release/consolidation-2026-06-26: weft-seam conformance + project-root artifacts#69

Open

tachyon-beep wants to merge 90 commits into

mainfrom

release/consolidation-2026-06-26

Commits on Jun 21, 2026

fix: stop repo gitignore hiding discovered source
John Morrissey
committed
fix: prevent stdlib submodule spoof taints
John Morrissey
committed
fix: reject MCP doctor caller filigree URLs
John Morrissey
committed
fix: harden rekey snapshot provenance
John Morrissey
committed
fix: preserve rust command shadow rebinds
John Morrissey
committed
fix: drop untrusted MCP sibling URLs
John Morrissey
committed
fix: bound delta caller seed expansion
John Morrissey
committed
fix: preserve explicit sibling loopback pins
John Morrissey
committed
Add `yaml.unsafe_load` and `yaml.full_load` to serialization sinks

google-labs-jules[bot]
and
tachyon-beep
committed
chore(deps): bump pypa/gh-action-pypi-publish
dependabot[bot]
authored
chore(deps): bump actions/configure-pages from 5 to 6
dependabot[bot]
authored
chore(deps): bump actions/deploy-pages from 4 to 5
dependabot[bot]
authored
chore(deps): bump actions/checkout from 4 to 7
dependabot[bot]
authored
chore(deps): bump astral-sh/setup-uv from 7.6.0 to 8.2.0
dependabot[bot]
authored

Commits on Jun 22, 2026

fix: gate waiver_add entity_symbol resolve under MCP network policy

John Morrissey
and
claude
committed
fix: eliminate cubic candidate-set merge blowup (scan DoS)

John Morrissey
and
claude
committed
docs: consolidate Wardline release materials
John Morrissey
committed

Commits on Jun 23, 2026

Commits on Jun 24, 2026

fix(filigree): avoid response body amplification
John Morrissey
committed
fix(site): pin site-kit fetch in pages build
John Morrissey
committed
fix(mcp): advertise scan integration effects
John Morrissey
committed
fix(mcp): gate rekey cache-dir writes
John Morrissey
committed
fix(rust): isolate mount overlay prepass failures
John Morrissey
committed
fix(fingerprint): bind singleton suppressions to source body
John Morrissey
committed
fix(rust): surface invalid trust markers
John Morrissey
committed
fix(fingerprint): include full call spans
John Morrissey
committed
fix(gitignore): track wardline suppression state
John Morrissey
committed
fix(doctor): preserve resolved url provenance
John Morrissey
committed
fix(scan): guard explicit output paths
John Morrissey
committed
fix(scan): preserve raw hashes for CRLF files
John Morrissey
committed
fix(filigree): require confirmed legacy identity
John Morrissey
committed
fix(rust): tolerate invalid UTF-8 manifests
John Morrissey
committed
fix(install): repair mismatched filigree loopback urls
John Morrissey
committed
fix(rust): track args and captured format taint
John Morrissey
committed
fix(rust): normalize nested cfg predicates
John Morrissey
committed
fix(rust): avoid recursive inline module indexing
John Morrissey
committed
fix(discovery): keep nested Rust target modules
John Morrissey
committed
fix(install): avoid quadratic foreign fence scan
John Morrissey
committed
fix(filigree): redact diagnostic URLs
John Morrissey
committed
Merge branch 'fix/candidate-set-merge-dos' into release/consolidation-2026-06-24
John Morrissey
committed
Merge branch 'origin/release/consolidation-2026-06-23' into release/consolidation-2026-06-24
John Morrissey
committed
Merge branch 'origin/dependabot/github_actions/actions/checkout-7' into release/consolidation-2026-06-24
John Morrissey
committed
Merge branch 'origin/dependabot/github_actions/actions/configure-pages-6' into release/consolidation-2026-06-24
John Morrissey
committed
Merge branch 'origin/dependabot/github_actions/actions/deploy-pages-5' into release/consolidation-2026-06-24
John Morrissey
committed
Merge branch 'origin/dependabot/github_actions/actions-minor-patch-8d02b2c012' into release/consolidation-2026-06-24
John Morrissey
committed
Merge branch 'origin/dependabot/github_actions/astral-sh/setup-uv-8.2.0' into release/consolidation-2026-06-24
John Morrissey
committed
Merge branch 'origin/sentinel-git-fsmonitor-fix-12815921081369848082' into release/consolidation-2026-06-24
John Morrissey
committed
Merge branch 'origin/sentinel/yaml-serialization-sinks-17995805523521999269' into release/consolidation-2026-06-24
John Morrissey
committed

