feat(release): add exact release evidence index contract

[seonghobae]

Scope

Advances #210 with one bounded, machine-readable release-evidence contract. This does not close #210, publish a release candidate, or claim release readiness.

release-evidence.mjs binds retained artifacts to one exact source commit, requires canonical SHA-256 evidence, keeps unresolved P0 buyer gaps explicit, requires SBOM/build-provenance/checksum/signature evidence, identifies SPDX 3.0.1 and SLSA provenance by their canonical identities, binds signatures structurally to retained subjects, and rejects duplicate/path-like/unknown/malformed evidence. Structural validation remains distinct from cryptographic signature verification and release acceptance.

The original TDD lineage is preserved, including the RED that required signature evidence to bind a retained subject plus exact digest and the subsequent directory-boundary hardening. No certification, SLSA-level, installation, rollback or buyer-journey claim follows from this slice.

Protected-main adoption

The lane previously adopted #239 as d8cda8a6c7d00ed31e73717fb290295176a350fc. Protected main then advanced through #240 to b84751674dd92bdcd0e266c7f002cdc43f5a938b, removing unsafe docs-only filters from CI and Commercial Readiness.

Current exact head e2965452ddb9227c5a0462a7820f95c70fe11821 is a non-force two-parent descendant of d8cda8a6... and current protected main. Its merge tree keeps #240's workflow semantics while preserving exactly the four release-evidence-owned paths. Fresh compare from protected main is ahead-only (behind_by=0) with those four paths only.

No predecessor check/review evidence transfers after this head move. Exact-head repository and central gates remain authoritative; queued/absent/skipped evidence is not passing. Keep Draft until terminal exact-head validation, current review/thread policy, and unchanged-base compatibility are satisfied without bypass.

Refs #210.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}