panopticon-mcp 1.0.0__tar.gz

panopticon_mcp-1.0.0/.editorconfig

@@ -0,0 +1,9 @@
+root = true
+[*]
+charset = utf-8
+end_of_line = lf
+insert_final_newline = true
+indent_style = space
+indent_size = 4
+[*.{json,yaml,yml,toml,md}]
+indent_size = 2

panopticon_mcp-1.0.0/.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,17 @@
+## Epic
+E__ — <name>
+
+## What changed
+
+## Definition-of-done items closed
+- [ ] ...
+
+## Plan / schema / rule changes
+- [ ] panopticon-buildplan.md updated (or N/A)
+- [ ] schemas/ updated + migrator (or N/A)
+- [ ] i18n ko+en docs added for new rules (or N/A)
+- [ ] docs/PROGRESS.md updated
+
+## Leak & privacy
+- [ ] No new persist path bypasses `util.leak_check`
+- [ ] No new network call outside `registry/` and the sandbox

panopticon_mcp-1.0.0/.github/assets/hero.svg

@@ -0,0 +1,111 @@
+<svg width="1200" height="420" viewBox="0 0 1200 420" fill="none" xmlns="http://www.w3.org/2000/svg">
+  <defs>
+    <radialGradient id="bg" cx="50%" cy="42%" r="80%">
+      <stop offset="0%" stop-color="#111931"/>
+      <stop offset="55%" stop-color="#0B101F"/>
+      <stop offset="100%" stop-color="#070A13"/>
+    </radialGradient>
+    <linearGradient id="beam" x1="0" y1="0" x2="1" y2="0">
+      <stop offset="0%" stop-color="#FF7A1A" stop-opacity="0"/>
+      <stop offset="100%" stop-color="#FF7A1A" stop-opacity="0.25"/>
+    </linearGradient>
+    <filter id="glow" x="-60%" y="-60%" width="220%" height="220%">
+      <feGaussianBlur stdDeviation="5" result="b"/>
+      <feMerge>
+        <feMergeNode in="b"/>
+        <feMergeNode in="SourceGraphic"/>
+      </feMerge>
+    </filter>
+    <filter id="dotglow" x="-140%" y="-140%" width="380%" height="380%">
+      <feGaussianBlur stdDeviation="3" result="b"/>
+      <feMerge>
+        <feMergeNode in="b"/>
+        <feMergeNode in="SourceGraphic"/>
+      </feMerge>
+    </filter>
+    <filter id="softglow" x="-60%" y="-60%" width="220%" height="220%">
+      <feGaussianBlur stdDeviation="10" result="b"/>
+      <feMerge>
+        <feMergeNode in="b"/>
+        <feMergeNode in="SourceGraphic"/>
+      </feMerge>
+    </filter>
+  </defs>
+
+  <rect width="1200" height="420" fill="url(#bg)"/>
+
+  <!-- faint panopticon floor plan spanning the banner -->
+  <g transform="translate(600 210)">
+    <circle r="320" stroke="#2E3D63" stroke-width="1" fill="none"/>
+    <circle r="250" stroke="#2E3D63" stroke-width="1" fill="none"/>
+    <circle r="185" stroke="#35486F" stroke-width="1" fill="none" stroke-dasharray="3 14"/>
+    <!-- radial spokes -->
+    <g stroke="#26345A" stroke-width="1">
+      <path d="M0 -320 L0 -185"/><path d="M0 320 L0 185"/>
+      <path d="M-320 0 L-185 0"/><path d="M320 0 L185 0"/>
+      <path d="M-226 -226 L-131 -131"/><path d="M226 -226 L131 -131"/>
+      <path d="M-226 226 L-131 131"/><path d="M226 226 L131 131"/>
+    </g>
+    <!-- outer cell ticks -->
+    <g stroke="#46588A" stroke-width="10" stroke-linecap="round">
+      <g id="tick"><path d="M-14 -285 A285 285 0 0 1 42 -282" fill="none"/></g>
+      <use href="#tick" transform="rotate(24)"/>
+      <use href="#tick" transform="rotate(72)"/>
