feat: rebuild local provenance, security, and review workflow (TAB-18–29) - #47

Merged

hudsonaikins merged 15 commits into

mainfrom

codex/tab-18-29-rebuild

Sep 13, 2026

Commits on Sep 12, 2026

feat: add local provenance storage and replay (TAB-18-20)
hudsonaikins-crown
committed
52b4839
fix: support long isolated provenance validation paths
hudsonaikins-crown
committed
3468f6f
fix: reject trailing unpaired provenance surrogates
hudsonaikins-crown
committed
d929ab2
feat: trusted-tool evidence and complete review workflow (TAB-21–29) (#48)

hudsonaikins
and
hudsonaikins-crown
authored
88ed140
fix: enforce provenance privacy, typed links, and stable replay (TAB-18–29)
hudsonaikins-crown
committed
cff2437
refactor: name predecessor predicate for coverage attribution
hudsonaikins-crown
committed
aefa341

Commits on Sep 13, 2026

fix: bind CI evidence and normalize provenance identities
hudsonaikins-crown
committed
79f0861
fix: preserve evidence boundaries and coordinate status approvals
hudsonaikins-crown
committed
4be5755
fix: validate cached receipts and preserve bounded lineage replay
hudsonaikins-crown
committed
8cb5218
fix: guard private control writes and validate source boundaries
hudsonaikins-crown
committed
f732e77
fix: use portable Gitleaks stdout report target
hudsonaikins-crown
committed
cf311f2
fix: make cross-clone approval reservations unique
hudsonaikins-crown
committed
95ad82e
fix: run Buildkite validation on hosted Linux
hudsonaikins-crown
committed
816b943
fix: run hosted PostgreSQL validation without root
hudsonaikins-crown
committed
0d26afb
fix: bind provenance checks to full canonical Git identity
hudsonaikins-crown
committed
30e8c30