fix: provenance-file takes precedence over OIDC auto-generated provenance - #9882

…on (#99)

## Summary

Adds ADR 0082, deciding that the **publish-stage** npm CLI is
provisioned as an explicitly pinned, integrity-verified distribution
selected from a reviewed allowlist, replacing the current floating
node-24-bundled npm **on the publish job only**. Build-stage npm
selection is unchanged and remains governed by ADR 0016/0017/0027.

- What changed?
- New ADR 0082: pin the publish-stage npm CLI version with
integrity-verified provisioning (version + distribution SHA-256 in the
publish job), a reviewed allowlist recorded in the specification, and a
bump procedure requiring an npm-internals diff-review checklist
(`oidc.js` flow, `buildMetadata()` branch structure, `@npmcli/config`
exclusive enforcement, `publishConfig` flatten timing, sigstore-js
major) plus per-version compatibility fixtures.
- Publish-side contract change (implementation lands with the #97 fix):
the publish job's npm validates against the allowlist pin, replacing the
current exact-equality check against the build-time
`runtime.npm_version` record, since build npm (toolchain, floating) and
publish npm (pinned) diverge by design. Build continues recording its
actual npm in `runtime.npm_version`.
- Relations updates (frontmatter only; accepted ADR bodies untouched):
`partially-supersedes ADR-0027` scoped to the publish-stage npm
provisioning clause (reverse edge added), `see-also` ADR
0016/0017/0029/0081 (reverse edges added).
- Index rows for 0082 in `docs/decisions/README.md` and `README.ko.md`.
- Why is this needed?
- The #97 remediation mechanism depends on npm internals that already
vary across the currently allowed range (11.5.1 / 11.17.0 / 12.0.2:
`oidc.js` structure, exclusive env carve-out, sigstore-js v3–v5). The
fourth dogfood showed fail-closed read-back protects acceptance but not
registry state (`@windlass/vers-js@0.1.2` is permanently burned). A
floating toolchain under a source-dependent publish mechanism leaves the
verification surface open, and a node-24 image update is a
correlated-failure vector for all callers. The decision completes the
builder-owned npm principle (ADR 0016/0017) and ADR 0027's recorded
pinned-setup intent on the publish path, and makes the specification's
per-version fixture obligation satisfiable. Upstream npm/cli#9882
adoption becomes a deliberate pinned bump.
- Scope note (from review): an earlier draft pinned npm across all jobs;
per reviewer decision the pin is publish-only, and a manifest-selected
build npm option was considered and excluded from this ADR (build-stage
selection may be revisited by a separate future decision).
- How to test: documentation-only; `adr-relations-check` passes (83
ADRs, 184 edges, NO PROBLEMS); prettier and markdownlint clean.

## Related Issues

- Related #97 (motivating defect), #30 (dogfood evidence)

## Change Type

- [x] Documentation

## Changelog

- Category: None
- User-facing note: Architecture decision record; no runtime behavior
change in this PR (spec amendments and provisioning changes follow in
the #97 fix implementation).

Changelog update:

- [x] Not needed because this change is not user-facing

## Checklist

### General

- [x] PR title follows [Conventional
Commits](https://www.conventionalcommits.org/) format: `type(scope):
Summary`
- [x] This PR does not expose backend/internal implementation details in
a public repo.
- [x] No secrets, tokens, keys, or private endpoints are included.
- [x] Changes stay within this repository's intended scope.

### Protocol / Compatibility Impact

- [x] No protocol/spec impact in this PR; ADR 0082's consequences (spec
allowlist, publish-side pin validation, provisioning) land in the
follow-up implementation PR.

## Testing

- [x] Lint and format pass
- [x] Manual verification performed

Describe test evidence: `adr-relations-check` reports 83 ADRs / 184
edges / NO PROBLEMS; prettier and markdownlint clean on
`docs/decisions/`; verified via git diff that existing ADRs changed only
in frontmatter `relations` (bodies immutable per convention).

