v0.5.0: agent context, and policy from the base branch

Verdicts are now bound to the agent's instructions as well as the files it read, and a pull request can no longer loosen the rules it's judged by.

Security

• The policy is read from the branch you merge into, not from the pull request. Before this, a PR could drop a required file or loosen .slipmark/policy.json and be judged by its own weaker rules. Now it's judged by the base branch's policy, and changes to the policy only take effect after merge. Every report records which policy decided it, including its SHA-256. Thanks to Kent Bodrov for reporting this.

New

• Agent context. Add "context": {} to the policy, and each verdict records the hashes of the agent's instructions: AGENTS.md, CLAUDE.md, skills, hooks, Cursor rules and MCP configs.
  • A verdict given under instructions that later changed stops counting.
  • A change to those instructions needs an approver's verdict.
  • Links that point outside the watched files are refused, and so are submodules.
• Changed agent instructions must be plain Markdown that GitHub shows in full. There are three layers:
  • an allow-list of Markdown constructs, where anything unknown is refused, including whatever GitHub adds later;
  • pattern checks;
  • in GitHub Actions, a comparison with GitHub's own Markdown renderer.
    These cover the patterns behind the Ghostcommit, Deadbugz and TrustFall attacks of 2026. Approvers can acknowledge flagged content with a signed verdict.
• Diff coverage: every file changed since the base needs a current, passing verdict.
• Signed verdicts through Sigstore, tied to the workflow that gave them.
• Attestation v2 fields: the spec a verdict was checked against, the checks Slipmark ran itself, and the model that gave it.
• require in the policy file, so required paths are read from the base branch too.

Details are in docs/attestation.md, and the full list is in CHANGELOG.md.

- uses: founder-ship-it/Slipmark@v0.5.0

npx slipmark@0.5.0 init