# Attacks rewritten as mandates: what changed in v1.2.0, sgit.ai > The changes to the article "Attacks rewritten as mandates" in v1.2.0, paragraph by paragraph. *Source: · sgit.ai v0.7.87 · this file is generated from the same content as the page, so the two cannot drift. Every page on this site has a `.md` twin; internal links below point at them.* --- [Home](../../../index.md) / [Articles](../../index.md) / [Attacks rewritten as mandates](../../attacks-rewritten-as-mandates.md) / [Versions](../attacks-rewritten-as-mandates.md) / v1.2.0 # Attacks rewritten as mandates: what changed in v1.2.0 From v1.1.0 (2026-10-18, `de821285d`) to v1.2.0 (2026-10-27, `db67c5ce1`), paragraph by paragraph. 0 paragraphs added, 0 removed, 3 changed in place, 50 unchanged. About 0 words added and 90 removed. Insertions are marked like this, deletions like this; unchanged runs are folded to one line; figures appear as their file names. [← v1.1.0](v1.1.0.md) · [all versions](../attacks-rewritten-as-mandates.md) 2 unchanged paragraphs !shot am-ledger.webp | images/ | The ledger. Chainguard's 28 public supply-chain incidents, May 2024 to October 2026, eachone dot oneeach,incident, coloured by its first vector; 23 of them are from 2026. Below,with every vector counted, by our reading: an install-time hook ran the payload in 17, a maintainer account or token was taken over in 16.counted. | timeline 22 unchanged paragraphs, under In short {#in-short}, A ledger of attacks {#ledger}, Every attack is reach beyond mandate {#reach}… !shot am-barriers.webp | images/ | For each of the 28 incidents, the control that would most likely have stopped it, by our reading: on the consumer's side, what you let in; on the publisher's side, what a credential was for. A consumer-side control appears in 26, a publisher-side mandate in 16, both in 14. And one case where the consumer was a model.reading. | comparison 9 unchanged paragraphs, under The next maintainer is an agent {#agents}, One pipeline, three records {#records} !shot am-records.webp | images/ | One pipeline, three records: what an agent consumes, what it was allowed to do, and what it produced and remembers. The first has products; the second and third are what RiskMandate and sgit work on. | architecture 17 unchanged paragraphs, under An open source question {#oss}, What this does not claim {#limits}, Where this comes from {#sources} [← v1.1.0](v1.1.0.md) · [all versions](../attacks-rewritten-as-mandates.md) --- *[Site index for agents](../../../llms.txt) · [HTML version](https://newsroom.sgit.ai/articles/versions/attacks-rewritten-as-mandates/v1.2.0.html)*