## Documentation

- [x] Spec/docs updated (this PR is the ADR; index READMEs updated in
both languages)
- [x] Changelog decision completed above

## Rollout / Risk

- Risk level: Low (documentation only)
- Rollback plan: revert this branch.

## Reviewer Checklist

- [x] Scope is clear and minimal
- [x] Security and boundary checks passed
- [x] Tests and docs are sufficient
- [x] Compatibility impact is correctly handled

---------

Signed-off-by: Yunseo Kim <git@yunseo.kim>

…ss build and publish stages (#100)

## Summary

- What changed: three architecture decision records completing the npm
CLI version-pinning decision chain for the JS/TS npm package profile:
- **ADR 0083** — defer the npm M1 publish remediation (#97) to the
upstream npm/cli#9882 fix; the first reviewed npm release containing the
fix becomes the initial publish npm pin, with an explicit revisit
trigger (unmerged close, materially different precedence semantics, or
no merge by 12026-10-01).
- **ADR 0084** — select the publish-stage npm provisioning mechanism:
download the exact recorded registry tarball URL, verify the committed
SHA-512 digest (SRI form, byte-identical to the registry-native
`dist.integrity`) over the compressed bytes before extraction, and
execute via a basename-`npm` launcher. Partially supersedes ADR 0082's
SHA-256 designation; amends its open mechanism choice.
- **ADR 0085** — pin the build-stage toolchain pair: the reusable
workflow resolves Node.js to an exact 24 patch recorded together with
the npm version that patch bundles, and each job that uses the bundled
npm asserts `node --version`/`npm --version` equality with the recorded
pair before the first npm invocation. Partially supersedes ADR 0027's
floating toolchain resolution clause only.
- Why is this needed: the fourth M1 dogfood (#97) showed a floating npm
on the publish path can publish-then-reject and permanently burn version
numbers. ADR 0082 pinned the publish npm and deliberately left two
questions open — what the #97 fix is (settled by 0083), which mechanism
provisions the pin (settled by 0084) — plus the build-stage version
selection review (settled by 0085 with an escalation trigger toward an
independently provisioned build npm).
- How to test: documentation-only change. Validation evidence below.

## Related Issues

- Related #97 — this PR records the remediation *decisions*;
implementation lands when the fixed npm release ships (ADR 0083 deferral
scope), so #97 stays open.
- Related #30 — dogfood attempt evidence referenced by the ADRs.

## Change Type

- [ ] Bug fix
- [ ] Feature
- [ ] Refactor
- [x] Documentation
- [ ] Test/CI
- [ ] Breaking change
- [ ] Other: <!-- describe -->

## Changelog

- Category: None
- User-facing note: Architecture decision records only — no user-facing
behavior changes. The implementing specification, workflow, and Go
changes land later under ADR 0083's deferral scope and ADR 0085's own
schedule.

Changelog update:

- [ ] `CHANGELOG.md` `[Unreleased]` updated
- [x] Not needed because this change is not user-facing

## Checklist

### General

- [x] PR title follows [Conventional
Commits](https://www.conventionalcommits.org/) format: `type(scope):
Summary`
- [x] This PR does not expose backend/internal implementation details in
a public repo.
- [x] No secrets, tokens, keys, or private endpoints are included.
- [x] Changes stay within this repository's intended scope.

### Protocol / Compatibility Impact

- [x] No protocol/spec impact
- [ ] Protocol/spec updated
- [ ] Conformance tests updated
- [ ] Breaking change is versioned and migration notes are included

ADR texts only; no specification files are modified. Each ADR records
which future specification amendments it governs.

## Testing

- [ ] Unit tests added/updated
- [ ] Integration or conformance tests added/updated
- [ ] Tests pass
- [x] Lint and format pass
- [ ] Type check passes
- [x] Manual verification performed

Describe test evidence:

- `prettier --write` on all touched files: clean.
- `markdownlint-cli2 docs/decisions/**/*.md`: 89 files, 0 errors.
- `python3
.agents/skills/adr-relations-check/scripts/check_relations.py`: **86
ADRs, 216 edges — NO PROBLEMS** (forward + reverse relation edges
symmetric, status grammar valid).
- Lefthook pre-commit (prettier, markdownlint) and commit-msg
(dco-signoff) passed on all three commits.

