weichen 28f000af8b Sign execution history for transport admission ...

Why: Success-shaped receipts and caller-writable history must not authorize apply/admit without controller-originated provenance.

Evidence: Fabricated, unsigned, tampered-history, and moved-ref tests were RED before HMAC binding; 52 controller/history/admission tests now pass.

Impact: Stores a local 0600 attestation key, signs successful history including transport commit SHA, and verifies it before apply/admit.

Refs: independent Codex review of feature/agent-cli-enforcement

2026-10-15 18:13:01 +00:00

..

hooks

Enforce execution-agent provenance at integration

2026-10-15 17:13:05 +00:00

zcode

Make development gates preserve work and verifiable evidence

2026-10-05 12:36:02 +00:00

agent_exec_adapters.py

Route project work through Cursor agy and PI

2026-10-15 06:48:06 +00:00

agent_exec_config.py

Harden Codex emergency profile configuration

2026-10-15 16:45:14 +00:00

agent_exec.py

Sign execution history for transport admission

2026-10-15 18:13:01 +00:00

check-evidence.py

Close review gaps in cleanup and evidence handling

2026-10-05 13:07:10 +00:00

check-pins.sh

Compare pin trees offline and archive finished task cards

2026-10-03 10:19:06 +00:00

check-worktree.py

Only count remote-unreachable commits as local work in finish guard

2026-10-05 15:05:54 +00:00

e2e.sh

Validate export delivery in the controlled integration window

2026-10-14 03:35:17 +00:00

evidence.py

Reject rewritten target history during local task recovery

2026-10-13 08:44:02 +00:00

evidence.sh

Make development gates preserve work and verifiable evidence

2026-10-05 12:36:02 +00:00

facts-verify.sh

Add evidence gates: facts registry, evidence tooling, and precheck checks

2026-10-05 10:47:27 +00:00

fetch-rdm-pin.sh

Add a reversible release switch and a lifecycle pin

2026-10-12 14:43:27 +00:00

lint-architecture.go

Add an architecture edge ratchet and waiting-state tokens

2026-10-03 16:02:57 +00:00

lint-architecture.sh

Add an architecture edge ratchet and waiting-state tokens

2026-10-03 16:02:57 +00:00

lint-boundaries.sh

Take the backend intent slow lane and the I2 port pins (I2 WP3)

2026-10-07 11:34:52 +00:00

lint-imports.go

Compare pin trees offline and archive finished task cards

2026-10-03 10:19:06 +00:00

plugin-new.sh

Pin the extension roadmap and downstream spike

2026-10-01 10:35:15 +00:00

svc_manifest.py

Gate deploys on versioned identity capabilities

2026-10-12 14:09:36 +00:00

svc.sh

Keep service start from downloading the Python base layer

2026-10-15 14:14:48 +00:00

task.sh

Require CLI provenance without constraining agent reasoning

2026-10-15 17:24:58 +00:00