plugin-scanner 3.7.2__tar.gz → 3.7.3__tar.gz

{plugin_scanner-3.7.2 → plugin_scanner-3.7.3}/.github/workflows/desktop-core-alpha-feed.yml

@@ -10,6 +10,7 @@ on:
       - tests/test_seal_pyinstaller_native_manifest.py
       - scripts/release/desktop_core_alpha_feed.py
       - scripts/release/authorize_macos_core_source.sh
+      - scripts/release/read_publish_attestation_commit.py
       - scripts/release/stage_native_runtime_for_desktop_core.py
       - scripts/release/seal_pyinstaller_native_manifest.py
       - scripts/release/fix_pyinstaller_macos_exe_headers.py
@@ -21,6 +22,7 @@ on:
       - .github/workflows/desktop-core-alpha-feed.yml
       - scripts/release/desktop_core_alpha_feed.py
       - scripts/release/authorize_macos_core_source.sh
+      - scripts/release/read_publish_attestation_commit.py
       - scripts/release/stage_native_runtime_for_desktop_core.py
       - scripts/release/seal_pyinstaller_native_manifest.py
       - scripts/release/fix_pyinstaller_macos_exe_headers.py

{plugin_scanner-3.7.2 → plugin_scanner-3.7.3}/.github/workflows/desktop-core-linux-feed.yml

@@ -167,8 +167,24 @@ jobs:
               --deny-self-hosted-runners >/dev/null
           }
           # Release Please attests the tag. A manual stable dispatch attests main.
+          # A repair dispatch attests the later main commit that checked out this tag.
           if ! verify_published_wheel "refs/tags/${CORE_TAG}"; then
-            verify_published_wheel "refs/heads/${RELEASE_BRANCH}"
+            if ! verify_published_wheel "refs/heads/${RELEASE_BRANCH}"; then
+              attested_commit=$(python3 -I scripts/release/read_publish_attestation_commit.py \
+                "$BUNDLE" "refs/heads/${RELEASE_BRANCH}")
+              [[ "$attested_commit" =~ ^[0-9a-f]{40}$ ]]
+              git -C "$TRUST_REPO" fetch --force --no-recurse-submodules origin \
+                "+${attested_commit}:refs/repair-attested"
+              git -C "$TRUST_REPO" merge-base --is-ancestor "$SOURCE_SHA" "$attested_commit"
+              gh attestation verify "$WHEEL" \
+                --repo "$GITHUB_REPOSITORY" \
+                --bundle "$BUNDLE" \
+                --signer-workflow "$GITHUB_REPOSITORY/.github/workflows/publish.yml" \
+                --signer-digest "$attested_commit" \
+                --source-digest "$attested_commit" \
+                --source-ref "refs/heads/${RELEASE_BRANCH}" \
+                --deny-self-hosted-runners >/dev/null
+            fi
           fi
           cp "$WHEEL" "$RUNNER_TEMP/attested-linux-x64.whl"
           test -f "$RUNNER_TEMP/attested-linux-x64.whl"

