@cassiomc1/forgeloop 1.10.0 → 1.10.2

package/docs/diagrams/forgeloop-code-attestation-flow.workflow.json

@@ -11,87 +11,411 @@
       {
         "id": "completion-to-manifest",
         "label": "Completion to manifest",
-        "focus": ["complete", "receipt", "manifest", "captured"],
-        "note": "Follow the transactional binding between valid completion evidence and exact source content."
+        "focus": [
+          "complete",
+          "receipt",
+          "manifest",
+          "captured"
+        ],
+        "note": "Completion and exact-content evidence bind to the project and task. No supplied CI receipt means NOT_VERIFIED."
       },
       {
         "id": "manifest-to-statement",
         "label": "Manifest to statement",
-        "focus": ["manifest", "captured", "statement", "signing", "bundle"],
+        "focus": [
+          "manifest",
+          "captured",
+          "statement",
+          "signing",
+          "bundle"
+        ],
         "note": "See how the deterministic code manifest becomes an in-toto Statement v1 and optional signature bundle."
       },
       {
         "id": "revision-range-coverage",
         "label": "Revision-range coverage",
-        "focus": ["base", "provider", "changed", "attestations", "union", "range"],
+        "focus": [
+          "base",
+          "provider",
+          "changed",
+          "attestations",
+          "union",
+          "range"
+        ],
         "note": "Inspect the separate changed-path coverage question and its gap or conflict result."
       }
     ],
     "legend": {
       "mode": "auto",
       "entries": {
-        "backend": { "label": "Protocol state" },
-        "database": { "label": "Content/evidence" },
-        "security": { "label": "Policy boundary" },
-        "cloud": { "label": "Signer" },
-        "messagebus": { "label": "Failure" },
-        "external": { "label": "Completion" }
+        "backend": {
+          "label": "Protocol state"
+        },
+        "database": {
+          "label": "Content/evidence"
+        },
+        "security": {
+          "label": "Policy boundary"
+        },
+        "cloud": {
+          "label": "Signer"
+        },
+        "messagebus": {
+          "label": "Failure"
+        },
+        "external": {
+          "label": "Completion"
+        }
       }
     }
   },
   "lanes": [
-    { "id": "completion", "label": "Completion Evidence" },
-    { "id": "integrity", "label": "Content Integrity" },
-    { "id": "providers", "label": "Provider Boundaries" },
-    { "id": "verification", "label": "Read-Only Verification" },
-    { "id": "results", "label": "Attestation Results" },
-    { "id": "coverage", "label": "Revision-Range Coverage" },
-    { "id": "exceptions", "label": "Gaps + Conflicts", "variant": "exception" }
+    {
+      "id": "completion",
+      "label": "Completion Evidence"
+    },
+    {
+      "id": "integrity",
+      "label": "Content Integrity"
+    },
+    {
+      "id": "providers",
+      "label": "Provider Boundaries"
+    },
+    {
+      "id": "verification",
+      "label": "Read-Only Verification"
+    },
+    {
+      "id": "results",
+      "label": "Attestation Results"
+    },
+    {
+      "id": "coverage",
+      "label": "Revision-Range Coverage"
+    },
+    {
+      "id": "exceptions",
+      "label": "Gaps + Conflicts",
+      "variant": "exception"
+    }
   ],
   "phases": [
-    { "id": "capture", "label": "Capture content", "fromCol": 0, "toCol": 1 },
-    { "id": "statement", "label": "Bind and sign", "fromCol": 2, "toCol": 3, "variant": "emphasis" },
-    { "id": "range", "label": "Evaluate coverage", "fromCol": 4, "toCol": 5, "variant": "dashed" }
+    {
+      "id": "capture",
+      "label": "Capture content",
+      "fromCol": 0,
+      "toCol": 1
+    },
+    {
+      "id": "statement",
+      "label": "Bind and sign",
+      "fromCol": 2,
+      "toCol": 3,
+      "variant": "emphasis"
+    },
+    {
+      "id": "range",
