anthfuller · anthfuller · Sep 20, 2026 · Sep 20, 2026
@@ -3,3 +3,11 @@
 /src/demo_runner/run_golden_dataset.py @anthfuller
 /scripts/check_golden_thresholds.py @anthfuller
 /config/policies/policy-schema.json @anthfuller
+
+# Supply-chain and CI guardrails
+/.github/workflows/ @anthfuller
+/.github/dependabot.yml @anthfuller
+/requirements.txt @anthfuller
+/requirements-ci.in @anthfuller
+/requirements-ci.lock @anthfuller
+/scripts/validate-supply-chain.py @anthfuller
@@ -0,0 +1,19 @@
+version: 2
+updates:
+  - package-ecosystem: pip
+    directory: /
+    schedule:
+      interval: weekly
+    labels:
+      - dependencies
+      - supply-chain
+    open-pull-requests-limit: 5
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    labels:
+      - dependencies
+      - supply-chain
+    open-pull-requests-limit: 5
@@ -1,95 +1,149 @@
 name: F7-LAS CI
+
 'on':
   push:
     branches:
-    - main
+      - main
   pull_request:
     branches:
-    - main
+      - main
+
 permissions:
   contents: read
+
 jobs:
   validate:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
-    - name: Checkout repository
-      uses: actions/checkout@v4
-    - name: Set up Python
-      uses: actions/setup-python@v5
-      with:
-        python-version: '3.11'
-    - name: Install dependencies
-      run: 'python -m pip install --upgrade pip
-
-        if [ -f requirements.txt ]; then pip install -r requirements.txt; fi
-
-        pip install pytest
-
-        '
-    - name: Add repo root to PYTHONPATH
-      run: echo "PYTHONPATH=$PWD" >> $GITHUB_ENV
-    - name: Install pinned OPA CLI
-      env:
-        OPA_VERSION: 1.20.2
-        OPA_SHA256: 69da5179ee403d10fa11bab6cfb4ffb0d23dba5f9b682fa977db772a1da5670f
-      run: |
-        mkdir -p "$RUNNER_TEMP/f7las-bin"
-        curl -fsSL "https://openpolicyagent.org/downloads/v${OPA_VERSION}/opa_linux_amd64_static" -o "$RUNNER_TEMP/f7las-bin/opa"
-        echo "${OPA_SHA256}  $RUNNER_TEMP/f7las-bin/opa" | sha256sum -c -
-        chmod 0755 "$RUNNER_TEMP/f7las-bin/opa"
-        echo "$RUNNER_TEMP/f7las-bin" >> "$GITHUB_PATH"
-        echo "OPA_BIN=$RUNNER_TEMP/f7las-bin/opa" >> "$GITHUB_ENV"
-        "$RUNNER_TEMP/f7las-bin/opa" version
-    - name: Verify src.policy package imports
-      run: 'python -c "import src.policy"
-
-        '
-    - name: Validate prompts
-      run: 'python scripts/validate-prompts.py config/prompts
-
-        '
-    - name: Validate policies
-      run: 'python scripts/validate-policies.py
-
-        '
-    - name: Validate tool allowlist
-      run: python scripts/allowlist-validator.py
-    - name: Validate settings
-      run: 'python scripts/validate-settings.py config/settings.yaml
-
-        '
-    - name: Validate canonical data contracts
-      run: python scripts/validate-contracts.py
-    - name: Validate canonical OPA policy
-      run: opa check --strict config/policies/canonical-workflow.rego
-    - name: Run behavioral scenarios
-      run: 'pytest -q tests/test_behavioral_scenarios.py
-
-        '
-    - name: Generate canonical evidence
-      run: |
-        python -m src.canonical.cli \
-          --input examples/canonical-workflow/request.json \
-          --output "$RUNNER_TEMP/f7las-canonical-evidence.json" \
-          --opa-binary "$OPA_BIN"
-    - name: Verify canonical evidence integrity
-      run: |
-        python -m src.canonical.evidence \
-          --evidence "$RUNNER_TEMP/f7las-canonical-evidence.json"
-    - name: Replay canonical evidence deterministically
-      run: |
-        python -m src.canonical.replay \
-          --input examples/canonical-workflow/request.json \
-          --evidence "$RUNNER_TEMP/f7las-canonical-evidence.json" \
-          --output "$RUNNER_TEMP/f7las-replayed-evidence.json" \
-          --opa-binary "$OPA_BIN"
-    - name: Run unit tests
-      run: 'pytest -q --ignore=tests/test_behavioral_scenarios.py
-
-        '
-    - name: Run golden dataset evaluation
-      run: "python -m src.demo_runner.run_golden_dataset \\\n  --scenarios tests/golden_dataset/scenarios.json\
-        \ \\\n  --rubric tests/golden_dataset/rubric.json \\\n  --output tests/golden_dataset/golden_eval_results.ci.json\
-        \ \\\n  --strict\n"
-    - name: Enforce golden thresholds
-      run: "python scripts/check_golden_thresholds.py \\\n  tests/golden_dataset/golden_eval_results.ci.json\n"
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: '3.12.14'
+
+      - name: Install hash-locked dependencies
+        run: python -m pip install --require-hashes -r requirements-ci.lock
+
