Skip to content

Commit 7869716

Browse files
ammarheidariammarheidari
committed
Retain stable release assessment evidence
1 parent 6490c10 commit 7869716

7 files changed

Lines changed: 141 additions & 4 deletions

‎README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -177,6 +177,7 @@ Start here:
177177
- [Phase 54 production operations package](docs/PHASE54_PRODUCTION_OPERATIONS_PACKAGE.md)
178178
- [Runtime operations](docs/OPERATIONS_RUNTIME.md)
179179
- [Phase 55 stable release execution](docs/PHASE55_STABLE_RELEASE_EXECUTION.md)
180+
- [Phase 55 stable assessment evidence](docs/evidence/PHASE55_STABLE_ASSESSMENT_20260724T110519Z.json)
180181
- [Public API baseline](docs/PUBLIC_API_BASELINE.md)
181182
- [Interoperability and tooling](docs/INTEROPERABILITY.md)
182183
- [Compatibility policy](docs/COMPATIBILITY.md)

‎docs/COMMERCIAL_READINESS_REPORT.md‎

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -81,9 +81,17 @@ retained manifests instead of stale hard-coded flags.
8181
but it is single-host WSL loopback. It reached about 13.5K TPS and did not
8282
meet the 20K peak target. Do not use it for broad operator capacity claims
8383
until a representative multi-host deployment benchmark passes.
84-
- Package publication evidence is closed for the public RC prerelease. Stable commercial release gates are foundation-complete, but live stable publication still requires retained stable release evidence, a completed protected stable publication run, and verified stable NuGet publication evidence.
84+
- Package publication evidence is closed for the public RC prerelease. Stable
85+
assessment run `30088170594` completed successfully and retained package,
86+
SBOM, API, digest, decision, and hosted attestation evidence. Live stable
87+
publication remains blocked by the six machine-evaluated qualification
88+
gates and still requires a protected publish run plus verified stable NuGet
89+
restore evidence.
8590
- Public/stable signing must use the organization's approved trusted certificate in the protected release environment; the current signing evidence is internal self-signed RC evidence.
86-
- Hosted GitHub provenance/SBOM attestations were skipped for dry-run and prerelease because private repository or organization attestation persistence can require a supported plan or public repository. These runs retained local provenance markers; stable runs keep hosted attestation reserved for the protected stable gate.
91+
- Hosted GitHub provenance/SBOM attestations were skipped for dry-run and
92+
prerelease. Stable assessment run `30088170594` produced and independently
93+
verified both hosted attestations against the release workflow, source
94+
commit, OIDC issuer, GitHub-hosted runner identity, and Rekor timestamp.
8795
- M3UA and M2PA provide stateful runtime implementations through `IMtp3Network`
8896
and `IMtp2Link`. Independent external M2PA peer evidence remains.
8997
- SCCP, TCAP, and MAP SMS provide stateful runtime implementations and now have

‎docs/PHASE55_STABLE_RELEASE_EXECUTION.md‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -41,6 +41,22 @@ publication additionally requires:
4141
- timestamped signature verification;
4242
- `NUGET_API_KEY`.
4343

44+
## Executed Assessment
45+
46+
GitHub Actions run
47+
[`30088170594`](https://github.com/araditc/sigtran.net/actions/runs/30088170594)
48+
completed successfully against commit
49+
`6490c1069df8dc5a867380ec94b3e280d6582fc8` with publication disabled. It
50+
generated the candidate package, final SPDX 2.2 SBOM, exact API comparison,
51+
digest manifest, SLSA provenance attestation, SBOM attestation, and all five
52+
release artifact bundles.
53+
54+
Independent download verification confirmed all 17 digest-manifest entries.
55+
Both hosted attestations verified against the repository, release workflow,
56+
source commit, GitHub-hosted runner identity, OIDC issuer, and Rekor timestamp.
57+
See the
58+
[retained stable assessment summary](evidence/PHASE55_STABLE_ASSESSMENT_20260724T110519Z.json).
59+
4460
## Current Decision
4561

4662
The current decision is `NO-GO`. Passing repository evidence covers native

‎docs/PHASE55_SUMMARY.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,4 +12,8 @@ Release actions are pinned to reviewed commit SHAs.
1212
Main branch protection and the reviewer-gated `nuget-stable` environment were
1313
created and verified through the GitHub API.
1414

15+
Stable assessment run
16+
[`30088170594`](https://github.com/araditc/sigtran.net/actions/runs/30088170594)
17+
completed successfully and produced verified SLSA provenance and SPDX SBOM
18+
attestations, five uploaded artifact bundles, and 17 verified digest entries.
1519
The current release decision is `NO-GO`. No stable package has been published.