{plugin_scanner-3.7.2 → plugin_scanner-3.7.3}/.github/workflows/publish.yml

@@ -107,6 +107,7 @@ jobs:
       channel: ${{ steps.version.outputs.channel }}
       release_train: ${{ steps.version.outputs.release_train }}
       source_sha: ${{ steps.version.outputs.source_sha }}
+      release_repair: ${{ steps.version.outputs.release_repair }}
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
         with:
@@ -222,9 +223,37 @@ jobs:
                 '$pypi + $testpypi + ($tags | map(select(. != $candidate))) | unique')
               EXPECTED_VERSION=$(uv run --no-sync python scripts/compute_main_release_version.py \
                 --base-version "$BASE_VERSION" <<< "$VERSIONS")
+              REPAIRING=false
               if [[ "$RELEASE_VERSION" != "$EXPECTED_VERSION" ]]; then
-                echo "Stable release version must match the next registry-derived version: ${EXPECTED_VERSION}" >&2
-                exit 1
+                LATEST_PYPI=$(uv run --no-sync python scripts/compute_main_release_version.py \
+                  --base-version "$BASE_VERSION" --latest-existing <<< "$PYPI_VERSIONS")
+                ASSET_NAMES_FILE=$(mktemp)
+                RELEASE_VIEW_ERROR=$(mktemp)
+                if gh release view "v${RELEASE_VERSION}" --repo "$GITHUB_REPOSITORY" --json assets \
+                  --jq '.assets[].name' > "$ASSET_NAMES_FILE" 2>"$RELEASE_VIEW_ERROR"; then
+                  REPAIR_ARGS=(--asset-names-file "$ASSET_NAMES_FILE")
+                elif grep -q "release not found" "$RELEASE_VIEW_ERROR"; then
+                  REPAIR_ARGS=(--release-missing)
+                else
+                  echo "Could not inspect the GitHub release for ${RELEASE_VERSION}" >&2
+                  exit 1
+                fi
+                if ! uv run --no-sync python scripts/stable_release_asset_repair.py \
+                  --requested "$RELEASE_VERSION" \
+                  --expected-next "$EXPECTED_VERSION" \
+                  --latest-pypi "$LATEST_PYPI" \
+                  "${REPAIR_ARGS[@]}"; then
+                  echo "Stable release version must match the next registry-derived version: ${EXPECTED_VERSION}" >&2
+                  exit 1
+                fi
+                git fetch --force --no-tags origin "+refs/tags/v${RELEASE_VERSION}:refs/tags/v${RELEASE_VERSION}"
+                SOURCE_SHA=$(git rev-parse "v${RELEASE_VERSION}^{commit}")
+                if ! git merge-base --is-ancestor "$SOURCE_SHA" HEAD; then
+                  echo "Published release is not an ancestor of this dispatch" >&2
+                  exit 1
+                fi
+                echo "release_repair=true" >> "$GITHUB_OUTPUT"
+                REPAIRING=true
               fi
               if git rev-parse -q --verify "v${RELEASE_VERSION}^{commit}" >/dev/null; then
                 tag_sha=$(git rev-parse "v${RELEASE_VERSION}^{commit}")
@@ -234,6 +263,10 @@ jobs:
                 fi
               fi
               VERSION="$RELEASE_VERSION"
+              if [[ "$REPAIRING" == "true" ]]; then
+                git checkout --detach "$SOURCE_SHA"
+                uv sync --frozen --extra dev --extra publish --extra cisco
+              fi
             else
               echo "Unsupported release channel and train: ${CHANNEL}:${TRAIN}" >&2
               exit 1
@@ -491,7 +524,7 @@ jobs:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
         with:
           persist-credentials: false
-          ref: ${{ (github.event_name == 'pull_request' && github.event.pull_request.head.sha) || github.sha }}
+          ref: ${{ (github.event_name == 'pull_request' && github.event.pull_request.head.sha) || needs.build.outputs.source_sha }}
       - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