## Documentation

- [x] README updated — `docs/decisions/README.md` and `README.ko.md`
sequence, inventory, and traceability tables (bilingual, same change).
- [x] Spec/docs updated — three new ADRs; reverse relation edges added
to ADR 0016/0017/0027/0067/0082/0083/0084; `docs/decisions/AGENTS.md`
index updated.
- [x] Changelog decision completed above

## Rollout / Risk

- Risk level: Low — documentation-only; no runtime, workflow, or
specification behavior changes.
- Rollback plan: revert the merge commit; ADR 0065's immutability rule
applies after acceptance, so any post-merge decision change would be a
new ADR instead.

## Reviewer Checklist

- [x] Scope is clear and minimal
- [x] Security and boundary checks passed
- [x] Tests and docs are sufficient
- [x] Compatibility impact is correctly handled

---------

Signed-off-by: Yunseo Kim <git@yunseo.kim>

…ance (#9947)

Backport of #9882 to `release/v11`.

Signed-off-by: Yunseo Kim <git@yunseo.kim>
Co-authored-by: Yunseo Kim <dev@yunseo.kim>

…digest-verified provisioning (#131)

## Summary

Implements ADR 0082/0083/0084 (publish-stage npm CLI pin) and ADR 0085
(build-stage Node.js toolchain pair pin), and completes the in-repo
preparation for the M1 dogfood retry as vers-js v0.1.3.

What changed:

- **Pins (machine-readable, embedded):**
`internal/toolchainpins/publish-npm.json` pins the publish npm CLI to
**11.21.0** (tarball URL + SHA-512 SRI, byte-identical to the packument
`dist.integrity`); `internal/toolchainpins/node-runtime.json` pins the
build toolchain pair to **Node.js 24.21.0 / npm 11.19.0**. Both change
only through the bump pull-request procedures those ADRs define (pin and
digest or pair updated together in one commit, internals/changelog
review, fixtures, full CI gate); a version bump does not require an ADR
amendment.
- **Publish-stage provisioning (ADR 0084):** new
`npm-profile-provision-npm` subcommand downloads only the recorded URL
through the hardened fetcher, verifies the compressed SHA-512 before
creating any directory, extracts with the no-links archive policy,
validates the extracted `package.json` version, and emits a private
launcher named `npm`. Provisioning executes neither node nor npm; every
failure is pre-mutation with registered diagnostics.
- **Pair assertion (ADR 0085):** new `npm-profile-toolchain-assert`
subcommand requires exact `node --version` / `npm --version` equality
with the recorded pair before the first npm invocation (build/sign jobs;
node-only mode in the publish job).
- **Publish pin validation (ADR 0082):** the publish job's npm version
must equal the allowlist pin, replacing the build/publish equality
check; the observed version is recorded as
`diagnostic_metadata.publish_npm_version` on every path reaching
Publish, including same-run convergence.
- **Static contract + drift gate:** `workflow-check` enforces the exact
Node patch, assertion steps, provisioning ordering, and zero ambient npm
in the publish job; new `pin-check` subcommand (wired into `lint.yml`)
fails on drift between the records and the spec tables.
- **Workflow:** all three jobs set up Node.js **24.21.0**; the publish
job provisions the pinned npm 11.21.0 before any npm invocation,
diagnostics included.
- **Fixtures:** PURL compatibility fixtures for npm 11.21.0 and 11.19.0
(scoped + unscoped), cross-checked live against both real CLIs' own
`npm-package-arg.toPurl` provenance-subject code path.
- **Docs:** spec amendments (allowlist + review note, provisioning, pin
validation, auth path finalization per ADR 0083, pair table, `npm
invocation` definition), dogfood runbook retargeted to v0.1.3, README
(English/Korean) publish-stage nuance, CHANGELOG `[Unreleased]` entries,
and the attempt-4 dogfood evidence record with forward metadata
retargeted.

