Key hardening changes:
- Config validation now rejects paths.source: . and paths.assets: ., so source/asset roots cannot
resolve to the repository root.
- apply-hak-manifest now refuses to run when paths.source is unset or unsafe, instead of potentially
writing under a root-level module/.
- Inline flags across utility parsers now reject empty values consistently, e.g. --dataset=, --hak=,
--endpoint=, --output=.
- build-changelog now supports --flag=value inline syntax like the other utilities.
Built development binaries live here:
sow-toolkiton Linux/macOSsow-toolkit.exeon Windows
Use ../sow-tools/build-tool.sh or ../sow-tools/build-tool.ps1 from this
repository root to refresh the binary. Sibling consumer repositories may point
their wrappers at this directory during local development; release workflows can
copy a pinned binary into each consumer repo's own tools/ directory.