Repository navigation

fix(osv): preserve immutable direct-source provenance - #1158

Draft

seonghobae wants to merge 109 commits into

mainfrom

fix/osv-direct-source-provenance-1096

Draft

fix(osv): preserve immutable direct-source provenance#1158
seonghobae wants to merge 109 commits into
mainfrom
fix/osv-direct-source-provenance-1096

Commits on Aug 20, 2026
- test(osv): define direct-source provenance contracts
  seonghobae
  committed
  654e554
- ci(osv): exercise direct-source provenance contract
  seonghobae
  committed
  327f9c7
- fix(osv): reconcile exact immutable source evidence
  seonghobae
  committed
  93dd991
- docs(osv): explain direct-source provenance evidence
  seonghobae
  committed
  00abb82
- ci(osv): preserve provenance before vulnerability verdict
  seonghobae
  committed
  123d9d2
- ci(osv): bind policy checkout to governed source
  seonghobae
  committed
  80fd3fd
- test(osv): bind reconciliation ahead of reporter
  seonghobae
  committed
  03254d7
- test(osv): reproduce live nested advisory shape
  seonghobae
  committed
  2b7f71d
- fix(osv): read authoritative nested affected range
  seonghobae
  committed
  9b95378
- test(osv): reject package-key tarball disagreement
  seonghobae
  committed
  f2a9419
- ci(osv): require full suite and branch coverage
  seonghobae
  committed
  42845bb
- test(osv): cover every fail-closed provenance branch
  seonghobae
  committed
  9d33c40
- fix(osv): fail closed on malformed source ports
  seonghobae
  committed
  003b357
- test(osv): assert exact CLI success code
  seonghobae
  committed
  78ae8a0
- fix(ci): keep provenance quality workflow PR-only
  seonghobae
  committed
  29af209
- fix(osv): fail closed on ambiguous provenance
  seonghobae
  committed
  c573b35
- Merge remote-tracking branch 'origin/main' into HEAD
  seonghobae
  committed
  c3636cc
- fix(osv): reject malformed UTF-8 inputs safely
  seonghobae
  committed
  e2c0031
- fix(osv): exit cleanly on malformed text input
  seonghobae
  committed
  d1da605
- Merge branch 'main' into fix/osv-direct-source-provenance-1096
  opencode-agent[bot]
  authored
  73bb8c7
- test: document OSV provenance cases
  seonghobae
  committed
  f285fd7
- Merge branch 'main' into fix/osv-direct-source-provenance-1096
  seonghobae
  committed
  915a528
Commits on Aug 21, 2026
- fix(security): read OSV inputs without symlink races
  seonghobae
  committed
  c6c2684
- test(security): cover secure OSV input branches
  seonghobae
  committed
  fe27160
- style(test): combine secure input contexts
  seonghobae
  committed
  75d7f5f
- Merge branch 'main' into fix/osv-direct-source-provenance-1096
  opencode-agent[bot]
  authored
  a0fbba8
- fix(osv): accept verified empty scan documents
  seonghobae
  committed
  9f46401
- docs: close coordinator docstring gate
  seonghobae
  committed
  6a4e63a
- chore(osv): satisfy reconciler lint contract
  seonghobae
  committed
  0f2e4c9
- fix(osv): parse pnpm package provenance safely
  seonghobae
  committed
  6e93fd0
- Merge protected main into OSV direct-source provenance
  seonghobae
  committed
  6ea77b1
- fix(security): pin pip-audit pip below vulnerability
  seonghobae
  committed
  3a619b5
- fix(osv): distinguish findings from scanner failure
  seonghobae
  committed
  ad46744
- fix(security): retain fixed pip-audit toolchain
  seonghobae
  committed
  a93d086
- fix(security): regenerate pip audit lock provenance
  seonghobae
  committed
  d02d57e
- chore(security): keep pip lock repair in its owner branch
  seonghobae
  committed
  f031579
- Merge branch 'main' into fix/osv-direct-source-provenance-1096
  seonghobae
  authored
  67f3064
- test: align scheduler gate with dispatch concurrency
  seonghobae
  committed
  843d874
- docs(security): clarify per-scan OSV evidence ownership
  seonghobae
  committed
  a7fb512
- test: track scheduler concurrency contract
  seonghobae
  committed
  acbd253
- chore(osv): restore Strix contract to owner lane
  seonghobae
  committed
  7a171bc
- test(scheduler): track current dispatch concurrency