Why: the fourth M1 dogfood published `@windlass/vers-js@0.1.2` with
npm-generated provenance because npm silently discarded the supplied
`--provenance-file` bundle (#97). The upstream fix (npm/cli#9882)
shipped in npm 12.1.0 and 11.20.0; ADR 0083 selects the fixed release as
the initial publish pin, and the operator selected npm 11.21.0, the
latest 11-line release carrying the fix. Pinning both toolchains
converts toolchain drift into reviewed bump events. The pinned 11.21.0
passed the ADR 0082 internals checklist and ADR 0084 registry
cross-checks (recorded in the spec's allowlist review note, including
the documented deviation that npm/cli published no git tag or GitHub
Release for v11.21.0, so the `gitHead` cross-check resolves at the
release-commit level).

How to test: `go test ./...`, `go test -race ./...`, `golangci-lint run
./...`, `actionlint .github/workflows/*.yml`, `pnpm exec prettier
--check .`, `pnpm exec markdownlint-cli2 "**/*.md"`, `fixture-check`,
`workflow-check`, `pin-check`, and the gated live evidence
`SLSA_BUILDER_LIVE_TOOLCHAIN=1 go test -run
'TestProvisionNpmLive|TestNPMPURLCLICompatibilityLive'
./internal/npmprofile/ -v`.

## Related Issues

- Related #30
- Related #97

## Change Type

- [ ] Bug fix
- [x] Feature
- [ ] Refactor
- [ ] Documentation
- [ ] Test/CI
- [ ] Breaking change
- [ ] Other: <!-- describe -->

## Changelog

- Category: Added
- User-facing note: the JS/TS npm profile now pins the publish-stage npm
CLI (initially npm 11.21.0, carrying the upstream npm/cli#9882
`--provenance-file` fix) provisioned from a digest-verified registry
tarball, and pins the build-stage Node.js/npm toolchain pair (currently
Node.js 24.21.0 / npm 11.19.0) asserted before first use; publish-side
npm validation compares against the allowlist pin and records
`publish_npm_version` outcome evidence; a `pin-check` CI gate fails on
drift between the machine-readable pin records and the specification
tables.

Changelog update:

- [x] `CHANGELOG.md` `[Unreleased]` updated
- [ ] Not needed because this change is not user-facing

## Checklist

### General

- [x] PR title follows [Conventional
Commits](https://www.conventionalcommits.org/) format: `type(scope):
Summary`
- [x] This PR does not expose backend/internal implementation details in
a public repo.
- [x] No secrets, tokens, keys, or private endpoints are included.
- [x] Changes stay within this repository's intended scope.

### CI/Workflow Changes (if applicable)

If this PR modifies GitHub Actions workflows or CI/CD configuration, it
must comply with our [Supply Chain Integrity
requirements](SECURITY.md#supply-chain-integrity):

- [x] All `uses:` references are pinned to full 40-character commit SHAs
(with `# vX.Y.Z` comment)
- [x] `step-security/harden-runner` is included as the first step in
every job
- [x] Job-level `permissions` are used instead of top-level
`permissions`

### Protocol / Compatibility Impact

- [ ] No protocol/spec impact
- [x] Protocol/spec updated
- [x] Conformance tests updated
- [ ] Breaking change is versioned and migration notes are included

If impacted, describe compatibility impact:

The publish-side npm version contract changes from exact equality with
the build-time npm record to allowlist pin validation (ADR 0082); the
diagnostics report schema gains the optional closed
`diagnostic_metadata.publish_npm_version` member following the
`package_manifest` extension precedent; new conformance fixtures cover
the PURL compatibility family for both pinned npm versions. The project
is pre-release and the profile workflow is referenced by SHA, so no
caller observes any change until it re-pins to a SHA carrying this
merge; no versioned migration is required.

