fix: close deep-audit safety gaps - #299

Merged

Wibias merged 49 commits into

mainfrom

agent/fix-deep-audit-findings

Aug 19, 2026

Commits on Aug 19, 2026

test: lock deep audit regressions
Wibias
committed
1ff722a
fix: trust CI scope policy source
Wibias
committed
5093740
fix: execute scoped CI policy from base
Wibias
committed
5f53abb
test: assert authority before coordination write
Wibias
committed
51f1961
fix: execute C# scope policy from base
Wibias
committed
bcafb91
fix: redeem before coordination mutations
Wibias
committed
59ad3f8
fix: record required probe evidence
Wibias
committed
dcbab67
fix: enforce required review probes
Wibias
committed
ffc0333
fix: parse branch diffs with NUL records
Wibias
committed
1e98e71
fix: pin orphan cleanup branch generation
Wibias
committed
68cdf8d
test: pin cleanup fixtures to one main generation
Wibias
committed
bc59243
perf: bound review brief diff excerpts
Wibias
committed
b299d5d
fix: add executable merge stack policy
Wibias
committed
77456d9
fix: preserve merged retry reconciliation
Wibias
committed
452c396
fix: enforce stack order at merge boundary
Wibias
committed
adbdc6f
test: require unconditional security lanes
Wibias
committed
98f0ee9
fix: always run Windows authority CI
Wibias
committed
c2b9aca
fix: always run C# CodeQL
Wibias
committed
bdb4a33
test: cover final audit hardening design
Wibias
committed
e7a0f21
docs: describe deep audit hardening
Wibias
committed
e0bbea4
docs: record deep audit hardening
Wibias
committed
a21713a
fix: remove unsafe branch diff parser
Wibias
committed
b77cecc
fix: reuse canonical probe evidence records
Wibias
committed
53f445d
fix: validate pre-open probes with canonical evidence
Wibias
committed
0462f8c
test: verify canonical probe evidence clears gate
Wibias
committed
17e163d
fix: classify renames from both path generations
Wibias
committed
cba6ed9
test: assert renamed code remains review scoped
Wibias
committed
fc1e9cb
fix: keep code-to-doc renames out of docs-only shortcut
Wibias
committed
8b3bd57
test: cover code-to-doc rename scope
Wibias
committed
699c4c2
docs: describe canonical probe evidence
Wibias
committed
f9e4fdf
docs: describe canonical probe evidence
Wibias
committed
c5fdacb
docs: describe pre-open probe obligations
Wibias
committed
5aa3937
test: bound interleaved tool micro-narration
Wibias
committed
4c4e117
fix: interrupt repetitive evidence micro-narration
Wibias
committed
e2cb20b
docs: make quiet execution contract explicit
Wibias
committed
3b571e8
docs: keep routine tool execution quiet
Wibias
committed
068d524
test: pin quiet execution guidance
Wibias
committed
81d096e
docs: roll audit fixes into v0.8.7
Wibias
committed
1dca04b
test: pin default micro-narration budget
Wibias
committed
be66541
docs: describe micro-narration guard
Wibias
committed
2750864
revert: restore README after failed docs replacement
Wibias
committed
0ca0b5a
test: prove micro-narration resets on real progress
Wibias
committed
7365d6e
docs: keep README unchanged
Wibias
committed
6f551a5
revert: restore canonical README
Wibias
committed
3edcd04
fix: match gerund micro-narration intents
Wibias
committed
c8f6ff0
docs: keep quiet execution compact
Wibias
committed
ff68a6e
test: keep quiet entrypoint contract within budget
Wibias
committed
707870b
test: preserve character-budget interrupt assertion
Wibias
committed
e020be9
fix: clear micro-narration only after pending tool-emission signal
Wibias
committed
4e2b7b6