Core scoped release evidence
Issue #1626 implements SPEC-008 R1–R7 and ADR-001 in Development. This is prospective source, UNEXECUTED until an entire independent final-source review and NEW complete-input admission. Source delivery does not establish native qualification, publication, catalog admission or GA readiness.
Source and workflow boundary
scripts/ga-platform-scope-lib.mjs binds original policy bytes, Git blob and SHA-256 to Core commit a0384e676c1b2dbf66b915563ea70c176c09d598. Its requirements revision remains d2df8e4bb9533da24acfece6beee4578b1d50357. It rejects duplicate keys, changed scope, mutable policy references and caller-selected target lists. bind-scoped-workflow-source.mjs requires develop, checkout HEAD, candidate assertion and workflow SHA to identify the same exact candidate before acquisition or runtime work.
The five prescribed scoped workflows are separate manual entrypoints. They preserve the original legacy files and check context. Required host evidence is ordered Windows then Linux, x64 for Core/CLI and amd64 for TUI; Darwin is deferred. The associated scoped packaged Admin, MCP and archive fixture workflows keep the original independently pinned dependency identities. The archive producer fixture is Linux TAR evidence only; Windows ZIP obligations remain separate producer/importer and outer release checks.
Production boundaries
| Requirement | Actual source boundary |
|---|---|
| R1 | ga-platform-scope-lib.mjs, exact workflow source binding |
| R2 | scoped-release-evidence-lib.mjs, strict CLI protected2/portable2 and TUI3 dispatch, operator3 retained reader |
| R3 | terminal job/run/attempt metadata, retained artifact API/body digest, scope-bound receipt refs and original file buffers |
| R4 | candidate4 archives/6 files/checksum5; full6 archives +6 SBOMs/checksum13 files; CLI6 declared/8 public/checksum7; TUI2 archives/4 public/checksum2 |
| R5 | scoped-template-evidence-lib.mjs retains the fixed CLI/Core roles and TC01..TC12/CA01..CA08 under landed #1628; absent native proof body readers/catalog admissions block success |
| R6 | separate scoped producer, consumer, publisher and terminal workflows; selected CORE_SHA256 and exact aggregate Windows/Linux digests |
| R7 | original native/operator/runtime, security/provenance/archive, private custody, first failure, mutation/retry, resource/lifecycle and retained byte checks remain mandatory |
createCandidate2Evidence is called by the actual candidate producer and validated by the actual candidate consumer. The consumer requires the actual native host and protected operator3 before startup. Artifact readback independently verifies the actual current producer job, run/attempt/source, ninety-day retention and uploaded original ZIP digest.
The scoped Core outer archive preflight is separate from staged-service and CLI TAR grammars. It accepts the actual producer's effective GNU/PAX file/directory names and confined internal links, denies traversal/external links/duplicates/cycles and descendants through link aliases, and bounds gzip expansion/member counts. Linux extraction uses the same digest-verified held buffer on owned native TAR stdin and observes EOF plus process close; Windows ZIP extraction uses the held buffer and the existing safe ZIP implementation. Neither reopens a mutable archive pathname after preflight. Production compatibility and unsafe archive negatives are UNEXECUTED regression sources.
Full/npm publication also requires the latest actual source-selected scoped technical workflow on the identical candidate: completed qualify-release context with GitHub Actions app15368, actual current attempt/job, ninety-day aggregate artifact and original native bodies. Historical three-platform checks and older passing runs cannot substitute; missing/queued/failed current authority denies before publication. Full publication rereads this authority before every write.
Full publication uses the actual held thirteen buffers, twelve canonical ASCII checksum rows, archive/SBOM binding and two actual native MCP receipts. The publisher reads provider controls before mutation, creates a private draft, uploads held buffers once, verifies private IDs/inventory/bodies, finalizes, recursively resolves the tag, and compares every headerless public body with the original held buffer. It preserves the private journal and draft on failure. No publisher callback enrolls a catalog.