+      "label": "Evaluate coverage",
+      "fromCol": 4,
+      "toCol": 5,
+      "variant": "dashed"
+    }
   ],
   "groups": [
-    { "id": "completion_binding", "label": "Completion transaction", "lane": "integrity", "fromCol": 0, "toCol": 3, "variant": "emphasis" },
-    { "id": "signer_boundary", "label": "Optional external signer", "lane": "providers", "fromCol": 4, "toCol": 5, "variant": "security" },
-    { "id": "coverage_boundary", "label": "Coverage is a separate question", "lane": "coverage", "fromCol": 0, "toCol": 5, "variant": "dashed" }
+    {
+      "id": "completion_binding",
+      "label": "Completion transaction",
+      "lane": "integrity",
+      "fromCol": 0,
+      "toCol": 3,
+      "variant": "emphasis"
+    },
+    {
+      "id": "signer_boundary",
+      "label": "Optional external signer",
+      "lane": "providers",
+      "fromCol": 4,
+      "toCol": 5,
+      "variant": "security"
+    },
+    {
+      "id": "coverage_boundary",
+      "label": "Coverage is a separate question",
+      "lane": "coverage",
+      "fromCol": 0,
+      "toCol": 5,
+      "variant": "dashed"
+    }
+  ],
+  "mainPath": [
+    "complete",
+    "receipt",
+    "manifest",
+    "captured",
+    "statement",
+    "signing",
+    "bundle",
+    "verify"
   ],
-  "mainPath": ["complete", "receipt", "manifest", "captured", "statement", "signing", "bundle", "verify"],
   "nodes": [
-    { "id": "complete", "lane": "completion", "col": 0, "type": "external", "label": "VALID", "sublabel": "completion", "width": 52 },
-    { "id": "receipt", "lane": "completion", "col": 1, "type": "database", "label": "Receipt", "sublabel": "ledger", "width": 54 },
-    { "id": "manifest", "lane": "integrity", "col": 2, "type": "database", "label": "Manifest", "sublabel": "SHA-256", "tag": "exact", "width": 60 },
-    { "id": "captured", "lane": "integrity", "col": 3, "type": "security", "label": "Captured", "sublabel": "transaction", "width": 68 },
-    { "id": "statement", "lane": "providers", "col": 4, "type": "backend", "label": "in-toto v1", "sublabel": "statement", "width": 72 },
-    { "id": "signing", "lane": "providers", "col": 5, "type": "cloud", "label": "Signer", "sublabel": "optional", "tag": "Cosign", "width": 58 },
-    { "id": "bundle", "lane": "verification", "col": 5, "type": "database", "label": "Bundle", "sublabel": "policy-bound", "width": 66 },
-    { "id": "verify", "lane": "results", "col": 5, "type": "security", "label": "Verify", "sublabel": "read-only", "tag": "no mutation", "width": 62 },
-    { "id": "base", "lane": "coverage", "col": 0, "type": "cloud", "label": "Base", "sublabel": "revision", "width": 52 },
-    { "id": "provider", "lane": "coverage", "col": 1, "type": "backend", "label": "Rev", "sublabel": "provider", "width": 52 },
-    { "id": "changed", "lane": "coverage", "col": 2, "type": "database", "label": "Paths", "sublabel": "changed", "width": 52 },
-    { "id": "attestations", "lane": "coverage", "col": 3, "type": "backend", "label": "Attest", "sublabel": "valid", "width": 42 },
-    { "id": "union", "lane": "coverage", "col": 4, "type": "database", "label": "Union", "sublabel": "digests", "width": 42 },
-    { "id": "range", "lane": "coverage", "col": 5, "type": "security", "label": "Range", "sublabel": "coverage", "tag": "no gaps", "width": 58 },
-    { "id": "boundary", "lane": "exceptions", "col": 3, "type": "security", "label": "Boundary", "sublabel": "scope/coverage", "tag": "important", "width": 74 },
-    { "id": "gap", "lane": "exceptions", "col": 5, "type": "messagebus", "label": "Gap", "sublabel": "fail closed", "width": 60 }
+    {
+      "id": "complete",
+      "lane": "completion",
+      "col": 0,
+      "type": "external",
+      "label": "VALID",
+      "sublabel": "completion",
+      "width": 52
+    },
+    {
+      "id": "receipt",
+      "lane": "completion",
+      "col": 1,
+      "type": "database",
+      "label": "Receipt",
+      "sublabel": "ledger",
+      "width": 54
+    },
+    {