+      <use href="#tick" transform="rotate(144)"/>
+      <use href="#tick" transform="rotate(168)"/>
+      <use href="#tick" transform="rotate(192)"/>
+      <use href="#tick" transform="rotate(216)"/>
+      <use href="#tick" transform="rotate(240)"/>
+      <use href="#tick" transform="rotate(264)"/>
+      <use href="#tick" transform="rotate(288)"/>
+      <use href="#tick" transform="rotate(336)"/>
+    </g>
+    <!-- caught cells: primary + secondary detection lights -->
+    <path d="M-14 -285 A285 285 0 0 1 42 -282" transform="rotate(96)"
+          fill="none" stroke="#FF7A1A" stroke-width="10" stroke-linecap="round" filter="url(#glow)"/>
+    <path d="M-14 -285 A285 285 0 0 1 42 -282" transform="rotate(312)"
+          fill="none" stroke="#FF7A1A" stroke-width="10" stroke-linecap="round" opacity="0.8" filter="url(#glow)"/>
+    <path d="M-14 -285 A285 285 0 0 1 42 -282" transform="rotate(48)"
+          fill="none" stroke="#FFB020" stroke-width="10" stroke-linecap="round" opacity="0.75" filter="url(#glow)"/>
+    <!-- detection dots on the rings -->
+    <g filter="url(#dotglow)">
+      <circle cx="161" cy="-191" r="4.5" fill="#FF7A1A"/>
+      <circle cx="-235" cy="-85" r="3.5" fill="#FFB020" opacity="0.85"/>
+      <circle cx="-296" cy="120" r="3" fill="#FF7A1A" opacity="0.7"/>
+      <circle cx="304" cy="98" r="3.5" fill="#FF7A1A" opacity="0.75"/>
+      <circle cx="-90" cy="-244" r="2.8" fill="#FFB020" opacity="0.6"/>
+    </g>
+  </g>
+
+  <!-- central emblem -->
+  <g transform="translate(600 148)">
+    <circle r="54" stroke="#6B7EB0" stroke-width="2" fill="none" stroke-dasharray="2 9" stroke-linecap="round"/>
+    <circle r="38" stroke="#E8EDF7" stroke-width="4" fill="#0A0E1A"/>
+    <rect x="-12" y="-18" width="24" height="36" rx="3.5" fill="#FF7A1A" filter="url(#softglow)"/>
+  </g>
+
+  <!-- wordmark -->
+  <text x="600" y="268" text-anchor="middle" fill="#E8EDF7"
+        font-family="Futura, 'Avenir Next', 'Helvetica Neue', Arial, sans-serif"
+        font-size="52" font-weight="700" letter-spacing="22">PANOPTICON</text>
+
+  <!-- tagline -->
+  <text x="600" y="316" text-anchor="middle" fill="#8B98B8"
+        font-family="SFMono-Regular, Menlo, Consolas, 'Liberation Mono', monospace"
+        font-size="19" letter-spacing="1">We don't watch you. We watch your MCPs.</text>
+
+  <!-- sub line -->
+  <text x="600" y="352" text-anchor="middle" fill="#4E5C7E"
+        font-family="SFMono-Regular, Menlo, Consolas, 'Liberation Mono', monospace"
+        font-size="14" letter-spacing="4">LOCAL-FIRST MCP BEHAVIOR OBSERVATORY</text>
+
+  <!-- corner terminal hints -->
+  <g font-family="SFMono-Regular, Menlo, Consolas, 'Liberation Mono', monospace" font-size="13">
+    <text x="48" y="52" fill="#3E4C6E">$ pano watch github</text>
+    <text x="48" y="76" fill="#8B98B8">READ  ~/.ssh/config</text>
+    <text x="238" y="76" fill="#FFB020">not declared</text>
+    <text x="48" y="100" fill="#FF6B4A">LEAK  AWS_ACCESS_KEY_ID</text>
+    <text x="268" y="100" fill="#5E6C8E">&lt;- decoy value</text>
+    <text x="1152" y="388" text-anchor="end" fill="#2E3A58">UNKNOWN stays visible - unobserved behavior stays UNKNOWN</text>
+  </g>
+</svg>

