sairintechnologycom · sairintechnologycom · Jul 13, 2026 · Jul 13, 2026
diff --git a/evidence/releases/v1.7.0/GA_VERIFICATION.md b/evidence/releases/v1.7.0/GA_VERIFICATION.md
@@ -0,0 +1,28 @@
+# v1.7.0 GA verification
+
+**Date:** 2026-07-13  
+**Tag:** `v1.7.0`  
+**Commit:** `6af3119`  
+**Command:** `scripts/verify-ga-release.sh v1.7.0`
+
+## Result
+
+```text
+final_status=PRODUCTION_GA_READY
+ga_ready=True
+production_ready=True
+ga_blockers=[]
+signing_verified=True
+provenance_verified=True
+real_repos=15/15
+```
+
+## Steps
+
+1. Download all release assets for `v1.7.0`
+2. `shasum -a 256 -c checksums.txt` → 12/12 OK
+3. `cosign verify-blob` on checksums.txt → Verified OK
+4. `gh attestation verify` on darwin_arm64 archive → exit 0
+5. `pkgsafe test production-readiness` with `PKGSAFE_RELEASE_ARTIFACT_DIR` → PRODUCTION_GA_READY
+
+Machine report: [production-readiness-ga.json](./production-readiness-ga.json)
diff --git a/evidence/releases/v1.7.0/RELEASE_SUMMARY.md b/evidence/releases/v1.7.0/RELEASE_SUMMARY.md
@@ -0,0 +1,68 @@
+# pkgsafe v1.7.0 — Production GA
+
+- **Tag:** `v1.7.0` (commit `6af3119`)
+- **Published:** 2026-07-13
+- **GitHub:** https://github.com/sairintechnologycom/pkgsafe/releases/tag/v1.7.0
+- **Channel:** **Latest** (not a pre-release)
+- **Release workflow:** https://github.com/sairintechnologycom/pkgsafe/actions/runs/29261919774  
+  (core publish succeeded; Homebrew tap push failed with PAT 403 — see caveats)
+
+## Classification
+
+```text
+final_status: PRODUCTION_GA_READY
+ga_ready: true
+production_ready: true
+ga_blockers: []
+```
+
+Evidence: [production-readiness-ga.json](./production-readiness-ga.json) · [GA_VERIFICATION.md](./GA_VERIFICATION.md)
+
+## What shipped (since v1.6.0)
+
+- Scan fail-closed: `--mode block` / `--fail-on` exit 1 on BLOCK
+- CI `--full` + `scan_coverage` (`full` / `changed_only` / `changed_only_empty`)
+- production-readiness defaults to real-repo catalog (15/15)
+- Install intercept: npm, **pnpm**, **yarn**, **uv**, pip, python -m pip
+- Shell shims for npm/pnpm/yarn/pip/uv
+- GA verify automation: `scripts/verify-ga-release.sh`
+
+## Verification ritual
+
+| Check | Result |
+|---|---|
+| Assets published (16) | PASS |
+| Checksums 12/12 | PASS |
+| Cosign verify-blob | PASS (Verified OK) |
+| GitHub attestation | PASS |
+| Binary `pkgsafe version` | `pkgsafe 1.7.0 (6af3119)` |
+| `production-readiness` | **PRODUCTION_GA_READY** |
+| Homebrew formula push | **FAIL** — tap token 403 |
+
+## Install
+
+```bash
+# Latest stable
+curl -fsSL https://github.com/sairintechnologycom/pkgsafe/releases/latest/download/install.sh | bash
+
+# Pin
+VERSION=1.7.0
+curl -fsSL "https://github.com/sairintechnologycom/pkgsafe/releases/download/v${VERSION}/install.sh" | bash
+```
+
+Homebrew (once tap formula is updated manually):
+
+```bash
+brew install sairintechnologycom/pkgsafe/pkgsafe
+brew upgrade pkgsafe
+```
+
+## Caveats
+
+1. **Homebrew:** GoReleaser could not push `Formula/pkgsafe.rb` to
+   `sairintechnologycom/homebrew-pkgsafe` (`403 Resource not accessible by
+   personal access token`). Release binaries are on GitHub Releases; refresh
+   `HOMEBREW_TAP_TOKEN` with `contents:write` on the tap and re-run formula
+   publish, or push the formula manually.