+      "id": "manifest",
+      "lane": "integrity",
+      "col": 2,
+      "type": "database",
+      "label": "Manifest",
+      "sublabel": "SHA-256",
+      "tag": "exact",
+      "width": 60
+    },
+    {
+      "id": "captured",
+      "lane": "integrity",
+      "col": 3,
+      "type": "security",
+      "label": "Captured",
+      "sublabel": "transaction",
+      "width": 68
+    },
+    {
+      "id": "statement",
+      "lane": "providers",
+      "col": 4,
+      "type": "backend",
+      "label": "in-toto v1",
+      "sublabel": "statement",
+      "width": 72
+    },
+    {
+      "id": "signing",
+      "lane": "providers",
+      "col": 5,
+      "type": "cloud",
+      "label": "Signer",
+      "sublabel": "optional",
+      "tag": "Cosign",
+      "width": 58
+    },
+    {
+      "id": "bundle",
+      "lane": "verification",
+      "col": 5,
+      "type": "database",
+      "label": "Bundle",
+      "sublabel": "policy-bound",
+      "width": 66
+    },
+    {
+      "id": "verify",
+      "lane": "results",
+      "col": 5,
+      "type": "security",
+      "label": "Verify",
+      "sublabel": "read-only",
+      "tag": "no mutation",
+      "width": 62
+    },
+    {
+      "id": "base",
+      "lane": "coverage",
+      "col": 0,
+      "type": "cloud",
+      "label": "Base",
+      "sublabel": "revision",
+      "width": 52
+    },
+    {
+      "id": "provider",
+      "lane": "coverage",
+      "col": 1,
+      "type": "backend",
+      "label": "Rev",
+      "sublabel": "provider",
+      "width": 52
+    },
+    {
+      "id": "changed",
+      "lane": "coverage",
+      "col": 2,
+      "type": "database",
+      "label": "Paths",
+      "sublabel": "changed",
+      "width": 52
+    },
+    {
+      "id": "attestations",
+      "lane": "coverage",
+      "col": 3,
+      "type": "backend",
+      "label": "Attest",
+      "sublabel": "valid",
+      "width": 42
+    },
+    {
+      "id": "union",
+      "lane": "coverage",
+      "col": 4,
+      "type": "database",
+      "label": "Union",
+      "sublabel": "digests",
+      "width": 42
+    },
+    {
+      "id": "range",
+      "lane": "coverage",
+      "col": 5,
+      "type": "security",
+      "label": "Range",
+      "sublabel": "coverage",
+      "tag": "no gaps",
+      "width": 58
+    },
+    {
+      "id": "boundary",
+      "lane": "exceptions",
+      "col": 3,
+      "type": "security",
+      "label": "Boundary",
+      "sublabel": "scope/coverage",
+      "tag": "important",
+      "width": 74
+    },
+    {
+      "id": "gap",
+      "lane": "exceptions",
+      "col": 5,
+      "type": "messagebus",
+      "label": "Gap",
+      "sublabel": "fail closed",
+      "width": 60
+    }
   ],
   "edges": [
-    { "id": "complete-receipt", "from": "complete", "to": "receipt", "variant": "emphasis" },
-    { "id": "receipt-manifest", "from": "receipt", "to": "manifest", "variant": "security", "route": "drop", "fromSide": "bottom", "toSide": "top" },
-    { "id": "manifest-captured", "from": "manifest", "to": "captured", "variant": "emphasis" },
-    { "id": "captured-statement", "from": "captured", "to": "statement", "variant": "security", "route": "drop", "fromSide": "bottom", "toSide": "top" },
-    { "id": "statement-signing", "from": "statement", "to": "signing", "variant": "dashed", "fromSide": "bottom", "toSide": "top", "route": "drop" },
-    { "id": "signing-bundle", "from": "signing", "to": "bundle", "variant": "security", "route": "drop", "fromSide": "bottom", "toSide": "top" },
-    { "id": "bundle-verify", "from": "bundle", "to": "verify", "variant": "emphasis" },
-    { "id": "base-provider", "from": "base", "to": "provider", "variant": "dashed" },
-    { "id": "provider-changed", "from": "provider", "to": "changed", "variant": "security" },
-    { "id": "changed-attestations", "from": "changed", "to": "attestations", "variant": "emphasis" },
-    { "id": "attestations-union", "from": "attestations", "to": "union", "variant": "dashed" },
