v0.15.0

Track T Phase 4 (T-E2): the v0.14 trust policy now also applies where dependencies enter, before anything is installed. The same policy that fails CI fails a commit and a pre-install CI step, with no model involved.

• openpulse gate: applies the policy to dependency files alone, comparing with a git ref so only what changed is trust-checked.
• Pre-commit hook: openpulse-gate checks the dependencies a commit adds or changes.
• The Action's gate input: runs before pip install or npm ci, with the base branch's files and policy, on a shallow checkout.
• Bypass routes: --no-verify is caught by the CI gate. A lockfile regenerated after the gate, an ungated file, and file names outside the hook's pattern are documented limits, each with a workaround.

Nothing new blocks without a policy, and verdicts, the evidence contract and the frozen evaluation are unchanged. No upgrade notes.

Added

• openpulse gate: the trust policy before install (track T, T-E2, v0.15.0 item Z1). openpulse gate FILE... [--base-ref REF | --base FILE...] [--policy PATH] applies the trust policy to dependency files alone, with no events needed. It is for a CI step before pip install or npm ci (--base-ref origin/main), and for a pre-commit hook (--base-ref HEAD). See docs/TRUST_POLICY.md, "Before install".
  • Comparison: with --base-ref, each file's copy at that ref is read with git show, and trust checks run only for added or changed dependencies. A file new since the ref counts as added.
  • The same evaluation as check and attest: the blocklist covers every dependency, lockfile hashes edited in place are caught, and NOT_PERFORMED never blocks.
  • Exit codes: 0 pass, 1 violation, 2 usage error. Without a policy it passes and says so. Deleted and non-dependency files are skipped.
• Pre-commit hook openpulse-gate (v0.15.0 item Z2). .pre-commit-hooks.yaml runs openpulse gate --base-ref HEAD on staged dependency files (requirements*.txt, pyproject.toml, poetry.lock, package-lock.json, Cargo.toml, Cargo.lock, go.mod, pom.xml), so a commit is checked only for the dependencies it adds or changes. See docs/TRUST_POLICY.md, "Pre-commit hook".
  • First commit: openpulse gate --base-ref HEAD in a repository with no commits treats every file as new instead of failing. Any other unknown ref is still a usage error.
• The Action's gate input: the trust policy before install (v0.15.0 item Z3). With gate: <dependency files>, the Action runs only openpulse gate (no events, contracts or SARIF), so it can sit before pip install or npm ci. See docs/GITHUB_ACTION.md, "Before install".
  • Pull requests: base copies come through the contents API (a shallow checkout is enough), and only added or changed dependencies are trust-checked. An unreadable base copy means that file is checked in full.
  • Settings: the policy and the private-name list come from the base branch when it has them, so a pull request cannot weaken or delete its own gate.
  • Dogfood: CI runs the gate input on every push, once passing and once blocked by the blocklist.
  • CLI without the Action: docs/TRUST_POLICY.md, "In CI, before install".
• Pre-install bypass routes pinned by tests (v0.15.0 item Z4). tests/test_gate_bypass.py now also covers the routes around the hook and the CI gate:
  • Covered: git commit --no-verify is caught by the CI gate, which compares with the base branch.
  • Documented limits: dependency files outside the hook's name pattern, a lockfile regenerated after the gate, and an install from a file the gate was not given.
  • Each is listed with what to do instead in docs/TRUST_POLICY.md, "Bypass routes".

Changed

• openpulse gate: a missing or invalid policy file is a usage error (exit 2), not a violation (exit 1).