From afa9c89b558c58a3e377e5f9b48954e1ac008c0d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Mat=C3=A9o=20H=2E=20Petel?= <113530345+fraware@users.noreply.github.com> Date: Wed, 26 Aug 2026 09:49:29 -0700 Subject: [PATCH 1/3] docs: align RC status with merged closure and ref integrity gate --- docs/CURRENT_RELEASE_STATUS.md | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/docs/CURRENT_RELEASE_STATUS.md b/docs/CURRENT_RELEASE_STATUS.md index 07d9a6bf..3f71a317 100644 --- a/docs/CURRENT_RELEASE_STATUS.md +++ b/docs/CURRENT_RELEASE_STATUS.md @@ -4,7 +4,7 @@ Living release/adoption status for Open Verification Kernel. **Last reviewed:** 2026-08-26 -**Current judgment:** `1.3.0-rc.1` is an **engineering release candidate under final review in PR #23** (`hardening/final-release-closure-2026-08-25`). It is not yet an attributable `v1.3.0-rc.1` release. The last previously signed immutable release remains `v1.2.1`; evidence from that tag must not be re-attributed to the RC source tree. +**Current judgment:** `1.3.0-rc.1` is an **engineering release candidate after the merge of final technical-closure PR #23**. It is not yet an attributable `v1.3.0-rc.1` release. The last previously signed immutable release remains `v1.2.1`; evidence from that tag must not be re-attributed to the RC source tree. The exact RC source identity is the final post-documentation candidate SHA that passes the complete exact-head development matrix; later movement of `main` does not redefine or authorize that candidate. The authoritative publication procedure is [RELEASE.md](RELEASE.md). The evidence threshold is [ATTRIBUTABLE_PUBLICATION.md](ATTRIBUTABLE_PUBLICATION.md). The generated TCB is [TRUSTED_COMPUTING_BASE.md](TRUSTED_COMPUTING_BASE.md). @@ -68,6 +68,17 @@ The exact final candidate SHA must pass all of the following after the last code A historical green SHA is not enough after the tree changes. The final exact-head matrix is the pre-tag engineering gate. +## Repository ref-integrity gate + +Release identity depends on repository refs remaining non-rewritable after they become authoritative. Before public publication: + +- [ ] `main` is protected against force-push and deletion, either by branch protection or an active equivalent ruleset; +- [ ] the release-tag namespace (`v*`, or a stricter equivalent covering this RC and future releases) is protected against update and deletion after tag creation; +- [ ] the signed annotated tag points directly to the exact final candidate SHA and GitHub reports the tag signature as verified; +- [ ] repository settings are checked live rather than inferred from documentation. + +The current protection gap is tracked in issue #25. Ref protection is defense in depth and does not replace exact-SHA, signed-tag, or release-ledger verification. + ## Tag-bound release authorization gate After the engineering candidate is frozen and a signed annotated tag is created, release authorization requires **new** `workflow_dispatch` runs on that exact tag for: @@ -120,6 +131,7 @@ Until an attributable `v1.3.0-rc.1` release exists, do not present that tag as a These cannot be truthfully marked complete merely from repository code: - [ ] freeze the exact final candidate after its complete development matrix is green; +- [ ] configure and live-verify `main` plus release-tag ref protection (issue #25); - [ ] create and push the signed annotated `v1.3.0-rc.1` tag; - [ ] execute all seven tag-bound release-evidence workflows; - [ ] retain governed holdout and consumer artifacts for those exact run IDs; From 2a956de4657a3be4e842841253e14027d4f80f20 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Mat=C3=A9o=20H=2E=20Petel?= <113530345+fraware@users.noreply.github.com> Date: Wed, 26 Aug 2026 09:50:08 -0700 Subject: [PATCH 2/3] docs: require live ref protection for attributable release --- docs/ATTRIBUTABLE_PUBLICATION.md | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/docs/ATTRIBUTABLE_PUBLICATION.md b/docs/ATTRIBUTABLE_PUBLICATION.md index 3f190fc7..48a4dd32 100644 --- a/docs/ATTRIBUTABLE_PUBLICATION.md +++ b/docs/ATTRIBUTABLE_PUBLICATION.md @@ -54,7 +54,11 @@ Required properties: - [ ] tag points directly to one commit; - [ ] direct target equals the exact release candidate SHA; - [ ] tag version exactly matches package release metadata; -- [ ] historical tags are not moved or re-attributed. +- [ ] historical tags are not moved or re-attributed; +- [ ] live repository settings protect the release-tag namespace against update and deletion after tag creation; +- [ ] `main` is protected against force-push and deletion by branch protection or an active equivalent ruleset. + +Ref protection is defense in depth, not a substitute for cryptographic identity checks. The release authorizer must still resolve and verify the annotated tag object and direct candidate target on every authorization run. Repository-setting evidence must be checked live; documentation cannot self-assert that the protection exists. The production Publish workflow must itself be dispatched on `refs/tags/`. Checking out a tag from a branch-bound workflow is not equivalent because the Sigstore workflow identity would remain branch-bound. @@ -210,6 +214,7 @@ Promotion to a production-stable `v1.3.0` claim additionally requires the projec ## Final maintainer checklist - [ ] exact final candidate passes the complete development matrix; +- [ ] `main` and the release-tag namespace have live verified ref protection; - [ ] signed annotated immutable tag exists and is GitHub-verified; - [ ] all seven required release-evidence workflows succeed as tag-bound `workflow_dispatch` runs; - [ ] label-free prediction → exact-run evaluation handoff is retained and digest-bound; From 578804914d91f212947bbdb6c9715328968df89c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Mat=C3=A9o=20H=2E=20Petel?= <113530345+fraware@users.noreply.github.com> Date: Wed, 26 Aug 2026 09:51:12 -0700 Subject: [PATCH 3/3] docs: enforce ref protection before signed release tag --- docs/RELEASE.md | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/docs/RELEASE.md b/docs/RELEASE.md index bf068f3e..2ccb800d 100644 --- a/docs/RELEASE.md +++ b/docs/RELEASE.md @@ -63,7 +63,15 @@ For this RC, that is `1.3.0-rc.1` and `v1.3.0-rc.1`. PyPI normalizes the version ## 2. Create a signed annotated immutable tag -Create the tag only after the candidate commit is final: +Before creating or pushing the release tag, live-verify repository ref protection: + +- `main` must be protected against force-push and deletion by branch protection or an active equivalent ruleset; +- the release-tag namespace (`v*`, or a stricter equivalent covering the RC and future release tags) must be protected against update and deletion after creation; +- these settings must be checked from live GitHub repository state, not inferred from this document. + +For `v1.3.0-rc.1`, the current ref-protection closure is tracked in issue #25. Do not treat the existence of that issue as evidence that the settings are configured. + +Create the tag only after the candidate commit is final and the ref-integrity precondition above is satisfied: ```bash export CANDIDATE_SHA='' @@ -75,6 +83,8 @@ git push origin "$TAG" The production authorizer requires an **annotated** tag whose signature GitHub reports as verified and whose direct target is exactly `CANDIDATE_SHA`. Lightweight tags, unsigned annotated tags, indirect/wrong targets, moved historical tags, or tags whose version differs from package metadata fail closed. +Ref protection is additional integrity control, not a substitute for those cryptographic and exact-target checks. The release authorizer must independently resolve the annotated tag object and candidate target on every run. + Do not move `v1.2.1` or earlier historical tags. Do not re-attribute historical Sigstore evidence to the new candidate. ## 3. Produce tag-bound release evidence