+      - name: Add repo root to PYTHONPATH
+        run: echo "PYTHONPATH=$PWD" >> "$GITHUB_ENV"
+
+      - name: Validate supply-chain invariants
+        run: python scripts/validate-supply-chain.py
+
+      - name: Audit dependencies and generate CycloneDX SBOM
+        run: |
+          mkdir -p "$RUNNER_TEMP/f7las-sbom"
+          pip-audit \
+            --require-hashes \
+            --disable-pip \
+            --strict \
+            --progress-spinner off \
+            --requirement requirements-ci.lock \
+            --format cyclonedx-json \
+            --output "$RUNNER_TEMP/f7las-sbom/f7las-python.cdx.json"
+
+      - name: Upload CycloneDX SBOM
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: f7las-python-sbom-${{ github.sha }}
+          path: ${{ runner.temp }}/f7las-sbom/f7las-python.cdx.json
+          if-no-files-found: error
+          retention-days: 30
+
+      - name: Install checksum-verified Gitleaks
+        env:
+          GITLEAKS_VERSION: 8.30.1
+          GITLEAKS_SHA256: 551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb
+        run: |
+          mkdir -p "$RUNNER_TEMP/f7las-bin"
+          archive="$RUNNER_TEMP/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz"
+          curl --proto '=https' --tlsv1.2 -fsSLo "$archive" \
+            "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz"
+          echo "${GITLEAKS_SHA256}  $archive" | sha256sum -c -
+          tar --no-same-owner -xzf "$archive" -C "$RUNNER_TEMP/f7las-bin" gitleaks
+          chmod 0755 "$RUNNER_TEMP/f7las-bin/gitleaks"
+          "$RUNNER_TEMP/f7las-bin/gitleaks" version
+
+      - name: Scan Git history for secrets
+        run: |
+          "$RUNNER_TEMP/f7las-bin/gitleaks" git --redact --no-banner --exit-code 1 .
+
+      - name: Install checksum-verified OPA CLI
+        env:
+          OPA_VERSION: 1.20.2
+          OPA_SHA256: 69da5179ee403d10fa11bab6cfb4ffb0d23dba5f9b682fa977db772a1da5670f
+        run: |
+          mkdir -p "$RUNNER_TEMP/f7las-bin"
+          curl --proto '=https' --tlsv1.2 -fsSLo "$RUNNER_TEMP/f7las-bin/opa" \
+            "https://openpolicyagent.org/downloads/v${OPA_VERSION}/opa_linux_amd64_static"
+          echo "${OPA_SHA256}  $RUNNER_TEMP/f7las-bin/opa" | sha256sum -c -
+          chmod 0755 "$RUNNER_TEMP/f7las-bin/opa"
+          echo "$RUNNER_TEMP/f7las-bin" >> "$GITHUB_PATH"
+          echo "OPA_BIN=$RUNNER_TEMP/f7las-bin/opa" >> "$GITHUB_ENV"
+          "$RUNNER_TEMP/f7las-bin/opa" version
+
+      - name: Verify src.policy package imports
+        run: python -c "import src.policy"
+
+      - name: Validate prompts
+        run: python scripts/validate-prompts.py config/prompts
+
+      - name: Validate policies
+        run: python scripts/validate-policies.py
+
+      - name: Validate tool allowlist
+        run: python scripts/allowlist-validator.py
+
+      - name: Validate settings
+        run: python scripts/validate-settings.py config/settings.yaml
+
+      - name: Validate canonical data contracts
+        run: python scripts/validate-contracts.py
+
+      - name: Validate canonical OPA policy
+        run: opa check --strict config/policies/canonical-workflow.rego
+
+      - name: Run behavioral scenarios
+        run: pytest -q tests/test_behavioral_scenarios.py
+
+      - name: Generate canonical evidence
+        run: |
+          python -m src.canonical.cli \
+            --input examples/canonical-workflow/request.json \
+            --output "$RUNNER_TEMP/f7las-canonical-evidence.json" \
+            --opa-binary "$OPA_BIN"
+
+      - name: Verify canonical evidence integrity
+        run: |
+          python -m src.canonical.evidence \
+            --evidence "$RUNNER_TEMP/f7las-canonical-evidence.json"
+
+      - name: Replay canonical evidence deterministically
+        run: |
+          python -m src.canonical.replay \
+            --input examples/canonical-workflow/request.json \
+            --evidence "$RUNNER_TEMP/f7las-canonical-evidence.json" \
+            --output "$RUNNER_TEMP/f7las-replayed-evidence.json" \
+            --opa-binary "$OPA_BIN"
+
+      - name: Run unit tests
+        run: pytest -q --ignore=tests/test_behavioral_scenarios.py
+
+      - name: Run golden dataset evaluation
+        run: |
+          python -m src.demo_runner.run_golden_dataset \
+            --scenarios tests/golden_dataset/scenarios.json \
+            --rubric tests/golden_dataset/rubric.json \
+            --output tests/golden_dataset/golden_eval_results.ci.json \
+            --strict
+
+      - name: Enforce golden thresholds
+        run: |
