feat(release): add exact release evidence index contract

[seonghobae]

Scope

Advances #210 with a bounded machine-readable release-evidence contract. This remains unshipped work: it does not publish a release candidate or claim release readiness. Structural evidence validation stays separate from the stacked cryptographic verifier in #236.

Current repair lineage

The hostile-object, nightly-calendar, detached-signature-coverage, container/migration presence and compatibility, filesystem-boundary, checksum-binding, deterministic artifact-order, and nightly generated_at identity repairs remain in non-force ancestry.

Regression 9c57cd4294f0257978def1fdf4d91b54a2d9bb83 requires nightly version=...YYYYMMDD.N to match the canonical UTC date in generated_at; causal production repair df83b68c065f94ece3c13c53e2ef881b093ed742 enforces that invariant, and CHANGELOG descendant 35bb9c8639c53caa6a52f5efff3a61a0a026b566 records it.

Hosted CI on exact 35bb9c8... then supplied a real regression RED in merge_compatibility: the leap-day positive control used version=0.2.0-nightly.20240229.1 while the helper still hard-coded generated_at=2026-02-28T14:30:00.000Z. Minimal causal repair 59c9d94a5bc61e062e4596f737280581cd684bad changes only release-evidence-nightly-date.test.mjs: the helper accepts an optional generation instant, the ordinary 2026-02-28 control remains the default, and the leap-day control now supplies 2024-02-29T14:30:00.000Z. Impossible-date negatives are unchanged. No production validation or gate was weakened.

Protected-main and dependent stack

Protected base remains main@193a87ef54c3fe6dcda4755bce4d6bc81e3a0297, protected:true. Current exact #217 head is 59c9d94a5bc61e062e4596f737280581cd684bad, open/Draft/mergeable.

Dependent #236 remains exact 40f5877edb9489d24760bbd479cd0b5880a182ad, open Draft/mergeable on this exact #217 parent. Its non-force restack preserves the prior child as ancestry; parent source/test/CHANGELOG changes arrive by ancestry rather than copied ownership. It does not inherit parent workflow or review authority.

Exact-head acceptance

The current exact-head runs are terminal:

• CI 34146507624: RED only because validate fails at repository format:check on .github/workflows/appguardrail.yml. The exact job first obtained an Ubuntu 24.04 hosted runner, started healthy PostgreSQL 16, checked out exact 59c9d94..., and completed pnpm install --frozen-lockfile with repository pnpm@10.15.0. Lint/typecheck/test/build are then skipped by the formatting failure. In the same exact CI run, merge_compatibility, compose_runtime, browser-acceptance, and today-concurrency are all GREEN. feat(release): add exact release evidence index contract #217 does not modify .github/workflows/appguardrail.yml; the control-plane lane owns that shared formatting repair.
• Commercial Readiness 34146507612: GREEN.
• SAST Semgrep 34146507700: GREEN.
• Security Scan 34146507617: RED on shared-foundation/security authority, including root qs@6.15.3 CVE-2026-82417/CVE-2026-82562. security: upgrade shared qs resolution to 6.16.0 #246/fix(security): upgrade shared vulnerable dependency graph #249 now own the package-manager-driven qs 6.16.0 repair; no release-lane suppression or duplicate leaf override is added here.
• AppGuardrail 34146507660: RED only at final gate after checkout, pinned scanner verification, scan, detector-contract verification, evidence redaction, SARIF upload and retained evidence upload completed. Three deploy-blocking HIGH todo-skip-auth findings are false positives on release-evidence-checksum-binding.test.mjs temp-directory literals ending -red-, -green-, and -order-; retained artifact 10028109754 has SHA-256 2246633936ffd0278baec1cec73f78c0b82ebf42ab838ad7206f2efb5debd6f1. The canonical scanner repair remains ContextualWisdomLab/appguardrail#1106 / Draft owner stack #998→#1129; AppGuardrail currently has no immutable GitHub release for LifeOS to consume.
• CodeQL PR 34146507626: terminal RED in the central compatibility/dispatch authority rather than product evidence; .github#1925/#1927 remain the owner path.

Submitted review authority contains only a GitHub Advanced Security COMMENTED review, not an independent APPROVED. Three current AppGuardrail code-scanning threads at checksum-binding test lines 97/111/127 remain unresolved intentionally until the scanner owner repair ships. They are not cosmetically rewritten or manually resolved to manufacture mergeability.

Shared owner repairs

#246 has advanced to Draft repair PR #249 from protected main. #249 adds root pnpm.overrides.qs = 6.16.0; exact temporary writer head 24151c18ed336075ac57336a0a87e7591245b4f4 must run pnpm@10.15.0, regenerate pnpm-lock.yaml, prove frozen install/typecheck, publish only the package-manager-owned delta, and self-remove. Writer run 34169583805 is currently queued and is not GREEN.

The AppGuardrail false-positive owner has regression work in Draft stack #998→#1129 but no immutable release. LifeOS therefore keeps the valid release evidence language and fails closed rather than weakening the gate.

Acceptance boundary

Keep Draft until the shared formatting/dependency/scanner/CodeQL owner repairs are integrated or immutably consumable, this exact/descendant head has unchanged-head terminal required GREEN evidence, a current independent approval, resolved valid review threads, live-base compatibility, and downstream immutable release/package/SBOM/provenance/reproducibility/rollback evidence.

The remaining documentation source gap is #211 docs/product-technical-gap-baseline.md, whose committed top currentness override is also stale for the newest #245 integration proof and #217/#247 control-plane state. PR/governance authority records the gap rather than reconstructing truncated historical Markdown.

No self-approval, administrator bypass, force-push, destructive rebase, stale evidence reuse, scanner suppression, or gate weakening is used.

Refs #210, #211, #212, #236, #246, #247, #249; ContextualWisdomLab/.github#712; ContextualWisdomLab/.github#1925; ContextualWisdomLab/.github#1927; ContextualWisdomLab/appguardrail#1106; ContextualWisdomLab/appguardrail#998; ContextualWisdomLab/appguardrail#1129.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}