-    { "id": "union-range", "from": "union", "to": "range", "variant": "security" },
-    { "id": "manifest-boundary", "from": "manifest", "to": "boundary", "variant": "dashed", "role": "branch", "fromSide": "left", "toSide": "left", "route": "return-left", "channelX": 44 },
-    { "id": "union-gap", "from": "union", "to": "gap", "variant": "security", "role": "error", "fromSide": "right", "toSide": "left", "route": "outside-right", "channelX": 550 }
+    {
+      "id": "complete-receipt",
+      "from": "complete",
+      "to": "receipt",
+      "variant": "emphasis"
+    },
+    {
+      "id": "receipt-manifest",
+      "from": "receipt",
+      "to": "manifest",
+      "variant": "security",
+      "route": "drop",
+      "fromSide": "bottom",
+      "toSide": "top"
+    },
+    {
+      "id": "manifest-captured",
+      "from": "manifest",
+      "to": "captured",
+      "variant": "emphasis"
+    },
+    {
+      "id": "captured-statement",
+      "from": "captured",
+      "to": "statement",
+      "variant": "security",
+      "route": "drop",
+      "fromSide": "bottom",
+      "toSide": "top"
+    },
+    {
+      "id": "statement-signing",
+      "from": "statement",
+      "to": "signing",
+      "variant": "dashed",
+      "fromSide": "bottom",
+      "toSide": "top",
+      "route": "drop"
+    },
+    {
+      "id": "signing-bundle",
+      "from": "signing",
+      "to": "bundle",
+      "variant": "security",
+      "route": "drop",
+      "fromSide": "bottom",
+      "toSide": "top"
+    },
+    {
+      "id": "bundle-verify",
+      "from": "bundle",
+      "to": "verify",
+      "variant": "emphasis"
+    },
+    {
+      "id": "base-provider",
+      "from": "base",
+      "to": "provider",
+      "variant": "dashed"
+    },
+    {
+      "id": "provider-changed",
+      "from": "provider",
+      "to": "changed",
+      "variant": "security"
+    },
+    {
+      "id": "changed-attestations",
+      "from": "changed",
+      "to": "attestations",
+      "variant": "emphasis"
+    },
+    {
+      "id": "attestations-union",
+      "from": "attestations",
+      "to": "union",
+      "variant": "dashed"
+    },
+    {
+      "id": "union-range",
+      "from": "union",
+      "to": "range",
+      "variant": "security"
+    },
+    {
+      "id": "manifest-boundary",
+      "from": "manifest",
+      "to": "boundary",
+      "variant": "dashed",
+      "role": "branch",
+      "fromSide": "left",
+      "toSide": "left",
+      "route": "return-left",
+      "channelX": 44
+    },
+    {
+      "id": "union-gap",
+      "from": "union",
+      "to": "gap",
+      "variant": "security",
+      "role": "error",
+      "fromSide": "right",
+      "toSide": "left",
+      "route": "outside-right",
+      "channelX": 550
+    }
   ],
   "cards": [
     {
@@ -100,7 +424,8 @@
       "items": [
         "PROCESSED means artifacts exist and parse",
         "VERIFIED means completion, evidence, manifest, and content bindings validate",
-        "ATTESTED additionally requires a valid external signature policy"
+        "ATTESTED additionally requires a valid external signature policy",
+        "No supplied CI receipt means NOT_VERIFIED, not a trust level"
       ]
     },
     {
@@ -109,7 +434,8 @@
       "items": [
         "The manifest records one SHA-256 digest per changed source entry",
         "The in-toto statement binds the manifest to completion evidence",
-        "Read-only verification never rewrites task state or ledger events"
+        "Read-only verification never rewrites task state or ledger events",
+        "Compaction preserves transaction manifests and event history"
       ]
     },
     {
@@ -118,7 +444,7 @@
       "items": [
         "Revision-range coverage asks whether changed paths have valid attestations",
         "Gaps and conflicting task digests fail closed",
-        "Verification Scope ≠ Attestation Coverage"
+        "Verification Scope \u2260 Attestation Coverage"
       ]
     }
   ]