release/consolidation-2026-06-26: weft-seam conformance + project-root artifacts#69

Merged

tachyon-beep merged 122 commits into

mainfrom

release/consolidation-2026-06-26

Jun 28, 2026

Commits on Jun 21, 2026

fix: stop repo gitignore hiding discovered source
John Morrissey
committed
fix: prevent stdlib submodule spoof taints
John Morrissey
committed
fix: reject MCP doctor caller filigree URLs
John Morrissey
committed
fix: harden rekey snapshot provenance
John Morrissey
committed
fix: preserve rust command shadow rebinds
John Morrissey
committed
fix: drop untrusted MCP sibling URLs
John Morrissey
committed
fix: bound delta caller seed expansion
John Morrissey
committed
fix: preserve explicit sibling loopback pins
John Morrissey
committed
Add `yaml.unsafe_load` and `yaml.full_load` to serialization sinks

google-labs-jules[bot]
and
tachyon-beep
committed
chore(deps): bump pypa/gh-action-pypi-publish
dependabot[bot]
authored
chore(deps): bump actions/configure-pages from 5 to 6
dependabot[bot]
authored
chore(deps): bump actions/deploy-pages from 4 to 5
dependabot[bot]
authored
chore(deps): bump actions/checkout from 4 to 7
dependabot[bot]
authored
chore(deps): bump astral-sh/setup-uv from 7.6.0 to 8.2.0
dependabot[bot]
authored

Commits on Jun 22, 2026

fix: gate waiver_add entity_symbol resolve under MCP network policy

John Morrissey
and
claude
committed
fix: eliminate cubic candidate-set merge blowup (scan DoS)

John Morrissey
and
claude
committed
docs: consolidate Wardline release materials
John Morrissey
committed

Commits on Jun 23, 2026

Commits on Jun 24, 2026

fix(filigree): avoid response body amplification
John Morrissey
committed
fix(site): pin site-kit fetch in pages build
John Morrissey
committed
fix(mcp): advertise scan integration effects
John Morrissey
committed
fix(mcp): gate rekey cache-dir writes
John Morrissey
committed
fix(rust): isolate mount overlay prepass failures
John Morrissey
committed
fix(fingerprint): bind singleton suppressions to source body
John Morrissey
committed
fix(rust): surface invalid trust markers
John Morrissey
committed
fix(fingerprint): include full call spans
John Morrissey
committed
fix(gitignore): track wardline suppression state
John Morrissey
committed
fix(doctor): preserve resolved url provenance
John Morrissey
committed
fix(scan): guard explicit output paths
John Morrissey
committed
fix(scan): preserve raw hashes for CRLF files
John Morrissey
committed
fix(filigree): require confirmed legacy identity
John Morrissey
committed
fix(rust): tolerate invalid UTF-8 manifests
John Morrissey
committed
fix(install): repair mismatched filigree loopback urls
John Morrissey
committed
fix(rust): track args and captured format taint
John Morrissey
committed
fix(rust): normalize nested cfg predicates
John Morrissey
committed
fix(rust): avoid recursive inline module indexing
John Morrissey
committed
fix(discovery): keep nested Rust target modules
John Morrissey
committed
fix(install): avoid quadratic foreign fence scan
John Morrissey
committed
fix(filigree): redact diagnostic URLs
John Morrissey
committed
Merge branch 'fix/candidate-set-merge-dos' into release/consolidation-2026-06-24
John Morrissey
committed
Merge branch 'origin/release/consolidation-2026-06-23' into release/consolidation-2026-06-24
John Morrissey
committed
Merge branch 'origin/dependabot/github_actions/actions/checkout-7' into release/consolidation-2026-06-24
John Morrissey
committed
Merge branch 'origin/dependabot/github_actions/actions/configure-pages-6' into release/consolidation-2026-06-24
John Morrissey
committed
Merge branch 'origin/dependabot/github_actions/actions/deploy-pages-5' into release/consolidation-2026-06-24
John Morrissey
committed
Merge branch 'origin/dependabot/github_actions/actions-minor-patch-8d02b2c012' into release/consolidation-2026-06-24
John Morrissey
committed
Merge branch 'origin/dependabot/github_actions/astral-sh/setup-uv-8.2.0' into release/consolidation-2026-06-24
John Morrissey
committed
Merge branch 'origin/sentinel-git-fsmonitor-fix-12815921081369848082' into release/consolidation-2026-06-24
John Morrissey
committed
Merge branch 'origin/sentinel/yaml-serialization-sinks-17995805523521999269' into release/consolidation-2026-06-24
John Morrissey
committed

