Harden stable release execution

Author: ammarheidari

.github/workflows/dotnet.yml

@@ -14,10 +14,10 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup .NET
-        uses: actions/setup-dotnet@v5
+        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
         with:
           dotnet-version: 10.0.x
 

.github/workflows/release.yml

@@ -4,6 +4,27 @@ All notable changes to SIGTRAN.NET will be documented in this file.
 
 This project follows Semantic Versioning once the public API reaches a stable release. During the alpha phase, breaking API changes may still occur as protocol behavior, transport abstractions, and interoperability evidence are finalized.
 
+## [1.0.0-rc.2] - Unreleased
+
+### Added
+
+- Formal layer contracts and stateful SCTP, M3UA, M2PA, SCCP, TCAP, and MAP SMS
+  runtime APIs.
+- Runtime health, BCL/OpenTelemetry diagnostics, structured events,
+  configuration validation, and an operations host.
+- Reflection-based public API baseline and protected stable release decision.
+
+### Changed
+
+- Normal package builds now produce `1.0.0-rc.2` rather than accidental stable
+  `1.0.0` packages.
+- Repository release/evidence governance types are internal and no longer part
+  of the consumer API.
+
+### Release status
+
+Unpublished. Stable `1.0.0` remains blocked by the retained `NO-GO` decision.
+
 ## [0.1.0-alpha] - 2026-06-27
 
 ### Release type

CHANGELOG.md

@@ -13,7 +13,9 @@ Repository: <https://github.com/araditc/sigtran.net>
 ## Status
 
 SIGTRAN.NET is currently in a **public release-candidate** track. Version
-`1.0.0-rc.1` has been published and restored from NuGet.org.
+`1.0.0-rc.1` has been published and restored from NuGet.org. Source builds now
+default to the unpublished `1.0.0-rc.2` candidate so ordinary packing cannot
+accidentally create a stable package.
 
 Native Linux SCTP, external SCTP/M3UA, and cross-implementation full-stack MAP
 SMS traffic evidence are retained. Stateful M3UA, M2PA, SCCP, TCAP, and MAP SMS
@@ -174,6 +176,8 @@ Start here:
 - [Phase 53 performance and resilience](docs/PHASE53_OPERATOR_PERFORMANCE_RESILIENCE.md)
 - [Phase 54 production operations package](docs/PHASE54_PRODUCTION_OPERATIONS_PACKAGE.md)
 - [Runtime operations](docs/OPERATIONS_RUNTIME.md)
+- [Phase 55 stable release execution](docs/PHASE55_STABLE_RELEASE_EXECUTION.md)
+- [Public API baseline](docs/PUBLIC_API_BASELINE.md)
 - [Interoperability and tooling](docs/INTEROPERABILITY.md)
 - [Compatibility policy](docs/COMPATIBILITY.md)
 - [Quality and contribution rules](docs/QUALITY.md)
@@ -184,6 +188,7 @@ Release and governance:
 
 - [Changelog](CHANGELOG.md)
 - [v0.1.0-alpha release notes](docs/releases/v0.1.0-alpha.md)
+- [RC.1 to RC.2 migration](docs/migrations/1.0.0-rc.1-to-rc.2.md)
 - [Alpha release checklist](docs/ALPHA_RELEASE.md)
 - [Production readiness report](docs/COMMERCIAL_READINESS_REPORT.md)
 
@@ -228,6 +233,7 @@ Stable production support requires:
 - Trusted package signing and provenance.
 - Stable package publication evidence.
 - Stable API lifecycle validation.
+- A machine-evaluated `GO` stable release decision.
 - Security, release, compliance, and operations review.
 
 The Linux SCTP, external M3UA, repository-profile full-stack traffic, and

README.md

@@ -19,6 +19,9 @@ Avoid public type, member, and parameter names containing:
 - `ReadinessReport`
 - Phase-numbered names such as `Phase17`
 
-Historical planning documents can still describe business goals in prose, but SDK identifiers must remain neutral, protocol-oriented, and reusable outside this repository's release plan.
+Historical planning documents can still describe business goals in prose, but
+SDK identifiers must remain neutral, protocol-oriented, and reusable outside
+this repository's release plan. Release governance models are internal and are
+not part of the package compatibility contract.
 
 The test suite includes a public API naming guard that scans exported types, public members, and public parameters for these banned planning terms.

docs/API_NAMING.md

@@ -2,6 +2,10 @@
 
 Status: public RC prerelease publication is closed; stable commercial publication remains gated.
 
