fix(security): bind release provenance to source

[Bill Berry (WilliamBerryiii)]

fix(security): bind release provenance to source

Description

This change bound release attestation verification to the exact source commit and immutable release tag. It also made the release artifact contract channel-specific so Stable verifies its OpenVEX relationships separately while PreRelease rejects an OpenVEX document.

• Required Stable releases to contain one canonical hve-core.openvex.json and one canonical dependencies.spdx.json
• Verified the OpenVEX document as a SLSA provenance subject and the dependency SBOM as the subject of an OpenVEX predicate
• Preserved the existing Marketplace repository, signer workflow, signer revision, source, predicate, hosted-runner, policy-parsing, and sidecar byte-equivalence guards
• Updated Stable release notes and consumer guidance to resolve the exact tag commit and apply source digest and source ref constraints
• Added Pester coverage for Stable and PreRelease artifact contracts and the two separate Stable VEX verification relationships

Related Issue(s)

Fixes #2839

Type of Change

Select all that apply:

Code & Documentation:

• Bug fix (non-breaking change fixing an issue)
• New feature (non-breaking change adding functionality)
• Breaking change (fix or feature causing existing functionality to change)
• Documentation update

Infrastructure & Configuration:

• GitHub Actions workflow
• Linting configuration (markdown, PowerShell, etc.)
• Security configuration
• DevContainer configuration
• Dependency update

AI Artifacts:

• Reviewed contribution with hve-builder and addressed all actionable findings
• Copilot instructions (.github/instructions/*.instructions.md)
• Copilot prompt (.github/prompts/*.prompt.md)
• Copilot agent (.github/agents/*.agent.md)
• Copilot skill (.github/skills/*/SKILL.md)
• Copilot hook (.github/hooks/*/*.json)
• Eval spec added/updated for changed AI artifacts (evals/)

Note for AI Artifact Contributors:

• Agents: Research, indexing/referencing other project (using standard VS Code GitHub Copilot/MCP tools), planning, and general implementation agents likely already exist. Review .github/agents/ before creating new ones.
• Skills: Must include both bash and PowerShell scripts. See Skills.
• Model Versions: Contributions MUST target models listed in the model catalog (scripts/linting/model-catalog.json) whose provider appears in providerAllowlist and whose status is ga or preview. Run npm run lint:models to validate references.
• See Agents Not Accepted and Model Version Requirements.

Other:

• Script/automation (.ps1, .sh, .py)
• Other (please describe):

Sample Prompts (for AI Artifact Contributions)

User Request:

Execution Flow:

Output Artifacts:

Success Indicators:

For detailed contribution requirements, see:

• Common Standards: docs/contributing/ai-artifacts-common.md - Shared standards for XML blocks, markdown quality, RFC 2119, validation, and testing
• Agents: docs/contributing/custom-agents.md - Agent configurations with tools and behavior patterns
• Prompts: docs/contributing/prompts.md - Workflow-specific guidance with template variables
• Instructions: docs/contributing/instructions.md - Technology-specific standards with glob patterns
• Skills: docs/contributing/skills.md - Task execution utilities with cross-platform scripts

Testing

• npm run test:ps -- -TestPath scripts/tests/release/Invoke-ProvenanceVerification.Tests.ps1 passed: 39 tests
• npm run test:ps -- -TestPath scripts/tests/extension/Workflow-PackagingContracts.Tests.ps1 passed: 190 tests
• npm run validate:docs passed: 78 Jest tests and 11 Mermaid source tests
• npm run spell-check passed: 808 files with zero issues
• npm run lint:yaml passed: 70 workflows
• npm run lint:ps passed: 259 PowerShell files
• git diff --check passed
• npm run validate:local was skipped because it includes the explicitly skipped link check
• npm run lint:md-links was skipped by user direction; an earlier run failed only on unchanged references in change-risk-model.md and data-classification.md
• Manual hosted release testing was not performed

The diff introduced no dependencies, credentials, workflow permission changes, or additional token scopes. A focused secret-pattern scan found no concerns.

Checklist

Required Checks

• Documentation is updated (if applicable)
• Files follow existing naming conventions
• Changes are backwards compatible (if applicable)
• Tests added for new functionality (if applicable)

AI Artifact Contributions

• Used hve-builder review mode to review contribution
• Addressed all actionable findings from the hve-builder review
• Verified contribution follows common standards and type-specific requirements

Required Local Checks

The following local-safe validation commands must pass before merging:

• Local validation aggregate: npm run validate:local (skipped because it includes the explicitly skipped link check)
• Documentation validation (if docs changed): npm run validate:docs
• Spell checking: npm run spell-check
• Link validation: npm run lint:md-links (skipped by user direction; earlier failures were confined to two unchanged files)

Security Considerations

• This PR does not contain any sensitive or NDA information
• Any new dependencies have been reviewed for security issues (N/A: no dependency changes)
• Security-related scripts follow the principle of least privilege

Additional Notes

Hosted release validation remains follow-up work. It should confirm real attestation lookup and that the local reusable VEX workflow's signer digest resolves to the release source commit.

[Codecov Comments Bot (codecov-commenter)]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 83.27%. Comparing base (52abb38) to head (0ceba78).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2841      +/-   ##
==========================================
+ Coverage   83.14%   83.27%   +0.13%     
==========================================
  Files         183      184       +1     
  Lines       34029    34500     +471     
  Branches       25       25              
==========================================
+ Hits        28292    28730     +438     
- Misses       5734     5767      +33     
  Partials        3        3              

Flag	Coverage Δ
docusaurus	89.92% <ø> (ø)
pester	84.24% <ø> (+0.40%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.
see 8 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

Eval Execution

⚠️ No eval summary was produced.