From 5a212525a0340b5fe1ff169a3d0ca8642f9b95d0 Mon Sep 17 00:00:00 2001 From: tegwick Date: Sun, 23 Aug 2026 01:47:37 +0200 Subject: [PATCH] Record deployed SBOM provenance evidence Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a028de-e2c8-7732-8521-46a7fc5db82f --- .../ACTIVITY-WP-0034-sbom-controlled-source-reference.md | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/workplans/ACTIVITY-WP-0034-sbom-controlled-source-reference.md b/workplans/ACTIVITY-WP-0034-sbom-controlled-source-reference.md index f27c246..be71e3d 100644 --- a/workplans/ACTIVITY-WP-0034-sbom-controlled-source-reference.md +++ b/workplans/ACTIVITY-WP-0034-sbom-controlled-source-reference.md @@ -69,3 +69,11 @@ projection is not limited to the attended batch. The deterministic catch-up report now retains only the allowlisted kind/repository/revision fields and a `controlled_source_count`, so the first unassisted fire can prove provenance directly in State Hub without copying Nexus payloads or archive URLs. + +Deployed 2026-08-23 from commit `34867d7`; API, worker, and event-router run +image config `sha256:9c611a394c117c8ccfe2fd813c0dda1943ea8a7444aa4bd4742d83712b2cf559`. +An in-worker, read-only report probe against the live selection returned +`selected_count=3` and `controlled_source_count=3` with the exact allowlisted +references. The existing schedule was not manually fired. Verification before +deploy: 61 focused tests and 435 repository tests passed, with one live +integration test skipped.