Commits on Jun 25, 2026

docs: spec for project-root-anchored scan artifacts + doctor hygiene

John Morrissey
and
claude
committed
docs: revise project-root-anchored artifacts spec per panel review

John Morrissey
and
claude
committed
docs: capture _ensure_weft_config ordering hazard in artifacts spec

John Morrissey
and
claude
committed
docs: resolve MCP doctor delete posture to 'MCP can delete too'

John Morrissey
and
claude
committed
docs: TDD implementation plan for project-root-anchored artifacts

John Morrissey
and
claude
committed
docs: revise plan per plan-review (advisory DoctorCheck status contract)

John Morrissey
and
claude
committed
feat(paths): project_root_for + artifacts_dir helpers (own DEFAULT_ARTIFACT_DIR)

John Morrissey
and
claude
committed
feat(artifacts): anchor default scan artifacts to the weft-project root

John Morrissey
and
claude
committed
fix(run): drop stale 'output defaults under the subdirectory' clause post-anchor

John Morrissey
and
claude
committed
test(scan): pin project-root artifact anchoring end-to-end

John Morrissey
and
claude
committed
refactor(discovery): expose WALK_SKIP_DIRS for the doctor sweep

John Morrissey
and
claude
committed
feat(doctor): DoctorCheck carries removed/review payload lists

John Morrissey
and
claude
committed
feat(doctor): _check_gitignore — advisory, idempotent, CRLF-safe managed block

John Morrissey
and
claude
committed
feat(doctor): _sweep_stray_artifacts — confined, no-follow, nested-root-aware

John Morrissey
and
claude
committed
feat(doctor): wire gitignore+sweep into doctor; anchor to project_root_for; fix scan hint+docstring

John Morrissey
and
claude
committed
fix(artifacts): restore dir-level symlink guard lost in the project-root anchor

John Morrissey
and
claude
committed
feat(mcp): doctor repair:true deletes strays; advertise destructiveHint: True

John Morrissey
and
claude
committed
docs: project-root-anchored artifacts + doctor hygiene (CHANGELOG + guides)

John Morrissey
and
claude
committed
fix(doctor): always protect default .wardline; align symlink exit code (final review)

John Morrissey
and
claude
committed
Merge feat/project-root-anchored-artifacts into release/consolidation-2026-06-25

John Morrissey
and
claude
committed
docs(weft): weft-seam conformance program plan + reusable kit spec

John Morrissey
and
claude
committed
feat(conformance): P0 enforceable weft seam registry + fail-closed gate

John Morrissey
and
claude
committed
refactor(federation): extract shared WeftHttp transport (wardline-18499aaa2d)

John Morrissey
and
claude
committed
refactor(federation): single-source the federation-status envelope (wardline-80e457bc41)

John Morrissey
and
claude
committed
feat(conformance): SEI(loomweave->wardline) reaches at_bar via consumer byte-pin (P2-W1)

John Morrissey
and
claude
committed
feat(conformance): qualname parity reaches at_bar (live oracle + both-axis byte-pins) (P3)

John Morrissey
and
claude
committed
feat(conformance): 3 consumer seams reach at_bar + harden the keystone gate

John Morrissey
and
claude
committed
feat(conformance): MCP B1/B2 reaches at_bar via one-sided golden-schema freeze

John Morrissey
and
claude
committed
feat(conformance): suppression-filter seam reaches at_bar (wardline-authority producer freeze)

John Morrissey
and
claude
committed
feat(conformance): scan-results emission/intake reaches at_bar (cross-repo) + close gate fail-open

John Morrissey
and
claude
committed
feat(conformance): finding-identity wire reaches at_bar (cross-repo)

John Morrissey
and
claude
committed
feat(conformance): taint-fact store wire reaches at_bar (cross-repo, Rust consumer)

John Morrissey
and
claude
committed
feat(conformance): vocabulary-descriptor wire reaches at_bar (cross-repo)

John Morrissey
and
claude
committed
feat(conformance): G1 wardline->legis scan-artifact wire reaches at_bar (shared vector)

John Morrissey
and
claude
committed
feat(conformance): peer_conformant verdict + dispose the 7 legis peer seams

John Morrissey
and
claude
committed
fix(conformance): downgrade SEI-wire-transport peer_conformant -> gap (honest)

John Morrissey
and
claude
committed
Merge weft-seam-conformance into release/consolidation-2026-06-26
John Morrissey
committed

Commits on Jun 26, 2026

site: member-specific deconfliction-not-security disclaimer + Charter→Plainweave refs

John Morrissey
and
claude
committed
docs(seam): adjudicate legis→warpline preflight seam — legis conforms to envelope, reverify ruled out

John Morrissey
and
claude
committed
feat(delta): declare scope_source + warpline producer_generated_at in delta scope block

John Morrissey
and
claude
committed
feat(attest): bump to wardline-attest-2 with per-boundary content_hash binding

John Morrissey
and
claude
committed
test(contract): publish wardline.delta_scope.v1 + strengthen worklist consumer drift check

John Morrissey
and
claude
committed
fix(attest): correct content_hash granularity label — entity-body, not whole-file

John Morrissey
and
claude
committed
feat(delta): mirror warpline impact_completeness as producer_completeness (D1)

John Morrissey
and
claude
committed

Commits on Jun 27, 2026

docs(contract): publish wardline-attest-2 consumer prompt (warpline Rung-2)

John Morrissey
and
claude
committed
style: apply ruff format to satisfy the Lint+Format CI gate

John Morrissey
and
claude
committed
feat(doctor): detect & clear stale sibling ephemeral.port files

John Morrissey
and
claude
committed
fix(doctor): preserve probe provenance and gate stale probes
John Morrissey
committed
product: rotate Now → weft-seam-conformance (crash recovery); PDR-0002

John Morrissey
and
claude
committed
feat(doctor): repo_binding store-read check — let the seam say "I can't read my store"

John Morrissey
and
claude
committed
product: doctor.repo_binding seam leg landed (Now bet execution); PDR-0003

John Morrissey
and
claude
committed
product: ACCEPT PRD-0001 (Codex P1 close-out — bet paid off); PDR-0004

John Morrissey
and
claude
committed
feat(ci): fail-closed source-drift job; arm sei_drift/worklist_drift (crit-3b)

John Morrissey
and
claude
committed
docs(plan): mark crit-3b T3 done + CI-verified (run 28301178826)

John Morrissey
and
claude
committed
fix(fingerprint): make entity_source_fingerprint interpreter-stable (3.12==3.13)

John Morrissey
and
claude
committed
product: ACCEPT crit-3 (source-drift CI fail-closed) + fingerprint cross-interpreter determinism fix; PDR-0005, PDR-0006

John Morrissey
and
claude
committed

Commits on Jun 28, 2026

docs: add 2026-06-28 architecture analysis
John Morrissey
committed
fix: harden baseline and delta contracts
John Morrissey
committed
refactor(core): break the broad core/ layering residual + enforce it

John Morrissey
and
claude
committed
feat(scan): surface INERT taint gate — Python enforcement-posture visibility

John Morrissey
and
claude
committed
feat(grammar): pack-bridge for elspeth's @trust_boundary vocabulary

John Morrissey
and
claude
committed
product: elspeth dogfood detour — ship inert-gate visibility + pack-bridge; PDR-0007, PDR-0008
John Morrissey
committed
refactor(grammar): de-elspeth the pack-bridge — generic third-party trust vocab

John Morrissey
and
claude
committed
feat(doctor): engine self-test + configured-but-missing loomweave dep flag

John Morrissey
and
claude
committed
feat(scan): FastAPI/starlette request-type taint source coverage

John Morrissey
and
claude
committed
fix(docs): re-sync glossary line-anchors after the Part A summary-block shift

John Morrissey
and
claude
committed
product: Q4 resolved — hold 'silent until opted in', instrument inert-gate prevalence; PDR-0009

John Morrissey
and
claude
committed
release: v1.1.0 — curated CHANGELOG + version bump

John Morrissey
and
claude
committed
fix(release): ruff-format install/doctor.py + make version test minor-bump-robust

John Morrissey
and
claude
committed