feat: add Proof Before Action evidence workflow - #169

Merged

saagpatel merged 41 commits into

mainfrom

codex/proof-before-action

Jul 19, 2026

Commits on Jul 19, 2026

feat: add Proof Before Action workflow
saagpatel
committed
1110577
test: restore portable Proof Before Action gates
saagpatel
committed
9ba1245
fix: ignore macOS metadata during proof staging
saagpatel
committed
860cd99
fix: exclude generated local metadata from proof input
saagpatel
committed
7b2366b
fix: distinguish GitHub OIDC permissions from secrets
saagpatel
committed
1e47949
fix: parse credential assignments without source false positives
saagpatel
committed
fb94dba
fix: redact private argv paths and restore Linux CI
saagpatel
committed
bf51748
fix: honor database-only declarations and malformed transports
saagpatel
committed
6a920e2
Handle Docker observer timeouts safely
saagpatel
committed
ab64774
Fail closed on unconfirmed observer cleanup
saagpatel
committed
df52cf4
Harden disposable observer final-state capture
saagpatel
committed
1a5696b
Fail closed on dirty trust evidence
saagpatel
committed
752bd4c
Bind trust and producer evidence to source
saagpatel
committed
cd6ec4b
Keep runtime and trust evidence honest
saagpatel
committed
1a41b18
Keep malformed inputs structured
saagpatel
committed
7168a16
Bind trust evidence to actual config pointers
saagpatel
committed
c2d4d95
Keep ignored subject inputs unbound
saagpatel
committed
16727ed
Bind evidence to the staged subject snapshot
saagpatel
committed
c20d47f
Close staging races without breaking v1
saagpatel
committed
0492623
Fail closed on partial repository walks
saagpatel
committed
137e666
Detect silently skipped repository subtrees
saagpatel
committed
fca3950
Validate nested trust evidence fields
saagpatel
committed
95f2f9a
Fail closed on trust chronology and network unknowns
saagpatel
committed
f9cc23a
Make unobservable effects fail closed
saagpatel
committed
b1652f2
Reject contradictory trust isolation evidence
saagpatel
committed
3dda384
Bind observations to immutable evidence
saagpatel
committed
fa253e9
Fix build hooks and surface consistency
saagpatel
committed
5b0151c
Fail closed on malformed trust evidence
saagpatel
committed
683de4d
Bind trust evidence to complete occurrences
saagpatel
committed
5588240
Recompute capsule semantic bindings
saagpatel
committed
3c9de82
Bind commands and canonical capsule bytes
saagpatel
committed
78e2875
Reject coerced capsule scalar types
saagpatel
committed
b0ba8bc
Reject malformed repository trust inputs
saagpatel
committed
74dbc3b
Prevent trust identity aliasing
saagpatel
committed
93aefce
Preserve exact remote trust paths
saagpatel
committed
62aece8
Fail closed on transient and unbound evidence
saagpatel
committed
38fb470
Separate transient file and database effects
saagpatel
committed
c527240
Require trusted observer image identity
saagpatel
committed
95e53cf
Preserve staged executable identity
saagpatel
committed
29c7475
Preserve runtime executable modes
saagpatel
committed
c7b39c7
Bound runtime evidence streaming
saagpatel
committed
18dcf64