docs(agents): the manifest shape is also a provenance signal #40

Merged

jlxq0 merged 1 commit from docs/manifest-shape-as-provenance into main

2026-09-01 18:14:39 +00:00

jlxq0 commented

2026-09-01 18:13:11 +00:00

Owner

A second use for the index-versus-single-manifest fact, beside avoiding a false rollback. Refs #14. Docs only, no version bump.

Every image this repository's CI builds is an index, because the buildctl path attaches an attestation. So a single-manifest jmap-mcp image did not come out of .forgejo/workflows/ci.yml.

v0.2.5 and v0.2.6 are single manifests, which is a third independent signal beside:

no OCI labels, so no org.opencontainers.image.revision to read
no Actions run that could have built them: six tasks on 2026-08-16, all cargo, all failure, no docker job at all

None of the three shares a failure mode with the others, which is what makes them corroboration rather than one observation counted three times.

Gate: cargo +1.93.0 fmt --all --check rc=0, cargo +1.93.0 test --all-features --locked rc=0, 197 passed.

A second use for the index-versus-single-manifest fact, beside avoiding a false rollback. Refs #14. Docs only, no version bump. Every image this repository's CI builds is an **index**, because the `buildctl` path attaches an attestation. So a **single-manifest** `jmap-mcp` image did not come out of `.forgejo/workflows/ci.yml`. `v0.2.5` and `v0.2.6` are single manifests, which is a **third independent signal** beside: - no OCI labels, so no `org.opencontainers.image.revision` to read - no Actions run that could have built them: six tasks on 2026-08-16, all `cargo`, all `failure`, no `docker` job at all None of the three shares a failure mode with the others, which is what makes them corroboration rather than one observation counted three times. Gate: `cargo +1.93.0 fmt --all --check` rc=0, `cargo +1.93.0 test --all-features --locked` rc=0, 197 passed.

jlxq0 added 1 commit

2026-09-01 18:13:11 +00:00

docs(agents): the manifest shape is also a provenance signal

CI / tag-ancestry (pull_request) Successful in 3s

Details

CI / cargo (pull_request) Successful in 56s

Details

CI / docker (pull_request) Successful in 14s

Details

75c6d7e10d

Every image this repository's CI builds is an index, because the buildctl path
attaches an attestation. So a single-manifest jmap-mcp image did not come out of
.forgejo/workflows/ci.yml.

v0.2.5 and v0.2.6 are single manifests. That is a third independent signal
beside their absent OCI labels and the absence of any Actions run that could
have built them, and none of the three shares a failure mode with the others,
which is what makes them corroboration rather than one observation counted three
times.

A second use for the index-versus-single-manifest fact, beside avoiding a false
rollback.

Refs #14

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

jlxq0 merged commit f0b67d5f30 into main

2026-09-01 18:14:39 +00:00

jlxq0 deleted branch docs/manifest-shape-as-provenance

2026-09-01 18:14:40 +00:00

jlxq0 referenced this pull request from a commit

2026-09-01 18:14:40 +00:00

Merge pull request 'docs(agents): the manifest shape is also a provenance signal' (#40) from docs/manifest-shape-as-provenance into main