[ryanjmichie-git]

Integration matrix case (c): v1.3.0 attestation bundle verified by the OLD Action pin (v1.0.2, 0bd8aae, pinned in this branch's workflow).

Expected: check green with exactly ONE version warning (the pre-attestation engine hashes the unknown attestation key via the root-digest denylist and warns on the unfamiliar format version). A follow-up commit tampers the artifact and must turn the check red. Draft is closed after results are recorded in the release PR.

[github-actions]

❌ TAMPER DETECTED

Bundle: issue #996 — v1.3.0 attestation fixture

Checks

Check	Status	Detail
format	warn	Version mismatch: expected 1.0.0, got 1.1.0
root_digest	ok	recomputed digest matches bundle content
signature	ok	Ed25519 signature valid for stored root digest
chain_hash	ok	chain file matches sealed chain_hash
chain_linkage	ok	verified 5 blocks
artifacts	fail	1 tampered/unreadable, 1 checked, 0 missing
coverage	ok	requirement coverage 100%

Provenance timeline

#	Action	Timestamp
0	genesis	2026-08-21T04:32:11.082194+00:00
1	file-edit	2026-08-21T04:32:11.184886+00:00
2	test-result	2026-08-21T04:32:11.289300+00:00
3	approval	2026-08-21T04:32:11.401815+00:00
4	finalize	2026-08-21T04:32:11.712146+00:00

Artifacts

Path	SHA-256	Status
src/example4.py	60b1e438f6e569f7	tampered

Decisions

No decisions recorded in this bundle.

Evaluation (recorded claims)

These are the claims recorded at signing time; verification proves they are unaltered, not that they are true.

• Status: pass
• Tests passed: 1
• Tests failed: 0
• Lint errors: 0
• Requirement coverage: 100%

---

Strict mode: on · Complete: yes · Anchor: .

[ryanjmichie-git]

Matrix result — recorded for the v1.3.0 release PR.

• Deploy commit: forgeproof-verify check green, report as expected for this case (see the Action's PR comment above / first check run).
• Tamper commit (one artifact byte flipped): check red.

Full matrix (all three drafts, Action pin v1.1.0 6101dd7 unless stated):

Case	Deploy	Tamper
(a) #15 v1.3.0 bundle × new Action	green — attestation checks ok, ### Attestation section rendered	red
(b) #16 frozen v1.0.1+v1.1.0 bundles × new Action	green — attestation skipped silently, zero warnings	red
(c) #17 v1.3.0 bundle × old Action v1.0.2 0bd8aae	green — exactly one warning (Version mismatch: expected 1.0.0, got 1.1.0)	red

Closing this draft; the branch is deleted. Check runs remain attached to this PR for the audit trail.