fix: close nine contracts that could only check what they were told - #146

Merged

rldyourmnd merged 9 commits into

mainfrom

fixtures/reprove-secret-scan-container-guard

Aug 13, 2026

Commits on Aug 13, 2026

fix(python-contract): discover invocation documents instead of trusting a registry
rldyourmnd
committed
c7196ca
fix(catalog): execute the capability schema instead of only shipping it
rldyourmnd
committed
bcb55b3
fix(rulesets): assert enforcement and the tag-immutability rule set
rldyourmnd
committed
2513334
fix(docs): bind documented tool commands to what ci-gate runs
rldyourmnd
committed
724d473
fix(secret-scan): require a digest-pinned image on the default container lane
rldyourmnd
committed
10765eb
feat(release): reconcile the changelog ledger against real tags
rldyourmnd
committed
05f26f9
docs: remove volatile inventory counts and fix the pinning contradiction
rldyourmnd
committed
3572142
fix(secret-scan): scope the scan to the checked-out ref by default
rldyourmnd
committed
807c680
chore(evidence): re-prove secret-scan against the current digest
rldyourmnd
committed
9b5f085