panopticon_mcp-1.0.0/.github/assets/logo.svg

@@ -0,0 +1,70 @@
+<svg width="256" height="256" viewBox="0 0 256 256" fill="none" xmlns="http://www.w3.org/2000/svg">
+  <!-- Panopticon eye: concentric floor-plan rings, terminal-cursor pupil -->
+  <defs>
+    <radialGradient id="bgGlow" cx="50%" cy="50%" r="60%">
+      <stop offset="0%" stop-color="#131A2E"/>
+      <stop offset="100%" stop-color="#0A0E1A"/>
+    </radialGradient>
+    <filter id="glow" x="-40%" y="-40%" width="180%" height="180%">
+      <feGaussianBlur stdDeviation="4" result="b"/>
+      <feMerge>
+        <feMergeNode in="b"/>
+        <feMergeNode in="SourceGraphic"/>
+      </feMerge>
+    </filter>
+    <linearGradient id="beamL" x1="118" y1="128" x2="38" y2="128" gradientUnits="userSpaceOnUse">
+      <stop offset="0%" stop-color="#FF7A1A" stop-opacity="0.02"/>
+      <stop offset="100%" stop-color="#FF7A1A" stop-opacity="0.2"/>
+    </linearGradient>
+    <filter id="dotglow" x="-120%" y="-120%" width="340%" height="340%">
+      <feGaussianBlur stdDeviation="2.5" result="b"/>
+      <feMerge>
+        <feMergeNode in="b"/>
+        <feMergeNode in="SourceGraphic"/>
+      </feMerge>
+    </filter>
+  </defs>
+
+  <rect width="256" height="256" rx="56" fill="url(#bgGlow)"/>
+
+  <!-- outer cell ring: brighter arcs -->
+  <g stroke="#4A5D8C" stroke-width="6" stroke-linecap="round">
+    <g id="cells">
+      <path d="M128 24 A104 104 0 0 1 154.9 27.5" fill="none"/>
+    </g>
+    <use href="#cells" transform="rotate(30 128 128)"/>
+    <use href="#cells" transform="rotate(60 128 128)"/>
+    <use href="#cells" transform="rotate(90 128 128)"/>
+    <use href="#cells" transform="rotate(150 128 128)"/>
+    <use href="#cells" transform="rotate(180 128 128)"/>
+    <use href="#cells" transform="rotate(240 128 128)"/>
+    <use href="#cells" transform="rotate(300 128 128)"/>
+    <use href="#cells" transform="rotate(330 128 128)"/>
+  </g>
+  <!-- caught cells: primary + secondary detection lights -->
+  <path d="M128 24 A104 104 0 0 1 154.9 27.5" transform="rotate(270 128 128)"
+        fill="none" stroke="#FF7A1A" stroke-width="6" stroke-linecap="round" filter="url(#glow)"/>
+  <path d="M128 24 A104 104 0 0 1 154.9 27.5" transform="rotate(120 128 128)"
+        fill="none" stroke="#FF7A1A" stroke-width="6" stroke-linecap="round" opacity="0.7" filter="url(#glow)"/>
+  <path d="M128 24 A104 104 0 0 1 154.9 27.5" transform="rotate(210 128 128)"
+        fill="none" stroke="#FFB020" stroke-width="6" stroke-linecap="round" opacity="0.55" filter="url(#glow)"/>
+
+  <!-- middle ring, brighter -->
+  <circle cx="128" cy="128" r="74" stroke="#6B7EB0" stroke-width="3" fill="none" stroke-dasharray="2 10" stroke-linecap="round"/>
+
+  <!-- detection dots on the middle ring -->
+  <g filter="url(#dotglow)">
+    <circle cx="182" cy="77.5" r="4" fill="#FF7A1A"/>
+    <circle cx="63" cy="171" r="3.2" fill="#FFB020" opacity="0.85"/>
+    <circle cx="128" cy="202" r="2.6" fill="#FF7A1A" opacity="0.7"/>
+  </g>
+
+  <!-- scan beam toward the caught cell (pointing left) -->
+  <path d="M118 128 L38 108 L38 148 Z" fill="url(#beamL)"/>
+
+  <!-- iris -->
+  <circle cx="128" cy="128" r="46" stroke="#E8EDF7" stroke-width="5" fill="#0A0E1A"/>
+
+  <!-- terminal cursor pupil -->
+  <rect x="113" y="106" width="30" height="44" rx="4" fill="#FF7A1A" filter="url(#glow)"/>
+</svg>

