founder-ship-it/Slipmark · Proof record #81
The gate refused.
Where it came fromsigned by GitHub
- Repository
- founder-ship-it/Slipmark
- Commit
- a5f353ffe3812a8e7dbedfb9db53e6c591e8e712
- Pull request
- #18
- Workflow
- Slipmark · pull_request
- Run
- 40222605199
Ledger entryLedger intact · 96 entries
- Entry
- #81 of 96
- Entry hash
- c5be4aa869a9648f7d5dccd5e366a3f6baf0fb4d19ac3a153d8f844ba2e31d13
- Previous hash
- ec13e7212c0b8e3f8f8a4c65c75c7954ba9fb5c4ae5aff572326d03ac0965302
Each entry's hash covers this run's verdicts and the previous entry's hash. The whole chain is recomputed every time this page is built: changing any past record would break it here.
Organisation rules Not met
Rules set by the repository owner, checked against the files this change touched.
| Rule | Result | Files it covered | Missing a passing verdict |
|---|---|---|---|
| Gate code and its spec need a reviewer pass | Not met | docs/attestation.md, src/attest/attestation.ts, src/attest/context.ts, src/attest/githubRender.ts, src/attest/markdownSubset.ts, src/attest/markdownWorker.ts | docs/attestation.md, src/attest/attestation.ts, src/attest/context.ts, src/attest/githubRender.ts, src/attest/markdownSubset.ts, src/attest/markdownWorker.ts |
| Payments code needs a security review | Met | none changed |
Gate results
What CI found when it re-hashed each attested file at commit a5f353f. Slipmark Cloud then read GitHub's own copy of the commit, re-hashed every attested file itself and got the same answer.
| Result | File | Agent | Verdict | Detail |
|---|---|---|---|---|
| Spec changed after verdict | src/attest/attestation.ts | reviewer | pass | attested 7556949190a7… now 4b2c1051aabe… |
| Spec changed after verdict | docs/attestation.md | reviewer | pass | attested 3752b18b9857… now 37e910537001… |
| Spec changed after verdict | docs/attestation.md | reviewer | pass | attested 3752b18b9857… now 37e910537001… |
| No verdict | src/attest/attestation.ts | — | — | no passing, current attestation covers src/attest/attestation.ts |
Verdicts as the agents recorded them
The attestation files in the repository at this commit.
reviewer · pass.slipmark/attestations/reviewer--docs_attestation.md.json
- Read
- docs/attestation.md 3752b18b9857076c2c1aa90a4ef815e94aa53ebd8642bc0706a48b55ce414a63
- Note
- Docs match code: policy-from order and fallback note, policy.source/ref/sha256, require in policy, subfolder and link rules, new exit-2 cases, signatures.issuer, HEAD message.
- Attested
- 25 Oct 2026, 14:32 UTC
reviewer · pass.slipmark/attestations/reviewer--src_attest_attestation.ts.json
- Read
- src/attest/attestation.ts 7556949190a721b8dc2ce0249664dde2302e88b5d7128b7ae5d56a3f2c48451b
- Note
- Policy read from base: resolution order, exact refs/remotes base via show-ref, ls-tree with every parent checked (linked .slipmark is exit 2), subfolder policy with root guard, CRLF, no-base matches v0.4; attack repos r1-r8 behave as documented.
- Attested
- 25 Oct 2026, 14:32 UTC
reviewer · pass.slipmark/attestations/reviewer--src_attest_signing.ts.json
- Read
- src/attest/signing.ts aeefb8706f106dc0ddfcea6b6f3bba1dff9a49c4c572ab8a0b9113803578ae42
- Note
- Signed verdicts section matches signing.ts: DSSE over canonical JSON minus signature, payload check, issuer default and signatures.issuer, * identity match, invalid always refuses, unreachable Sigstore exits 2 only when required.
- Attested
- 25 Oct 2026, 14:32 UTC
What this proves: these verdicts were recorded by founder-ship-it/Slipmark's own workflow at this commit, and the files above either matched or did not. It does not prove a verdict was right, only what it was about.