‎docs/PHASE_INDEX.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -59,7 +59,7 @@ This index is the complete phase map for Sigtran.NET. It links each phase to the
5959
| 52 | End-to-end SS7 traffic lab | [Phase 52 End-To-End SS7 Traffic Lab](PHASE52_END_TO_END_SS7_TRAFFIC_LAB.md), [Phase 52 Summary](PHASE52_SUMMARY.md), [Interoperability](INTEROPERABILITY.md) | Complete for repository-profile cross-implementation traffic; operator/vendor profile evidence remains |
6060
| 53 | Operator-sized performance and resilience | [Phase 53 Performance And Resilience](PHASE53_OPERATOR_PERFORMANCE_RESILIENCE.md), [Phase 53 Summary](PHASE53_SUMMARY.md), [Performance Foundation](PHASE14_PERFORMANCE.md) | Implementation and controlled 62K-operation baseline complete; 20K peak and multi-host operator qualification pending |
6161
| 54 | Production operations package | [Phase 54 Production Operations Package](PHASE54_PRODUCTION_OPERATIONS_PACKAGE.md), [Phase 54 Summary](PHASE54_SUMMARY.md), [Runtime Operations](OPERATIONS_RUNTIME.md) | Implementation complete; representative Kubernetes SCTP validation remains |
62-
| 55 | Stable release execution | [Phase 55 Stable Release Execution](PHASE55_STABLE_RELEASE_EXECUTION.md), [Phase 55 Summary](PHASE55_SUMMARY.md), [Public API Baseline](PUBLIC_API_BASELINE.md) | Execution controls complete; machine decision NO-GO and no stable publication |
62+
| 55 | Stable release execution | [Phase 55 Stable Release Execution](PHASE55_STABLE_RELEASE_EXECUTION.md), [Phase 55 Summary](PHASE55_SUMMARY.md), [Public API Baseline](PUBLIC_API_BASELINE.md) | Assessment run 30088170594 complete with verified attestations; machine decision NO-GO and no stable publication |
6363

6464
## Current Production Gate
6565

‎docs/SDK_ROADMAP.md‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -540,7 +540,9 @@ upload, public restore verification, and GitHub release creation. The current
540540
machine-evaluated decision is `NO-GO` because independent M2PA,
541541
operator/vendor-profile acceptance, 20K TPS, multi-host soak, representative
542542
Kubernetes SCTP, and organization-trusted signing evidence remain open. No
543-
stable tag or package is published by this phase.
543+
stable tag or package is published by this phase. Stable assessment run
544+
`30088170594` completed the non-publishing release path and retained verified
545+
package/SBOM attestations plus all release artifact bundles.
544546

