Description
Historical delivery: make a built deployment candidate attest the immutable product source, deployment revision, overlay digest, and exact runtime projection contract.
Acceptance Criteria
- #1 Images record immutable product and deployment revisions plus overlay digest
- #2 Runtime projections fail closed on digest mismatch
- #3 A local build cannot silently publish or move a registry tag
Definition of Done
- #1 python3 -m pytest tests -q
- #2 tofu fmt -check -recursive terraform; tofu init -backend=false and tofu validate pass for terraform/ and terraform/examples/standalone/
- #3 customer-identifier and shipped-text gates from .github/workflows/ci.yml return clean
Implementation Notes
Re-verified during the ownership-boundary migration: 1,331 passed, 2 skipped, 6,570 subtests; fresh module and standalone OpenTofu validation succeeded; format, customer-identifier, and shipped-text gates are clean.
Later ownership-boundary candidate validation supersedes the 1,331 count: 1,333 passed, 2 skipped, 6,570 subtests using PATH=/opt/homebrew/opt/python@3.13/libexec/bin:/opt/homebrew/bin:/opt/homebrew/sbin:/usr/local/bin:/System/Cryptexes/App/usr/bin:/usr/bin:/bin:/usr/sbin:/sbin:/var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/local/bin:/var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/bin:/var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/appleinternal/bin:/pkg/env/global/bin:/Library/Apple/usr/bin:/Users/rob/.codex-work/packages/standalone/releases/0.149.0-aarch64-apple-darwin/codex-path:/Users/rob/.codex-work/tmp/arg0/codex-arg03R8UBy:/opt/homebrew/opt/python@3.13/libexec/bin:/Users/rob/.bun/bin:/Users/rob/go/bin:/opt/homebrew/opt/go/libexec/bin:/Applications/iTerm.app/Contents/Resources/utilities:/Users/rob/.orbstack/bin:/Users/rob/.local/bin:/opt/homebrew/opt/fzf/bin:/Users/rob/.orbstack/bin:/Users/rob/.local/bin python3 -m pytest tests -q. Exact containing revision will be appended after commit.
Final Summary
Completed before Backlog adoption. Provenance labels and runtime projection checks were validated in the migration baseline.