Skip to content

chore(release): enforce the source-policy boundary - #71

Merged
abrichr merged 1 commit into
mainfrom
agent/source-policy-boundary-ml
Jul 28, 2026
Merged

chore(release): enforce the source-policy boundary#71
abrichr merged 1 commit into
mainfrom
agent/source-policy-boundary-ml

Conversation

@abrichr

@abrichr abrichr commented Jul 28, 2026

Copy link
Copy Markdown
Member

Summary

  • read the generated public source policy
  • fail closed when the policy is missing or invalid
  • scan the tracked tree, wheel, and sdist before publication
  • reject private crown-jewel paths and signatures

Validation

  • current tree, wheel, and sdist pass
  • a poisoned archive is rejected
  • a missing policy is rejected

This is a release-boundary guard. It does not change runtime behavior.

@abrichr
abrichr merged commit 7246d98 into main Jul 28, 2026
4 checks passed
@abrichr
abrichr deleted the agent/source-policy-boundary-ml branch July 28, 2026 08:29
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant