new advisories
Some checks failed
Docs CI / lint-and-preview (push) Has been cancelled

This commit is contained in:
2025-11-23 23:38:25 +02:00
parent c13355923f
commit 2de8d1784b
24 changed files with 443 additions and 17 deletions

View File

@@ -3,6 +3,13 @@
## Mission
Signer validates callers, enforces Proof-of-Entitlement, and produces signed DSSE bundles for SBOMs, reports, and exports.
## Advisory Handling
- Any new/updated advisory triggers immediate doc + sprint updates; no approval.
- Update high-level + detailed docs; inline only short snippets; put runnable/long code in `docs/benchmarks/**` or `tests/**` (deterministic/offline) and link.
- Add tasks + Execution Log entries in relevant `SPRINT_*.md` with doc paths/owners; add risks if schema/feed/transparency caps apply.
- Check archived advisories; mark supersedes/extends if overlapping.
- Defaults: hybrid reachability (graph DSSE required; edge-bundle optional), deterministic/frozen feeds; act first, report after.
## Key docs
- [Module README](./README.md)
- [Architecture](./architecture.md)