coulomb/activity-core
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Record deployed SBOM provenance evidence
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a028de-e2c8-7732-8521-46a7fc5db82f
This commit is contained in:
tegwick 2026-08-23 01:47:37 +02:00
parent 34867d784f
commit 5a212525a0
1 changed files with 8 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

8
workplans/ACTIVITY-WP-0034-sbom-controlled-source-reference.md
View file

@ -69,3 +69,11 @@ projection is not limited to the attended batch. The deterministic catch-up
report now retains only the allowlisted kind/repository/revision fields and a
`controlled_source_count`, so the first unassisted fire can prove provenance
directly in State Hub without copying Nexus payloads or archive URLs.
Deployed 2026-08-23 from commit `34867d7`; API, worker, and event-router run
image config `sha256:9c611a394c117c8ccfe2fd813c0dda1943ea8a7444aa4bd4742d83712b2cf559`.
An in-worker, read-only report probe against the live selection returned
`selected_count=3` and `controlled_source_count=3` with the exact allowlisted
references. The existing schedule was not manually fired. Verification before
deploy: 61 focused tests and 435 repository tests passed, with one live
integration test skipped.