panopticon_mcp-1.0.0/.github/workflows/audit.yml

@@ -0,0 +1,13 @@
+name: dependency-audit
+on:
+  schedule: [{ cron: "0 3 * * 1" }]
+  workflow_dispatch:
+permissions:
+  contents: read
+jobs:
+  osv:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803
+      - uses: google/osv-scanner-action/osv-scanner-action@6e4298ebc4db23e847df9b2e2de2939d6f066c67
+        with: { scan-args: "--lockfile=uv.lock" }

panopticon_mcp-1.0.0/.github/workflows/ci.yml

@@ -0,0 +1,71 @@
+name: ci
+on:
+  push: { branches: [main] }
+  pull_request:
+  schedule:
+    - cron: "17 3 * * *"
+permissions:
+  contents: read
+jobs:
+  lint-type:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+      - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
+      - run: uv sync --all-extras
+      - run: uv run ruff check . && uv run ruff format --check .
+      - run: uv run mypy
+      - run: uv run mypy --strict tests/unit/engine
+      - run: uv run mypy --strict scripts/check_rules.py
+      - run: uv run mypy --strict scripts/check_engine_loc.py scripts/check_no_excuse_rules.py
+      - run: uv run python scripts/check_no_excuse_rules.py tests/unit/engine scripts/check_rules.py
+      - run: uv run python scripts/check_engine_loc.py  # 250 pure LOC maximum
+      - run: uv run python scripts/validate_schemas.py
+      - run: uv run python scripts/check_i18n.py
+      - run: uv run python scripts/check_phrases.py
+      - run: uv run python scripts/check_rules.py
+      - run: uv run python scripts/check_persistence_boundary.py
+  test:
+    strategy:
+      matrix:
+        os: [ubuntu-latest, macos-latest]
+        py: ["3.11", "3.12"]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+      - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
+        with: { python-version: "${{ matrix.py }}" }
+      - run: uv sync --all-extras
+      - run: uv run pytest -m "not docker and not network" --cov --cov-report=xml
+      - uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v5
+        if: matrix.os == 'ubuntu-latest' && matrix.py == '3.12'
+        with: { files: coverage.xml }
+  test-docker:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+      - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
+      - run: uv sync --all-extras
+      - run: make images images-podman
+      - run: uv run pytest -m docker
+  self-scan:
+    # E16: run our own analyze line on this repository.
+    runs-on: ubuntu-latest
+    if: github.event_name != 'pull_request'
+    permissions:
+      contents: read
+      security-events: write
+    steps:
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+      - id: scan
+        uses: ./
+        with:
+          path: .
+          mode: quick
+          sarif: pano.sarif
+          fail-on: never
+      - uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4
+        if: always()
+        with:
+          sarif_file: pano.sarif
+          category: panopticon-self-scan

