[fraware]

Purpose — viral distribution without false transferable security claims

Cumulative draft integration proposal extending #225 at pinned source 49a9e91026c3aee9c74154a749bff963d0165146. Targets main only to execute existing full CI and six-platform reproducibility; does not merge, close or modify #225.

The larger project's near-term distribution strategy is simple: a developer obtains a bounded, comprehensible and reusable verification report from their ordinary GitHub PR. It must never transform a fixture result or caller-supplied unbound manifest into an apparently verified entire PR. This PR closes an unguarded publication path in the composite GitHub Action.

Finding and correction

inputs.verification-manifest != '' invoked ovk verify on a caller-selected manifest without prepare_verified_change_input.py, then allowed Emit OVK GitHub check (verify path) and Post OVK pull-request comment to publish to GitHub. A configured head_sha alone did not establish a source-to-model/pr-diff correspondence for the manifest.

Changes:

1. Remove the manifest-specific GitHub Check emission step entirely. Restrict PR-comment publication to the default internally prepared source-bound change input.
2. Reject strict Action enforcement for an explicit manifest until manifest inputs and source coverage have an authenticated binding. Local advisory manifest verification stays available with no Check/comment publication. Emit an explicit scope warning even if the user requests publication.
3. Invalidate reserved generated Action outputs before the installer runs. upload-artifact executes with always(); stale receipts from earlier invocations in the same workspace must not be reuploaded on installer failure.
4. In manifest mode remove the prior source receipt/handoff, and refuse prepopulated output bundles without deleting caller-owned contents. No evidence is silently mixed across invocations.
5. Regression tests assert the absence of publication routes and strict mode, and execute real Bash refusal on strict and prepopulated output directories. The source-identity limitation is documented in docs/PR_SOURCE_BINDING_V1.md.

No change to the underlying verifier's proven semantics, source-to-IR correspondence, signed EvidenceBundle, verified GitHub event authentication, or production relying authority. General software-security certification remains explicitly unqualified.

Required qualification and product gates

• Exact-head CI all jobs and six-platform reproducibility must pass on the final proposed SHA. The parent integration: preserve pilot evidence integrity and release provenance across drafts #225 has its own separate open qualification, and no earlier green parent CI is sufficient.
• Independently review the Action's generated-output filename reservation and multi-invocation behavior; inspect the real Action dogfood on a GitHub synthetic merge preview.
• Check that ordinary source-bound default PR check continues functioning while unbound caller-diff and manifest inputs produce advisory artifacts only.
• Do not merge without upstream provenance/metrics review. Do not publish the unsigned/unprotected historical tag or unqualified v1.3 RC. Ref/tag governance Release blocker: protect main and v* release tags before v1.3.0-rc.1 #25 and external consent/pilot Run an external advisory-mode pilot #20 remain separate blockers.

Decision: draft / no release / no strict enforcement / no signed portable certificate until independent proof and operational review.

[fraware]

Additional publication-channel closure and frozen-head test gate — 2026-10-15

Exact candidate source: 16afc46e9fc0eb2a1a2518ce3b567bc4873541bc. This PR remains draft/unmerged. New CI 38829751821 and six-platform Repro 38829751850 are queued; no green claim until both complete at this exact head.

The security audit extended beyond Check/comment emission:

• Set action outputs previously exported decision_state=allow and recommendation=allow from caller-selected verification-manifest or changed-files inputs, even where auto Check/comment publishing was suppressed. Downstream user workflow steps could interpret those outputs as PR approval. Both explicitly unbound input modes now export unknown, require_human_review, exit_code=2, check_emitted=false. Their detailed local advisory evidence is preserved.
• The internally prepared default PR diff still preserves its observed decision state and normal Action outputs, subject to the existing unauthenticated/source-to-model/strict-profile limits. Regression tests exercise both branches with real Bash output parsing.
• Pre-install generated-output invalidation prevents stale artifacts from being uploaded via if: always() on an install failure. Manifest mode refuses populated bundle output directories rather than merging historical and current artifacts, and does not delete caller-owned nonempty bundle contents. Strict manifest execution exits 2 before verifier use.
• The source identity limitations and output distinction are now documented. None of these guards proves that a supported source profile comprehensively captures arbitrary application behavior.

Independent quality gate: inspect final exact-head CI/repro, then security review of composite Action outputs and any remaining alternate publication path before marking review-ready. No production reliance, signed evidence transport, source-model sufficiency, administrative release ref protection, or independent pilot is established.

[fraware]

Failed-first CI and corrected final-head contract — 2026-10-15

Initial candidate 16afc46e9fc0eb2a1a2518ce3b567bc4873541bc: CI 38829751821 FAILED. The first unit failure was in an inherited contract test still expecting inputs.verification-manifest != '' in the PR-comment publication condition. That expectation described the old unsafe behavior; it contradicted this PR's deliberate refusal to publish unbound manifests. The existing contract assertion was updated to inputs.verification-manifest == '', documenting the reason, without weakening the new unbound-source regression tests.

Current exact candidate: 52ab39d3bbfb12327b32bc576b50509b11bbd32e. CI 38830619642 and six-platform repro 38830619644 were queued at the checkpoint. No passing conclusion asserted. The original failed workflow remains recorded.

The cumulative follow-on #227 introduces an independent read-only advisory job summary and its own additional tests; neither PR has been merged or released. Main branch/ref protections and independently adjudicated external pilots remain open.