Merge branch 'main' into dependabot/github_actions/actions-e145140e36

1a69231

Select commit

Loading

Failed to load commit list.

Uh oh!

There was an error while loading. Please reload this page.

Secret Scanning (Gitleaks) on: push

Gitleaks secret scan

demo-freeze on: push

guard

Shared-module hash lock on: pull_request

Shared modules match committed SHA-256 lock

infra pointer guard on: pull_request

infra/ stays pointer-only

demo-freeze on: pull_request

guard

Shared-source drift guard on: pull_request 4

Shared source files in sync with killinchu

What's New feed honesty — no feed entry the app doesn't register (Wave S Dev 5) on: pull_request

What's New feed lists only registered surfaces (drift-proof)

vendor-sync-check on: pull_request

vendor-sync

Container build + GHCR push on: pull_request

Build image + SBOM (push on main + release)

CodeQL on: pull_request

Analyze (javascript-typescript)

Analyze (actions)

no-hf-mirror-guard on: pull_request

guard

infra vendoring guard on: pull_request

No re-vendored repos under infra/

Conventional Commits PR title lint on: pull_request

Lint PR title (Conventional Commits)

surface-registry sync guard on: pull_request

holographic.html SURFACES <-> szl3d_holographic.py SURFACES in lockstep

Action-contract promotion guard on: pull_request

Action-contract promotion qualification

Dockerfile build-file guard on: pull_request

COPY/ADD sources exist

Full docker build (scheduled)

Private-IP Leak Check on: pull_request

Egress hygiene — no private/internal addresses in served code

copy-sync lockstep guard on: pull_request

COPY <-> serve.py imports <-> hf-sync mirror are in lockstep

manifest-coverage guard on: pull_request

every registered surface ships an honesty manifest the wall can read

demo-freeze-hotfix-validate on: pull_request

hotfix-validate

Trivy + Grype container vulnerability scan on: pull_request

Trivy filesystem scan

Grype CVE gate (fail on HIGH/CRITICAL)

Dependabot auto-merge on: pull_request

dependabot-auto-merge

Tests on: pull_request

Run tests

Hugging Face payload manifest closure regressions

Nemo owner dispatch immutable-selection contract

GDW authenticated durability and promotion contract

Wave 26 MODELED Lambda-AttnRes and replay contracts

Operator & reason endpoint tests (pytest)

Proof-carrying formula registry — no overclaims (pytest, offline)

Λ parity — flagship inline vs published universal kernel (pytest, offline)

Demo-critical route-table regression guard (pytest)

Energy-operator autostart + /readyz redeploy-stall guard (pytest)

Backend hardening surface tests (pytest)

Energy /metrics private-address egress guard (pytest, offline)

Evidence tab auto-refresh surface guard (pytest, offline)

Receipt-monitor verifier tests (pytest, offline)

canonical HF single-writer guard (stdlib, network-free)

Theorem-manifest honesty-guard self-test (stdlib, network-free)

Theorem-manifest validator runs against the REAL manifest (stdlib, network-free)

Release-receipt tamper-rejection integration test (real Sigstore verify)

Action-contract manifest validator self-test (stdlib, network-free)

Anatomy/formula/runtime map validator self-test (stdlib, network-free)

Benchmark map validator self-test (stdlib, network-free)

Controls-evidence map validator self-test (stdlib, network-free)

Cross-repo handoff manifest validator self-test (stdlib, network-free)

GitHub access checklist validator self-test (stdlib, network-free)

HF test-results manifest validator self-test (stdlib, network-free)

Phase-completion manifest validator self-test (stdlib, network-free)

Public-pattern manifest validator self-test (stdlib, network-free)

DSSE PAE parity — szl_dsse cosign-family, diverges from szl-receipt (pytest, offline)

DSSE PAE parity — sign_cert_dsse Ed25519 cosign-family, diverges from szl-receipt (offline)

Frontier 3D-surface manifest — honest, single-source (pytest, offline)

V4 fleet peer-health federates live standalone Spaces, honestly (pytest, offline)

Frontier-endpoint governance contract (pytest — Wave J Dev 3)

Operational STATUS aggregate contract (Wave R Dev 2 — pytest, offline)

Shared guarded-surface wrapper — one bad surface never 500s the SPA (pytest, offline)

Guarded-import liveness — no silent no-op dead first-party imports (pytest, offline)

Durable bounded receipt/energy ledger — bounds size + degrades honestly (pytest, offline)

Sovereign local backend — honest UNAVAILABLE when Tower down (pytest, offline)

Frontier Index honesty — no catalog label a backend doesn't emit (Wave Q Dev 5)

Frontier model admission + HF estate honesty (pytest, offline)

Namespace Leak Check on: pull_request

Doctrine v7 §14 — Personal Namespace Fence

Secret Scanning (Gitleaks) on: pull_request

Gitleaks secret scan

Doctrine — banned-token grep gate on: pull_request

Banned-token scan (Doctrine v7 §1)

DCO on: pull_request 1

DCO sign-off check

Pin Check on: pull_request

pin-check / All actions SHA-pinned

Lockfile Registry Check on: pull_request

lockfiles / No lockfile references a Replit-internal registry host

Anatomy-map drift guard on: pull_request

anatomy-map-drift / Anatomy map honest & in sync (locked-8 + Λ=Conjecture-1)

Docs CI on: pull_request 3

docs / Validate CITATION.cff

docs / Markdown lint

docs / External link check

docs / Required files present

secrets / TruffleHog Secret Scan

Doctrine Overclaim Guard on: pull_request

overclaim / Governed surfaces are honest (Theorem U citation rule)

HF Space module-drift guard on: pull_request 1

hf-module-drift / Source in sync with the live HF Space

Doctrine on: pull_request 3

check / doctrine

Code scanning results

Trivy

CodeQL

grype

GitHub Advanced Security / CodeQL succeeded Aug 4, 2026 in 3s

No new alerts in code changed by this pull request

View all branch alerts.

Loading

Re-running checks...