panopticon_mcp-1.0.0/.github/workflows/images.yml

@@ -0,0 +1,118 @@
+name: publish-sandbox-images
+
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  publish:
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803
+      - uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130
+      - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f
+      - uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Publish base image
+        id: base
+        uses: docker/build-push-action@1104d471370f9806843c095c1db02b5a90c5f8b6
+        with:
+          context: src/panopticon/sandbox/images
+          file: src/panopticon/sandbox/images/base.Dockerfile
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: ghcr.io/brnyxx/pano-sandbox-base:0.1
+          provenance: mode=max
+          sbom: true
+      - name: Publish Node 20 image
+        id: node20
+        uses: docker/build-push-action@1104d471370f9806843c095c1db02b5a90c5f8b6
+        with:
+          context: src/panopticon/sandbox/images
+          file: src/panopticon/sandbox/images/node.Dockerfile
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: ghcr.io/brnyxx/pano-sandbox-node:20
+          build-args: BASE_IMAGE=ghcr.io/brnyxx/pano-sandbox-base@${{ steps.base.outputs.digest }}
+          provenance: mode=max
+          sbom: true
+      - name: Publish Node 22 image
+        id: node22
+        uses: docker/build-push-action@1104d471370f9806843c095c1db02b5a90c5f8b6
+        with:
+          context: src/panopticon/sandbox/images
+          file: src/panopticon/sandbox/images/node.Dockerfile
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: ghcr.io/brnyxx/pano-sandbox-node:22
+          build-args: |
+            BASE_IMAGE=ghcr.io/brnyxx/pano-sandbox-base@${{ steps.base.outputs.digest }}
+            NODE_IMAGE=node:22-bookworm-slim@sha256:83f487e0a63425e5b4d146fb5e5be574bcbe1b7b843d3ebafdd95eaf7767a7e5
+          provenance: mode=max
+          sbom: true
+      - name: Publish Python 3.12 image
+        id: python312
+        uses: docker/build-push-action@1104d471370f9806843c095c1db02b5a90c5f8b6
+        with:
+          context: src/panopticon/sandbox/images
+          file: src/panopticon/sandbox/images/python.Dockerfile
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: ghcr.io/brnyxx/pano-sandbox-python:3.12
+          provenance: mode=max
+          sbom: true
+      - name: Verify immutable manifests and tool versions
+        shell: bash
+        env:
+          BASE_DIGEST: ${{ steps.base.outputs.digest }}
+          NODE20_DIGEST: ${{ steps.node20.outputs.digest }}
+          NODE22_DIGEST: ${{ steps.node22.outputs.digest }}
+          PYTHON312_DIGEST: ${{ steps.python312.outputs.digest }}
+        run: |
+          set -euo pipefail
+          docker buildx imagetools inspect "ghcr.io/brnyxx/pano-sandbox-base@$BASE_DIGEST"
+          docker buildx imagetools inspect "ghcr.io/brnyxx/pano-sandbox-node@$NODE20_DIGEST"
+          docker buildx imagetools inspect "ghcr.io/brnyxx/pano-sandbox-node@$NODE22_DIGEST"
+          docker buildx imagetools inspect "ghcr.io/brnyxx/pano-sandbox-python@$PYTHON312_DIGEST"
+          docker run --rm --platform linux/amd64 --entrypoint node "ghcr.io/brnyxx/pano-sandbox-node@$NODE20_DIGEST" --version
+          docker run --rm --platform linux/arm64 --entrypoint node "ghcr.io/brnyxx/pano-sandbox-node@$NODE22_DIGEST" --version
+          docker run --rm --platform linux/amd64 --entrypoint python "ghcr.io/brnyxx/pano-sandbox-python@$PYTHON312_DIGEST" --version
+          docker run --rm --platform linux/amd64 --entrypoint uv "ghcr.io/brnyxx/pano-sandbox-python@$PYTHON312_DIGEST" --version
+      - name: Record immutable publication digests
+        shell: bash
+        env:
+          BASE_DIGEST: ${{ steps.base.outputs.digest }}
+          NODE20_DIGEST: ${{ steps.node20.outputs.digest }}
+          NODE22_DIGEST: ${{ steps.node22.outputs.digest }}
+          PYTHON312_DIGEST: ${{ steps.python312.outputs.digest }}
+          PANO_COMMIT: ${{ github.sha }}
+        run: |
+          python - <<'PY'
+          import json
+          import os
+          from pathlib import Path
+
+          payload = {
+              "commit": os.environ["PANO_COMMIT"],
+              "ghcr.io/brnyxx/pano-sandbox-base:0.1": os.environ["BASE_DIGEST"],
+              "ghcr.io/brnyxx/pano-sandbox-node:20": os.environ["NODE20_DIGEST"],
+              "ghcr.io/brnyxx/pano-sandbox-node:22": os.environ["NODE22_DIGEST"],
+              "ghcr.io/brnyxx/pano-sandbox-python:3.12": os.environ["PYTHON312_DIGEST"],
+          }
+          Path("image-digests.json").write_text(
+              json.dumps(payload, sort_keys=True, separators=(",", ":")) + "\n",
+              encoding="utf-8",
+          )
+          PY
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        with:
+          name: sandbox-image-digests
+          path: image-digests.json

