Supply-chain hardening: version pinning, SLSA attestations, fix #506#512

Merged

backnotprop merged 24 commits intomainfrom

harden/supply-chain

Apr 8, 2026

Commits on Apr 7, 2026

feat(install): supply-chain hardening (#507) + fix Gemini crash on Windows (#506)
backnotprop
committed
fix(install): address PR #512 review feedback
backnotprop
committed
test(ci): add Windows integration job for install.cmd
backnotprop
committed
fix(install.cmd): capture gh stderr on failure (consistency with install.sh)
backnotprop
committed
fix(install): address second review pass on PR #512
backnotprop
committed
fix(install): tighten attestation verify with --source-ref and --signer-workflow
backnotprop
committed
fix(install): address PR #512 review cycle 4 (parser edges, ps1 stream, docs)
backnotprop
committed
fix(install): address PR #512 review cycle 5
backnotprop
committed
fix(install.cmd): randomize checksum temp path + tighten test assertions
backnotprop
committed
fix(install.cmd): escape ! in Claude Code slash command files
backnotprop
committed
fix(install.cmd): double-caret escape for ! in slash command echoes
backnotprop
committed
fix(install.ps1): fall back to x64 on ARM64 Windows instead of 404ing
backnotprop
committed
fix(install): pre-flight MIN_ATTESTED_VERSION guard + placeholder docs
backnotprop
committed
fix(install): close PS injection + move Windows pre-flight before download
backnotprop
committed

Commits on Apr 8, 2026