+2. Workflow job marked failed only because of the Homebrew step after assets
+   and signatures were already published.
diff --git a/evidence/releases/v1.7.0/production-readiness-ga.json b/evidence/releases/v1.7.0/production-readiness-ga.json
@@ -0,0 +1,200 @@
+{
+  "generated_at": "2026-07-13T15:27:19Z",
+  "final_status": "PRODUCTION_GA_READY",
+  "current_stage": "PRODUCTION_GA_READY",
+  "recommendation": "PRODUCTION_GA_READY: all GA hardening gates verified.",
+  "pass": true,
+  "private_beta_ready": true,
+  "ga_ready": true,
+  "production_ready": true,
+  "online_benchmark_status": "pass",
+  "benchmark_candidate_eligible": true,
+  "benchmark_packages_configured": 25,
+  "benchmark_packages_executed": 25,
+  "benchmark_packages_skipped": 0,
+  "benchmark_coverage_ratio": 1,
+  "github_action_status": "valid",
+  "signed_release_status": "signed",
+  "signing_configured": true,
+  "signing_verified": true,
+  "sbom_status": "present",
+  "sbom_verified": true,
+  "checksums_status": "verified",
+  "checksums_verified": true,
+  "provenance_status": "verified",
+  "provenance_configured": true,
+  "provenance_verified": true,
+  "docs_status": "complete",
+  "real_repo_validation_count": 15,
+  "required_real_repo_validation_count": 15,
+  "repo_validation_pass_rate": 1,
+  "ecosystem_depth_status": "npm-ga-pypi-public-beta-go-cargo-preview",
+  "isolated_backend_status": "unavailable",
+  "isolated_backend_available": false,
+  "behavior_analysis_default_mode": "disabled",
+  "npm_repo_count": 12,
+  "pypi_repo_count": 4,
+  "go_repo_count": 0,
+  "cargo_repo_count": 0,
+  "false_block_count": 0,
+  "scanner_crash_count": 0,
+  "average_scan_duration_ms": 1,
+  "p95_scan_duration_ms": 3,
+  "average_scan_duration_us": 971,
+  "p95_scan_duration_us": 2098,
+  "scan_timing_trustworthy": true,
+  "scan_timing_floor_count": 12,
+  "critical_detection_rate": 1,
+  "known_good_false_block_rate": 0,
+  "private_beta_recommendation": true,
+  "gates": [
+    {
+      "name": "rollout readiness",
+      "passed": true,
+      "blocking": true,
+      "duration_ms": 24990,
+      "summary": "PRIVATE_BETA_READY",
+      "details": [
+        "GO for private beta rollout. Continue to keep lifecycle behavior analysis labelled best-effort."
