Dev recursive improvements - #267

Merged

bordumb merged 32 commits into

mainfrom

dev-recursiveImprovements

Jun 13, 2026

Commits on Jun 13, 2026

feat(cli): add --print-uri to auths pair — emit the token URI for out-of-band delivery
bordumb
committed
0f040ba
feat: ri-burndown cycles 1-7 — close AITFC-1, DOTAK-1, LTL-6b, LTL-R1, PWNTS-1, V-WASM, AITFC-6

bordumb
and
claude
committed
051cd23
fix: complete oidc_binding field in auths-python and auths-node bindings
bordumb
committed
8dabb79
fix(DOTAK-2): multi-capability credentials verify via single-source capability codec
bordumb
committed
e1162f1
feat(signing): capture repository/sha/workflow_ref in signed CI provenance
bordumb
committed
922fee7
feat(org): public authenticated_org_state() for offline key-state resolution

bordumb
and
claude
committed
3791a75
feat(compliance): SOC 2 (TSC) and ISO 27001 Annex-A framework predicates

bordumb
and
claude
committed
48b9765
feat(AITFC-4): offline org-bundle + evidence-pack verification in auths-verifier, exported to WASM

bordumb
and
claude
committed
eafdb9d
feat(transparency): local log writer — append/prove with leaf-bound row verification
bordumb
committed
a65c40d
feat(AITFC-5b): pinned log-key checkpoint attestation for offline evidence-pack verification

bordumb
and
claude
committed
7832a2e
feat(LTL-5): mobile FFI read-only KEL verify surface over one shared attachment-pairing core
bordumb
committed
df69939
feat(LTL-6): offline auth-challenge verifier — auth verify against the registry's in-force key
bordumb
committed
8b68749
feat(LTL-R2): host-side apply of device-authored shared-KEL rotation
bordumb
committed
ef5fb56
feat(PWNTS-1b): KEL-anchored OIDC-subject policy — org anchor-oidc-policy writer + verify --oidc-policy-did resolver

bordumb
and
claude
committed
9c7108a
feat(PWNTS-4): stateless commit-bundle verification — verifyCommitJson WASM export over a parsed BundleTrust anchor; P-256 SSH verify through the provider port
bordumb
committed
96de9d5
feat(agents): record a KEL-anchored delegation attestation on agent add

bordumb
and
claude
committed
ee32fa2
feat(rp): registry-sync surface — RegistrySync port, RegistryWatcher poll loop, git fetch adapter for refs/auths/*

bordumb
and
claude
committed
4747df2
feat(LTL-8): registry propagation over git remotes — auths registry push/pull with validated KEL merge

bordumb
and
claude
committed
d6c7b35
feat(verify): offline transparency anchoring for artifact verify — --log-evidence under a pinned log key

bordumb
and
claude
committed
cea89bf
feat(auths-mobile-ffi): delegated device-link KEL verification

bordumb
and
claude
committed
fa24197
feat(artifact): --curve flag for ephemeral CI signing
bordumb
committed
4afcffa
feat(artifact): --signature-only self-check for ephemeral verify

bordumb
and
claude
committed
1bef4d0
fix(org): resolve org signing key by DID so default-flag lifecycle works

bordumb
and
claude
committed
eb638af
feat(auths-mcp-server): configurable tool sandbox root

bordumb
and
claude
committed
ac415e8
fix(cli): accept leading-hyphen base64url nonce values

bordumb
and
claude
committed
fa42f1f
fix(sign): confirm a signature landed before reporting a commit signed

bordumb
and
claude
committed
768c36d
fix(whoami): resolve a paired delegate via the single local-signer resolver
bordumb
committed
3f747a7
fix(cli): re-signing a commit replaces its Auths-* trailers instead of appending

bordumb
and
claude
committed
eee627c
fix(xtask): exclude hidden dirs (incl .worktrees) from AST check file-walks

bordumb
and
claude
committed
0ca88ec
fix(ci): document shared-kel-rot endpoint + allow auths-rp git2 wrapper

bordumb
and
claude
committed
79d1890
chore: add CI identity bundle for signer verification
bordumb
committed
578f5a9
fix: update error docs
bordumb
committed
0b7e80e

Navigation Menu

Uh oh!

Dev recursive improvements - #267

Dev recursive improvements#267
bordumb merged 32 commits into
mainfrom
dev-recursiveImprovements

Commits on Jun 13, 2026

feat(cli): add --print-uri to auths pair — emit the token URI for out-of-band delivery

feat: ri-burndown cycles 1-7 — close AITFC-1, DOTAK-1, LTL-6b, LTL-R1, PWNTS-1, V-WASM, AITFC-6

fix: complete oidc_binding field in auths-python and auths-node bindings

fix(DOTAK-2): multi-capability credentials verify via single-source capability codec

feat(signing): capture repository/sha/workflow_ref in signed CI provenance

feat(org): public authenticated_org_state() for offline key-state resolution

feat(compliance): SOC 2 (TSC) and ISO 27001 Annex-A framework predicates

feat(AITFC-4): offline org-bundle + evidence-pack verification in auths-verifier, exported to WASM

feat(transparency): local log writer — append/prove with leaf-bound row verification

feat(AITFC-5b): pinned log-key checkpoint attestation for offline evidence-pack verification

feat(LTL-5): mobile FFI read-only KEL verify surface over one shared attachment-pairing core

feat(LTL-6): offline auth-challenge verifier — auth verify against the registry's in-force key

feat(LTL-R2): host-side apply of device-authored shared-KEL rotation

feat(PWNTS-1b): KEL-anchored OIDC-subject policy — org anchor-oidc-policy writer + verify --oidc-policy-did resolver

feat(PWNTS-4): stateless commit-bundle verification — verifyCommitJson WASM export over a parsed BundleTrust anchor; P-256 SSH verify through the provider port

feat(agents): record a KEL-anchored delegation attestation on agent add

feat(rp): registry-sync surface — RegistrySync port, RegistryWatcher poll loop, git fetch adapter for refs/auths/*

feat(LTL-8): registry propagation over git remotes — auths registry push/pull with validated KEL merge

feat(verify): offline transparency anchoring for artifact verify — --log-evidence under a pinned log key

feat(auths-mobile-ffi): delegated device-link KEL verification

feat(artifact): --curve flag for ephemeral CI signing

feat(artifact): --signature-only self-check for ephemeral verify

fix(org): resolve org signing key by DID so default-flag lifecycle works

feat(auths-mcp-server): configurable tool sandbox root

fix(cli): accept leading-hyphen base64url nonce values

fix(sign): confirm a signature landed before reporting a commit signed

fix(whoami): resolve a paired delegate via the single local-signer resolver

fix(cli): re-signing a commit replaces its Auths-* trailers instead of appending

fix(xtask): exclude hidden dirs (incl .worktrees) from AST check file-walks

fix(ci): document shared-kel-rot endpoint + allow auths-rp git2 wrapper

chore: add CI identity bundle for signer verification

fix: update error docs