Commits on Jun 25, 2026

docs: spec for project-root-anchored scan artifacts + doctor hygiene

John Morrissey
and
claude
committed
docs: revise project-root-anchored artifacts spec per panel review

John Morrissey
and
claude
committed
docs: capture _ensure_weft_config ordering hazard in artifacts spec

John Morrissey
and
claude
committed
docs: resolve MCP doctor delete posture to 'MCP can delete too'

John Morrissey
and
claude
committed
docs: TDD implementation plan for project-root-anchored artifacts

John Morrissey
and
claude
committed
docs: revise plan per plan-review (advisory DoctorCheck status contract)

John Morrissey
and
claude
committed
feat(paths): project_root_for + artifacts_dir helpers (own DEFAULT_ARTIFACT_DIR)

John Morrissey
and
claude
committed
feat(artifacts): anchor default scan artifacts to the weft-project root

John Morrissey
and
claude
committed
fix(run): drop stale 'output defaults under the subdirectory' clause post-anchor

John Morrissey
and
claude
committed
test(scan): pin project-root artifact anchoring end-to-end

John Morrissey
and
claude
committed
refactor(discovery): expose WALK_SKIP_DIRS for the doctor sweep

John Morrissey
and
claude
committed
feat(doctor): DoctorCheck carries removed/review payload lists

John Morrissey
and
claude
committed
feat(doctor): _check_gitignore — advisory, idempotent, CRLF-safe managed block

John Morrissey
and
claude
committed
feat(doctor): _sweep_stray_artifacts — confined, no-follow, nested-root-aware

John Morrissey
and
claude
committed
feat(doctor): wire gitignore+sweep into doctor; anchor to project_root_for; fix scan hint+docstring

John Morrissey
and
claude
committed
fix(artifacts): restore dir-level symlink guard lost in the project-root anchor

John Morrissey
and
claude
committed
feat(mcp): doctor repair:true deletes strays; advertise destructiveHint: True

John Morrissey
and
claude
committed
docs: project-root-anchored artifacts + doctor hygiene (CHANGELOG + guides)

John Morrissey
and
claude
committed
fix(doctor): always protect default .wardline; align symlink exit code (final review)

John Morrissey
and
claude
committed
Merge feat/project-root-anchored-artifacts into release/consolidation-2026-06-25

John Morrissey
and
claude
committed
docs(weft): weft-seam conformance program plan + reusable kit spec

John Morrissey
and
claude
committed
feat(conformance): P0 enforceable weft seam registry + fail-closed gate

John Morrissey
and
claude
committed
refactor(federation): extract shared WeftHttp transport (wardline-18499aaa2d)

John Morrissey
and
claude
committed
refactor(federation): single-source the federation-status envelope (wardline-80e457bc41)

John Morrissey
and
claude
committed
feat(conformance): SEI(loomweave->wardline) reaches at_bar via consumer byte-pin (P2-W1)

John Morrissey
and
claude
committed
feat(conformance): qualname parity reaches at_bar (live oracle + both-axis byte-pins) (P3)

John Morrissey
and
claude
committed
feat(conformance): 3 consumer seams reach at_bar + harden the keystone gate

John Morrissey
and
claude
committed
feat(conformance): MCP B1/B2 reaches at_bar via one-sided golden-schema freeze

John Morrissey
and
claude
committed
feat(conformance): suppression-filter seam reaches at_bar (wardline-authority producer freeze)

John Morrissey
and
claude
committed
feat(conformance): scan-results emission/intake reaches at_bar (cross-repo) + close gate fail-open

John Morrissey
and
claude
committed
feat(conformance): finding-identity wire reaches at_bar (cross-repo)

John Morrissey
and
claude
committed
feat(conformance): taint-fact store wire reaches at_bar (cross-repo, Rust consumer)

John Morrissey
and
claude
committed
feat(conformance): vocabulary-descriptor wire reaches at_bar (cross-repo)

John Morrissey
and
claude
committed
feat(conformance): G1 wardline->legis scan-artifact wire reaches at_bar (shared vector)

John Morrissey
and
claude
committed
feat(conformance): peer_conformant verdict + dispose the 7 legis peer seams

John Morrissey
and
claude
committed
fix(conformance): downgrade SEI-wire-transport peer_conformant -> gap (honest)

John Morrissey
and
claude
committed
Merge weft-seam-conformance into release/consolidation-2026-06-26
John Morrissey
committed