+      ]
+    },
+    {
+      "name": "benchmark validation",
+      "passed": true,
+      "blocking": true,
+      "duration_ms": 0,
+      "summary": "PRIVATE_BETA_ACCURACY_CANDIDATE",
+      "details": [
+        "direct recall 100.00%",
+        "transitive recall 100.00%",
+        "source import recall 100.00%",
+        "packages configured=25 executed=25 skipped=0 coverage=100.00% candidate_eligible=true"
+      ]
+    },
+    {
+      "name": "real repository evidence",
+      "passed": true,
+      "blocking": true,
+      "duration_ms": 0,
+      "summary": "real repository evidence threshold met",
+      "details": [
+        "validated=15 required=15 passed=15 failed=0"
+      ]
+    },
+    {
+      "name": "online benchmark",
+      "passed": true,
+      "blocking": false,
+      "duration_ms": 0,
+      "summary": "online benchmark: pass",
+      "details": [
+        "mode=connected attempted=25 passed=25 failed=0 network_unavailable=0 registry_unavailable=0 package_not_found=0 scanner_failure=0 expectation_mismatch=0"
+      ]
+    },
+    {
+      "name": "OSV cache",
+      "passed": true,
+      "blocking": true,
+      "duration_ms": 277,
+      "summary": "OSV database is initialized",
+      "details": [
+        "records: 260056",
+        "path: /Users/bhushan/.pkgsafe/pkgsafe.db"
+      ]
+    },
+    {
+      "name": "CI outputs",
+      "passed": true,
+      "blocking": true,
+      "duration_ms": 1,
+      "summary": "JSON, SARIF, and Markdown outputs generated",
+      "details": [
+        "/var/folders/38/czrn5d6s5992dpmtjy_cn6rm0000gn/T/pkgsafe-ci-output-1408960400/results.json",
+        "/var/folders/38/czrn5d6s5992dpmtjy_cn6rm0000gn/T/pkgsafe-ci-output-1408960400/results.sarif",
+        "/var/folders/38/czrn5d6s5992dpmtjy_cn6rm0000gn/T/pkgsafe-ci-output-1408960400/summary.md"
+      ]
+    },
+    {
+      "name": "documentation",
+      "passed": true,
+      "blocking": true,
+      "duration_ms": 0,
+      "summary": "production docs exist",
+      "details": [
+        "README.md",
+        "SECURITY.md",
+        "docs/ci-cd.md",
+        "docs/github-action.md",
+        "docs/mcp-codex.md",
+        "docs/policy-guide.md",
+        "docs/private-registry.md",
+        "docs/known-limitations.md",
+        "docs/threat-model.md",
+        "docs/release-verification.md"
+      ]
+    },
+    {
+      "name": "policy validation",
+      "passed": true,
+      "blocking": true,
+      "duration_ms": 0,
+      "summary": "default policy is valid",
+      "details": [
+        "default-policy.yaml"
+      ]
+    },
+    {
+      "name": "release artifacts",
+      "passed": true,
+      "blocking": false,
+      "duration_ms": 35,
+      "summary": "checksums and SBOM exist and checksums verify",
+      "details": [
+        "/Users/bhushan/Documents/Projects/pkgsafe/dist/ga-verify/checksums.txt",
+        "/Users/bhushan/Documents/Projects/pkgsafe/dist/ga-verify/pkgsafe_1.7.0_darwin_amd64.tar.gz.sbom.json"
+      ]
+    },
+    {
+      "name": "github action",
+      "passed": true,
+      "blocking": false,
+      "duration_ms": 0,
+      "summary": "composite action, entrypoint, and example workflow present",
+      "details": [
+        "action.yml",
+        "scripts/github-action-entrypoint.sh",
+        ".github/workflows/pkgsafe-action-example.yml"
+      ]
+    },
+    {
+      "name": "signed release",
+      "passed": true,
+      "blocking": false,
+      "duration_ms": 1524,
+      "summary": "cosign signature verified for checksums.txt",
+      "details": [
+        "Flag --certificate has been deprecated, please use --bundle with --trusted-root to provide the public certificate\nFlag --signature has been deprecated, please use --bundle to provide a signature\nVerified OK"
+      ]
+    },
+    {
+      "name": "sbom",
+      "passed": true,
+      "blocking": false,
+      "duration_ms": 0,
+      "summary": "SBOM present",
+      "details": [
+        "/Users/bhushan/Documents/Projects/pkgsafe/dist/ga-verify/pkgsafe_1.7.0_darwin_amd64.tar.gz.sbom.json"
+      ]
+    },
+    {
+      "name": "build provenance",
+      "passed": true,
+      "blocking": false,
+      "duration_ms": 12302,
+      "summary": "GitHub build provenance attestation verified",
+      "details": [
+        "gh attestation verify succeeded"
+      ]
+    }
+  ]
+}