fix(security): fail closed formal PyPI dependency evidence - #2344

Draft

seonghobae wants to merge 7 commits into

mainfrom

fix/formal-pypi-release-security-gate

Commits on Sep 22, 2026

fix(strix): resolve evidence binder from trusted source
seonghobae
committed
d548fad
test(strix): bind evidence helper to trusted source root
seonghobae
committed
2db8684
fix(security): require exact-head release dependency evidence
seonghobae
committed
747fc3e
fix(security): close release evidence review gaps
seonghobae
committed
1a86be0
fix(security): keep dependency review fail closed
seonghobae
committed
b5b3b2c
test: restore Strix fixture evidence contracts
seonghobae
committed
28afd9e
test: emit evidence for PR head scope fixtures
seonghobae
committed
ca51715