feat: add trust and expiry annotations to scan, inspect, and WASM - #57

Merged

danielewood merged 12 commits into

mainfrom

feat/trust-annotations

Feb 21, 2026

Commits on Feb 21, 2026

feat: add trust and expiry annotations to scan summary, inspect, and WASM

danielewood
and
claude
committed
fix: strengthen trust verification, fix WASM race and error handling

danielewood
and
claude
committed
fix: harden AIA fetchers against SSRF and context cancellation

danielewood
and
claude
committed
fix: return copy from AllKeys, extract certAnnotation, add --out-file completion

danielewood
and
claude
committed
test: strengthen trust/expiry assertions across all test suites

danielewood
and
claude
committed
fix: prevent expired+untrusted double-counting in scan summary

danielewood
and
claude
committed
chore: add missing PR refs to CHANGELOG entries

danielewood
and
claude
committed
fix: close SSRF bypass, WASM panic, callback leak, and test gaps

danielewood
and
claude
committed
fix: harden SSRF, WASM deadlock, memory leaks, and nil-roots fallback

danielewood
and
claude
committed
fix: harden error handling, WASM safety, and test coverage gaps

danielewood
and
claude
committed
docs: document accepted risks for DNS rebinding and shared map

danielewood
and
claude
committed
fix: address review findings — CS-5, ERR-1, ERR-5 compliance

danielewood
and
claude
committed