release: bind sealed evidence to exact source identity

[seonghobae]

Summary

• seal the exact repository and protected-main source commit inside canonical SOURCE_IDENTITY.json rather than trusting caller assertions;
• cover that identity in canonical SHA256SUMS, retain its exact digest in handoff manifest format version 2, and revalidate every accepted file before manifest issuance;
• bind each parsed SBOM and source-identity snapshot to the digest already accepted from the sealed checksum set, preventing parse-time substitution of alternate valid JSON;
• reject output-parent redirection into the verified evidence set during the verification-to-manifest handoff window;
• preserve bounded descriptor/path controls, strict CycloneDX 1.7 artifact binding, deterministic output, standalone operation, and provider-neutral downstream handoff;
• update operator guidance and CHANGELOG.md without changing workflows or introducing publication authority.

Exact-head sequencing

• Exact stacked base: b17e8a044704bb98b59970510492c4915d374f5a from PR release: verify sealed SBOM evidence before attestation #54.
• Source-identity RED head: 8adb4e2305a454714864ac8e251fbd66ee2e946b.
• Output-parent redirection RED head: 8489c52af83b7afb004809ef0e805cb339d29378.
• Exact current proposed head: eb2cba679ff1202866850cb24049efad885f0dc8.

This PR targets feature/sealed-release-evidence-verifier, not protected main. It remains draft until PR #54 is integrated with current protected main through an auditable credential-separated exact-tree mechanism and the complete stack is independently reverified. PR #58 is a later bounded slice stacked on this exact head and does not change this PR's current tree.

Changed paths

The nine changed paths are limited to CHANGELOG.md, operator documentation, the credential-free verifier, and its tests. No .github path is changed.

Test-first evidence

The output-parent redirection RED head caused every Python 3.10–3.13 job to fail only because the CLI accepted a parent redirected into the evidence directory and issued manifest.json inside the verified set. The first implementation passed all tests but correctly failed the 100% coverage gate on two uncovered storage-error lines. Exact current head includes the explicit failure-normalization regressions.

Exact-current-head verification

Exact head eb2cba679ff1202866850cb24049efad885f0dc8 passed the read-only exact-head ci workflow:

• Python 3.10–3.13 test matrix;
• 713 tests on Python 3.13;
• 100% production statement and branch coverage over 1,591 statements and 548 branches;
• Ruff, compile checks, product-guard self-test, and public-docstring contracts;
• wheel and source-distribution package acceptance and installed-wheel smoke testing;
• exact SHA checkout with persisted credentials disabled and repository permissions limited to contents: read and metadata: read.

Only ci is associated with this stacked exact head. Exact-head SAST Semgrep, Security Scan, completed automated review, and qualifying independent approval are not treated as satisfied. CodeRabbit review requests have been rate-limited; review latency is not a pass condition. There are no submitted reviews or unresolved inline review threads.

Verification contract

The verifier requires the exact six-file set: canonical wheel, source distribution, paired CycloneDX 1.7 SBOMs, SOURCE_IDENTITY.json, and canonical SHA256SUMS.

SOURCE_IDENTITY.json is strict, canonical, bounded, descriptor-bound JSON with an exact repository and 40-character lowercase source commit. Its digest is covered by SHA256SUMS, retained in manifest format version 2, and rechecked through final manifest issuance. Caller expectations must equal the sealed values.

Each parsed SBOM and source-identity snapshot must match the digest already accepted from the checksum set. A valid alternate JSON document exposed only during semantic parsing therefore fails closed even if the original checksummed bytes are restored before final rehashing.

The writer checks the current resolved output location before verification and rechecks the current output parent immediately before exclusive creation, after descriptor/path binding, and after durable synchronization. Redirecting a previously safe parent into the verified evidence directory fails closed before trusted handoff issuance.

Changing repository or source identity changes the sealed checksum evidence and handoff-manifest bytes. This is evidence binding, not proof that artifacts were honestly built from the claimed source; protected provenance remains a separate independently reviewed organization control.

