Fail closed on post-verification tampering by binding approval evidence to the exact staged Git tree and validating publication buffers against staged blob IDs. Adds deterministic security regressions to CI.
Fail closed on post-verification tampering by binding approval evidence to the exact staged Git tree and validating publication buffers against staged blob IDs. Adds deterministic security regressions to CI.