[ryanjmichie-git]

Integration matrix case (b): frozen v1.0.1 + v1.1.0 fixtures verified by the NEW Action pin (v1.1.0, 6101dd7) — the forever contract, exercised in the Action.

Expected: check green with both legacy bundles, attestation output false, no warnings. A follow-up commit tampers an artifact and must turn the check red. Draft is closed after results are recorded in the release PR.

[github-actions]

ForgeProof verification — 2 bundles, FAILURES

---

Bundle file: .forgeproof/issue-998.rpack

✅ VERIFIED

Bundle: issue #998 — v110 fixture

Checks

Check	Status	Detail
format	ok	forgeproof-rpack v1.0.0
root_digest	ok	recomputed digest matches bundle content
signature	ok	Ed25519 signature valid for stored root digest
chain_hash	ok	chain file matches sealed chain_hash
chain_linkage	ok	verified 5 blocks
artifacts	ok	1 artifacts checked
coverage	ok	requirement coverage 100%
attestation	skipped	no attestation in bundle (pre-v1.3 format)
attestation_signature	skipped	no attestation in bundle
attestation_subjects	skipped	no attestation in bundle

Provenance timeline

#	Action	Timestamp
0	genesis	2026-07-12T05:36:36.601639+00:00
1	file-edit	2026-07-12T05:36:36.693774+00:00
2	decision	2026-07-12T05:36:36.786248+00:00
3	test-result	2026-07-12T05:36:36.880614+00:00
4	finalize	2026-07-12T05:36:36.973636+00:00

Artifacts

Path	SHA-256	Status
src/example2.py	a859096dbcc30a95	checked

Decisions

• c — x (r)

Evaluation (recorded claims)

These are the claims recorded at signing time; verification proves they are unaltered, not that they are true.

• Status: pass
• Tests passed: 1
• Tests failed: 0
• Lint errors: 0
• Requirement coverage: 100%

---

Strict mode: on · Complete: yes · Anchor: .

---

Bundle file: .forgeproof/issue-999.rpack

❌ TAMPER DETECTED

Bundle: issue #999 — v1.0.1 compatibility fixture

Checks

Check	Status	Detail
format	ok	forgeproof-rpack v1.0.0
root_digest	ok	recomputed digest matches bundle content
signature	ok	Ed25519 signature valid for stored root digest
chain_hash	ok	chain file matches sealed chain_hash
chain_linkage	ok	verified 5 blocks
artifacts	fail	1 tampered/unreadable, 1 checked, 0 missing
coverage	ok	requirement coverage 100%
attestation	skipped	no attestation in bundle (pre-v1.3 format)
attestation_signature	skipped	no attestation in bundle
attestation_subjects	skipped	no attestation in bundle

Provenance timeline

#	Action	Timestamp
0	genesis	2026-07-03T04:42:37.416883+00:00
1	file-edit	2026-07-03T04:42:37.556252+00:00
2	decision	2026-07-03T04:42:37.648437+00:00
3	test-result	2026-07-03T04:42:37.741686+00:00
4	finalize	2026-07-03T04:42:37.832642+00:00

Artifacts

Path	SHA-256	Status
src/example.py	9b03eb339790e7de	tampered

Decisions

• Freeze v1.0.x behavior before the v1.1.0 engine changes — Generate this bundle with the unmodified v1.0.1 engine (ROADMAP Principle 1: any .rpack ever signed must verify with every future verifier)

Evaluation (recorded claims)

These are the claims recorded at signing time; verification proves they are unaltered, not that they are true.

• Status: pass
• Tests passed: 2
• Tests failed: 0
• Lint errors: 0
• Requirement coverage: 100%

---

Strict mode: on · Complete: yes · Anchor: .

[ryanjmichie-git]

Matrix result — recorded for the v1.3.0 release PR.

• Deploy commit: forgeproof-verify check green, report as expected for this case (see the Action's PR comment above / first check run).
• Tamper commit (one artifact byte flipped): check red.

Full matrix (all three drafts, Action pin v1.1.0 6101dd7 unless stated):

Case	Deploy	Tamper
(a) #15 v1.3.0 bundle × new Action	green — attestation checks ok, ### Attestation section rendered	red
(b) #16 frozen v1.0.1+v1.1.0 bundles × new Action	green — attestation skipped silently, zero warnings	red
(c) #17 v1.3.0 bundle × old Action v1.0.2 0bd8aae	green — exactly one warning (Version mismatch: expected 1.0.0, got 1.1.0)	red

Closing this draft; the branch is deleted. Check runs remain attached to this PR for the audit trail.