feat(core): bind release artifacts to canonical manifest identity

[seonghobae]

Partial implementation of #201.

Buyer-visible boundary

This lane adds a deliberately inert release-manifest admission primitive that binds an exact non-null lowercase Git source identity, bounded canonical Chromium revision, explicit release channel, the exact repository-pinned Rust toolchain, exact dependency-lock SHA-256 evidence, and bounded canonical artifact name/SHA-256 evidence without signing, publishing, update transport, installation, rollback, or release authority.

The production contract requires:

• an exact 40-character lowercase hexadecimal source commit that is not Git's all-zero zero-id sentinel;
• a bounded canonical Chromium revision token;
• Rust toolchain identity exactly equal to repository baseline 1.97.1;
• an exact lowercase sha256: dependency-lock digest;
• a non-empty bounded artifact inventory with deterministic ordering;
• bounded ASCII leaf artifact names and exact lowercase sha256: artifact digests;
• artifact-name uniqueness under ASCII case folding while preserving admitted spelling; and
• fail-closed reserved-device basenames CON, PRN, AUX, NUL, COM0-COM9, and LPT0-LPT9, including extensions.

The latter is an intentionally bounded buyer-environment filename rule, not a complete OneDrive or SharePoint synchronization-compatibility guarantee; additional service-specific restrictions such as desktop.ini remain outside this validator.

Possession of a valid manifest remains metadata evidence only. It does not authenticate a build, prove the claimed compiler or dependency lock was used, prove repository reachability, prove reproducibility/provenance, authorize a channel, or grant signing/publication/installation/update/rollback authority.

Test-first lineage

Historical failing heads are regression lineage only, never current passing evidence:

• 80531172b671fc5c7a36d0b8a77ecc1bf07ba120 established the original missing release-manifest contract.
• b5d5365e364497b6c68cd0c35f2101675510f372 reproduced case-only artifact-name collision admission.
• 42ca2fd98750e7d0b09f98325ae939af8afdb27d / CI 32602571068 reproduced moving Rust-toolchain alias admission.
• fc8e51d6b0b182601c8501b86ffac528db193d23 / CI 32602850524 reproduced stale toolchain-error text after exact-pin enforcement.
• c875358316ac78fa1075f2c2da947f3d21e68faf / CI 32603982257 reproduced admission of Git's all-zero source sentinel.
• ac9f4ff80fb8615b0002c770750194397936adb0 / CI 32609512987 / Rust job 97120098572 reproduced stale public InvalidSourceCommit diagnostic text after the non-null validator was already present.

Current production requires at least one nonzero hexadecimal digit in addition to the exact lowercase 40-hex shape, and the public error contract states the same fail-closed rule.

Current exact state

Protected main is exact b05d5acca82b9d916ada2c8e82f59f92a89817e1. Current exact contributor head is 3e34a54ae279686a28309d59b8b3b9bfbd283a80. GitHub reports this PR open, non-draft, and mergeable against that current protected-main base.

The current head is a non-destructive convergence commit over the moved protected main. It preserves the release-manifest production boundary while incorporating current protected-main changes; predecessor evidence is not reused as current-head proof.

Exact-current evidence

On unchanged exact head 3e34a54ae279686a28309d59b8b3b9bfbd283a80:

• CI run 32701197890: success;
• Rust contracts job 97352884247: success — repository contracts, canonical formatting, locked workspace/all-target check, full tests, strict Clippy, and rustdoc all succeeded;
• Production coverage job 97352884399: success and explicitly checked out exact SHA 3e34a54ae279686a28309d59b8b3b9bfbd283a80;
• exact-head verifier reports production functions, lines, regions, and branches all exactly 100% covered;
• exact coverage artifact 9510608942, exact-coverage-3e34a54ae279686a28309d59b8b3b9bfbd283a80, uploaded ZIP SHA-256 d423cc3fa7f67d06530f4adfa63e566eb5bd2f87f3be43dbfae8e6c53fe865f3;
• SAST Semgrep run 32701197831: success;
• Security Scan run 32701197767: success; and
• Manifest V3 Compatibility run 32701197741: success.

