pakka v0.15.0
9f8bb48
This commit was signed with the committer’s verified signature.
amargautam
Amar Gautam
Gate integrity release. Review pass markers are now bound to the exact staged diff: pakka-core review-pass writes a JSON marker containing the diff's SHA-256, and the commit gate recomputes and requires a fresh match — a pass for one diff can never authorize another commit, and legacy timestamp-only markers are rejected. The Reviewed-by-pakka attestation trailer applies the same verification before stamping, so unreviewed commits inside a pass window no longer carry the reviewed trailer. Also fixes --trailer injection colliding with pathspec commits. Found by one day of dogfooding the previous releases. Assets CI-built with SLSA provenance attestation, SHA256SUMS, CycloneDX SBOM.