Federation Release Attestation

federation-release-attestation

Prove parity. Never overwrite. Tags are immutable receipts. If a tag is behind main, issue a new corrected tag.

Manifest Schema

{
  "release": "vYYYY.MM.DD-AAA",
  "generated_at": "ISO-8601",
  "generated_by": "agent-id",
  "repos": {
    "arifOS": {
      "commit": "full SHA",
      "tag": "vYYYY.MM.DD-AAA",
      "tag_matches_head": true,
      "ci_status": "pass|fail|unknown",
      "ci_run_url": "url or UNMEASURED",
      "artifact_hash": "sha256 or UNMEASURED",
      "deployed_commit": "full SHA or UNMEASURED",
      "runtime_health": "healthy|degraded|down|UNMEASURED",
      "tools_list_count": 0,
      "surface_consistent": false
    }
  },
  "federation_summary": {
    "total_repos": 7,
    "repos_at_tag": 0,
    "repos_with_ci_pass": 0,
    "repos_runtime_healthy": 0,
    "drift_detected": false,
    "drift_details": []
  },
  "corrected_from": null,
  "signature": "sha256 or UNMEASURED"
}

Operating Procedure

1. Inventory

For each of the 7 federation repos:

cd /root/<repo>
git rev-parse HEAD                    # current commit
git rev-parse vYYYY.MM.DD-AAA^{}     # tag commit (if exists)
git status --porcelain               # working tree
git rev-list --count origin/main..HEAD  # ahead
git rev-list --count HEAD..origin/main  # behind

2. Tag-vs-Main Check

for each repo:
  if tag_commit != head_commit:
    drift = true
    detail: "Tag {tag} at {tag_commit}, main at {head_commit}"

3. CI Evidence

For each repo, fetch the workflow run for the tag commit:

if ci_status == "UNMEASURED":
  report as "missing evidence" — do not fabricate

4. Runtime Probe

for each organ with a runtime:
  curl :port/health → parse status, deployed_commit, tools_loaded
  if timeout or error: report "UNMEASURED"

5. Generate Manifest

Combine all evidence into the manifest schema. If drift detected on any repo, set corrected_from to the previous release tag and propose a new tag.

6. Tag Discipline (Iron Rule)

• Never git tag -f an existing published tag.
• Never git push --force a tag.
• If correction needed: create new tag (e.g., v2026.07.17-AAA-r2 or next date).
• Old tag remains as immutable receipt of what was known at that time.

Federation Repo Map

DITEMPA BUKAN DIBERI — Forged, Not Given.