+          python scripts/check_golden_thresholds.py \
+            tests/golden_dataset/golden_eval_results.ci.json
@@ -52,12 +52,15 @@ Nothing in this repository should be connected to production data, identities, c
 
 ## Validate the current repository
 
-Use Python 3.10 or later in an isolated environment:
+The canonical code supports Python 3.10 or later. To reproduce the CI dependency
+environment, use Python 3.12.14 in an isolated environment and install the
+hash-locked file:
 
 ```bash
 python -m venv .venv
 source .venv/bin/activate
-python -m pip install -r requirements.txt
+python -m pip install --require-hashes -r requirements-ci.lock
+python scripts/validate-supply-chain.py
 python scripts/validate-prompts.py
 python scripts/validate-policies.py
 python scripts/validate-settings.py config/settings.yaml
@@ -78,6 +81,7 @@ These commands validate the **current prototype and repository structure**. They
 - [Current QA and maturity statement](docs/F7-LAS-QA.md)
 - [Canonical data contracts v1.0.0](schemas/contracts/README.md)
 - [Canonical offline workflow](examples/canonical-workflow/README.md)
+- [Supply-chain and CI controls](docs/supply-chain-and-ci.md)
 - [Roadmap](ROADMAP.md)
 - [Security policy](SECURITY.md)
 

@@ -16,7 +16,7 @@ The target is an **Executable Reference Implementation**: one offline, determini
 4. **Approval binding** — synthetic approval is bound to the exact request/action digests, scope, complete policy reference, authority, and expiry in the canonical path.
 5. **Behavioral scenarios** — an executable canonical matrix tests permitted, denied, malformed, unauthorized, unavailable, timed-out, tampered, expired, obligation, and recovery paths.
 6. **Evidence and replay** — canonical evidence can be independently verified for complete correlation and tampering, then replayed from the admitted input to reproduce the exact canonical outcome.
-7. **Supply chain and CI** — pin dependencies and actions; add integrity, vulnerability, secret, and SBOM checks.
+7. **Supply chain and CI** — implement pinned and hashed dependencies, immutable action references, verified tool downloads, known-vulnerability and Git-history secret gates, and a retained CI SBOM.
 8. **Documentation reconciliation** — execute every documented command in a clean environment.
 9. **F7-LAS-specific diagrams** — replace diagrams only after execution semantics are frozen.
 10. **Independent review** — review the complete branch diff and CI evidence before any merge, release, or Zenodo update.

@@ -71,6 +71,21 @@ No. Architecture and evidence use auditable plans, decisions, source references,
 
 Layer S is a cross-cutting software supply-chain control domain. It is not an eighth layer and does not change the fundamental seven-layer model.
 
+## Which Layer S controls are implemented in this repository?
+
+The canonical CI installs a fully resolved, SHA-256-hashed Python lock, pins
+external GitHub Actions to full commit SHAs, verifies downloaded OPA and
+Gitleaks binaries against fixed SHA-256 values, scans the Git history for
+recognized secret patterns, checks the locked Python graph for published known
+vulnerabilities, and retains a CycloneDX JSON SBOM for 30 days. Dependabot is
+configured to propose weekly Python and GitHub Actions updates for review.
+
+These controls cover the repository's Python CI environment and the two
+downloaded Linux binaries. They do not attest the GitHub-hosted runner image,
+prove that dependencies are non-malicious, guarantee that no secret exists, or
+create a signed release SBOM or provenance attestation. See
+[Supply-chain and CI controls](supply-chain-and-ci.md) for the exact boundary.
+
 ## How should practitioners use the repository today?
 
 Use it as a design-review lens, threat-modeling aid, draft control catalog, and source of clearly labeled examples. Verify each claimed outcome independently before adapting any pattern.

@@ -13,6 +13,7 @@ This directory contains the governed documentation for the F7-LAS seven-layer re
 - [QA and maturity](F7-LAS-QA.md) — current repository truth and limitations.
 - [Canonical data contracts v1.0.0](../schemas/contracts/README.md) — machine-validated request-through-audit definitions used by the canonical executable path.
 - [Canonical offline workflow](../examples/canonical-workflow/README.md) — the bounded synthetic Python + OPA Layers 1–7 demonstration.
+- [Supply-chain and CI controls](supply-chain-and-ci.md) — implemented dependency, action, download, vulnerability, secret, and SBOM checks and their limits.
 
 ## Architecture graphics