[SG-4885] feat(platform): tirith platform check — a pre-plan policy step, no platform changes

.github/workflows/lint.yml

@@ -15,3 +15,11 @@ jobs:
         with:
           options: "--check"
           src: "."
+          # Pinned. `psf/black@stable` resolves to whatever Black is newest at the time the job runs,
+          # so a Black release reformats the world and this check goes red on every open branch with
+          # nothing in the repository having changed. That is what happened here: main last passed
+          # this job in November 2025 and fails it today, on 14 files nobody touched.
+          #
+          # 25.1.0 is the release the tree is actually formatted for -- verified by running it against
+          # origin/main, which comes back clean. Bump it deliberately, in a commit that reformats.
+          version: "25.1.0"

CHANGELOG.md

@@ -6,6 +6,52 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 
+
+
+## [1.2.0] - 2026-08-03
+
+### Added
+- `tirith platform check`: run an organization's policies against a plan, state or arbitrary JSON
+  document from CI or a laptop. Masks the document locally, packs it with the terraform source into
+  an archive, uploads it, creates a StackGuardian run, polls it and reports the verdict as JSON
+  and/or markdown. The uploaded bundle carries the source under `code/` and a `metadata.json`
+  describing the repository, the commit and where in the repository `code/` belongs.
+- `--fail-on-error` on the local surface too, so evaluating policy files without an account can gate
+  a merge. Off by default: the local form has always exited 0 either way, and changing that silently
+  would turn existing green pipelines red.
+- `ExitStatus.ERROR_POLICY_FAILED` (3), so a caller can tell "a policy said no" from "tirith could
+  not tell you". Both surfaces use the same code for the same meaning. Note this applies **only**
+  with `--fail-on-error`; without it the local form still exits 0 for everything, including a policy
+  it could not evaluate.
+
+### Changed
+- `cli.main(args=...)` is now honoured. It previously called `parse_args()` with no argument, so
+  the parameter was ignored and the CLI could only ever read `sys.argv`.
+
+### Notes
+- The local evaluation surface is unchanged, including its single-dash long options. Subcommands
+  are dispatched before the flat parser sees anything, so `--json` output stays byte-identical.
+- No new runtime dependencies: the platform integration is stdlib-only.
+
+## [1.1.0] - 2026-08-01
+
+### Added
+- `core`: Policy metadata passthrough — `meta.id`, `meta.name`, `meta.description`,
+  `meta.severity`, `meta.enforcement`, `meta.tags` and `meta.remediation` now reach the result
+  document when a policy declares them. Keys that are absent are omitted, so the output of a
+  policy declaring none of them is unchanged. `{{ var.x }}` substitution works in all of them.
+
+### Fixed
+- `core`: Variable substitution no longer mutates the caller's policy dictionary. Evaluating the
+  same parsed policy more than once (a policy set, or a retry) previously leaked substituted
+  values from one evaluation into the next.
+- `core`: An unsupported `condition.type` now populates `result` instead of returning without it,
+  which raised `KeyError` in the pretty printer far from the real cause.
+- `core`: Provider errors reported without a `ProviderError` severity are now surfaced instead of
+  being discarded and `None` evaluated against the condition — a typo'd `operation_type` read as
+  a genuine policy violation. These are treated as malformed provider calls and are deliberately
+  not subject to `error_tolerance`.
+
 ## [1.0.5] - 2025-11-19
 
 ### Fixed