Bind published artifact hashes to authenticated source commits

[samovers]

Delivery outcome

Bind the trusted publisher's verified-artifact hashes to the authenticated execution commit, so legitimate source artifact changes can be published while fabricated or stale producer hashes are refused.

Primary trust boundary: evidence-publication custody. Parent Tracking Epic: #167. This is a new corrective Delivery following the existing #168 baseline/publication work; no closed issue or merged PR is reopened. The single draft implementation PR is #382; it carries design, policy correction, focused tests and mechanical pin/currentness companions under valid approval.

This Delivery is a prerequisite for #379 / PR #380. Its source branch starts from current main, independently of PR #380. Do not incorporate that PR's kernel, manifest or fixture changes here.

Demonstrated failure

PR #380 source run 34149023176, attempt 1, passed both locked baselines and native verification at historical head 64d3cbd60828c353bf284f2b7bbbfdbb6f5cd018. Trusted publisher 34151241570, attempt 1, refused staging with review baseline verified artifacts differ, producing no final artifacts or receipt.

At unchanged trusted main ff092c414db9fa24dbd6ab86c7722db89e0c95b5, producer run_review_baseline.py hashes configured verified artifacts in its executed source root. Publisher evidence_publication_policy.py instead hashes those artifacts under its policy checkout. The executed capability manifest hash was 41b1f113b2e39de75ed5d7f4a3ae106b2b91d5f3603aaab27294c2a6c97da119; the older policy copy was cfb1ea4c9f0746633816e0eb40ddad6184e7aa37547d0ad800b07bda696a989b. Both source envelopes matched their executed bytes. The ActiveArtifactSet bytes matched across both revisions.

Earlier source success is historical evidence of the defect, not passing evidence for this Delivery or PR #380's repaired head.

Smallest complete change and revised source-file contract

The current design is RFC v0.2 in draft PR #382. Version 1 and its approval card are withdrawn after review B1: authenticated Contents response bytes did not prove a supported file.

Keep configured paths under trusted default-branch policy. Strengthen the shared inventory/artifact source reader to resolve the exact execution commit, walk selected path components through nonrecursive Git trees, require tree parents and a terminal regular blob (100644/100755), then fetch that raw blob by proved ID. Refuse all symlinks, including ordinary-target and parent links, submodules and directory terminals. Require exact raw length and Git blob object ID before SHA-256 hashing. Keep one bounded authenticated HTTP helper, locally constructed URLs, strict metadata decoding, 8 MiB responses and existing timeout; no fallback, checkout, recursive listing or source execution.

Hash each proven artifact once into one ordered expected list required by both producer checks and staged revalidation. Delete the old policy-root calculation and untyped Contents path. The current trusted paths imply twelve bounded reads. Source test inventory keeps its existing downstream schema/collection validation after the same file proof.

Expected companions: existing publisher and focused tests, the policy hash in evidence-publication.yml, that workflow's hash in conformance.yml, and design/conformance documentation. Workflow behavior stays unchanged. Root test inventory changes only if actual collection changes; no kernel runtime or configured artifact bytes change.

Acceptance invariants

• P01: Only trusted configuration chooses artifact paths/order; producer-added, omitted, duplicated, changed or reordered entries refuse and never select fetched paths.
• P02: Exact commit → matching untruncated selected trees → supported regular blob proof binds every source read. All selected-path links/submodules/directories, missing or ambiguous names, malformed metadata, identity/mode/size/hash mismatches and failed/redirected/oversized reads refuse without fallback.
• P03: One ordered SHA-256 list of proven file bytes controls both runs and staged revalidation. Matching changed/unchanged source passes; stale or invented hashes fail. Full staging negatives use both envelopes' matching non-file metadata hashes and recomputed comparisons, then fail specifically at source-file proof before output.
• P04: Metadata never substitutes for content. Regular JSON that resembles metadata remains inert valid data. No checkout or execution; checks over configuration, locks, schema and other policy-owned inputs remain.
• P05: Preserve live admission/revocation, exact source run/attempt/ticket, artifact IDs/digests, safe extraction, inventory/outcomes, comparison, native reauthentication and final receipt. No rerun or exceptional publication path.
• P06: Start from main and preserve configured artifact files and policy-owned baseline inputs, obtaining this prerequisite's own receipt through the existing trusted publisher before merge. No circular dependency on PR Constrain and authorize legacy correction supersession #380's changes.

Verification

Use fictional source bytes, fake bounded HTTP responses, and temporary directories. No database or production access is needed for focused tests. Exercise the existing staging boundary with changed and unchanged source controls; false hashes and malformed lists; response failures; exact request binding; executable-looking inert bytes; and existing admission, comparison, archive and receipt refusal cases.

Mandatory package contract must pass before each commit. Run focused publication/admission tests and applicable lint/workflow-pin checks. After implementation, obtain an exact-head zero-Blocker content review before one fresh admission and required hosted verification/publication. The existing final receipt and later exact-head human merge authorization remain required. Phase-A-only heads receive no expensive admission.

Authority and non-goals

High-risk. Repository user owns semantic and final merge approval; trusted default policy owns publication decisions; the existing source chain owns repository/execution coordinates; GitHub API supplies authenticated commit bytes; the final receipt owns published artifact custody. Producer evidence and fetched content are untrusted data. Compromise of trusted policy, GitHub/TLS or publisher credentials is excluded from this bounded defect.

No semantic promotion, authority grants, credentials, database roles, transactions, runtime activation, capability/provisioning manifests, ActiveArtifactSet, contracts, canonical content, deployment or release changes. The existing currentness record is mechanically refreshed for the already-approved workflow pin, preserving its status, links, schema and validation rules. No rewriting historical envelopes, reusing the failed attempt, source checkout, PR-specific hash exception or weakening of checks.

Status: implemented at 1b057a9af2658b9c985a3c3cc7bd86af6b83ef5c in draft PR #382 under valid same-task approval for OFARM2-SOURCE-ARTIFACT-PUBLICATION-001 version2. One divided exact-head review reports zero Blockers. Local publication/admission81 and existingpin1 tests passed, packagePASS0, Ruff/whitespacePASS. Extraction retains its two known missing review records. All seven bootstrap inputs remain unchanged; no kernel/database changes.

The first admitted run34571981032 failed tenant preflight before either baseline; both native jobs passed, handoff was skipped and no receipt exists. Its failure is retained. The unchanged accepted offline generator refreshed only the conformance workflow digest and aggregate digest in the checked currentness sidecar. Review confirmed that generated companion remains within evidence-publication custody and adds no independent authority decision; frozen receipt/release identity/native rules/provisioning identity remain unchanged. Existing targeted tests20 passed; tenant preflight and packagePASS0. Bounded review: zero Blockers at the current head. Fresh admission supersedes the old head; no attempt was rerun.

Next: existing hosted/native/publication evidence and final receipt, followed by a complete task-user packet and later exact-head merge authorization.

Final verification completed

Current head 1b057a9af2658b9c985a3c3cc7bd86af6b83ef5c: source34572760216 attempt1 passed 4,269 tests per baseline, equivalence,23 platform checks,both native jobs and handoff. Trusted publisher34575188363 attempt1 passed; final receipt10189355421 archive SHA-256 98798e236cdde712772da57066627cf81a5fa5931018dae388139a0b73d02de3 was downloaded and verified with exact head/admission/run/artifact bindings. Scoped final review remains zero Blockers. The previous failed source attempt is preserved; no rerun or bypass occurred. PR #382 remains draft and unmerged.

Next: final same-task user acceptance and later exact-head merge authorization. Delivery remains open until an authorized normal merge is verified.