Skip to content

README.md

Latest commit

 

History

History
41 lines (27 loc) · 1.45 KB

README.md

File metadata and controls

41 lines (27 loc) · 1.45 KB
Raw

Stage351: Hybrid Enforcement Signature Manifest Layer

Stage351 extends Stage350 by creating a hybrid, context-bound, PQC-ready signature manifest for the Stage350 enforcement session.

What Stage351 Adds

  • Binds docs/enforcement/enforcement_session.json
  • Binds the Stage350 session_sha256
  • Records CI / local execution context
  • Records GitHub Actions context when available
  • Defines Sigstore OIDC as required for CI acceptance
  • Integrates GPG / Sigstore OIDC / Ed25519 / PQC ML-DSA entries into one signature envelope
  • Records ML-DSA as intent_only PQC metadata
  • Prevents false claims of signatures that do not exist

Important Fact Boundary

Stage351 does not claim that GPG, Sigstore, Ed25519, or ML-DSA signatures exist unless the actual signature artifact exists.

PQC Position

Stage351 records ML-DSA / NIST FIPS 204 as PQC-ready metadata.

It does not publish private keys. It does not publish raw secrets. It does not claim a real PQC signature unless a verifiable PQC signature artifact exists.

Public Evidence

  • docs/signatures/stage351_signature_manifest.json

Decision Model

  • pending: local execution / metadata-only manifest
  • accept: CI context and required signature conditions are satisfied
  • warn: non-CI inconsistency detected
  • block: CI required context or required signature is missing

Safety Boundary

Private core logic, private signing keys, raw secrets, and unverified signature claims are excluded from GitHub.