+Source builds now default to unpublished version `1.0.0-rc.2`. Stable release
+manifest `eng/release/stable-release.json` and
+`eng/evaluate-stable-release.ps1` produce the authoritative machine decision.
+
 The readiness APIs now consume `SigtranVerificationCatalogs.CreateCurrent()`.
 Native Linux SCTP and external SCTP/M3UA evidence report passing status from their
 retained manifests instead of stale hard-coded flags.
@@ -56,6 +60,20 @@ retained manifests instead of stale hard-coded flags.
   Ubuntu 24.04 against the independent C/lksctp peer. Native SCTP established,
   the M3UA ASP became active, live/readiness were healthy, and the metrics
   endpoint reported one active association with zero faults or reconnects.
+- The exported SDK surface was reduced from 1,133 XML-documented types to 313
+  actual exported types. Repository governance/evidence types are internal.
+  Reflection baselines retain 6,440 RC.1 members and 2,185 stable-candidate
+  members; the intentional prerelease break is documented for RC.2.
+- The stable workflow now pins the SBOM tool, compares the public API baseline,
+  evaluates retained evidence, validates certificate chain/fingerprint/expiry,
+  requires a matching existing tag and exact confirmation, uses a protected
+  environment, uploads artifacts, verifies public NuGet restore, and creates a
+  GitHub release only after all gates pass.
+- GitHub API evidence confirms main branch protection with strict
+  `build-test-pack`, one approval, stale-review dismissal, conversation
+  resolution, linear history, and no force-push/deletion. The
+  `nuget-stable` environment is restricted to protected branches and requires
+  reviewer approval.
 
 ## Remaining Production Blockers
 
@@ -78,9 +96,18 @@ retained manifests instead of stale hard-coded flags.
   representative cluster SCTP/CNI deployment evidence has yet been retained.
   Cluster network, firewall, readiness, termination, and rollback behavior need
   validation in the adopting operator environment.
+- The machine-evaluated stable decision is `NO-GO`. Stable publication is
+  blocked by independent external M2PA, operator/vendor profile acceptance,
+  20K TPS capacity, multi-host soak, representative Kubernetes SCTP, and
+  organization-trusted signing evidence.
 
 ## Production Decision
 
 Do not publish this SDK as stable commercially production-ready yet.
 
-The SDK has enough retained evidence for public RC consumption and controlled integration use. The stable release gate is ready to evaluate future stable publication evidence, but it must not be used to claim a stable public commercial release until the protected stable publication run, trusted public signing evidence, and stable NuGet publication evidence are retained and verified. The legacy OpenSS7/IPSS7 path can remain as historical evidence, but it is no longer the SDK's permanent commercial gate.
+The SDK has enough retained evidence for public RC consumption and controlled
+integration use. Stable publication is mechanically guarded and remains
+`NO-GO`; no stable tag or NuGet package may be created until every manifest
+gate passes and the protected workflow succeeds. The legacy OpenSS7/IPSS7 path
+can remain as historical evidence, but it is no longer the SDK's permanent
+release gate.

docs/COMMERCIAL_READINESS_REPORT.md

@@ -6,7 +6,8 @@ This phase makes the public SDK surface easier to consume in large projects by d
 
 ## API Surface Catalog
 
-`SigtranApiSurfaceCatalog.GetSurfaces()` exposes the public API surfaces that adopters should track:
+The historical `SigtranApiSurfaceCatalog` described the API surfaces that
+adopters should track:
 
 - M3UA
 - SCTP
@@ -51,9 +52,12 @@ Migration guides must include code samples so users can update applications with
 
 ## Public API Baseline
 
-`SigtranPublicApiBaseline.CreateCurrent()` defines the current pre-stable public API baseline manifest.
+The historical readiness model is now internal release tooling. The executable,
+version-controlled baseline is `eng/api/Sigtran.NET.1.0.public-api.txt`; see
+[Public API Baseline](PUBLIC_API_BASELINE.md).
 
-The baseline covers known public surfaces and requires diff review before API-shaping changes are accepted.
+The reflection-based baseline covers only exported types and public members.
+Release planning and evidence orchestration types are intentionally excluded.
 
 ## API Lifecycle Readiness
 

docs/PHASE15_API_LIFECYCLE.md

@@ -110,7 +110,8 @@ The gate keeps supply-chain completeness separate from commercial release readin
 - Verify package signature and timestamp with `dotnet nuget verify --all`.
 - Create GitHub provenance and SBOM attestations with `actions/attest-build-provenance` and `actions/attest-sbom`.
 - Retain provenance marker, public API diff, and digest manifest artifacts.
-- Upload package, symbols, and supply-chain evidence with `actions/upload-artifact@v4`.
+- Upload package, symbols, and supply-chain evidence with the SHA-pinned
+  `actions/upload-artifact` action.
 