         with:
           name: distributions
@@ -1203,6 +1236,7 @@ jobs:
           SOURCE_SHA: ${{ needs.build.outputs.source_sha }}
           VERSION: ${{ needs.build.outputs.version }}
           GITHUB_REF: ${{ github.ref }}
+          RELEASE_REPAIR: ${{ needs.build.outputs.release_repair }}
         run: |
           git fetch --force origin refs/heads/main:refs/remotes/origin/main
           if [[ "$GITHUB_REF" == "refs/tags/v${VERSION}" ]]; then
@@ -1213,8 +1247,12 @@ jobs:
           else
             remote_main_sha=$(git ls-remote --exit-code origin refs/heads/main | awk '{print $1}')
             if [[ "$remote_main_sha" != "$SOURCE_SHA" ]]; then
-              echo "Main publication source is no longer the branch head" >&2
-              exit 1
+              if [[ "$RELEASE_REPAIR" == "true" ]] && git merge-base --is-ancestor "$SOURCE_SHA" origin/main && [[ "$(git rev-parse "v${VERSION}^{commit}")" == "$SOURCE_SHA" ]]; then
+                :
+              else
+                echo "Main publication source is no longer the branch head" >&2
+                exit 1
+              fi
             fi
           fi
       - name: Inspect TestPyPI release state
@@ -1294,6 +1332,7 @@ jobs:
           SOURCE_SHA: ${{ needs.build.outputs.source_sha }}
           VERSION: ${{ needs.build.outputs.version }}
           GITHUB_REF: ${{ github.ref }}
+          RELEASE_REPAIR: ${{ needs.build.outputs.release_repair }}
         run: |
           git fetch --force origin refs/heads/main:refs/remotes/origin/main
           if [[ "$GITHUB_REF" == "refs/tags/v${VERSION}" ]]; then
@@ -1304,8 +1343,12 @@ jobs:
           else
             remote_main_sha=$(git ls-remote --exit-code origin refs/heads/main | awk '{print $1}')
             if [[ "$remote_main_sha" != "$SOURCE_SHA" ]]; then
-              echo "Stable tag source is no longer the main branch head" >&2
-              exit 1
+              if [[ "$RELEASE_REPAIR" == "true" ]] && git merge-base --is-ancestor "$SOURCE_SHA" origin/main && [[ "$(git rev-parse "v${VERSION}^{commit}")" == "$SOURCE_SHA" ]]; then
+                :
+              else
+                echo "Stable tag source is no longer the main branch head" >&2
+                exit 1
+              fi
             fi
           fi
           tag="v${VERSION}"
@@ -1553,6 +1596,8 @@ jobs:
           GH_TOKEN: ${{ github.token }}
           SOURCE_SHA: ${{ needs.build.outputs.source_sha }}
           VERSION: ${{ needs.build.outputs.version }}
+          RELEASE_REPAIR: ${{ needs.build.outputs.release_repair }}
+          GITHUB_SHA: ${{ github.sha }}
         run: |
           tag="v${VERSION}"
           git fetch --force --no-tags origin "+refs/tags/${tag}:refs/tags/${tag}"
@@ -1596,8 +1641,16 @@ jobs:
             remote_guard_files=("$existing_dir"/hol_guard-*)
             [[ "${#remote_guard_files[@]}" -gt 0 ]]
             for remote_file in "${remote_guard_files[@]}"; do
-              gh attestation verify "$remote_file" --repo "$GITHUB_REPOSITORY" \
-                --bundle "$bundle" --source-digest "$SOURCE_SHA" >/dev/null
+              if ! gh attestation verify "$remote_file" --repo "$GITHUB_REPOSITORY" \
+                --bundle "$bundle" --source-digest "$SOURCE_SHA" >/dev/null; then
+                if [[ "$RELEASE_REPAIR" != "true" ]]; then
+                  exit 1
+                fi
+                gh attestation verify "$remote_file" --repo "$GITHUB_REPOSITORY" \
+                  --bundle "$bundle" \
+                  --signer-workflow "$GITHUB_REPOSITORY/.github/workflows/publish.yml" \
+                  --source-digest "$GITHUB_SHA" >/dev/null
+              fi
             done
             exit 0
           fi

