feat(core): bind release SBOM to manifest artifacts - #221

Draft

seonghobae wants to merge 143 commits into

feat/release-manifest-artifact-contractfrom

feat/release-spdx-sbom-binding

Commits on Aug 22, 2026

test(core): define release manifest artifact admission contract
seonghobae
committed
8053117
test(core): format release manifest contract before semantic red
seonghobae
committed
663087f
feat(core): add fail-closed release manifest identity primitive
seonghobae
committed
69a1c4f
feat(core): expose release manifest identity contract
seonghobae
committed
dac79ef
style(core): apply canonical release manifest formatting
seonghobae
committed
db4990c
test(core): close exact release manifest coverage branches
seonghobae
committed
d611f20
docs(changelog): record release manifest identity primitive
seonghobae
committed
489d332
test(core): reject case-colliding release artifacts
seonghobae
committed
b5d5365
fix(core): reject case-colliding release artifacts
seonghobae
committed
d640a41
docs(changelog): record cross-platform artifact collision guard
seonghobae
committed
4627924
test(core): reject Windows device artifact names
seonghobae
committed
2d00a17
fix(core): reject Windows device artifact names
seonghobae
committed
091b5a7
style(core): apply canonical release-manifest formatting
seonghobae
committed
10eeaed
test(core): cover ordinary four-byte artifact basenames
seonghobae
committed
bcabafd
docs(adr): record release manifest identity boundary
seonghobae
committed
7f30d4e
docs: index proposed release manifest ADR
seonghobae
committed
cdd4bdd
docs: index active release manifest ADR
seonghobae
committed
441fab7
docs: trace release filename portability evidence
seonghobae
committed
459631a
test(core): require release build identity evidence
seonghobae
committed
d141483
test(core): canonicalize release build identity regression
seonghobae
committed
78f2359
feat(core): bind release build identity evidence
seonghobae
committed
000ff2d
style(core): canonicalize release build identity formatting
seonghobae
committed
ec2323b
docs(adr): bind release build identity evidence
seonghobae
committed
a0d23b6
docs(changelog): record release build identity binding
seonghobae
committed
7eddd3e
test(core): satisfy strict release manifest Clippy contract
seonghobae
committed
965d995
test(release): reject unpinned Rust toolchains
seonghobae
committed
42ca2fd
fix(release): bind exact pinned Rust toolchain
seonghobae
committed
923fe8b
docs(adr): bind release identity to pinned Rust baseline
seonghobae
committed
eff600d
docs(changelog): record exact release toolchain binding
seonghobae
committed
547b53a
test(release): require exact toolchain error contract
seonghobae
committed
fc8e51d
test(release): decouple exact pin from obsolete token bound
seonghobae
committed
7e5ccf1
fix(release): make pinned toolchain contract explicit
seonghobae
committed
a957ff6
test(release): reject null Git source identity
seonghobae
committed
c875358
fix(release): reject null Git source identity
seonghobae
committed
cf17966
docs(release): reject Git zero-id as source identity
seonghobae
committed
7d7dd94
docs(release): record non-null Git identity rationale
seonghobae
committed
bf29cb4

