  committed
  69d3613
- test: register complete compound Cargo licence notices
  seonghobae
  committed
  60394b6
- ci: pin compound licence notice registry
  seonghobae
  committed
  45407a0
- test: register fourteen checksum-bound Cargo MIT grants
  seonghobae
  committed
  9ac9d86
- ci: pin reviewed MIT grant batch
  seonghobae
  committed
  a550ee9
- test: register remaining reviewed Cargo MIT variants
  seonghobae
  committed
  aaafbbb
- ci: pin remaining reviewed MIT grant variants
  seonghobae
  committed
  0cdafe2
- test: register reviewed Apache Zlib and BSD full grants
  seonghobae
  committed
  1d6530d
- ci: pin complete Apache Zlib and BSD grant registry
  seonghobae
  committed
  71290da
- fix: require full grants for resolved compound licence choices
  seonghobae
  committed
  05263fe
- ci: pin compound grant validation
  seonghobae
  committed
  3aebd56
- fix: report missing licence texts before grant selection
  seonghobae
  committed
  e65b276
- ci: pin independent missing-grant checks
  seonghobae
  committed
  fbb48ec
- test: bind reviewed root-development licence variants
  seonghobae
  committed
  13a59ca
- ci: pin reviewed development-licence variants
  seonghobae
  committed
  7cd4141
- fix: bind sibling Cargo path crates to immutable release source
  seonghobae
  committed
  2a53d90
- ci: require source checkout binding before licence and full verdict
  seonghobae
  committed
  98f948f
- fix: collect Cargo lock from the resolved workspace
  seonghobae
  committed
  c770d50
- ci: pin workspace-aware Cargo lock collection
  seonghobae
  committed
  4c23ba2
- fix: require source-bound development Cargo closure in release gates
  seonghobae
  committed
  2cd2ede
- ci: collect both release and development Cargo workspaces
  seonghobae
  committed
  e433a08
- test: execute dual Cargo workspace capture without network
  seonghobae
  committed
  878b74e
- fix: accept reviewed spaced Cargo legacy licence pair
  seonghobae
  committed
  4964e75
- ci: pin reviewed spaced Cargo legacy licence adapter
  seonghobae
  committed
  f996ee5
- fix: distinguish reviewed Apache reference from independent MIT grant
  seonghobae
  committed
  84a8a12
- ci: pin reviewed independent MIT alternative validation
  seonghobae
  committed
  f5bddad
- fix: partition complete Strix plan into bounded native matrices
  seonghobae
  committed
  fb2dd27
- ci: run all Strix fixtures across two authenticated matrices
  seonghobae
  committed
  8334ab0
- fix: bind every native dependency to its actual interpreter architecture
  seonghobae
  committed
  9d19d0d
- ci: pin verified primary and build native architecture checks
  seonghobae
  committed
  bd65571

Commits

Commits on Sep 18, 2026

Commits on Sep 19, 2026

Commits on Sep 20, 2026

Commits on Sep 23, 2026

Commits on Sep 24, 2026

Commits on Sep 25, 2026

Commits on Sep 26, 2026

Commits on Sep 27, 2026