## Testing

- [x] Unit tests added/updated
- [x] Integration or conformance tests added/updated
- [x] Tests pass
- [x] Lint and format pass
- [x] Type check passes
- [x] Manual verification performed

Describe test evidence:

- `go test ./...` and `go test -race ./...` green (all 16 packages);
`golangci-lint run ./...` 0 issues; `actionlint` clean; Prettier and
markdownlint clean.
- Executable contract gates green: `fixture-check`, `workflow-check
--profile npm-only`, and the new `pin-check` (repo-state GREEN; a spec
copy with one flipped SRI character fails exit 1 with
`toolchain-pin-drift`).
- Live evidence (gated, non-CI): `TestProvisionNpmLive` downloads the
recorded npm 11.21.0 tarball, verifies its SHA-512 against the pinned
SRI, and reports npm 11.21.0 from the provisioned launcher;
`TestNPMPURLCLICompatibilityLive` exercises both pinned CLIs' own
`npm-package-arg.toPurl` provenance-subject code path for all four
fixtures (4/4 pass).
- TDD throughout: RED outputs captured before every behavior change (pin
validation divergence/mismatch cases, convergence metadata, drift table
mutations, checker contract fixtures).
- Independent review: local cubic review (2 findings triaged as
design-consistent fail-closed tradeoffs) and an adversarial reviewer
pass that cited 4 blockers (setup-node version logging, fixture CLI
evidence, tag-less release cross-check, convergence metadata); all 4
resolved, including two by explicit operator decision recorded in the
spec, and the delta re-review approved.

## Documentation

- [x] README updated
- [x] Spec/docs updated
- [x] Changelog decision completed above

## Rollout / Risk

- Risk level: Medium
- Rollback plan: revert the merge commit. Callers pin the reusable
workflow by SHA, so merging changes no caller behavior until the caller
is re-pinned; the fail-closed post-publish read-back remains the
permanent safety net for anything outside the pinned surface. The
remaining rollout steps are external: bump the vers-js caller pin to a
main SHA carrying this work, then dispatch the v0.1.3 dogfood per
`docs/dogfood/npm-m1-verification-procedure.md` phases 1-6.

## Reviewer Checklist

- [x] Scope is clear and minimal
- [x] Security and boundary checks passed
- [x] Tests and docs are sufficient
- [ ] Compatibility impact is correctly handled



<!-- This is an auto-generated description by cubic. -->
---
## Summary by cubic
Pins the publish-stage npm CLI and the build-stage Node.js/npm toolchain
pair with digest-verified provisioning. Previously the publish job used
the npm bundled with Node.js 24 and required the publish npm version to
equal the build-time npm version; the latest dogfood attempt published
npm-generated provenance because npm discarded the supplied
`--provenance-file` bundle. The publish stage now provisions npm
11.21.0, the latest 11-line release carrying the upstream fix, from a
digest-verified registry tarball before any npm invocation.

**Provisioning and assertion**
- New `npm-profile-provision-npm` downloads only the recorded tarball,
verifies the SHA-512 SRI, extracts with the no-links archive policy and
explicitly bounded copies, and emits a private launcher; it never
executes node or npm, and every failure stays pre-mutation.
- The publish execution boundary accepts exactly the provisioned private
launcher layout and rejects every sibling layout.
- New `npm-profile-toolchain-assert` requires exact `node
--version`/`npm --version` equality with the pinned pair (Node.js
24.21.0 / npm 11.19.0) before first npm use; the publish job asserts
node only.
- Publish now validates npm against the allowlist pin instead of
equality with the build record, and records the observed version as
`publish_npm_version` on every path that reaches publish, including
same-run convergence.
- New `pin-check` CI gate fails on drift between the machine-readable
pin records and the spec tables.

**Workflow, fixtures, and rollout**
- All three workflow jobs set up Node.js 24.21.0; the publish job
provisions npm 11.21.0 before any npm invocation including diagnostics,
and ambient npm resolution is gone from the job.
- The static checker rejects skippable assertions, ambient or hardcoded
executable rebinding, spoofed `--npm-executable` arguments, and any
preflight-report path binding other than the uploaded outcome report;
preflight failures persist typed reports to the outcome path.
- Added PURL compatibility fixtures for both pinned npm versions,
cross-checked live against each CLI's own provenance-subject derivation;
diagnostic metadata now rejects null members at any depth.
- Callers pin the workflow by SHA, so no behavior changes until they
re-pin; remaining steps are the vers-js caller pin bump to a main SHA
carrying this work (now verified against the caller's `uses:` reference
via a `?ref=main` fetch) and the v0.1.3 dogfood dispatch.