The npm wrapper independently binds public registry version/gitHead/SRI/latest identity, original tarball hash/size, raw operator manifest hash and opaque original tool buffers. The public npm TAR reader verifies those exact files inside the actual registry tarball without materialization or execution. The actual scoped registry consumer separately verifies retained operator3 and original manifest equality before runtime proof.
Published qualification uses a v4 envelope around the unchanged v3 private/public evidence body. It preserves negative proofs, original dependency pins, trusted Admin unlock receipts, first custody, first failure, no mutation retry, native lifecycle scenarios and cleanup convergence. Its current-attempt aggregate requires exactly Windows/Linux terminal successful jobs and complete provider inventories. Classified pre-browser failure remains failure.
Catalog and provider authority
Production Core publication and scoped tool catalogs are EMPTY. A coherent fixture, wrapper, provider response, caller release tuple or scope assertion cannot grant production authority. Source entries require actual immutable publication and a separately reviewed pins-only admission. Scoped tool pins bind scope/candidate schema, repository/tag/full source, release ID, exact asset IDs/URLs/sizes/digests and retained manifest/body bytes. Old distribution contracts remain readable under their own versions.
Operator3 TUI uses the exact candidate3 asset keys executable/name/platform/sha256; retention adds relativePath, yielding exactly five keys. Historical operator2 asset variants remain under their original reader and cannot serve as candidate3/schema/policy/catalog proof. There is no optional executable variant in scoped eligibility.
Read-only provider observation on 2026-10-04 found Core release environment ID 20898438221, protected-branch selection, develop admin enforcement with force-push/deletion disabled, and documented immutable-releases endpoint enabled:true/enforced_by_owner:false. These observations are source preflight bindings, not permanent claims: the actual publisher rereads controls before each write. It requires credentials able to read those controls; missing permissions fail before draft creation. No extra human reviewer or self-review rule is introduced. Provider settings were not changed.
Verification status
tests/scoped-release-evidence.test.js exercises the production candidate producer/reader, full held asset/SBOM/checksum validator, immutable public byte/tag/asset readback, current-attempt selector, empty-catalog prepublication denials, historical and scoped CLI reader compatibility, mixed versions, native tools/SEA/architecture substitutions, and npm original TAR byte reader. These are finite fixtures, not native or public qualification. All are UNEXECUTED in this author unit. Natural source CI and actual authorized native/public qualification remain separate evidence.
The reviewed TUI checksum, Template consumer-role and CLI archive-origin amendments must land before final interface freeze. The former CLI inner Windows ZIP blocker is an agent-added origin error; the selected protected2 route uses existing matching-host native TARs. Core staged-service Windows ZIP and Core outer Windows ZIP remain mandatory. Original failures and private evidence remain preserved.
PR1638 original-byte bridges: the published aggregate holds raw downloaded members, compares original provider ZIP bodies before fatal JSON decoding, and consumes those same verified buffers. Candidate smoke fetches original digest-bound ZIP in its own process, retains the exact six members and compares every held downloaded file before candidate validation or same-buffer archive extraction. No independent candidate checksum map establishes provider custody. Prospective actual-caller fixtures include both-platform aggregate success and classified failure, lossy UTF8 differences, original invalid UTF8, coherent Core runtime archive/manifest/sums replacement retaining original tool fixture bytes, and original digest/inventory substitution. They remain unexecuted before distinct entire-source review and NEW complete-input admission.
The sole final release publisher receives DEVELOPMENT_CANDIDATE_TOKEN from the existing protected release environment; no github.token fallback is eligible. Actual provisioning and Administration-read/Actions-read/Checks-read/Contents-write capability remain unproved; provider preflight and exact environment ID20898438221 plus current same-candidate app15368 technical authority stay mandatory before each write. No credential grants, provider settings, publication or deployment were performed. PR1637 retains its separate npm interpretation defect.