{plugin_scanner-3.7.2 → plugin_scanner-3.7.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 3.7.2
+Version: 3.7.3
 Summary: Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows.
 Project-URL: Homepage, https://hol.org/guard
 Project-URL: Security, https://hol.org/guard/security

{plugin_scanner-3.7.2 → plugin_scanner-3.7.3}/docs/guard/release-checklist.md

@@ -48,7 +48,7 @@ Guard uses two isolated release lines:
 2. The `Release Please` workflow opens or updates a `chore(release): <version>` pull request with changelog and version metadata.
 3. Merge that pull request when the batch is ready. Merging it tags the release commit and dispatches `Publish to PyPI` for `release_channel=stable` and `release_train=main`.
 4. Confirm the dispatched publish builds native wheels, uploads to PyPI, and creates the GitHub release assets.
-5. Maintainers can still dispatch `Publish to PyPI` from `main`, or from the existing `v<version>` tag if `main` has moved, with the exact version and `expected_sha`.
+5. Maintainers can still dispatch `Publish to PyPI` from `main` with the exact version. The normal target is the next registry-derived version. A fresh dispatch of the latest published version is accepted only when that version's GitHub release is missing its wheels or provenance bundle; the workflow builds that repair from the existing tag. A complete release is not republished, and an older version is not replayed. Workflow reruns are denied.
 
 Normal pushes to `main` still build and verify packages without publishing.
 

{plugin_scanner-3.7.2 → plugin_scanner-3.7.3}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "3.7.2"
+version = "3.7.3"
 description = "Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-3.7.2 → plugin_scanner-3.7.3}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "3.7.2"
+version = "3.7.3"
 description = "Open-source antivirus and runtime protection for AI agents, tools, MCP servers, plugins, skills, and package installs."
 readme = "README.md"
 license = "Apache-2.0"

plugin_scanner-3.7.2/release-metadata/plugin-scanner-v3.7.2.toolchain.cdx.json → plugin_scanner-3.7.3/release-metadata/plugin-scanner-v3.7.3.toolchain.cdx.json

@@ -27,7 +27,7 @@
     "component": {
       "name": "hol-guard-release-toolchain",
       "type": "application",
-      "version": "3.7.2"
+      "version": "3.7.3"
     }
   },
   "specVersion": "1.6",

{plugin_scanner-3.7.2 → plugin_scanner-3.7.3}/scripts/release/authorize_macos_core_source.sh

@@ -53,8 +53,24 @@ verify_published_wheel() {
     --deny-self-hosted-runners >/dev/null
 }
 # Release Please attests the tag. A manual stable dispatch attests main.
+# A repair dispatch attests the later main commit that checked out this tag.
 if ! verify_published_wheel "refs/tags/${CORE_TAG}"; then
-  verify_published_wheel "refs/heads/${RELEASE_BRANCH}"
+  if ! verify_published_wheel "refs/heads/${RELEASE_BRANCH}"; then
+    attested_commit=$(python3 -I scripts/release/read_publish_attestation_commit.py \
+      "$BUNDLE" "refs/heads/${RELEASE_BRANCH}")
+    [[ "$attested_commit" =~ ^[0-9a-f]{40}$ ]]
+    git -C "$TRUST_REPO" fetch --force --no-recurse-submodules origin \
+      "+${attested_commit}:refs/repair-attested"
+    git -C "$TRUST_REPO" merge-base --is-ancestor "$SOURCE_SHA" "$attested_commit"
+    gh attestation verify "$WHEEL" \
+      --repo "$GITHUB_REPOSITORY" \
+      --bundle "$BUNDLE" \
+      --signer-workflow "$GITHUB_REPOSITORY/.github/workflows/publish.yml" \
+      --signer-digest "$attested_commit" \
+      --source-digest "$attested_commit" \
+      --source-ref "refs/heads/${RELEASE_BRANCH}" \
+      --deny-self-hosted-runners >/dev/null
+  fi
 fi
 cp "$WHEEL" "$RUNNER_TEMP/attested-macos-arm64.whl"
 test -f "$RUNNER_TEMP/attested-macos-arm64.whl"