<sup>Written for commit f69846e.
Summary will update on new commits.</sup>

<a
href="https://cubic.dev/pr/windlasstech/slsa-builder/pull/131?utm_source=github"
target="_blank" rel="noopener noreferrer"
data-no-image-dialog="true"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source
media="(prefers-color-scheme: light)"
srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img
alt="View guided diff"
src="https://www.cubic.dev/buttons/review-in-cubic-light.svg"></picture></a>
<a
href="https://www.cubic.dev/action/auto-fix/pr/windlasstech/slsa-builder/131?returnTo=https%3A%2F%2Fgithub.com%2Fwindlasstech%2Fslsa-builder%2Fpull%2F131&source=description"
target="_blank" rel="noopener noreferrer"
data-no-image-dialog="true"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://www.cubic.dev/buttons/turn-on-auto-fix-dark.svg"><source
media="(prefers-color-scheme: light)"
srcset="https://www.cubic.dev/buttons/turn-on-auto-fix-light.svg"><img
alt="Turn on auto-fix"
src="https://www.cubic.dev/buttons/turn-on-auto-fix-light.svg"></picture></a>

<!-- End of auto-generated description by cubic. -->

---------

Signed-off-by: Yunseo Kim <git@yunseo.kim>

…#151)

## Summary

Implements the final npm SLSA provenance contract decided in ADR
0103-0112 (the issue #143 provenance-compatibility follow-up). The
branch carries the accepted ADR set, the spec revisions
(`docs/architecture/`), and the trusted-core implementation in SDD
order: specification commits land before the implementation commits that
realize them.

What changed:

- **Invocation identity (ADR 0103, 0104):**
`externalParameters.workflow` records exactly the called workflow's
`{ref, repository, path}`; the legacy environment snapshots leave the
signed record. `internalParameters.github` is a closed triple of
`event_name`, `repository_id`, `repository_owner_id`, bound to the OIDC
Build Trigger and Build Config URI claims (certificate OIDs .16/.18) and
to the signing certificate's platform-fixed source claims. A builder
identity migration guard rejects bundles that mix old and new identity
shapes.
- **Dependency chain (ADR 0105, 0109, 0110):** `resolvedDependencies`
records the ordered chain `invocation-source`, `built-source`,
`package-manifest`, `lockfile`, `node-runtime`, plus
`package-manager-distribution` for non-npm managers and `runner-image`,
with the governed mediaType matrix. The signed `package-manifest`
descriptor carries offline `manifest_evidence` (`path` + base64 content,
16 MiB bound) so verifiers can recompute it without repository access;
the selected manifest is snapshotted before any build script runs.
- **Builder record (ADR 0106, 0107):** `builder.version` records the
observed `{nodejs, npm, corepack?}` triple, and build script invocations
are recorded as `runDetails.metadata.windlass_build_script_disposition`.
- **Runner environment (ADR 0111, 0112):** The `runner-image`
descriptor's annotation set is exactly `deployment_version`,
`operating_system`, `image_version`, `runner_label`; `operating_system`
comes from the same bounded on-disk metadata snapshot as
`image_version`, and ambient `ImageOS` is diagnostic-only.
- **Public contract (ADR 0108):** The `release-tag` and
`provenance-sidecar` optional inputs are removed, shrinking the npm
reusable workflow contract to one required input (`package-directory`)
and six optional inputs.
- **Diagnostics and fixtures:** Seven new closed-registry diagnostic IDs
(`resolved-dependencies-invocation-source`,
`resolved-dependencies-built-source`,
`resolved-dependencies-package-manifest`, `package-manifest-evidence`,
`build-script-disposition-mismatch`, `build-trigger-mismatch`,
`build-config-uri-mismatch`); the conformance corpus is regenerated with
47 registrations across 17 requirement IDs, and new fuzz targets
(`FuzzDecodeInternalParameters`, `FuzzParseCallerWorkflowPath`,
`FuzzManifestEvidence`, `FuzzFixtureManifestEvidence`,
`FuzzBindOIDCSignerIdentity`) are registered in both the lint and
scheduled fuzz workflows.

