Repository navigation
security inventory: distinguish mutable sibling clone workflow from pinned verification #6
Description
Status
SECURITY / REPRODUCIBILITY / CLAIM BOUNDARY INVENTORY ITEM
Finding
The Core verification workflow clones sibling repositories from GitHub using the current branch state:
git clone --depth 1 "https://github.com/Riverbraid/${repo}.git" "$repo"Risk boundary
This does not prove compromise. It means this workflow should be treated as a live compatibility check, not a pinned verification surface.
Recommended future review
- Decide whether this workflow should remain a live compatibility workflow.
- If a pinned verification claim is desired, clone exact commits from an explicit registry or lock file.
- Document the difference between mutable compatibility checks and pinned verification.
Boundary
This issue records inventory only.
It does not claim a patch was applied.
It does not claim the repository is secure, hardened, audited, or defect free.
It does not change registry, verifier behavior, workflow, protocol, hash, seal, manifest, tag, or release state.
Evidence surface
Repository file: Riverbraid-Core/.github/workflows/verify.yml
Claim boundary: reproducibility and verification surface distinction, not external security audit
Activity
Riverbraid commentedon Jul 27, 2026
Draft PR #7 addresses the tool-manageable claim-boundary portion of this issue by renaming the workflow as a live compatibility check, explicitly stating that it clones mutable default branches, and separating it from the pinned Evaluation Kit reproduction surface.
The issue should remain open after that documentation/workflow classification change until execution evidence exists for the final PR state and a separate decision is made on whether a pinned Core compatibility profile is required.
No pinned-verification, security-hardening, or runtime-success claim is made by PR #7.
Riverbraid commentedon Jul 27, 2026
Exact-head execution evidence is now available for PR #7.
GitHub Actions run
30280666028completed successfully for head861098ef48bf4d0e692c30a1eee9548dd2fe9cc3. The updated workflow explicitly identifies itself asRiverbraid Core Live Compatibility Check, clones current sibling default branches as a mutable compatibility surface, and states that it is not the pinned Evaluation Kit reproduction path.This satisfies the issue's classification and documentation objective on the draft branch. Keep the issue open until PR #7 is merged or otherwise dispositioned; no pinned Core profile is being claimed.