Skip to content

chore(release): enforce the source-policy boundary - #17

Merged
abrichr merged 1 commit into
mainfrom
agent/source-policy-boundary-types
Jul 28, 2026
Merged

chore(release): enforce the source-policy boundary#17
abrichr merged 1 commit into
mainfrom
agent/source-policy-boundary-types

Conversation

@abrichr

@abrichr abrichr commented Jul 28, 2026

Copy link
Copy Markdown
Member

Summary

  • read the generated public source policy
  • fail closed when the policy is missing or invalid
  • scan the tracked tree, wheel, and sdist before publication
  • reject private crown-jewel paths and signatures

Validation

  • current tree, wheel, and sdist pass
  • a poisoned archive is rejected
  • a missing policy is rejected

This is a release-boundary guard. It does not change runtime behavior.

@abrichr
abrichr merged commit 08059cd into main Jul 28, 2026
1 check passed
@abrichr
abrichr deleted the agent/source-policy-boundary-types branch July 28, 2026 08:18
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant