Skip to content

v2026.10.15

Choose a tag to compare

View all tags
@github-actions github-actions released this 15 Oct 18:42
· 1208 commits to main since this release
v2026.10.15
0a3b051
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Single-fix release. files: evidence resolved from git now hashes the raw blob bytes. Builds up to 2026.10.14 recorded a wrong sha256 for any file with non-ASCII bytes. Such a receipt fails at cleo complete with a message naming T13738: check the file, then re-run cleo verify to record the correct hash. Cross-device sync (Stage C: sync.seal, sync.push, sync.pull, sync.strict) stays unreleased and inert on this stable build until the Stage C exit gate releases its flags, and project hooks (hooks-v1) stay off on stable builds until their promotion. No schema migrations.

Fixed

  • File evidence read from git hashes the raw blob bytes, so non-ASCII files get correct sha256 (provenance: T13738)

Verified on macOS (listed by hand)

A UTF-8 multibyte file committed in a sandbox repo, with the working copy edited afterwards so that a hash read from disk would show. Each build ran cleo verify <task> --gate implemented --evidence "commit:<sha>;files:utf8.md":

  • git cat-file blob sha256: a9508f57d3d94460ad68f36c24c5ceab1ce2cc2db856bfea64e5052ddabac37e
  • 2026.10.15 records a9508f57d3d94460ad68f36c24c5ceab1ce2cc2db856bfea64e5052ddabac37e (matches)
  • 2026.10.14 records 3c2842970345134e664653d209195a537c921da03c04c0175a6d366abb4a687f (the lossy text re-encode)
Assets 11
Loading