plugin_scanner-3.7.3/scripts/release/read_publish_attestation_commit.py

@@ -0,0 +1,37 @@
+#!/usr/bin/env python3
+"""Print the main commit attested by a publish-workflow provenance bundle."""
+
+from __future__ import annotations
+
+import base64
+import json
+import sys
+
+
+def main(argv: list[str] | None = None) -> int:
+    args = list(sys.argv[1:] if argv is None else argv)
+    if len(args) != 2:
+        print("usage: read_publish_attestation_commit.py BUNDLE EXPECTED_REF", file=sys.stderr)
+        return 2
+    bundle_path, expected_ref = args
+    document = json.loads(open(bundle_path, encoding="utf-8").readline())
+    payload = json.loads(base64.b64decode(document["dsseEnvelope"]["payload"]))
+    build = payload["predicate"]["buildDefinition"]
+    workflow = build["externalParameters"]["workflow"]
+    digest = build["resolvedDependencies"][0]["digest"]["gitCommit"]
+    if workflow.get("path") != ".github/workflows/publish.yml":
+        raise SystemExit("provenance workflow is not the publish workflow")
+    if workflow.get("ref") != expected_ref:
+        raise SystemExit("provenance ref is not the release branch")
+    if (
+        not isinstance(digest, str)
+        or len(digest) != 40
+        or any(char not in "0123456789abcdef" for char in digest)
+    ):
+        raise SystemExit("provenance commit is not a commit sha")
+    print(digest)
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

{plugin_scanner-3.7.2 → plugin_scanner-3.7.3}/scripts/retry_verify_published.py

@@ -15,7 +15,17 @@ SLEEP_SECONDS = 5.0
 VERIFY_SCRIPT = Path(__file__).with_name("verify_native_runtime_release.py")
 
 
+# PyPI can show a release to one read and hide it from the next while the
+# upload is still propagating. Those states are incomplete, not a byte mismatch.
+_PROPAGATION_ERRORS = (
+    "Registry release is absent",
+    "Base Guard release is not present yet",
+)
+
+
 def is_retryable_incomplete_error(stderr: str) -> bool:
+    if any(message in stderr for message in _PROPAGATION_ERRORS):
+        return True
     return "missing=" in stderr and "extra=[]" in stderr and "mismatched=[]" in stderr
 
 
@@ -27,9 +37,7 @@ def wait_for_published(
     runner: Callable[[Sequence[str]], subprocess.CompletedProcess[str]] | None = None,
     sleeper: Callable[[float], None] = time.sleep,
 ) -> int:
-    run = runner or (
-        lambda command: subprocess.run(command, check=False, capture_output=True, text=True)
-    )
+    run = runner or (lambda command: subprocess.run(command, check=False, capture_output=True, text=True))
     command = [sys.executable, str(VERIFY_SCRIPT), "verify-published", *argv]
     last_error = "Published artifacts were not exact"
     for attempt in range(attempts):