  seonghobae
  committed
  9b44801
- chore(osv): keep Strix assertions on canonical owner
  seonghobae
  committed
  7449aaf
- test(security): require supported OSV output flags
  seonghobae
  committed
  10f1ccd
- fix(security): use supported OSV output arguments
  seonghobae
  committed
  db6dee6
- Merge branch 'main' into fix/osv-direct-source-provenance-1096
  opencode-agent[bot]
  authored
  c24ce16
- test(scheduler): preserve dispatch concurrency contract
  seonghobae
  committed
  1eaba56
- chore(osv): restore canonical Strix ownership
  seonghobae
  committed
  092d838
- test(scheduler): align quick gate with canonical concurrency
  seonghobae
  committed
  fca5cd1
- ci: refresh pip audit runtime
  seonghobae
  committed
  eb7efe5
- chore(osv): restore canonical pip lock ownership
  seonghobae
  committed
  c45a776
- Merge branch 'main' into fix/osv-direct-source-provenance-1096
  opencode-agent[bot]
  authored
  f61a879
- fix(osv): report malformed evidence cleanly
  seonghobae
  committed
  4748ced
- Merge branch 'main' into fix/osv-direct-source-provenance-1096
  seonghobae
  authored
  4e1102b
Commits on Aug 23, 2026
- Merge protected main into OSV provenance repair
  seonghobae
  committed
  2cc5427
- fix(osv): pin immutable SheetJS artifact integrity
  seonghobae
  committed
  6a92e1c
- fix(security): trust protected policy on self-scan
  seonghobae
  committed
  10ee81c
- fix(osv): preserve raw evidence during policy bootstrap
  seonghobae
  committed
  e61fb11
Commits on Aug 24, 2026
Commits on Aug 25, 2026
Commits on Aug 26, 2026
Commits on Aug 27, 2026
- Merge branch 'main' into fix/osv-direct-source-provenance-1096
  seonghobae
  committed
  a656d96
Commits on Aug 28, 2026
Commits on Aug 30, 2026
Commits on Aug 31, 2026
- Merge branch 'main' into fix/osv-direct-source-provenance-1096
  opencode-agent[bot]
  authored
  4f0b35f
- Merge branch 'main' into fix/osv-direct-source-provenance-1096
  opencode-agent[bot]
  authored
  3e23a4d
- Merge protected main into OSV provenance repair
  seonghobae
  committed
  b0d9042
- fix: preserve OSV group integrity after reconciliation
  seonghobae
  committed
  7217b96
- fix: fail closed on ambiguous OSV evidence
  seonghobae
  committed
  8509db8
- fix: bind OSV completeness to exact scanner exit
  seonghobae
  committed
  e9d8775
- fix: preserve OSV container entrypoint authority
  seonghobae
  committed
  48ead63
- fix: grant OSV result-write capability only
  seonghobae
  committed
  92e2929
- Merge protected main into OSV provenance owner
  seonghobae
  committed
  3adc9b2
- fix(osv): reject malformed retained identities
  seonghobae
  committed
  3bedc28
Commits on Sep 1, 2026
Commits on Sep 5, 2026
Commits on Sep 6, 2026
- Merge branch 'main' into fix/osv-direct-source-provenance-1096
  opencode-agent[bot]
  authored
  83f365b
- Merge branch 'main' into fix/osv-direct-source-provenance-1096
  opencode-agent[bot]
  authored
  56be37a
Commits on Sep 7, 2026
- Merge branch 'main' into fix/osv-direct-source-provenance-1096
  opencode-agent[bot]
  authored
  02c7c22
Commits on Sep 9, 2026
- Merge branch 'main' into fix/osv-direct-source-provenance-1096
  opencode-agent[bot]
  authored
  7223714
Commits on Sep 10, 2026
- Merge branch 'main' into fix/osv-direct-source-provenance-1096
  opencode-agent[bot]
  authored
  4291186
- Merge branch 'main' into fix/osv-direct-source-provenance-1096
  opencode-agent[bot]
  authored
  033e4a3
Commits on Sep 12, 2026
- Merge branch 'main' into fix/osv-direct-source-provenance-1096
  opencode-agent[bot]
  authored
  972ad7e
Commits on Sep 13, 2026

Commits

Commits on Aug 20, 2026

Commits on Aug 21, 2026

Commits on Aug 23, 2026

Commits on Aug 24, 2026

Commits on Aug 25, 2026

Commits on Aug 26, 2026

Commits on Aug 27, 2026

Commits on Aug 28, 2026

Commits on Aug 30, 2026

Commits on Aug 31, 2026

Commits on Sep 1, 2026

Commits on Sep 5, 2026

Commits on Sep 6, 2026

Commits on Sep 7, 2026

Commits on Sep 9, 2026

Commits on Sep 10, 2026

Commits on Sep 12, 2026

Commits on Sep 13, 2026