panopticon_mcp-1.0.0/.github/workflows/platform.yml

@@ -0,0 +1,99 @@
+name: platform-evidence
+
+on:
+  workflow_dispatch:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  probe:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - label: darwin-arm64
+            runs-on: macos-14
+          - label: darwin-x86_64
+            runs-on: macos-15-intel
+          - label: linux-amd64
+            runs-on: ubuntu-24.04
+          - label: linux-arm64
+            runs-on: ubuntu-24.04-arm
+          - label: windows-x64
+            runs-on: windows-2025
+    runs-on: ${{ matrix.runs-on }}
+    name: probe-${{ matrix.label }}
+    permissions:
+      contents: read
+      id-token: write
+      attestations: write
+    steps:
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803
+      - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78
+      - name: Install test dependencies
+        run: uv sync --all-extras
+      - name: Build local sandbox image
+        if: startsWith(matrix.label, 'linux-')
+        run: make images
+      - name: Probe platform
+        shell: bash
+        env:
+          PANO_PLATFORM_LABEL: ${{ matrix.label }}
+          PANO_COMMIT: ${{ github.sha }}
+        run: uv run python scripts/platform_probe.py --label "$PANO_PLATFORM_LABEL" --commit "$PANO_COMMIT" --output "evidence/$PANO_PLATFORM_LABEL.json"
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        if: always()
+        with:
+          name: platform-${{ matrix.label }}
+          path: evidence/${{ matrix.label }}.json
+      - uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a
+        with:
+          subject-path: evidence/${{ matrix.label }}.json
+
+  probe-wsl2:
+    runs-on: windows-2025
+    permissions:
+      contents: read
+      id-token: write
+      attestations: write
+    steps:
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803
+      - name: Probe hosted WSL2
+        shell: pwsh
+        env:
+          PANO_COMMIT: ${{ github.sha }}
+          PANO_WORKSPACE: ${{ github.workspace }}
+        run: ./scripts/run_wsl2_probe.ps1 -Commit "$env:PANO_COMMIT" -Workspace "$env:PANO_WORKSPACE"
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        if: always()
+        with:
+          name: platform-wsl2-x64
+          path: evidence/wsl2-x64.json
+      - uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a
+        with:
+          subject-path: evidence/wsl2-x64.json
+
+  validate:
+    needs: [probe, probe-wsl2]
+    if: always()
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+      attestations: read
+    steps:
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803
+      - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
+        with:
+          pattern: platform-*
+          path: evidence
+          merge-multiple: true
+      - name: Validate exact platform matrix
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PANO_COMMIT: ${{ github.sha }}
+          PANO_REPOSITORY: ${{ github.repository }}
+        run: uv run --no-project python scripts/run_platform_matrix.py --require darwin-arm64,darwin-x86_64,linux-amd64,linux-arm64,windows-x64,wsl2-x64 --evidence-dir evidence --commit "$PANO_COMMIT" --github-repo "$PANO_REPOSITORY"