Skip to content

chore(release): enforce the source-policy boundary - #33

Merged
abrichr merged 2 commits into
mainfrom
agent/source-policy-boundary-tray
Jul 28, 2026
Merged

chore(release): enforce the source-policy boundary#33
abrichr merged 2 commits into
mainfrom
agent/source-policy-boundary-tray

Conversation

@abrichr

@abrichr abrichr commented Jul 28, 2026

Copy link
Copy Markdown
Member

Summary

  • read the generated public source policy
  • fail closed when the policy is missing or invalid
  • scan the tracked tree, wheel, and sdist before publication
  • reject private crown-jewel paths and signatures

Validation

  • current tree, wheel, and sdist pass
  • a poisoned archive is rejected
  • a missing policy is rejected

This is a release-boundary guard. It does not change runtime behavior.

@abrichr
abrichr merged commit 52fee25 into main Jul 28, 2026
10 checks passed
@abrichr
abrichr deleted the agent/source-policy-boundary-tray branch July 28, 2026 08:19
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant