fix(osv): preserve immutable direct-source provenance - #1158

Open

seonghobae wants to merge 96 commits into

mainfrom

fix/osv-direct-source-provenance-1096

Commits on Aug 20, 2026

test(osv): define direct-source provenance contracts
seonghobae
committed
654e554
ci(osv): exercise direct-source provenance contract
seonghobae
committed
327f9c7
fix(osv): reconcile exact immutable source evidence
seonghobae
committed
93dd991
docs(osv): explain direct-source provenance evidence
seonghobae
committed
00abb82
ci(osv): preserve provenance before vulnerability verdict
seonghobae
committed
123d9d2
ci(osv): bind policy checkout to governed source
seonghobae
committed
80fd3fd
test(osv): bind reconciliation ahead of reporter
seonghobae
committed
03254d7
test(osv): reproduce live nested advisory shape
seonghobae
committed
2b7f71d
fix(osv): read authoritative nested affected range
seonghobae
committed
9b95378
test(osv): reject package-key tarball disagreement
seonghobae
committed
f2a9419
ci(osv): require full suite and branch coverage
seonghobae
committed
42845bb
test(osv): cover every fail-closed provenance branch
seonghobae
committed
9d33c40
fix(osv): fail closed on malformed source ports
seonghobae
committed
003b357
test(osv): assert exact CLI success code
seonghobae
committed
78ae8a0
fix(ci): keep provenance quality workflow PR-only
seonghobae
committed
29af209
fix(osv): fail closed on ambiguous provenance
seonghobae
committed
c573b35
Merge remote-tracking branch 'origin/main' into HEAD
seonghobae
committed
c3636cc
fix(osv): reject malformed UTF-8 inputs safely
seonghobae
committed
e2c0031
fix(osv): exit cleanly on malformed text input
seonghobae
committed
d1da605
Merge branch 'main' into fix/osv-direct-source-provenance-1096
opencode-agent[bot]
authored
73bb8c7
test: document OSV provenance cases
seonghobae
committed
f285fd7
Merge branch 'main' into fix/osv-direct-source-provenance-1096
seonghobae
committed
915a528

Commits on Aug 21, 2026

fix(security): read OSV inputs without symlink races
seonghobae
committed
c6c2684
test(security): cover secure OSV input branches
seonghobae
committed
fe27160
style(test): combine secure input contexts
seonghobae
committed
75d7f5f
Merge branch 'main' into fix/osv-direct-source-provenance-1096
opencode-agent[bot]
authored
a0fbba8
fix(osv): accept verified empty scan documents
seonghobae
committed
9f46401
docs: close coordinator docstring gate
seonghobae
committed
6a4e63a
chore(osv): satisfy reconciler lint contract
seonghobae
committed
0f2e4c9
fix(osv): parse pnpm package provenance safely
seonghobae
committed
6e93fd0
Merge protected main into OSV direct-source provenance
seonghobae
committed
6ea77b1
fix(security): pin pip-audit pip below vulnerability
seonghobae
committed
3a619b5
fix(osv): distinguish findings from scanner failure
seonghobae
committed
ad46744
fix(security): retain fixed pip-audit toolchain
seonghobae
committed
a93d086
fix(security): regenerate pip audit lock provenance
seonghobae
committed
d02d57e
chore(security): keep pip lock repair in its owner branch
seonghobae
committed
f031579
Merge branch 'main' into fix/osv-direct-source-provenance-1096
seonghobae
authored
67f3064
test: align scheduler gate with dispatch concurrency
seonghobae
committed
843d874
docs(security): clarify per-scan OSV evidence ownership
seonghobae
committed
a7fb512
test: track scheduler concurrency contract
seonghobae
committed
acbd253
chore(osv): restore Strix contract to owner lane
seonghobae
committed
7a171bc
test(scheduler): track current dispatch concurrency
seonghobae
committed
9b44801
chore(osv): keep Strix assertions on canonical owner
seonghobae
committed
7449aaf
test(security): require supported OSV output flags
seonghobae
committed
10f1ccd
fix(security): use supported OSV output arguments
seonghobae
committed
db6dee6
Merge branch 'main' into fix/osv-direct-source-provenance-1096
opencode-agent[bot]
authored
c24ce16
test(scheduler): preserve dispatch concurrency contract
seonghobae
committed
1eaba56
chore(osv): restore canonical Strix ownership
seonghobae
committed
092d838
test(scheduler): align quick gate with canonical concurrency
seonghobae
committed
fca5cd1
ci: refresh pip audit runtime
seonghobae
committed
eb7efe5
chore(osv): restore canonical pip lock ownership
seonghobae
committed
c45a776
Merge branch 'main' into fix/osv-direct-source-provenance-1096
opencode-agent[bot]
authored
f61a879
fix(osv): report malformed evidence cleanly
seonghobae
committed
4748ced
Merge branch 'main' into fix/osv-direct-source-provenance-1096
seonghobae
authored
4e1102b

Commits on Aug 23, 2026

Commits on Aug 24, 2026

Commits on Aug 25, 2026

Commits on Aug 27, 2026

Merge branch 'main' into fix/osv-direct-source-provenance-1096
seonghobae
committed
a656d96

Commits on Aug 28, 2026

Commits on Aug 30, 2026

Commits on Aug 31, 2026

Merge branch 'main' into fix/osv-direct-source-provenance-1096
opencode-agent[bot]
authored
4f0b35f
Merge branch 'main' into fix/osv-direct-source-provenance-1096
opencode-agent[bot]
authored
3e23a4d
Merge protected main into OSV provenance repair
seonghobae
committed
b0d9042
fix: preserve OSV group integrity after reconciliation
seonghobae
committed
7217b96
fix: fail closed on ambiguous OSV evidence
seonghobae
committed
8509db8
fix: bind OSV completeness to exact scanner exit
seonghobae
committed
e9d8775
fix: preserve OSV container entrypoint authority
seonghobae
committed
48ead63
fix: grant OSV result-write capability only
seonghobae
committed
92e2929
Merge protected main into OSV provenance owner
seonghobae
committed
3adc9b2
fix(osv): reject malformed retained identities
seonghobae
committed
3bedc28

Commits on Sep 1, 2026