Release evidence contract

Contract ID: LL-FDE-OPS-003
Version: 0.1.0
Status: implemented for public-draft build/deploy evidence; not a publication, validation, signature, or archival standard

1. Evidence set

Every candidate promoted to the existing production site must retain one coherent evidence set:

Record	Required content	Authority limit
Source manifest	Repository-relative source files, byte counts, digests, content-set digest, release posture	Proves candidate source bytes only
CI run	Exact commit, workflow revision, dependency lockfiles, gate results	Proves the recorded checks ran in that environment
Deployment evidence	Built-file paths, byte counts, per-file SHA-256 digests, artifact-set digest, source-manifest digest	Proves candidate build bytes only
Provider receipt	Site/deploy identifiers, URL, deploy state, provider timestamps	Proves provider acceptance, not correctness
Live verification	Checked origin/time, routes, status, noindex state, security-header state, failures	Proves the observed responses at one point in time
Decision record	Named authorities, gate evidence, decisions, date, exact manifest	Required separately for formal publication; currently unsigned

No one record substitutes for another. An artifact digest does not establish measurement validity, and a publication decision cannot excuse a byte mismatch or failed live check.

2. Deployment-evidence schema

scripts/build-deployment-evidence.mjs emits:

schema_version;
evidence_class;
release_posture and numeric-output boundary;
generation time and source commit when provided by CI;
digest of the source-manifest file and its declared content-set digest;
deterministic artifact-set digest;
sorted file path, byte count, and SHA-256 digest entries;
explicit limitations.

The artifact-set digest is SHA-256 over the canonical JSON serialization of the sorted artifact entries. It is deterministic for identical build bytes and paths; the generation timestamp is not part of that digest.

3. Retention

Ordinary CI builds: 30-day GitHub artifact retention.
Production-draft deployments: 90-day GitHub artifact retention.
Scheduled monitor receipts: 14-day GitHub artifact retention.
Approved formal releases: a separate immutable archive, checksum set, signed decision, and persistent identifier are required; GitHub artifact retention is insufficient.

Retention periods are configuration facts, not legal, records-management, or research-data-retention approval.

4. Failure behavior

Deployment must stop when any source, manifest, contract, scorer, study, reproducibility, type, build, browser, accessibility, posture, ancestry, identity, provider, route, or header gate fails. The workflow must not retry by weakening the gate or deploying different local bytes.

If live verification fails after provider deployment, treat the release as a deployment incident, restore the last verified candidate, and retain both receipts.

5. Secret handling

Tokens are supplied only through protected environment secrets.
Secret values must not appear in source, command arguments, logs, screenshots, receipts, or artifacts.
Site identifiers and public origins are non-secret deployment targets and are fixed in the reviewed workflow to prevent accidental replacement-project deployment.
Receipts must be reviewed before external distribution.