Govern v2: the Marketplace address delegates to the gate in decionis/agent-safe-pipeline

SECURITY.md

@@ -1,6 +1,6 @@
 # Security Policy
 
-Decionis takes the security of the **Decionis Action Gate** (`decionis/govern`) and the platform it talks to seriously.
+Decionis takes the security of **Decionis Govern** (`decionis/govern`), the gate it delegates to, and the platform it talks to seriously.
 
 ## Reporting a vulnerability
 
@@ -13,17 +13,18 @@ We acknowledge reports within **2 business days** and aim to provide a remediati
 
 ## Scope
 
-- The Action source (`src/`, `action.yml`) in this repository.
-- The Decionis APIs the Action calls (`api.decionis.com`), including the evaluate-decision, execution-grant, and OIDC endpoints.
+- `action.yml` in this repository, which delegates to the gate at a pinned commit.
+- The gate itself, `govern/` in [decionis/agent-safe-pipeline](https://github.com/decionis/agent-safe-pipeline), whose [security policy](https://github.com/decionis/agent-safe-pipeline/security/policy) covers it: report there for the binary, the installer, the release archives and the contract client.
+- The Decionis APIs the gate calls (`api.decionis.com`): enforce-and-bind, the escalation status, claim-token and finalize-token.
 
-## What the Action handles
+## What the action handles
 
-- Your `DECIONIS_API_KEY` is read only from the workflow input you provide and is sent solely to the configured `api-base-url` over HTTPS. It is never logged.
-- Execution Grants are short-lived, single-use, and signed; they are verifiable against the published JWKS.
-- The Action runs with zero third-party dependencies (Node 20 built-ins only), minimizing supply-chain surface.
+- Your `DECIONIS_API_KEY` reaches the gate as an input and is sent solely to the configured `api-url` over HTTPS, as a bearer token. It is never logged and never given to the gated command.
+- The execution grant a decision carries is claimed by the gate immediately before the command and never leaves it; the command receives the decision's identifiers and the authority's claim attestation.
+- The pinned action downloads the release binary its commit names and verifies its SHA-256 before running it, or builds the same bytes from the pinned commit.
 
 ## More
 
-- Security overview: https://decionis.com/security
-- Privacy: https://decionis.com/privacy
-- Terms: https://decionis.com/terms
+- Security overview: <https://decionis.com/security>
+- Privacy: <https://decionis.com/privacy>
+- Terms: <https://decionis.com/terms>

SUPPORT.md

@@ -1,19 +1,19 @@
 # Support
 
-Help with the **Decionis Action Gate** (`decionis/govern`).
+Help with **Decionis Govern** (`decionis/govern`), the workflow gate.
 
 ## Get started
 
 - **Quickstart + free API keys:** https://decionis.com/quickstart?source=github_action
-- **Action docs:** the [README](./README.md) and copy-paste workflows in [`examples/`](./examples/)
+- **Action docs:** the [README](./README.md), copy-paste workflows in [`examples/`](./examples/), and [the gate's README](https://github.com/decionis/agent-safe-pipeline/blob/master/govern/README.md)
 - **GitHub Action page:** https://decionis.com/marketplace/github
 
 ## Get help
 
 | Need                                | Where                                                      |
 | ----------------------------------- | ---------------------------------------------------------- |
 | Setup, policy, or verdict questions | **support@decionis.com**                                   |
-| A bug in the Action                 | [Open an issue](https://github.com/decionis/govern/issues) |
+| A bug in the gate                   | [Open an issue](https://github.com/decionis/agent-safe-pipeline/issues) |
 | A suspected security issue          | See [SECURITY.md](./SECURITY.md) — report privately        |
 | API / platform status               | https://decionis.com                                       |