The materializer workflow run on this head was skipped and is not promoted to passing evidence. All current inline review threads are resolved. Formal review inventory contains automated COMMENTED reviews only; no eligible counted independent APPROVED review is inferred from scanners, CI, comments, author activity, or model output.

Documentation / standards boundary

ADR 0015 records the release-manifest identity decision, including the pinned Rust baseline, Git zero-id rejection, bounded filename portability rule, and deliberate migration requirement for a future Rust upgrade. Canonical doctoring records the Microsoft filename rationale and versioned Git protocol evidence. Git's protocol grammar distinguishes zero-id = 40*"0" from ordinary object identifiers; rejecting that sentinel is an identity-representation rule only and does not authenticate GitHub or establish source reachability/trust.

Scope boundary

This slice does not close #201 and does not implement signing identity, full SBOM/SLSA provenance, installer/update transport, rollback/freeze protection, platform package authority, or integrated release acceptance. Those remain separately reviewed release-lifecycle work.

Protected-main AGENTS.md remains authoritative. This scheduled writer does not merge, self-approve, force-push, alter workflows/rulesets/secrets, tag, release, or publish.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

📝 Walkthrough

Walkthrough

릴리스 매니페스트 공개 모듈에 build identity와 아티팩트 검증 규칙을 추가했습니다. Rust 1.97.1 toolchain, lowercase SHA-256 dependency-lock digest, source commit 및 Chromium revision을 검증합니다. 예약 장치 이름과 잘못된 식별자를 거부합니다. 관련 테스트와 ADR 문서를 갱신했습니다.

Changes

릴리스 매니페스트

Layer / File(s)	Summary
공개 계약과 매니페스트 구성 crates/originweave-core/src/lib.rs, crates/originweave-core/src/release_manifest.rs	release_manifest 공개 모듈과 ReleaseBuildIdentity, ReleaseArtifact, ReleaseManifest 계약을 추가했습니다. ReleaseManifest는 build identity를 필수 입력으로 저장하고 반환합니다.
식별자 및 아티팩트 검증 crates/originweave-core/src/release_manifest.rs	Rust 1.97.1 toolchain, canonical lowercase SHA-256 digest, 40자리 lowercase Git source commit, Chromium revision 및 bounded ASCII 아티팩트 이름을 검증합니다. 예약 장치 이름, 경로 유사 이름, 대소문자 충돌 및 all-zero commit을 거부합니다.
검증 테스트 crates/originweave-core/tests/release_manifest.rs, crates/originweave-core/tests/release_manifest_build_identity.rs	유효한 build identity 보존과 잘못된 toolchain, digest, source commit, revision, 아티팩트 이름, 중복 및 개수 제한을 검증합니다. 오류 문자열과 Error::source() 동작도 확인합니다.
식별 경계 문서화 docs/adr/0015-release-manifest-identity.md, docs/README.md, docs/adr/README.md, docs/doctoring.md, CHANGELOG.md	릴리스 매니페스트 식별 규칙과 Windows·OneDrive·SharePoint 예약 이름 제한을 문서화했습니다. ADR 0015를 Proposed 상태로 색인하고 관련 기준선과 참고 문헌을 갱신했습니다.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Merge Risk: 🟡 Moderate · up to 4601c

The release-manifest admission contract is well tested, but merge readiness is reduced by documentation that claims broader Microsoft synchronization compatibility than the validator provides, along with unresolved provenance and Git-reference accuracy issues. These bounded contract and documentation mismatches should be corrected or explicitly accepted before merge.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	PR은 #201의 릴리스 매니페스트 식별 경계를 구현하며, 서명·배포 등 미구현 범위는 부분 구현 목표와 일치합니다.
Out of Scope Changes check	✅ Passed	코드, 테스트, ADR, 문서 변경은 모두 릴리스 매니페스트 식별 계약과 예약 장치명 검증 범위에 해당합니다.
Docstring Coverage	✅ Passed	Docstring check was indeterminate for this PR — some files could not be analyzed in time. Not blocking.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목은 릴리스 아티팩트를 정식 매니페스트 식별자에 바인딩하는 핵심 변경을 정확하고 간결하게 설명합니다.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/release-manifest-artifact-contract

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

Devin Review found 3 new potential issues.

[devin-ai-integration]

Devin Review found 2 new potential issues.