May 2, 2026 — 12 min — Platform & AI
Agent Repo Trust Gates: Conftest Policies, SLSA Provenance, and SBOM in GitHub Actions
Why standard code review misses capability escalation in skill manifests, and how to wire a pre-merge conftest policy gate and post-merge SLSA provenance chain that actually work — correcting three common mistakes in the recipes that circulate online.