v1.12.0

Changelog

• 46b6f00: ci: authenticate the chart provenance attestation to ghcr (@blakebauman)
• 6831165: docs: repoint the conformance receipt at the v1.11.0 run (@blakebauman)
• a21a610: test: give the hardening grab-bags subject-named homes (@blakebauman)
• 06594a4: Merge pull request #50 from fold-run/test/redistribute-hardening-tests (@blakebauman)
• 0abd3ad: docs: design record for governing server-initiated requests (@blakebauman)
• 9caefc8: policy: govern the requests upstreams make of the caller (@blakebauman)
• 1defa47: Merge pull request #51 from fold-run/policy/server-initiated (@blakebauman)
• e0141ae: policy: stop advertising what policy will not grant (@blakebauman)
• 8ad4869: Merge pull request #52 from fold-run/policy/server-initiated-pair (@blakebauman)
• 5358954: docs: design record for pinning upstream definitions (@blakebauman)
• abfb737: Merge pull request #53 from fold-run/docs/design-definition-pinning (@blakebauman)
• 93a44b6: feat: notice when an upstream rewrites what it advertises (@blakebauman)
• b17465b: Merge pull request #54 from fold-run/feat/definition-pinning (@blakebauman)
• 3e58a5d: policy: deny rules, and deny wins globally (@blakebauman)
• e895d25: Merge pull request #55 from fold-run/policy/deny-rules (@blakebauman)
• d1655b2: policy: constrain grants by argument (@blakebauman)
• b5ece8e: Merge pull request #56 from fold-run/policy/argument-constraints (@blakebauman)
• f012c64: policy: gate on what a tool says it does (@blakebauman)
• baf822f: policy: drop the parameters the filter's thunk already carries (@blakebauman)
• 98ea4b4: Merge pull request #57 from fold-run/policy/destructive-gating (@blakebauman)
• abe355f: docs: read the policy section as one thing again (@blakebauman)
• 66e6a87: Merge pull request #58 from fold-run/docs/policy-depth-pass (@blakebauman)
• d1311f8: docs: design record for the external decision hook (@blakebauman)
• 33134d1: Merge pull request #59 from fold-run/docs/design-decision-hook (@blakebauman)
• 00ece7e: feat: the external decision hook, ingress stage (@blakebauman)
• 0d27469: Merge pull request #60 from fold-run/feat/decision-hook-ingress (@blakebauman)
• 137178f: feat: the decision hook's egress stage (@blakebauman)
• 5b51bf6: Merge pull request #61 from fold-run/feat/decision-hook-egress (@blakebauman)
• cd38936: feat: inspect what an upstream asks of the caller (@blakebauman)
• 24317e9: Merge pull request #62 from fold-run/feat/decision-hook-reverse (@blakebauman)
• 7f124b6: release: v1.12.0 — governance in both directions (@blakebauman)