audit: version-aware verdicts + install gate (fixes the CVE-remediation catch-22) - #29

Merged

superbiche merged 14 commits into

mainfrom

feat/version-aware-verdict-core

Aug 1, 2026

Commits on Jul 13, 2026

Commits on Jul 31, 2026

Inbox safe blocks security bumps CVE catch-22 (reveille, third occurrence)
superbiche
committed
audit: version-aware verdicts + install gate — resolve the real target, stop blocking remediations
superbiche
committed
audit: harden version-aware gate per orthogonal review (7 findings closed)
superbiche
committed
audit: close delta-review residuals (round 2) — source identity, semver precedence, evidence lifecycle
superbiche
committed
audit: close delta-2 residuals (round 3) — lossless tokens, origin trust, cumulative sources, scoped evidence
superbiche
committed
audit: close delta-3 residuals (round 4) — npm last-wins, effective sources, strict core grammar, discriminated identity
superbiche
committed
audit: close delta-4 residuals (round 5) — centralized effective sources, full SemVer grammar
superbiche
committed
audit: close delta-5 residuals (round 6) — npm env precedence, scoped argv, node-semver limits, credential redaction
superbiche
committed
audit: close delta-6 residuals (round 7) — keyed scoped selectors, operational/display split, pip config parser
superbiche
committed
audit: close delta-7 residuals (round 8) — config-path threading, pip section semantics, boolean vocabulary
superbiche
committed
audit: close delta-8 residuals (round 9) — anchored config paths, ConfigParser fidelity, always-block cleanup
superbiche
committed
wrappers: restore the partial-snapshot contract broken by the cleanup refactor (round 10)
superbiche
committed