Why: the issue #143 investigation fixed npm's registry-side provenance
handling (npm/cli#9882, shipped in npm 11.20.0/12.1.0); this migration
lands the slsa-builder-side contract that pairs with it, completing the
ADR 0103-0112 decision set.

How to test: `go test ./...` (full suite and race), `go run
./cmd/slsa-builder-internal fixture-check --index
testdata/fixtures/index.json`, `go run ./cmd/slsa-builder-internal
workflow-check --workflow .github/workflows/js-ts-npm-package-slsa3.yml
--profile npm-only`, plus the eight scenario contracts (happy tag push,
dispatch retry, offline manifest evidence, closed-schema regression,
runner evidence, builder migration guard, seven-input contract,
historical P02 cryptographic verification).

## Related Issues

- Related #143
- Related #30 (the remaining live dogfood read-back for this contract is
tracked separately and requires operator authorization)

## Change Type

- [ ] Bug fix
- [x] Feature
- [ ] Refactor
- [ ] Documentation
- [ ] Test/CI
- [x] Breaking change
- [ ] Other: <!-- describe -->

## Changelog

- Category: Changed / Removed (both entries carry **Breaking:** markers)
- User-facing note: The npm provenance contract is finalized per ADR
0103-0112 (workflow identity, closed github triple, ordered dependency
chain with offline manifest evidence, builder versions, script
disposition, runner operating system), and the `release-tag` /
`provenance-sidecar` workflow inputs are removed.

Changelog update:

- [x] `CHANGELOG.md` `[Unreleased]` updated
- [ ] Not needed because this change is not user-facing

## Checklist

### General

- [x] PR title follows [Conventional
Commits](https://www.conventionalcommits.org/) format:
      `type(scope): Summary`
- [x] This PR does not expose backend/internal implementation details in
a public repo.
- [x] No secrets, tokens, keys, or private endpoints are included.
- [x] Changes stay within this repository's intended scope.

### CI/Workflow Changes (if applicable)

If this PR modifies GitHub Actions workflows or CI/CD configuration, it
must comply with our
[Supply Chain Integrity
requirements](SECURITY.md#supply-chain-integrity):

- [x] All `uses:` references are pinned to full 40-character commit SHAs
(with `# vX.Y.Z` comment)
- [x] `step-security/harden-runner` is included as the first step in
every job
- [x] Job-level `permissions` are used instead of top-level
`permissions`

### Protocol / Compatibility Impact

- [ ] No protocol/spec impact
- [x] Protocol/spec updated
- [x] Conformance tests updated
- [x] Breaking change is versioned and migration notes are included

Compatibility impact: this is a breaking change to the signed npm
provenance shape and the public workflow input contract, delivered while
the project is pre-release (no stable version exists). The specification
revisions in `docs/architecture/` define the new observable behavior,
the ADR set 0103-0112 records the decisions, and `CHANGELOG.md`
`[Unreleased]` carries the **Breaking:** entries. Callers pinned by
workflow SHA are unaffected until they deliberately re-pin; the builder
identity migration guard rejects mixed-shape bundles rather than
misclassifying them.

## Testing

- [x] Unit tests added/updated
- [x] Integration or conformance tests added/updated
- [x] Tests pass
- [x] Lint and format pass
- [x] Type check passes
- [x] Manual verification performed

Test evidence: `go test ./...` and `go test -race ./...` fully green;
`golangci-lint run ./...` reports 0 issues and `golangci-lint fmt
--diff` is clean; `fixture-check` and `workflow-check --profile
npm-only` pass; `actionlint` passes; Prettier and markdownlint pass. All
five new fuzz targets pass 30-second smokes. The eight migration
scenario contracts pass individually (including the historical P02
production signer fixture and the dispatch-retry signed invocation
context). `cubic review` was run per commit and over the full branch
diff against `origin/main`; final result: no issues (seven findings were
fixed during the review loop, two were rejected with documented
grounds).