Trust boundary

No branch-local workflow, publication permission, signing credential, protected-ref write, self-push, merge/rebase job, conflict strategy, or model-executing write identity is introduced. The verifier remains credential-free; downstream attestation and publication remain separately reviewed organization controls.

Remaining gates

Before integration or merge, require:

• prerequisite exact-tree integration of PR release: verify sealed SBOM evidence before attestation #54 with current protected main through an auditable credential-separated mechanism;
• exact-current-head SAST Semgrep and Security Scan on the integrated tree;
• completed exact-current-head automated review with no actionable finding;
• qualifying independent approval anchored to the unchanged integrated exact head;
• branch protection and repository-policy satisfaction.

Progresses #55 and #46.

[coderabbitai]

Warning

Review limit reached

@seonghobae, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 51 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 352e11b1-b408-472e-92f4-458402225733

📥 Commits

Reviewing files that changed from the base of the PR and between b17e8a0 and eb2cba6.

📒 Files selected for processing (9)

• CHANGELOG.md
• docs/sealed-release-evidence.md
• src/egressweave/release_evidence.py
• tests/test_sealed_release_evidence.py
• tests/test_sealed_release_evidence_checksum_snapshot.py
• tests/test_sealed_release_evidence_output_boundary.py
• tests/test_sealed_release_evidence_sbom_digest_binding.py
• tests/test_sealed_release_evidence_snapshot_boundary.py
• tests/test_sealed_release_evidence_source_identity.py

---

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@coderabbitai review

[coderabbitai]

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[seonghobae]

@opencode-agent @cwl-noema-review Please independently inspect exact current head eb2cba679ff1202866850cb24049efad885f0dc8 against base b17e8a044704bb98b59970510492c4915d374f5a.

Review the complete nine-file diff and distinguish actionable findings from stale predecessor-head analysis. Prioritize the six-file evidence cardinality, canonical SOURCE_IDENTITY.json profile, checksum coverage, parse-time SBOM/source-identity digest binding, descriptor/path and bounded-read controls, final rehash lifetime, manifest-format-v2 semantics, and the manifest output-parent TOCTOU boundary. Specifically verify that redirecting a previously safe output parent into the verified evidence directory during verification fails closed, while the credential-free provider-neutral handoff, public docstrings, APA 7th references, and unchanged workflow trust boundary remain intact.

The regression was demonstrated at RED exact head 8489c52af83b7afb004809ef0e805cb339d29378; all Python 3.10–3.13 test jobs failed only because the redirected-parent attack was still accepted. Exact current head eb2cba679ff1202866850cb24049efad885f0dc8 now passes the read-only exact-head ci workflow, package acceptance, 713 tests, and 100% production statement and branch coverage over 1,591 statements and 548 branches. Do not treat absent SAST Semgrep, absent Security Scan, CodeRabbit review latency, stack sequencing, or absent independent approval as successful. Submit concrete findings or an exact-head verdict only; do not approve unless every applicable gate is satisfied.

[seonghobae]

@coderabbitai review

[coderabbitai]

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[seonghobae]

@coderabbitai review

Review exact current stacked head eb2cba679ff1202866850cb24049efad885f0dc8 against exact base b17e8a044704bb98b59970510492c4915d374f5a. Ignore predecessor-head and rate-limit status. Focus on canonical SOURCE_IDENTITY.json, exact checksum coverage, parse-time SBOM/source-identity digest binding, final rehash lifetime, output-parent redirection refusal, strict JSON, bounded descriptor/path controls, manifest format v2, unchanged workflow trust boundary, beginner-readable docstrings, and APA 7th guidance. Do not treat absent SAST/Security Scan, stack sequencing, draft state, or independent approval as satisfied.

[coderabbitai]

Your plan includes PR reviews subject to rate limits. More reviews will be available in 20 seconds.