2026-08-01
sourcelock 0.1.0
Hardening pass: the gate stops reporting green for free
An adversarial review of the shipped code, followed by an external code review, found a set of failures that shared one shape: the tool reporting success for something it had not verified. Every item below is a fix for that, and several of them made the claims on this site wrong until today.
- +
lock initrefuses to write when any selected canary could not be observed, and never deletes a pin it could not re-observe. An offline run used to pin what it could reach and silently drop the rest, deleting exactly the pins that detect drift.--allow-partialopts in; the write is a temp file plus a rename - +Two new doctor statuses and two new exit codes:
unpinned(3) for a canary observed but never pinned,stale(4) for a match against data the source stopped publishing. A missing lockfile used to reportokat exit 0 — a build that verified nothing, reporting green - +
errorsplit out fromunreachable: “CMS is down” and “our adapter has a bug” need opposite fixes and used to print the same line - +A
viacolumn on every canary, so anokanswered by a fallback mirror while the authority is dark is visible rather than implied. Canary notes now reach the CLI, the JSON, and the CI annotations instead of being dropped - +Receipts stamp
retrieved_atat the fetch boundary, so a cached answer no longer claims it was fetched when the receipt was printed; multi-fetch tools list every artifact's URL, status, hash and retrieval time - +Ed25519 manifest signing (
manifest build|sign|verify), with--check-lockbinding the signature to the lockfile doctor actually reads, plus a composite GitHub Action that annotates each failing canary with its remediation verbatim - +
leiereturnsscreen_result: indeterminatewith the verdict fields absent when the snapshot is incomplete or a reinstatement date is populated. A malformed row used to produce a false miss, which reads as “not excluded” - +The CPT non-claim corrected and narrowed. No CPT or CDT record is vendored and no AMA/ADA descriptor text is reproduced, but 17 government-authored CMS Level-II descriptions cite CPT code numbers inside CMS's own definition text (G0317 references 99306 and 99310) and ship as CMS published them. The old key asserted the opposite of the shipped bytes; a test now re-derives the set on every run
- +PHI guard hardened in both directions — bypasses closed, false positives fixed, an allowlist added — and reframed honestly as a structural best-effort refusal rather than a compliance control, with its unclosed evasion classes written down
- +Input echo closed across CLI and MCP: rejection messages name the path and the detector, never the offending value