## Documentation

- [x] README updated (public input contract wording, both English and
Korean)
- [x] Spec/docs updated (seven `docs/architecture/` specifications plus
the ADR index)
- [x] Changelog decision completed above

## Rollout / Risk

- Risk level: Medium
- Rollback plan: Pre-release contract change with no stable release to
break. Callers pin the reusable workflow by commit SHA, so existing pins
keep the prior behavior; rollback of this branch is `git revert` of the
implementation commits (spec and ADR commits are decision records and
stay). The M1 live dogfood (issue #30, attempt 5) verifies the migrated
contract against the real npm registry before any release.

## Reviewer Checklist

- [x] Scope is clear and minimal
- [x] Security and boundary checks passed
- [x] Tests and docs are sufficient
- [x] Compatibility impact is correctly handled

<!-- This is an auto-generated description by cubic. -->
---
## Summary by cubic
Lands the final npm SLSA provenance contract from ADRs 0103-0112 as the
first-release record of the signed provenance shape and public workflow
inputs, pairing with the registry-side handling fixed in issue #143.

- Invocation identity is now `externalParameters.workflow` `{ref,
repository, path}` plus a closed `internalParameters.github` triple,
both bound to OIDC certificate claims with a migration guard rejecting
mixed-shape bundles.
- `resolvedDependencies` carries the ordered `invocation-source`,
`built-source`, `package-manifest`, `lockfile`, `node-runtime` chain,
with offline `manifest_evidence` on the signed package-manifest so
verifiers recompute it without repository access.
- The public contract is one required and six optional inputs;
`release-tag` and `provenance-sidecar` were never shipped.
- Runner OS comes from the same on-disk metadata snapshot as image
version; ambient `ImageOS` is diagnostic-only.
- The source manifest is snapshotted before build and re-checked before
install and pack; any byte drift fails closed with
`source-manifest-drift`.
- Review hardening: corrected the Build Trigger OID constant, enforced
positive decimal repository IDs, classified publish-input failures,
tightened the canonical runner software URI spelling and rejected
whitespace-padded detail values at capture, and reported packed-tarball
inspection failures under `package-pack-failed`, plus fuzz fixes
including the `.git` repository rejection and module-proxy storage
allowlist.

**Verification impact**
- New OIDC bindings (Build Trigger, Build Config URI) fail closed before
registry or release mutation.
- Existing callers pinned by workflow SHA keep prior behavior;
re-pinning is required to adopt the new contract.
- Conformance corpus regenerated with 47 registrations across 17
requirement IDs, plus six new fuzz targets.

<sup>Written for commit cfda119.
Summary will update on new commits.</sup>

<a
href="https://cubic.dev/pr/windlasstech/slsa-builder/pull/151?utm_source=github"
target="_blank" rel="noopener noreferrer"
data-no-image-dialog="true"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source
media="(prefers-color-scheme: light)"
srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img
alt="View guided diff"
src="https://www.cubic.dev/buttons/review-in-cubic-light.svg"></picture></a>
<a
href="https://www.cubic.dev/action/auto-fix/pr/windlasstech/slsa-builder/151?returnTo=https%3A%2F%2Fgithub.com%2Fwindlasstech%2Fslsa-builder%2Fpull%2F151&source=description"
target="_blank" rel="noopener noreferrer"
data-no-image-dialog="true"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://www.cubic.dev/buttons/turn-on-auto-fix-dark.svg"><source
media="(prefers-color-scheme: light)"
srcset="https://www.cubic.dev/buttons/turn-on-auto-fix-light.svg"><img
alt="Turn on auto-fix"
src="https://www.cubic.dev/buttons/turn-on-auto-fix-light.svg"></picture></a>

<!-- End of auto-generated description by cubic. -->

---------

Signed-off-by: Yunseo Kim <git@yunseo.kim>