545547
## Recommended First Deliverable
546548

‎docs/evidence/PHASE55_STABLE_ASSESSMENT_20260724T110519Z.json‎

Lines changed: 106 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,106 @@
1+
{
2+
"schemaVersion": 1,
3+
"assessment": {
4+
"mode": "stable",
5+
"version": "1.0.0",
6+
"publishRequested": false,
7+
"runId": 30088170594,
8+
"runUrl": "https://github.com/araditc/sigtran.net/actions/runs/30088170594",
9+
"sourceCommit": "6490c1069df8dc5a867380ec94b3e280d6582fc8",
10+
"startedAtUtc": "2026-07-24T11:01:34Z",
11+
"completedAtUtc": "2026-07-24T11:05:19Z",
12+
"conclusion": "success",
13+
"publicationJob": "skipped"
14+
},
15+
"releaseDecision": {
16+
"decision": "NO-GO",
17+
"blockerCount": 6,
18+
"decisionArtifactSha256": "70b0768d71a8af2e54fa63902e918a9487b42a505b372cf070e5bbfa607d27d0",
19+
"blockers": [
20+
"independent-m2pa",
21+
"operator-profile",
22+
"capacity-target",
23+
"multi-host-soak",
24+
"kubernetes-sctp",
25+
"trusted-signing"
26+
]
27+
},
28+
"package": {
29+
"name": "Sigtran.NET.1.0.0.nupkg",
30+
"sizeBytes": 605658,
31+
"sha256": "8f278ee4f68b195a3a223912108ddf0d490a4587ff3433bdac7e09221b84eb27",
32+
"signed": false,
33+
"published": false,
34+
"note": "Signing and publication are intentionally disabled for a NO-GO assessment."
35+
},
36+
"publicApi": {
37+
"baselineMembers": 2185,
38+
"candidateMembers": 2185,
39+
"addedMembers": 0,
40+
"removedMembers": 0,
41+
"baselineSha256": "7db9488d1552da68de3d4fd5c0ef9f1d39d990797c1fdfa3e916bc5407b67d34"
42+
},
43+
"sbom": {
44+
"format": "SPDX-2.2",
45+
"name": "Sigtran.NET 1.0.0",
46+
"sha256": "43d48b18d93d4e07fd127cb5e307da7b2705b844fe2d0c1217e2b8b1b1f70fb7"
47+
},
48+
"attestations": [
49+
{
50+
"kind": "build-provenance",
51+
"predicateType": "https://slsa.dev/provenance/v1",
52+
"url": "https://github.com/araditc/sigtran.net/attestations/36934622",
53+
"verified": true
54+
},
55+
{
56+
"kind": "sbom",
57+
"predicateType": "https://spdx.dev/Document/v2.2",
58+
"url": "https://github.com/araditc/sigtran.net/attestations/36934660",
59+
"verified": true
60+
}
61+
],
62+
"attestationVerification": {
63+
"repository": "araditc/sigtran.net",
64+
"signerWorkflow": "araditc/sigtran.net/.github/workflows/release.yml",
65+
"signerIdentity": "https://github.com/araditc/sigtran.net/.github/workflows/release.yml@refs/heads/main",
66+
"oidcIssuer": "https://token.actions.githubusercontent.com",
67+
"runnerEnvironment": "github-hosted",
68+
"sourceCommitVerified": true,
69+
"transparencyLog": "https://rekor.sigstore.dev",
70+
"verifiedTimestampCountPerAttestation": 1,
71+
"verifiedAtUtc": "2026-07-24T11:08:12Z"
72+
},
73+
"digestManifest": {
74+
"sha256": "2cb31827a162c9eb7f7ffa8caa0c343352a31759ca2283c6b08e5667b950eea2",
75+
"entryCount": 17,
76+
"verifiedEntryCount": 17,
77+
"failureCount": 0
78+
},
79+
"uploadedArtifacts": [
80+
{
81+
"id": 8594638381,
82+
"name": "sigtran-package",
83+
"archiveSha256": "4e19f51b69c345f929ba74cd57b10c0e6e0150689c5be440f1903be8f0b3ad9c"
84+
},
85+
{
86+
"id": 8594638882,
87+
"name": "sigtran-symbols",
88+
"archiveSha256": "f7a1ffa2356859996abb87b10cd99677939b4bbde3c8d684d5b785f44207150f"
89+
},
90+
{
91+
"id": 8594639313,
92+
"name": "sigtran-supply-chain",
93+
"archiveSha256": "b53d7a50e66ef817f1d92f1ea7fcdce27cba494ea1d7903a5544f87838555b77"
94+
},
95+
{
96+
"id": 8594639687,
97+
"name": "sigtran-release-dry-run",
98+
"archiveSha256": "b789af801b960b709119844b0728841b1678af2d8ff24979e4e519583dbcd9a6"
99+
},
100+
{
101+
"id": 8594640097,
102+
"name": "sigtran-stable-release-decision",
103+
"archiveSha256": "a28d05d5b7402ca686203f83a8fc30908bd9eebd2ef8a2a7211db4959c6f9aa4"
104+
}
105+
]
106+
}

0 commit comments

Comments
 (0)