plugin_scanner-3.7.3/scripts/stable_release_asset_repair.py

@@ -0,0 +1,88 @@
+#!/usr/bin/env python3
+"""Allow a stable dispatch to finish a published release whose GitHub files are missing.
+
+The next registry version remains the normal path. A dispatch of the latest
+PyPI version is accepted only when that version's GitHub release cannot yet
+supply the Desktop updater: the pure wheel, the macOS arm64 wheel, or the
+publish provenance bundle is absent. A complete release is not republished.
+"""
+
+from __future__ import annotations
+
+import argparse
+import sys
+from collections.abc import Iterable
+from pathlib import Path
+
+# Keep aligned with verify_native_runtime_release.EXPECTED_TARGETS. Stable
+# versions are canonical X.Y.Z; wheel tags still use PEP 427's dash-to-underscore
+# normalization so a pre-release form cannot miss its filename.
+_NATIVE_PLATFORM_TAGS = (
+    "manylinux_2_17_x86_64",
+    "macosx_13_0_x86_64",
+    "macosx_11_0_arm64",
+    "win_amd64",
+)
+
+
+def _required_release_assets(version: str) -> set[str]:
+    wheel_version = version.replace("-", "_")
+    required = {
+        f"hol_guard-{wheel_version}-py3-none-any.whl",
+        f"hol_guard-{version}.tar.gz",
+        f"hol-guard-v{version}.intoto.jsonl",
+    }
+    required.update(
+        f"hol_guard-{wheel_version}-py3-none-{platform}.whl" for platform in _NATIVE_PLATFORM_TAGS
+    )
+    return required
+
+
+def github_release_needs_asset_repair(version: str, asset_names: Iterable[str]) -> bool:
+    names = {name.strip() for name in asset_names if name.strip()}
+    return not _required_release_assets(version).issubset(names)
+
+
+def stable_dispatch_is_allowed(
+    *,
+    requested: str,
+    expected_next: str,
+    latest_pypi: str,
+    asset_names: Iterable[str] = (),
+    release_missing: bool = False,
+) -> bool:
+    if requested == expected_next:
+        return True
+    if not latest_pypi or requested != latest_pypi:
+        return False
+    if release_missing:
+        return True
+    return github_release_needs_asset_repair(requested, asset_names)
+
+
+def _asset_names(path: Path | None) -> tuple[str, ...]:
+    if path is None:
+        return ()
+    return tuple(path.read_text(encoding="utf-8").splitlines())
+
+
+def main(argv: list[str] | None = None) -> int:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--requested", required=True)
+    parser.add_argument("--expected-next", required=True)
+    parser.add_argument("--latest-pypi", default="")
+    parser.add_argument("--asset-names-file", type=Path)
+    parser.add_argument("--release-missing", action="store_true")
+    args = parser.parse_args(argv)
+    allowed = stable_dispatch_is_allowed(
+        requested=args.requested,
+        expected_next=args.expected_next,
+        latest_pypi=args.latest_pypi,
+        asset_names=_asset_names(args.asset_names_file),
+        release_missing=bool(args.release_missing),
+    )
+    return 0 if allowed else 1
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

{plugin_scanner-3.7.2 → plugin_scanner-3.7.3}/src/codex_plugin_scanner/guard/native_policy_snapshot_publisher.py

@@ -37,6 +37,16 @@ def _snapshot_api() -> Any:
     return native_policy_snapshot
 
 
+def _same_resident_paths(left, right) -> bool:
+    """True when the resident file set is unchanged.
+
+    Matching paths with new mtimes are hook traffic, not a new resident.
+    A restart adds or removes a generation path and must withdraw Watch.
+    """
+
+    return {path for path, _mtime, _size in left} == {path for path, _mtime, _size in right}
+
+
 class NativePolicySnapshotPublisher(NativePolicySnapshotPublisherInputs):
     """Asynchronously publish an authenticated snapshot and expose its barrier."""
 
@@ -69,6 +79,7 @@ class NativePolicySnapshotPublisher(NativePolicySnapshotPublisherInputs):
         self._published_config_digest: str | None = None
         self._published_policy_fingerprint: tuple[str, str, str] | None = None
         self._observed_policy_fingerprint: tuple[str, str, str] | None = None
+        self._observe_extension_refresh = False
         self._renewal_due_monotonic: float | None = None
         self._renewal_after_generation: int | None = None
         self._retry_not_before_monotonic: float | None = None
@@ -143,6 +154,64 @@ class NativePolicySnapshotPublisher(NativePolicySnapshotPublisherInputs):
             self._condition.notify_all()
         self._publish_event.set()
 
