release: assemble protected-source evidence bundle

[seonghobae]

Refs #58.

Writer-safe child of #91 exact bc85547ebed648c03142edad661c57b1b42a2dc4. This lane assembles already-produced protected-source release evidence; it does not rebuild binaries/images, publish a tag/release/package, or create a second compiler/build authority. Production Rust, routing/TLS/HTTP policy, product auth/business logic, Keyverse/Wardnet/EgressWeave authority, supplier source, deployment state, and dedicated baseline lane #61 remain unchanged.

Current repair: bind vulnerability reports to the scanned candidate image

Historical exact 8085a6a12d06f17f031538c7446f050623a533e4 was terminal GREEN, but fresh hostile characterization found an evidence-integrity gap. The assembler authenticated each Trivy JSON by its receipt-recorded SHA-256, while Supply Chain separately recorded generic_local_image_id and pg_erd_local_image_id; the assembler never proved that the authenticated report described that recorded image. A stale/hostile report for another image could therefore be substituted and re-hashed into an otherwise internally consistent receipt.

The fix is fail-closed and stays downstream of the existing Supply Chain producer. verify_trivy_image_binding() now requires exactly one receipt image-ID record, validates sha256:<64 lowercase hex>, and requires the corresponding Trivy JSON to identify ArtifactType=container_image, exact ArtifactName, exact Metadata.Reference, matching Metadata.ImageID, and an exact-SHA tag in Metadata.RepoTags. The existing receipt-digest check still authenticates the report bytes first. Generic and pg-erd reports are independently bound to cwl-pingora-gateway:${SOURCE_SHA} and cwl-pingora-pg-erd-migration:${SOURCE_SHA}.

The prior successful Supply Chain artifact was inspected rather than assumed: on 8085a6..., receipt image IDs sha256:c692159160a6b95d902d8ef6e6b26a1b8fb1495ab7cb6c6e7de8a9921aa00349 and sha256:4f8b3bf644ff76e24b46aa41253385cd40baaff7cd2770c7070900d0f877f016 exactly match the respective Trivy Metadata.ImageID, source-SHA references, and RepoTags. Thus the selected verifier strengthens identity without requiring an evidence-producer change.

tests/protected_release_evidence_workflow_contract.rs locks the new image-ID/reference/tag requirements. docs/doctoring/PROTECTED_RELEASE_EVIDENCE_TRACEABILITY.md records the RCA explicitly: digest authenticity is not scanned-object identity. docs/product-technical-gap-baseline.md remains untouched under #61 ownership.

Exact current state

Current exact is 411ea0361fc392508c19c4ad0362c0cc845c3de3, an ordinary-forward descendant of 8085a6... with merge base exactly 8085a6..., behind 0, and only the same three effective paths:

• .github/workflows/protected-release-evidence.yml
• tests/protected_release_evidence_workflow_contract.rs
• docs/doctoring/PROTECTED_RELEASE_EVIDENCE_TRACEABILITY.md

The PR was converted back to Draft before this source movement, so predecessor GREEN was not transferred. The repaired exact has now reacquired terminal hosted evidence: CI 34657862357, Supply Chain 34657862365, PgErd bounded-origin capacity 34657862366, TLS H2 Performance 34657862338, and Release Reproducibility 34657862364 are all success. Exact-current technical re-review 5184411500 found no additional writer-safe defect and fresh review-thread enumeration is 0. The PR is Ready again. No independent APPROVED review is claimed.

Promotion boundary

The actual protected bundle remains post-integration evidence: workflow_dispatch requires refs/heads/main and consumes successful same-SHA Release Reproducibility and Supply Chain push runs. GitHub immutable-release administration remains a separate prerequisite and is not inferred from ordinary repository write access. No self-approval, administrator bypass, predecessor-success transfer, protected merge, immutable release, representative NUMA closure, shadow/canary, observed rollback, cutover, or legacy-removal credit is claimed.

