[northcutted]

Wave 2 for clearcutt-verify: Phase B (structural gaps) plus contract hygiene, per the assessment's §2 gap A, §3 (verify), and §4 Phase B/C/D, and the items the orchestrator appended (VEX scoping, the estate signer role, the no-check exit code, the live cosign trusted-root bug).

Item	What changed	Test that proves it
1. --rescan (gap A)	grype over each image's verified SBOMs, per platform; images[].rescan beside vulnerabilities (scanner, database.built, findings); policy.scanSource (attestation/rescan/worst, worst by default with --rescan); maxScanAgeDays by database build time; no verified SBOM or unreadable platforms ⇒ unknown, never clean; grype missing ⇒ exit 1 before the run; grype's database updated once before the run (grype db update, failure ⇒ exit 1 before reading anything) and scans run with GRYPE_DB_AUTO_UPDATE=false (with it already false, only grype db status checks a database is there); grype scanning nothing ⇒ exit 1 after writing	TestRescanScansOnlyVerifiedSBOMs, TestRescanGrypeFailureIsUnknown, TestScanSourceGating, TestMaxScanAgeUsesTheRescansDatabase, TestGrypeDatabaseIsPreparedOnce (stand-in grype binary: env and order), TestEstateVerifyRescan (recorded grype output; database update failing), e2e --rescan case (registry:3 leg)
2. VEX for rescans	vex: list (relative to the policy), scoped per image before grype sees it (image products by digest / repository_url / plain reference rewritten to subcomponents or every package; package products estate-wide; rule in docs/verify-estate.md); every suppressed finding listed with suppressedBy; unused statements warned	TestVEXScoping, TestReadVEXRefusesWhatIsntOpenVEX, the rescan tests above
3. Observe-only tier	observe: patterns ⇒ images[].observeOnly, summary.verdicts.observeOnly, ignored by --fail-on, marked in history rows	TestObserveOnly, TestEstateVerifyObserveOnly
4. Contract hygiene	IDs from the full reference, order-independent (hash suffix on collisions); uniqueImages (observations still sharing an ID numbered -2, -3 by canonical reference, then digest, not input order); report and history validated against the embedded schemas before writing (exit 1); deterministic checkedAt; legacy history IDs renamed when unambiguous, computed from each image's observed reference as the old IDs were (a tagless reference had the repository's ID, a digest reference the digest's)	TestImageID, TestAssignIDsIsUniqueAndOrderIndependent, TestUniqueImages (incl. one reference at two digests, both orders; SourceRefs), TestValidate, TestValidateUsesThePublishedSchemas, TestEstateVerifyWritesNothingInvalid, TestHistoryKeepsImagesAcrossTheIDChange (incl. bare, digest, and tag+digest references; unknown reference left alone)
5. Staleness from claims	name/history edges have no drift (no version identified) and link to no image (base.imageId empty; an unreadable image, which has no digest either, is never matched); maxDaysBehind fails only on proven drift, claimed drift ⇒ unverified; --reproduce doesn't skip an unknown recipe	TestBuildGraphNameAndHistoryEdgesHaveNoDrift, TestNamedBaseIsNotLinkedToAnUnreadableImage, TestStalenessFromClaimsNeverFails, TestReproduceDoesNotSkipAnUnknownRecipe
6. sourceRepositoryOwner	value validated (https://github.com/OWNER exactly, a trailing slash allowed); every trust-policy field described in the schema; exact rule documented	TestSourceRepositoryOwnerIsValidated (a repository URL, no scheme, http, another forge, no owner: refused at policy read naming https://github.com/OWNER, for trusted signers, stack signers, and trust-policy signers; the owner with and without / accepted), TestAccepts (owner with a trailing slash matches its repositories, not acme-evil); schema regenerated
7. Provenance honesty	images[].provenance (builderId, buildType, builderChecked); detail says what was/wasn't checked; provenanceBuilders: makes the builder a check (another builder, or none, ⇒ failed, and neither source nor images[].provenance is read from failed provenance; an empty entry is refused at policy read); golden test recomputes every verdict in the contract bundles; contract README records the v0.16.0 meaning change	TestProvenanceBuilders (listed ⇒ verified + builderChecked; another builder, none, and an unvalidated empty entry ⇒ failed, no source, no panic; unchecked ⇒ read), TestReadProvenanceDetails (SLSA v1, v0.2), TestReadPolicy (provenanceBuilders: [''] refused), TestVerdictsInContractBundlesArePinned (pinned the bundles; the minimal example's hand-written verdicts were corrected)
8. Contract gate	portal-contract job: clearcutt-portal (pinned to main b183f2e, the documented invocation isn't released yet; move the pin at its next release) builds the fresh e2e bundle and the v0.16.0 fixture; in the PR gate summary contract	workflow + TestPRGateSummaryContractMatchesItsJobs
estate role	trust-policy role estate; estate pull/history --trust-policy/--policy; estate history now verifies the index signature (breaking: needs a signer or --allow-unverified)	TestEstatePullAndHistoryUseTheEstateRole, e2e history round trip
Nothing checked ⇒ exit 1	an all-unknown report is written and the run exits 1	TestEstateVerifyNothingCheckedIsNotAPass
Live cosign bug	root cause: a concurrent cosign process losing Sigstore's trusted root (each run refreshes TUF into the shared cache; v3.0.6 only warns, then fails the bundle; verify kept the last stderr line and read it as failed). Fix: cosign initialize once (for keyless signers and key signers that check the transparency log), then --trusted-root on every verification that needs it (keyless, and key with tlog on), using the root of the mirror initialize used (TUF_MIRROR, else remote.json, else the default), else the newest trusted_root.json in the cache; none found ⇒ a loud warning (stderr, ::warning, report warnings) and the old per-run fetch; TUF errors (the legacy client's initializing tuf, tuf: failed to decode included) ⇒ unknown with TUF's message; --trusted-root FILE; action pins cosign v3.1.4; keyless e2e job against the public Sigstore	TestLostTrustedRootIsUnknownNotFailed, TestLegacyTUFErrorsAreUnknown, TestPrepareTrustedRoot (two mirrors, another layout, none found, key with and without tlog), TestEstateVerifyFetchesTheTrustedRootOnce (incl. the warning in the report), cosign-keyless-e2e

Not shown deterministically:

• The live "trusted root is required when using new bundle format" failure was not reproduced on demand. The root-cause analysis comes from the stderr quoted in TestLostTrustedRootIsUnknownNotFailed (cosign v3.0.6 in the showcase's CI) and cosign's source; the keyless e2e job exercises the fixed path (one cosign initialize, --trusted-root on every verification) against the public Sigstore, but it doesn't force the race.

Not done:

• Refusing, when the policy is read, a signer whose identity is a reusable workflow and that names neither sourceRepository nor sourceRepositoryOwner (nor sourceMatchesImage). That case stays decided at evidence time: such evidence is present, never verified (callerUnchecked).

Deferred: the northcutted-images fixture wasn't regenerated with --rescan (it is a real estate; the minimal example carries the new fields); the keyless e2e runs only for same-repository PRs (forks get no OIDC token).

🤖 Generated with Claude Code