+    def _queue_observe_republish(self) -> bool:
+        """Refresh an acknowledged Watch snapshot without opening a pause window.
+
+        ``request_publish`` drops readiness first. That is required when
+        enforcement might strengthen, and it is how a hook storm turns Watch
+        into a fresh-approval deadlock: each resident-file or command-control
+        update withdraws the snapshot, the next review pauses, and the pause
+        updates the same files again. Watch does not stop those reviews, so
+        keep serving the resident-validated observe snapshot until the refresh
+        commits.
+        """
+
+        with self._condition:
+            snapshot = self._snapshot
+            if self._closed or not self._acked or snapshot is None or snapshot.get("mode") != "observe":
+                return False
+            generation = snapshot.get("generation")
+            if not isinstance(generation, int) or generation <= 0:
+                return False
+            self._renewal_after_generation = generation
+            self._retry_not_before_monotonic = self._monotonic_clock()
+            self._failure_count = 0
+        self._publish_event.set()
+        return True
+
+    def _republish_preserving_watch(self) -> None:
+        if not self._queue_observe_republish():
+            self.request_publish()
+
+    def _accept_resident_fingerprint(self, fingerprint) -> None:
+        """Refresh Watch after resident metadata changes without hiding a policy edit.
+
+        Resident mtime churn and a config change can land in one poll. Keeping
+        the old observe snapshot in that case would let hooks run under Watch
+        after the installed policy moved to enforce. Policy-input changes that
+        are not an observe command-control refresh withdraw readiness first.
+        """
+
+        if self._input_fingerprint is None:
+            self._input_fingerprint = fingerprint
+            return
+        same_resident = _same_resident_paths(self._input_fingerprint[1], fingerprint[1])
+        previous_inputs = dict(self._input_fingerprint[0])
+        current_inputs = dict(fingerprint[0])
+        changed_paths = {
+            path
+            for path in previous_inputs.keys() | current_inputs.keys()
+            if previous_inputs.get(path) != current_inputs.get(path)
+        }
+        self._input_fingerprint = fingerprint
+        if changed_paths and self._policy_input_changed(changed_paths) and not self._observe_extension_refresh:
+            self.request_publish()
+            return
+        if same_resident:
+            self._republish_preserving_watch()
+            return
+        self.request_publish()
+
     notify_policy_changed = request_publish
 
     def register_workspace(self, workspace: Path | None) -> bool:
@@ -295,11 +364,7 @@ class NativePolicySnapshotPublisher(NativePolicySnapshotPublisherInputs):
             if self._input_fingerprint is None:
                 self._input_fingerprint = fingerprint
             elif fingerprint[1] != self._input_fingerprint[1]:
-                # Resident generation files are created on every managed
-                # restart. Re-push the last snapshot before a hook can rely
-                # on the replacement resident's in-memory policy.
-                self._input_fingerprint = fingerprint
-                self.request_publish()
+                self._accept_resident_fingerprint(fingerprint)
             elif fingerprint[0] != self._input_fingerprint[0]:
                 previous_inputs = dict(self._input_fingerprint[0])
                 current_inputs = dict(fingerprint[0])
@@ -310,11 +375,11 @@ class NativePolicySnapshotPublisher(NativePolicySnapshotPublisherInputs):
                 }
                 self._input_fingerprint = fingerprint
                 if self._policy_input_changed(changed_paths):
-                    self.request_publish()
+                    self._republish_preserving_watch()
             if self._monotonic_clock() >= self._reconcile_due_monotonic:
                 self._reconcile_due_monotonic = self._monotonic_clock() + 1.0
                 if self._policy_input_changed():
-                    self.request_publish()
+                    self._republish_preserving_watch()
             with self._condition:
                 if self._closed:
                     return
@@ -430,7 +495,7 @@ class NativePolicySnapshotPublisher(NativePolicySnapshotPublisherInputs):
             # A separate process may commit authority while the resident is
             # acknowledging this candidate. Re-read verified authority outside
             # the hook barrier and reject an ACK for the earlier controls.
-            if self._compiled_command_extensions() != command_extensions:
+            if self._compiled_command_extensions() != command_extensions and snapshot.get("mode") != "observe":
                 with self._condition:
                     self._acked = False
                 raise NativePolicySnapshotError("native_command_control_binding_changed")
@@ -448,6 +513,16 @@ class NativePolicySnapshotPublisher(NativePolicySnapshotPublisherInputs):
                     resident_generation,
                     resident_directory_fingerprint,
                 )
+                if (
+                    resident_fingerprint_confirmed is None
+                    and snapshot.get("mode") == "observe"
+                    and _same_resident_paths(resident_fingerprint_before, resident_fingerprint)
+                    and self._resident_fingerprint_matches_generation(resident_fingerprint, resident_generation)
+                ):
+                    # Hook reviews touch resident generation files while this
+                    # publish is in flight. Watch still matches the resident
+                    # that acknowledged the snapshot; do not drop it and pause.
+                    resident_fingerprint_confirmed = resident_fingerprint
                 if resident_fingerprint_confirmed is None:
                     self._acked = False
                     raise NativePolicySnapshotError("native_policy_snapshot_resident_changed")