Commits on Aug 23, 2026

test(core): pin non-null release source error contract
seonghobae
committed
ac9f4ff
fix(core): align release source diagnostic with non-null identity
seonghobae
committed
a7f995e
docs(release): pin Git protocol references
seonghobae
committed
070798d
docs(release): pin doctoring Git references
seonghobae
committed
f7c3145
test(release): reject Win32 COM0 and LPT0 aliases
seonghobae
committed
37d846f
fix(release): reject Win32 COM0 and LPT0 device aliases
seonghobae
committed
9ced1c2
docs(adr): record portable COM0 and LPT0 exclusion
seonghobae
committed
73d3453
fix(release): satisfy strict ASCII digit lint
seonghobae
committed
bfec859
docs(doctoring): record portable COM0 and LPT0 exclusions
seonghobae
committed
45f024d
docs(changelog): record portable release device aliases
seonghobae
committed
8145d40
test(core): require manifest-bound SPDX SBOM identity
seonghobae
committed
723f80b
feat(core): bind SPDX SBOM identity to release manifest
seonghobae
committed
1e09c8c
docs(changelog): record release SBOM identity boundary
seonghobae
committed
6a24339
docs(doctoring): record SPDX 3.0.1 SBOM boundary
seonghobae
committed
f4bd3b4
docs(adr): define release SBOM identity boundary
seonghobae
committed
69b5344
docs(adr): index release SBOM identity decision
seonghobae
committed
5e27afa
docs(index): include release SBOM ADR
seonghobae
committed
f938d33
test(core): cover SBOM binding in one concrete iterator contract
seonghobae
committed
41ba34d
test(core): prove SBOM binding retains exact artifact identity
seonghobae
committed
8b377ab
fix(core): retain exact artifact identity in SBOM binding
seonghobae
committed
5ec9bbb
test(core): bind SBOM identity to exact release manifest
seonghobae
committed
6d86b5f
fix(core): retain exact release manifest in SBOM binding
seonghobae
committed
a89112d
style(core): apply canonical Rust formatting
seonghobae
committed
29d960d
test(core): reject self-describing release SBOM
seonghobae
committed
e72b59b
fix(core): reject self-describing release SBOM
seonghobae
committed
25cd851
test(core): require typed SBOM self-description denial
seonghobae
committed
ed3dfe6
docs(release): require non-circular SBOM identity
seonghobae
committed
8a72af1
docs(changelog): record SBOM self-description rejection
seonghobae
committed
3a39bab
test(core): require inspectable SBOM identity binding
seonghobae
committed
91e7850
fix(core): expose exact SBOM binding identities
seonghobae
committed
eeff140
fix(core): preserve borrowed SBOM version accessor
seonghobae
committed
5de7752
docs: record inspectable SBOM identity contract
seonghobae
committed
4a6825a
docs: remove unrelated SBOM stack drift
seonghobae
committed
e18d002
docs: restore inherited extension wording
seonghobae
committed
c73e07c
test(core): require complete release SBOM inventory
seonghobae
committed
a9e9368
fix(core): require complete release SBOM inventory
seonghobae
committed
97d9c71
docs(adr): require release SBOM inventory completeness
seonghobae
committed
70fe74a
docs(changelog): record complete release SBOM inventory
seonghobae
committed
4bed6b6
test(core): satisfy SBOM completeness quality gates
seonghobae
committed
6879348
test(core): cover SBOM completeness error contract
seonghobae
committed
e0a8d2d
test(core): cover SBOM completeness in canonical binding suite
seonghobae
committed
26fa8e8
test(core): require exact SPDX JSON-LD context identity
seonghobae
committed
b988116
feat(core): bind SPDX JSON-LD context identity
seonghobae
committed
30d77b7
docs(adr): bind SPDX 3.0.1 JSON-LD context
seonghobae
committed
aec7f6f
test(release): require bounded SPDX JSON-LD envelope verification
seonghobae
committed
19ac78f
feat(release): validate bounded SPDX JSON-LD envelope
seonghobae
committed
9d01ded
test(release): keep validator callable unbound
seonghobae
committed
b6bdb93
docs(adr): bind SPDX envelope verification limits
seonghobae
committed
4507701
test(release): admit SPDX namespace context mappings
seonghobae
committed
8215a79
fix(release): accept SPDX namespace context mappings
seonghobae
committed
4c34ae8
docs(adr): permit pinned SPDX context extensions
seonghobae
committed
545a107
test(release): keep SPDX context extensions local
seonghobae
committed
c521039
test(release): reject semantic JSON-LD context overrides
seonghobae
committed
f242237
fix(release): pin SPDX context semantics fail closed
seonghobae
committed
483b97e
test(release): lock SPDX envelope to schema context
seonghobae
committed
eed3094
docs(adr): fail closed on SPDX context composition
seonghobae
committed
0db65f2
docs(research): record SPDX context authority boundary
seonghobae
committed
69a00cd
docs(changelog): record SPDX context fail-closed repair
seonghobae
committed
dc04358
test(release): reproduce deeply nested SPDX parser failure
seonghobae
committed
b6cc795
fix(release): fail closed on excessive SPDX JSON nesting
seonghobae
committed
03bb9a5
test(release): reject streaming SPDX input paths
seonghobae
committed
a03815f
test(release): make FIFO regression cleanup deterministic
seonghobae
committed
41befbe
fix(release): reject non-regular SPDX inputs
seonghobae
committed
b729cde
test(release): bind SPDX bytes to declared artifact digest
seonghobae
committed
724b0f2
fix(release): verify SPDX bytes against artifact digest
seonghobae
committed
c40b046
docs(release): record SPDX artifact digest binding
seonghobae
committed
04b983e

