lock sha/digest POC#2410

Draft

maxandersen wants to merge 16 commits intojbangdev:mainfrom

maxandersen:lockfeature2

Commits on Feb 23, 2026

feat(lock): phase 1 checksum verify and basic lockfile enforcement
maxandersen
committed
feat(lock): add lock command and source manifest entries
maxandersen
committed
feat(lock): enforce locked source manifest matching in run
maxandersen
committed
fix(lock): treat bare #suffix as sha256 checksum prefix
maxandersen
committed
feat(lock): record and enforce transitive dependency graph in lock
maxandersen
committed
test(lock): add lockfile edge-case coverage for missing entries
maxandersen
committed
test(lock): add drift edge-case checks for locked sources and deps
maxandersen
committed
docs(lock): add locking guide and CLI help pages
maxandersen
committed
feat(lock): use locked source manifest as include-source override
maxandersen
committed
feat(lock): finalize lock modes and local-file lock defaults
maxandersen
committed
feat(lock): add per-artifact dependency digest recording and verification
maxandersen
committed
refactor(lock): clean imports and polish lock verification flow
maxandersen
committed
refactor(lock): remove remaining fully-qualified type usages
maxandersen
committed
ux(lock): improve security-focused mismatch errors with fix guidance
maxandersen
committed
fix(help): include lock command in help sections mapping
maxandersen
committed

Commits on Feb 24, 2026

fix(native-image): add dev.jbang.cli.Lock to reachability metadata
maxandersen
committed