{plugin_scanner-3.7.2 → plugin_scanner-3.7.3}/src/codex_plugin_scanner/guard/native_policy_snapshot_publisher_inputs.py

@@ -32,6 +32,7 @@ class NativePolicySnapshotPublisherInputs:
 
     store: GuardStore  # pyright: ignore[reportUninitializedInstanceVariable]
     _command_control_runtime: ExtensionControlRuntime | None = None
+    _observe_extension_refresh: bool = False
     guard_home: Path  # pyright: ignore[reportUninitializedInstanceVariable]
     _condition: Condition  # pyright: ignore[reportUninitializedInstanceVariable]
     _acked: bool  # pyright: ignore[reportUninitializedInstanceVariable]
@@ -291,7 +292,21 @@ class NativePolicySnapshotPublisherInputs:
         )
         self._observed_policy_fingerprint = current_fingerprint
         changed = force_republish or previous_fingerprint != current_fingerprint
-        if changed or current_fingerprint[0] == "unavailable":
+        # Command-control churn under Watch must republish, but it must not
+        # withdraw the resident-validated observe snapshot. Withdrawing it
+        # makes the next review pause, and that pause is what churns the
+        # controls again. Policy, mode, and unavailable inputs still withdraw.
+        self._observe_extension_refresh = bool(
+            changed
+            and not force_republish
+            and previous_fingerprint is not None
+            and current_fingerprint[0] not in {"", "unavailable"}
+            and previous_fingerprint[0] == current_fingerprint[0]
+            and previous_fingerprint[1] == "observe"
+            and current_fingerprint[1] == "observe"
+            and previous_fingerprint[2] != current_fingerprint[2]
+        )
+        if (changed or current_fingerprint[0] == "unavailable") and not self._observe_extension_refresh:
             # A verified state change invalidates the previous ACK immediately,
             # including WAL-only mutations. Do not leave a readiness window
             # between observation and the publisher's next push attempt.

plugin_scanner-3.7.3/src/codex_plugin_scanner/version.py

@@ -0,0 +1,3 @@
+"""Single source of truth for tool version."""
+
+__version__ = "3.7.3"  # x-release-please-version

{plugin_scanner-3.7.2 → plugin_scanner-3.7.3}/tests/test_desktop_core_alpha_feed_security.py

@@ -111,10 +111,19 @@ def test_privileged_feed_is_main_bound_and_pins_candidate_provenance() -> None:
     assert '--source-ref "$source_ref"' in provenance
     assert 'verify_published_wheel "refs/tags/${CORE_TAG}"' in provenance
     assert 'verify_published_wheel "refs/heads/${RELEASE_BRANCH}"' in provenance
+    assert "read_publish_attestation_commit.py" in provenance
+    assert 'merge-base --is-ancestor "$SOURCE_SHA" "$attested_commit"' in provenance
+    assert '--source-digest "$attested_commit"' in provenance
+    attestation = (ROOT / "scripts/release/read_publish_attestation_commit.py").read_text(
+        encoding="utf-8"
+    )
+    assert "provenance workflow is not the publish workflow" in attestation
     linux = linux_workflow_text()
     assert '--source-ref "$source_ref"' in linux
     assert 'verify_published_wheel "refs/tags/${CORE_TAG}"' in linux
     assert 'verify_published_wheel "refs/heads/${RELEASE_BRANCH}"' in linux
+    assert "read_publish_attestation_commit.py" in linux
+    assert '--source-digest "$attested_commit"' in linux
     assert "merge-base --is-ancestor" in linux
     assert "--deny-self-hosted-runners" in provenance