Commits on Aug 24, 2026

test(release): reject symlinked SPDX candidates
seonghobae
committed
d14221c
fix(release): reject indirect SPDX input paths
seonghobae
committed
6f339df
test(release): reject symlinked SBOM parent paths
seonghobae
committed
46c8cbf
fix(release): reject indirect SBOM ancestor paths
seonghobae
committed
24616ea
test(release): reject transient parent symlink swaps
seonghobae
committed
2e44d2d
fix(release): pin SPDX path traversal to directory descriptors
seonghobae
committed
a7e9f50
test(release): reject numeric overflow in SPDX JSON
seonghobae
committed
2532493
fix(release): reject non-finite numeric overflow
seonghobae
committed
3d065c2
merge: reconcile main into release manifest artifact contract
seonghobae
committed
4601cdd
test(release): pin manifest documentation truth
seonghobae
committed
5c47f9d
test(release): align Git citation revision contracts
seonghobae
committed
1ca7bec
docs(release): narrow manifest portability claims
seonghobae
committed
15648b3
docs(release): align portability and Git evidence
seonghobae
committed
ff9be05
test(release): cover changelog portability truth
seonghobae
committed
0aed213
docs(release): bound changelog portability claim
seonghobae
committed
c2e581f
merge(main): converge release manifest contract
seonghobae
committed
3e34a54
merge(parent): converge release SBOM stack
seonghobae
committed
9c631e0
test(release): reject final-path swap after SPDX open
seonghobae
committed
f9c98ad
fix(release): revalidate SPDX leaf identity after read
seonghobae
committed
12f20d7
docs(release): record direct SPDX file identity hardening
seonghobae
committed
b375dad
docs: mark merged MCP routing as protected-main truth
seonghobae
committed
1d1ab65
test(release): reject parent identity replacement
seonghobae
committed
bc898a3
fix(release): bind SPDX parent directory identity
seonghobae
committed
e0e8539
test(release): reject nested duplicate SPDX documents
seonghobae
committed
b247baa
fix(release): reject nested duplicate SPDX documents
seonghobae
committed
8caf156
test(release): prevent SPDX payload retention in parse errors
seonghobae
committed
62120e5
fix(release): detach SPDX payloads from parser errors
seonghobae
committed
f8abe9e
test(release): redact failed SPDX path evidence
seonghobae
committed
90026e8
fix(release): redact SPDX file read causes
seonghobae
committed
45071da

Commits on Aug 25, 2026

Commits on Aug 26, 2026

test(release): reject oversized SPDX numeric tokens
seonghobae
committed
fa6eab3
style(release): preserve canonical test formatting
seonghobae
committed
b4965d3
fix(release): bound SPDX JSON numeric tokens
seonghobae
committed
1051088

Commits on Aug 27, 2026

test(release): require CLI SBOM digest binding
seonghobae
committed
927ee3c
feat(release): bind SPDX CLI to manifest digest
seonghobae
committed
3a2db64

Commits on Aug 28, 2026

merge: reconcile release SBOM with current parent
seonghobae
committed
f023715
test(release): reject malformed SBOM paths safely
seonghobae
committed
a9b1cc9
fix(release): redact malformed SBOM path errors
seonghobae
committed
44146e5