Release artifacts lack cosign signing — blocks inclusion in varve toolchain layers

[avrabe]

ordeal v0.17.0 publishes SHA256SUMS.txt with no cosign signature (no .cosign.bundle/.sig/.pem) — short of the org release-artifact standard (Track A: keyless cosign over the sums; canonical: synth's release.yml Phase 6+).

Concrete impact today: the varve deposit workflow assembles toolchain layers only from upstream releases whose sums verify against their repo's cosign identity — fail-closed, no TOFU. ordeal was slated for layer 2026.08.1 alongside rivet/synth/loom/meld/spar/witness/kiln/wsc and is now excluded until its releases sign. Copy the sums-signing block from synth's release.yml (or varve's, same shape); once a signed release exists, re-adding ordeal to the layer roster is a one-line change in varve's deposit-layer.yml.

🤖 Filed from the varve full-toolchain deposit per report-tool-friction.

[avrabe]

Accepted — this is the org Track-A gap, and it's in flight as TR-033 in the rivet graph.

PR #117 adds keyless cosign signing of SHA256SUMS.txt to the release workflow (same shape as synth's Phase-6 block: .cosign.bundle + detached .sig/.pem, identity https://github.com/pulseengine/ordeal/.github/workflows/release.yml@*, GitHub Actions OIDC issuer). It rides the v0.18.0 cut — which is otherwise ready (6/6 verified) — so v0.18.0 will be the first signed release. I'll post the cosign verify-blob output from the published assets here and close once it's live; re-adding ordeal to varve's deposit-layer.yml roster for the next layer is then the one-liner you described.

[avrabe]

v0.18.0 is live and is the first cosign-signed ordeal release. Verified on the published assets, not the workflow log:

$ gh release download v0.18.0 --repo pulseengine/ordeal
$ shasum -a 256 -c SHA256SUMS.txt
./ordeal-v0.18.0-aarch64-apple-darwin.tar.gz: OK
./ordeal-v0.18.0-aarch64-unknown-linux-gnu.tar.gz: OK
./ordeal-v0.18.0-x86_64-apple-darwin.tar.gz: OK
./ordeal-v0.18.0-x86_64-unknown-linux-gnu.tar.gz: OK
$ cosign verify-blob \
    --certificate-identity-regexp 'https://github.com/pulseengine/ordeal/.github/workflows/release.yml@.*' \
    --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
    --bundle SHA256SUMS.txt.cosign.bundle \
    SHA256SUMS.txt
Verified OK

Assets: SHA256SUMS.txt.cosign.bundle (verifier-friendly) plus detached .sig/.pem, exactly the Track-A shape varve consumes. Tracked as TR-033 (verified) in the rivet graph; the tag's falsification statement includes "varve's fail-closed deposit verification rejects the release" as a standing kill-criterion — if your deposit run rejects it, reopen this.

ordeal should now be re-addable to deposit-layer.yml for the next layer. Closing as shipped in v0.18.0.