Close the loop: recursive review, agent enforcement, a recall index, and dogfooded distribution - #56

Open

kridaydave wants to merge 37 commits into

mainfrom

feat/close-the-loop

Commits on Sep 12, 2026

docs(todo): close-the-loop night run — campaign 1 research brief and rulings
kridaydave
committed
8d4c22c
feat(refs): static install-reference scanner for lifecycle and data scripts
kridaydave
committed
c2b6f39
feat(refs): plumb PKGBUILD npm-delivery specs for recursive review
kridaydave
committed
74d6584
fix(refs): review follow-ups — multi-spec capture, disclosed unscannable lines, shared token scanner
kridaydave
committed
461e40f
feat(recursive): second-order review engine with depth, cycle, and budget caps
kridaydave
committed
97b9bf4
feat(render): recursive delivery chains on the card; R23 graduates to MEDIUM
kridaydave
committed
d44d8c9
test(recursive): end-to-end adversarial delivery chain blocks through the real CLI
kridaydave
committed
185008e
fix(render): worst-first child findings on the card; pin truncation assert
kridaydave
committed
a833fa5
docs(todo): mark campaign 1 complete
kridaydave
committed
072c661
docs(todo): campaign 2 research brief and rulings
kridaydave
committed
47235ab
feat(agent): policy-bound non-interactive review and hook gate
kridaydave
committed
79a040a
feat(shim): fail-closed PATH shims routing installs through agent gate
kridaydave
committed
baf0b76
docs(readme): agent enforcement recipes with honest bypass list
kridaydave
committed
6f8495a
feat(policy): BLUELINE_POLICY env scoping for shims and hooks, fail closed
kridaydave
committed
9e1150f
fix(agent): gate fails closed on errors, per-registry routing, deny unreviewable shapes
kridaydave
committed
03707a4
fix(agent): wire gate hard-denies, capture package-naming flags, deny substitution-hidden managers
kridaydave
committed
d7c7fd6
fix(scanner): find verbs behind global flags, deny npm registry overrides in gated installs
kridaydave
committed
ce1c6d7
fix(scanner): deny env/config/tag registry overrides, disclose dynamic --package, respect comments
kridaydave
committed
b988abc
docs(todo): mark campaign 2 complete
kridaydave
committed
8a3da20
feat(recall): local-first revocation index — serve, sync, advisory fold-in, staleness policy
kridaydave
committed
2b61ab8
docs(todo): mark campaign 3 complete
kridaydave
committed
b92d275
fix(recall): unique sync tmp file, per-process snapshot cache, pypi name normalization, serve read timeout
kridaydave
committed
887c970
docs(todo): campaign 3 research brief and rulings
kridaydave
committed
99e7066
docs(todo): campaign 4 research brief and rulings
kridaydave
committed
2ec845e
feat(distribution): crates.io metadata, homebrew formula, AUR scaffold, full npm platform matrix
kridaydave
committed
281892d
feat(release): SLSA build-provenance attestation for GitHub release binaries
kridaydave
committed
3f6cdbd
docs: distribution notes and changelog for packaging completion
kridaydave
committed
6e5c9cc
docs(todo): mark campaign 4 complete
kridaydave
committed
fd0b2e1
fix(release): build and publish the missing linux-arm64-musl binary package
kridaydave
committed
3f64da8
test(dogfood): our own AUR scaffold and npm shims reviewed by our own checks
kridaydave
committed
44dc772
docs(goal): mark campaigns 1-4 complete; PR pending
kridaydave
committed
6038b3a
docs(changelog): merge duplicate unreleased sections
kridaydave
committed
acf82c1
docs(goal): PR opened
kridaydave
committed
07b805c
fix(ci): dogfood gate checks scanner health, not a hardcoded evaluated set
kridaydave
committed
f834c7f
test(recursive): pin the reference-cap boundary that mutation testing caught
kridaydave
committed
7dff7db

Commits on Sep 13, 2026