 `SigtranReleaseWorkflowValidation` now requires these workflow fragments, including SBOM generation, signing, verification, attestation, artifact upload, and final SBOM/API diff environment outputs.
 

docs/PHASE34_SUPPLY_CHAIN_RELEASE_EXECUTION.md

@@ -0,0 +1,73 @@
+# Phase 55 - Stable Release Execution
+
+Phase 55 turns the stable release foundation into executable controls and
+records the real release decision.
+
+## Delivered Units
+
+1. Package defaults changed from accidental stable `1.0.0` to source version
+   `1.0.0-rc.2`.
+2. Repository governance and evidence orchestration types removed from the
+   exported SDK surface.
+3. Reflection-based RC.1 and stable-candidate public API baselines retained.
+4. Machine-enforced API comparison added to the release workflow.
+5. Versioned stable evidence manifest and `GO/NO-GO` evaluator added.
+6. SBOM tool and GitHub Actions pinned; package/SBOM attestations retained.
+7. Stable certificate trust, fingerprint, validity, and chain validation added.
+8. Stable publication bound to an existing matching tag, exact confirmation,
+   protected GitHub environment, and NuGet secret.
+9. Public NuGet visibility/clean restore verification and GitHub release
+   creation added after a successful stable push.
+10. Stable assessment execution and final release decision retained.
+
+## Stable Gate
+
+`eng/release/stable-release.json` is the source-controlled evidence manifest.
+`eng/evaluate-stable-release.ps1` verifies:
+
+- stable SemVer and requested version agreement;
+- existence and SHA-256 digest of every declared evidence file;
+- every required gate's declared outcome;
+- presence and digest of the public API baseline.
+
+The workflow can run a stable assessment with `publish=false`. A stable
+publication additionally requires:
+
+- decision `GO`;
+- exact confirmation `publish Sigtran.NET 1.0.0`;
+- existing tag `v1.0.0` pointing at the workflow commit;
+- approval in the `nuget-stable` GitHub environment;
+- trusted non-self-issued certificate matching the protected fingerprint;
+- timestamped signature verification;
+- `NUGET_API_KEY`.
+
+## Current Decision
+
+The current decision is `NO-GO`. Passing repository evidence covers native
+Linux SCTP, independent M3UA, repository-profile full-stack MAP SMS traffic,
+runtime operations, and the public API baseline.
+
+Open required gates are:
+
+- independent external M2PA interoperability;
+- operator/vendor profile acceptance;
+- 20K TPS target;
+- representative multi-host soak/failover;
+- representative Kubernetes SCTP deployment;
+- organization-trusted stable signing identity.
+
+The protected publication gate is configured and retained at
+`docs/evidence/PHASE55_GITHUB_PROTECTION_20260724T102354Z.json`. Main requires
+strict `build-test-pack`, one PR approval, stale-review dismissal, conversation
+resolution, linear history, and blocks force-push/deletion. `nuget-stable`
+requires a reviewer and protected branch. Administrators can bypass repository
+rules, so the machine evidence manifest and exact workflow confirmation remain
+mandatory independent controls. Protection does not make protocol and capacity
+gates pass.
+
+## Publication Result
+
+No stable tag or NuGet package is created while the decision is `NO-GO`.
+`1.0.0-rc.1` remains the latest public package. Source packaging defaults to
+the next RC candidate so an ordinary `dotnet pack` cannot accidentally produce
+a stable package.

docs/PHASE55_STABLE_RELEASE_EXECUTION.md

@@ -0,0 +1,15 @@
+# Phase 55 Summary
+
+Status: stable release execution controls complete; stable publication blocked
+by evidence.
+
+The package now defaults to RC.2, exports only consumer-facing protocol/runtime
+APIs plus focused diagnostics, has a real reflection-based API baseline and
+diff, and uses a machine-readable stable evidence decision. The workflow
+supports protected signing, attestations, package upload, public restore
+verification, and GitHub release creation only after every stable gate passes.
+Release actions are pinned to reviewed commit SHAs.
+Main branch protection and the reviewer-gated `nuget-stable` environment were
+created and verified through the GitHub API.
+
+The current release decision is `NO-GO`. No stable package has been published.