ci(af01): establish workflow trust baseline - #43

Merged

TheHalfMoon merged 76 commits into

mainfrom

feat/af01-stack-a-workflow-trust

Aug 27, 2026

Commits on Aug 26, 2026

docs(af01): inventory workflow trust authority
TheHalfMoon
committed
daae1ef
feat(af01): define workflow trust policy
TheHalfMoon
committed
0f373b6
feat(af01): add deterministic workflow trust audit
TheHalfMoon
committed
d602343
test(af01): cover workflow trust counterexamples
TheHalfMoon
committed
cbac27b
ci(af01): harden mandatory workflow trust
TheHalfMoon
committed
ad8d0fc
ci(af01): pin registry smoke runner
TheHalfMoon
committed
9163611
ci(af01): harden oracle workflow authority
TheHalfMoon
committed
6ba5364
test(af01): register audit module before execution
TheHalfMoon
committed
e844f5b
fix(af01): close action metadata checkout authority gap
TheHalfMoon
committed
0be4766
test(af01): prove metadata checkout and policy fail closed
TheHalfMoon
committed
95a2b48
fix(af01): audit logical cargo invocations
TheHalfMoon
committed
d76afa1
test(af01): cover logical cargo command parsing
TheHalfMoon
committed
0d639dc
test(af01): construct literal cargo continuation
TheHalfMoon
committed
8550a64
fix(af01): close workflow policy parser bypasses
TheHalfMoon
committed
bb7183e
docs(af01): bind trust rules to rationale
TheHalfMoon
committed
47fe525
test(af01): regress all trust parser bypasses
TheHalfMoon
committed
c6d8434
docs(af01): record completed Stack A implementation tasks
TheHalfMoon
committed
3c84f9a

Commits on Aug 27, 2026

fix(af01): reject quoted trust syntax
TheHalfMoon
committed
8150905
test(af01): cover quoted trust syntax
TheHalfMoon
committed
bc74c4c
test(af01): discover all trust audit tests
TheHalfMoon
committed
315d8cb
test(af01): align trust syntax findings
TheHalfMoon
committed
35e1db5
fix(af01): allow cargo version introspection
TheHalfMoon
committed
3b64052
test(af01): cover cargo version introspection
TheHalfMoon
committed
732c5bb
fix(af01): reject quoted permission overrides
TheHalfMoon
committed
283d425
test(af01): cover quoted permission override
TheHalfMoon
committed
f6239ab
fix(af01): fail closed on indirect cargo execution
TheHalfMoon
committed
d0753ed
test(af01): cover indirect cargo execution
TheHalfMoon
committed
2d0ee7a
fix(af01): scope indirect Cargo detection to executable authority
TheHalfMoon
committed
6a0882d
test(af01): cover unrelated shell substitutions
TheHalfMoon
committed
3460b69
fix(af01): normalize heredocs and retry wrapper
TheHalfMoon
committed
e69e4b9
test(af01): cover heredoc data and retry Cargo authority
TheHalfMoon
committed
0215009
ci(af01): remove implicit retry wrapper trust
TheHalfMoon
committed
b62a464
fix(af01): restore exact rust toolchain pin
TheHalfMoon
committed
1b550f6
fix(af01): fail closed on unverified retry wrappers
TheHalfMoon
committed
ab52bc6
test(af01): require direct Cargo retry authority
TheHalfMoon
committed
3de3510
fix(af01): audit executable shell surfaces
TheHalfMoon
committed
9d1f14b
test(af01): cover composite and heredoc shell authority
TheHalfMoon
committed
00ea8f8
fix(af01): recurse through local Action shell authority
TheHalfMoon
committed
8591e68
test(af01): cover recursive Action shell authority
TheHalfMoon
committed
31e051d
test(af01): enforce live executable surface audit
TheHalfMoon
committed
e14d29d
fix(af01): close Action executable indirection gaps
TheHalfMoon
committed
120fcc2
test(af01): cover Action executable provenance bypasses
TheHalfMoon
committed
fee280d
fix(af01): bind Action runner to built commandF path
TheHalfMoon
committed
fa1d323
fix(af01): remove dynamic Action executable argument
TheHalfMoon
committed
131cc9a
test(af01): bind Action runner fixture to target path
TheHalfMoon
committed
25189a5
docs(af01): record Action shell authority boundary
TheHalfMoon
committed
58256ce
fix(af01): preserve shell test-expression boundaries
TheHalfMoon
committed
99fdc44
test(af01): cover shell conditional expression boundary
TheHalfMoon
committed
e786ae7
test(af01): bind source-map fixture to target path
TheHalfMoon
committed
503f6fc
ci(af01): gate executable authority surface directly
TheHalfMoon
committed
a9e1a64
fix(af01): close executable surface bypasses
TheHalfMoon
committed
d919e60
test(af01): cover surface delegation bypasses
TheHalfMoon
committed
4d3e7be
docs(af01): record executable surface authority
TheHalfMoon
committed
10f5785
fix(af01): preserve fail-closed Cargo precision
TheHalfMoon
committed
e9fabe8
test(af01): pin surface precision regressions
TheHalfMoon
committed
0d21158
fix(af01): reject unresolved action wrappers
TheHalfMoon
committed
37a204d
test(af01): reject unresolved action env wrappers
TheHalfMoon
committed
c9d01bd
fix(af01): reject direct relative action scripts
TheHalfMoon
committed
3c3ec7a
test(af01): reject direct non-action-root scripts
TheHalfMoon
committed
5c408c0
fix(af01): fail closed on Action PATH mutation
TheHalfMoon
committed
78e8569
test(af01): cover PATH-resolved Action delegation
TheHalfMoon
committed
0b08daa
fix(af01): reject builtin PATH writers
TheHalfMoon
committed
59ae5dc
test(af01): cover builtin PATH writers
TheHalfMoon
committed
5618298
fix(af01): close wrapper heredoc and hash authority
TheHalfMoon
committed
e836e88
test(af01): cover wrapper heredocs and resolution mutation
TheHalfMoon
committed
688651a
test(af01): audit cross-step environment channels
TheHalfMoon
committed
e5e4532
test(af01): cover cross-step environment channel bypass
TheHalfMoon
committed
99a7ab6
fix(af01): reject indirect environment channel authority
TheHalfMoon
committed
311893b
test(af01): cover indirect environment channel bypasses
TheHalfMoon
committed
8c645ba
ci(af01): enforce environment channel audit directly
TheHalfMoon
committed
0fc0607
fix(af01): reject shell startup environment authority
TheHalfMoon
committed
b67188b
test(af01): cover shell startup environment bypasses
TheHalfMoon
committed
7fd664a
fix(af01): reject dynamic variable-name writers
TheHalfMoon
committed
74743a1
test(af01): cover dynamic startup variable writers
TheHalfMoon
committed
b12e9da
fix(af01): parse dynamic writers quote-aware
TheHalfMoon
committed
85e0a19
test(af01): lock quote-aware environment audit precision
TheHalfMoon
committed
28d9e39