release: revalidate evidence after manifest publication

[seonghobae]

Test-first scope

This bounded stacked draft addresses #59 without changing workflows or credentials.

• Exact stacked base: ccfd7809b352e95f4f6e646d0e886ac28e773698 from PR release: bind sealed evidence to a canonical root path #58.
• RED test-only exact head: d1c3bb80096f3c537f99fe79d0ad80c1a29cd5d5.
• Exact-head CI run: 31058973263.

Four isolated regressions demonstrate that the current CLI reports success when:

• the sealed evidence set changes immediately after the manifest writer returns;
• a second independent evidence pass would produce different manifest semantics;
• the closed output path is replaced with different bytes;
• the closed output path disappears before a bounded reread.

Exact-head package acceptance and Ruff succeeded. Python 3.10–3.13 failed only at pytest on the four intentional RED regressions, confirming the missing post-publication contract without an unrelated quality or packaging regression.

The bounded implementation has been specified for the pinned OpenCode agent. Production code, documentation, CHANGELOG.md, exact-head GREEN CI/security evidence, and automated review remain pending.

Trust boundary

No .github file, publication permission, signing identity, ref write, branch update workflow, conflict strategy, or model-executing credential path is introduced. This PR targets the exact stacked branch from PR #58 and remains draft. It must not be retargeted or merged before prerequisite stack integration, exact-head CI, SAST Semgrep, Security Scan, package acceptance, completed automated review, qualifying independent approval, and repository-policy gates all succeed.

Progresses #59 and #46.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: a1a7a1a3-a316-4e24-b478-199877f9b295

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@opencode-agent Implement the bounded GREEN slice for exact current test-only head d1c3bb80096f3c537f99fe79d0ad80c1a29cd5d5 without modifying .github, workflows, credentials, refs outside this PR branch, or prerequisite stack files beyond the four paths below.

The exact-head RED CI run 31058973263 is valid test-first evidence: package acceptance and Ruff succeeded; Python 3.10–3.13 failed only at pytest because all four new post-publication regressions still observe the old success behavior.

Required production contract:

1. In src/egressweave/release_evidence.py, add a beginner-readable private helper that runs after write_evidence_manifest(...) and before the success message. It must independently call build_evidence_manifest(...) again with the same canonical evidence root, repository, and source SHA. Normalize any SystemExit from that second verification to release evidence changed after manifest publication; reject a semantically different second manifest with the same message.
2. Encode the original manifest through the existing deterministic strict-JSON encoder, reopen the closed output through _read_bounded_file with maximum_bytes=len(expected_payload) and the existing output label, normalize any read failure to evidence manifest output changed after publication, and require byte-for-byte equality. Do not overwrite, repair, or delete failed output.
3. Update CHANGELOG.md under Unreleased/Security.
4. Update docs/sealed-release-evidence.md operator procedure, threat model/nonclaims, and references. Cite in APA 7th form: CWE Content Team. (2026). CWE-367: Time-of-check time-of-use (TOCTOU) race condition. MITRE. https://cwe.mitre.org/data/definitions/367.html. State explicitly that the final pass narrows but cannot eliminate races on mutable local storage.

Credential-free local verification against the exact base plus this implementation already demonstrated: 70 passed, with src/egressweave/release_evidence.py at 100% statement and branch coverage (356 statements, 118 branches) across tests/test_sealed_release_evidence*.py. Reproduce the complete repository CI on the new exact head. Keep the PR draft and do not merge or retarget it.