After dependency-ordered protected integration, rerun same-SHA reproducibility/provenance and Supply Chain evidence, run this assembler, verify immutable-release administration, bind version/CHANGELOG/tag/package to the same evidence, verify the published release/assets, then proceed through representative deployment, shadow/canary, observed rollback, cutover, and verified legacy removal.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: d98c2f06-adc4-426c-97c8-4302712f4fd5

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch release/protected-evidence-bundle-v1

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@coderabbitai review

[coderabbitai]

⚠️ Action not completed

Head commit changed.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[seonghobae]

Exact-head technical review on 2ae255671fff778bc019120e449f0acec5c2c120 after re-reading all three effective paths and the docs-only d9dd6c9…2ae2556 movement. The new commit only adds primary GitHub release/attestation authorities; it does not change workflow/test semantics. I re-checked the current GitHub documentation: immutable releases lock the associated tag/assets after publication and generate a release attestation; repository immutability status requires Administration read, and enablement requires Administration write. The workflow still fails closed to explicit workflow_dispatch on refs/heads/main, exact successful same-SHA push evidence, receipt/digest identity, and binary attestation verification; it does not rebuild or publish. Current review threads are empty. No additional writer-safe defect found in the current three-path delta. This COMMENT is technical evidence only, not the independent approving review required for protected integration. Exact-current CI/Supply Chain remain nonterminal, so no Ready/merge/release credit yet.

[seonghobae]

Current-head technical review on 8085a6a12d06f17f031538c7446f050623a533e4 after receipt-verification repair. Re-read the three effective paths and rechecked the exact helper against the current Release Reproducibility and Supply Chain artifacts. Valid current artifacts pass; hostile mutations for a missing digest record, duplicate digest record, contradictory identity field, and post-receipt file tamper are rejected. CI 34654032831, Supply Chain 34654032872, PgErd capacity 34654032841, TLS H2 Performance 34654032865, and Release Reproducibility 34654032825 are all terminal SUCCESS; unresolved review threads are 0. No additional writer-safe finding identified. This COMMENT is evidence only and is not the independent approving review required by the active ruleset.

[seonghobae]

Exact-head technical review on 411ea0361fc392508c19c4ad0362c0cc845c3de3 after scan-to-image identity repair. Re-read all three effective paths and compared 8085a6...411ea036: ahead 3 / behind 0, with only the workflow, structural contract, and focused TRACEABILITY changed. I also downloaded Supply Chain artifact candidate-evidence-8085a6... (server digest sha256:8064adfb9c7654fc5c9932b5c5f0a04151b1e885387dfebbc31b5bd6565b7f14) and verified that both receipt image IDs exactly equal the respective Trivy Metadata.ImageID, while ArtifactType, source-SHA ArtifactName/Metadata.Reference, and RepoTags match the selected new fail-closed checks. No new build/scan/publication authority is introduced. Fresh review threads are 0. Current-head CI/Supply Chain/capacity/performance/reproducibility runs are still nonterminal, so this PR correctly remains Draft and no predecessor GREEN is transferred. This COMMENT is technical evidence only, not independent approval.

[seonghobae]

Exact-head technical re-review on 411ea0361fc392508c19c4ad0362c0cc845c3de3 after the scan-to-image binding repair reacquired terminal hosted evidence. Re-read the three-path delta and the fail-closed verify_trivy_image_binding() contract. Current-head workflow runs are all terminal SUCCESS: CI 34657862357, Supply Chain 34657862365, PgErd bounded-origin capacity 34657862366, TLS H2 Performance 34657862338, Release Reproducibility 34657862364. Review threads remain empty. The fix binds each authenticated Trivy report to the receipt-recorded Docker image ID and exact source-SHA image reference/tag without creating a new build, scan, compiler, publication, or product-domain authority. No additional writer-safe source/test/docs defect found on this exact. This COMMENT is technical evidence only; it is not the independent approving review required for protected integration.

[seonghobae]

@coderabbitai approve

[coderabbitai]

✅ Action performed

Comments resolved. Approval is disabled; enable reviews.request_changes_workflow to allow explicit top-level @coderabbitai resolve or @coderabbitai approve commands.