feat: integrate runtime provenance with audited production dependencies - #248

Open

Joncallim wants to merge 47 commits into

mainfrom

codex/68-provenance-audit-integration

Commits on Sep 2, 2026

fix: upgrade express security dependency chain
Joncallim
committed
b3014db
feat: add Docker runtime edge evidence refs
Joncallim
committed
4c12108
fix: attest Docker evidence with observation token
Joncallim
committed
08617a1
feat: expose runtime edge evidence inspector
Joncallim
committed
d6a72cd
docs: describe runtime evidence observation token accurately
Joncallim
committed
7202d08
fix: harden version one runtime evidence
Joncallim
committed
62e34eb
fix: require explicit runtime evidence tokens
Joncallim
committed
41d53d5
fix: reject empty runtime evidence tokens
Joncallim
committed
8ad070c
fix: validate version one evidence semantics
Joncallim
committed
2758383
fix: bind runtime evidence to edge endpoints
Joncallim
committed
b65cd6a
feat: evidence Docker Compose dependency declarations
Joncallim
committed
3c03324
feat: expose Compose dependency evidence
Joncallim
committed
8a33379
test: cover Compose dependency evidence fixture
Joncallim
committed
5768820
test: reject self-attested Compose evidence
Joncallim
committed
81215b5
feat: schedule systemd observations independently
Joncallim
committed
318512e
fix: align systemd provider state contract
Joncallim
committed
82956fd
test: preserve scheduler legacy baseline
Joncallim
committed
b8c9eff
test: cover systemd provider state in hostile fixture
Joncallim
committed
2f3c193
feat: attest systemd dependency declarations
Joncallim
committed
368795f
feat: validate systemd evidence boundary
Joncallim
committed
0a50366
fix: preserve systemd dependency semantics
Joncallim
committed
19492db
test: enforce systemd evidence semantics
Joncallim
committed
01673f4
docs: explain systemd relationship evidence
Joncallim
committed
3028ff5
feat: add bounded systemd findings endpoint
Joncallim
committed
ce7e54c
feat: expose bounded runtime findings
Joncallim
committed
e0d1c30
fix: attach canonical evidence to findings
Joncallim
committed
7f6ec16
fix: bind findings to triggering evidence
Joncallim
committed
0bdf1bc
test: cover findings accessibility
Joncallim
committed
f832f76
test: cover 44-service map density
Joncallim
committed
5d4b187
feat: flag internal network port publications
Joncallim
committed
1311c3d
feat: add internal network port findings
Joncallim
committed
3c59f8b
fix: require host publication for internal port findings
Joncallim
committed
6af0e71
docs: define bounded Docker port finding
Joncallim
committed
6dfbb8a
docs: state findings severity policy
Joncallim
committed
9b9aa3e
feat: derive path-free Docker daemon state evidence
Joncallim
committed
a144be6
feat: validate path-free Docker daemon evidence
Joncallim
committed
4e85038
feat: flag Docker daemon state bind mounts
Joncallim
committed
d9ff040
feat: surface Docker daemon state findings
Joncallim
committed
2fdff82
fix: suppress runtime evidence in mock mode
Joncallim
committed
1e8ff68
feat: bind npm manifest provenance evidence
Joncallim
committed
7fa1c6e
chore: refresh npm provenance contracts
Joncallim
committed
ceec457
fix: accept closed npm provenance evidence
Joncallim
committed
ebfe0a8
fix: attest only bound Docker host ports
Joncallim
committed
a1ef1b9
docs: clarify runtime provenance boundaries
Joncallim
committed
9b0e928
feat: bind cron schedule provenance to its own slot
Joncallim
committed
c4da2fa
feat: validate cron schedule provenance at API boundary
Joncallim
committed
2240fea
feat: surface cron collection state
Joncallim
committed
c5e3063