v0.1.2

Verifiable artifacts

npm publication was not enabled for this release.

shasum -a 256 -c SHA256SUMS
gh attestation verify decionis-agent-safe-pipeline-0.1.2.tgz \
  --repo decionis/agent-safe-pipeline \
  --bundle agent-safe-pipeline-0.1.2.provenance.sigstore.json \
  --custom-trusted-root trusted_root.jsonl

The CycloneDX SBOM was generated from the extracted npm tarball and contains at least five dependency components. Raw in-toto statements and their signed Sigstore bundles are attached for mirrors and offline verification.

What's Changed

• feat(conformance): add Unicode/numeric edge-case hash vectors by @yunaremaia in #23
• Record fixture and security ownership by @ocularminds in #24
• Add bot-authored pull request workflow by @decionis-bot[bot] in #26
• Localize repository rules for AgentSafe by @decionis-bot[bot] in #27
• Bind idempotency keys to execution intents by @decionis-bot[bot] in #28
• Harden authority response and grant validation by @decionis-bot[bot] in #29
• Freeze decisions and authorization evidence by @decionis-bot[bot] in #30
• Enforce single-use execution invariants by @decionis-bot[bot] in #31
• Bound untrusted intent traversal by @decionis-bot[bot] in #32
• Fail closed on Presence boundary errors by @decionis-bot[bot] in #34
• Enforce declared verification gates by @decionis-bot[bot] in #33
• Restrict automated discovery probes by @decionis-bot[bot] in #36
• Bound PR bot API responses by @decionis-bot[bot] in #35
• Release v0.1.2 by @ocularminds in #37

New Contributors

• @yunaremaia made their first contribution in #23
• @decionis-bot[bot] made their first contribution in #26

Full Changelog: v0.1.1...v0.1.2