fix(security): bind release publication inputs to stable descriptors - #377

Merged

seonghobae merged 18 commits into

mainfrom

fix/release-publication-stable-inputs-2db716

Aug 15, 2026

Commits on Aug 15, 2026

test(security): require stable descriptor-bound release inputs
seonghobae
committed
cff6c72
fix(security): bind release inputs to stable descriptors
seonghobae
committed
81297cc
fix(security): authenticate stable release publication bytes
seonghobae
committed
7d3417e
docs(security): record release file stability rationale
seonghobae
committed
b0c115c
test(security): require atomic publication receipt output
seonghobae
committed
fabf23e
fix(security): write publication receipt atomically
seonghobae
committed
66e6733
test(security): require stable release materialization bytes
seonghobae
committed
b933efe
test(security): preserve output-directory validation in release evidence
seonghobae
committed
d91087c
fix(security): bind release materialization to accepted bytes
seonghobae
committed
c5bb620
test(release): require complete publication receipt runtime handoff
seonghobae
committed
7349f79
test(release): require self-contained receipt handoff
seonghobae
committed
5c30326
test(release): specify atomic output behavior independent of helper placement
seonghobae
committed
80b2641
fix(release): keep publication receipt runtime self-contained
seonghobae
committed
b00bec9
docs(release): align file-stability evidence with isolated runtime
seonghobae
committed
34d8d63
chore(release): converge stable-input lane on protected main
seonghobae
committed
5602fb7
Finish release stable-input coverage on current main
seonghobae
committed
f72c166
test: cover stable file metadata failure branches
seonghobae
committed
bfc4d5a
merge: refresh release publication hardening on protected main
seonghobae
committed
c91d04b

Navigation Menu

Uh oh!

fix(security): bind release publication inputs to stable descriptors - #377

fix(security): bind release publication inputs to stable descriptors#377
seonghobae merged 18 commits into
mainfrom
fix/release-publication-stable-inputs-2db716

Commits on Aug 15, 2026

test(security): require stable descriptor-bound release inputs

fix(security): bind release inputs to stable descriptors

fix(security): authenticate stable release publication bytes

docs(security): record release file stability rationale

test(security): require atomic publication receipt output

fix(security): write publication receipt atomically

test(security): require stable release materialization bytes

test(security): preserve output-directory validation in release evidence

fix(security): bind release materialization to accepted bytes

test(release): require complete publication receipt runtime handoff

test(release): require self-contained receipt handoff

test(release): specify atomic output behavior independent of helper placement

fix(release): keep publication receipt runtime self-contained

docs(release): align file-stability evidence with isolated runtime

chore(release): converge stable-input lane on protected main

Finish release stable-input coverage on current main

test: cover stable file metadata failure branches

merge: refresh release publication hardening on protected main