diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 4e1eb20..6e5705e 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -153,7 +153,7 @@ jobs: if: matrix.language == 'csharp' with: global-json-file: global.json - - uses: github/codeql-action/init@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4 + - uses: github/codeql-action/init@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4 with: languages: ${{ matrix.language }} build-mode: ${{ matrix.build-mode }} @@ -162,7 +162,7 @@ jobs: run: | dotnet restore ArcSlate.slnx --locked-mode dotnet build ArcSlate.slnx -c Release --no-restore -p:UseSharedCompilation=false - - uses: github/codeql-action/analyze@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4 + - uses: github/codeql-action/analyze@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4 with: category: /language:${{ matrix.language }} diff --git a/eng/policy/dependency-review.json b/eng/policy/dependency-review.json index 607763a..7be4ab3 100644 --- a/eng/policy/dependency-review.json +++ b/eng/policy/dependency-review.json @@ -2,7 +2,7 @@ "schemaVersion": 1, "owner": "ArcSlate", "decision": "approved", - "reviewedOn": "2026-09-21", + "reviewedOn": "2026-09-26", "baselineCommit": "26331c3b240a95603d2f9d25949f47899ac484e0", "baselineFrameworkVersions": { "dotnet": "10.0.401", @@ -11,18 +11,18 @@ "frameworkMajorUpgrade": false, "runtimePostureAssessment": "No framework version changes: existing desktop Native AOT and trim posture retained.", "checks": { - "compilation": "Retain required Windows/Linux compilation in the existing CI graph.", - "aot": "Retain Windows x64/ARM64 and Linux x64 AOT publication; no runtime graph changed.", - "compatibility": "No package versions, APIs or generated public contracts changed; prior WP02 stage evidence retained.", - "licence": "Complete locked closure and published cached metadata reviewed; existing source/native notices and provenance gates retained.", - "security": "Existing dependency-review and CodeQL gates remain required; no duplicated scanner or vulnerability-free assertion.", - "sbom": "Existing portable dependencies.json is generated from actual restore assets; no distributed closure changed.", - "localRuntime": "Not run: dependency policy tooling changes do not affect application runtime behavior.", + "compilation": "Workflow-only update: github/codeql-action init/analyze 4.38.0 -> 4.38.1 (Dependabot actions group). Required Windows/Linux compilation runs unchanged in CI.", + "aot": "No project, package or publish input changed; existing Windows x64/ARM64 and Linux x64 AOT publication jobs are unchanged.", + "compatibility": "Patch release within CodeQL action v4 with the same inputs and outputs; no package versions, APIs or generated contracts changed.", + "licence": "GitHub-owned action pinned to the immutable commit 1c5b675653bb5c22dbe9b12b556ec555138e09fd of annotated tag v4.38.1; no distributed closure or notice changed.", + "security": "Immutable SHA pin retained; CodeQL and dependency-review gates stay required; no vulnerability-absence claim.", + "sbom": "No restore closure change; the portable dependencies.json SBOM is unaffected.", + "localRuntime": "Not run: CI-only workflow action update; no application runtime behavior changed.", "performance": "Not applicable: no runtime dependency, executable behavior or performance-sensitive algorithm changed.", "migration": "Not applicable: no persistence format or storage dependency changed." }, "inputs": { - ".github/workflows/ci.yml": "72e49befc9213d9c02974853313cf19e0c8adb1642a44b5ba33b8b00de90c8c2", + ".github/workflows/ci.yml": "4df50b97f6c50da7faed6609ef2789b412c78679f533d22168a25ad685ac18b7", "Directory.Build.props": "3152c97565a3f41762fc224fb86cbe723849235ec4010c80bdc9a604d5fe3909", "Directory.Build.targets": "178d0fc0bbc04d39c2b8c3df01ddcc81fc709d54f435606212625ab5ec58d99d", "Directory.Packages.props": "ef826d5a6865882ae44e02c03a21e2d94e3146a2027a22bdbc6a558aac260321", diff --git a/eng/provenance/NOTICE.txt b/eng/provenance/NOTICE.txt index bb9391f..d0f5447 100644 --- a/eng/provenance/NOTICE.txt +++ b/eng/provenance/NOTICE.txt @@ -2,7 +2,7 @@ ArcForges source provenance notices Generated from reviewed active records. Original licence files and dependency notices remain authoritative. -arcnotes-provenance-tools-r4 +arcnotes-provenance-tools-r5 Source: https://github.com/ArcForges/ArcNotes @ b7358bd7b1dca0671cd51cf6d798d5c09911b198 Material licence: AGPL-3.0-only Notice scope: source @@ -11,6 +11,7 @@ Original provenance checker from Contracts: Apache-2.0; complete source terms an ArcSlate adapts product identity and future format/storage owner declarations. ArcSlate owner modifications: reduce hosted CI to Windows/Linux compilation and offline checks; remove mandatory runtime evidence and redundant validation. ArcSlate owner modifications: add reviewed dependency policy, upgrade records and offline negative fixtures adapted from ArcNotes b7358bd7b1dca0671cd51cf6d798d5c09911b198. +ArcSlate owner modifications: reviewed dependency updates are recorded in the owner dependency admission and review inputs. Copyright ArcForges contributors. ArcSlate adapts ArcNotes dependency admission and retained support tooling under AGPL-3.0-only; original Apache checker attribution remains retained. canonical-agpl-legal-r1 diff --git a/eng/provenance/files.json b/eng/provenance/files.json index a4c7d3b..3989db9 100644 --- a/eng/provenance/files.json +++ b/eng/provenance/files.json @@ -38,6 +38,7 @@ "eng/provenance/records/arcnotes-provenance-tools-r2.json", "eng/provenance/records/arcnotes-provenance-tools-r3.json", "eng/provenance/records/arcnotes-provenance-tools-r4.json", + "eng/provenance/records/arcnotes-provenance-tools-r5.json", "eng/provenance/records/canonical-agpl-legal-r1.json", "eng/provenance/records/contracts-apache-legal-r1.json", "eng/provenance/records/upstream-avalonia-legal-r1.json", @@ -64,10 +65,10 @@ "third-party/sources.json" ], "reused": { - "eng/ArcForges.Repository/ProvenancePolicy.cs": "arcnotes-provenance-tools-r4", - "eng/ArcForges.Repository/Program.cs": "arcnotes-provenance-tools-r4", - "tests/ArcForges.ArcSlate.Tests/ProvenancePolicyTests.cs": "arcnotes-provenance-tools-r4", - "tests/ArcForges.ArcSlate.Tests/CandidateTests.cs": "arcnotes-provenance-tools-r4", + "eng/ArcForges.Repository/ProvenancePolicy.cs": "arcnotes-provenance-tools-r5", + "eng/ArcForges.Repository/Program.cs": "arcnotes-provenance-tools-r5", + "tests/ArcForges.ArcSlate.Tests/ProvenancePolicyTests.cs": "arcnotes-provenance-tools-r5", + "tests/ArcForges.ArcSlate.Tests/CandidateTests.cs": "arcnotes-provenance-tools-r5", "LICENSE": "canonical-agpl-legal-r1", "eng/third-party/LICENSE.Contracts.txt": "contracts-apache-legal-r1", "third-party/Avalonia.LICENSE.txt": "upstream-avalonia-legal-r1", @@ -76,23 +77,23 @@ "third-party/MicroCom.LICENSE.txt": "upstream-microcom-legal-r1", "third-party/Protobuf.LICENSE.txt": "upstream-protobuf-legal-r1", "third-party/Tmds.DBus.LICENSE.txt": "upstream-tmds-dbus-legal-r1", - "eng/ArcForges.Repository/IdentityEvidence.cs": "arcnotes-provenance-tools-r4", - "src/ArcForges.ArcSlate.Core/BuildIdentity.cs": "arcnotes-provenance-tools-r4", - "tests/ArcForges.ArcSlate.Tests/BuildIdentityTests.cs": "arcnotes-provenance-tools-r4", - "Directory.Build.targets": "arcnotes-provenance-tools-r4", - "Directory.Build.props": "arcnotes-provenance-tools-r4", - "Directory.Packages.props": "arcnotes-provenance-tools-r4", - "eng/ArcForges.Repository/ArcForges.Repository.csproj": "arcnotes-provenance-tools-r4", - "src/ArcForges.ArcSlate/ArcForges.ArcSlate.csproj": "arcnotes-provenance-tools-r4", - "src/ArcForges.ArcSlate/Program.cs": "arcnotes-provenance-tools-r4", - "src/ArcForges.ArcSlate/LiveSmoke.cs": "arcnotes-provenance-tools-r4", - ".github/workflows/ci.yml": "arcnotes-provenance-tools-r4", - "eng/version-sources.json": "arcnotes-provenance-tools-r4", - "eng/ArcForges.Repository/DependencyPolicy.cs": "arcnotes-provenance-tools-r4", - "docs/dependency-policy.md": "arcnotes-provenance-tools-r4", - "eng/policy/dependency-policy.json": "arcnotes-provenance-tools-r4", - "tests/ArcForges.ArcSlate.Tests/DependencyPolicyTests.cs": "arcnotes-provenance-tools-r4", - "eng/policy/dependency-review.json": "arcnotes-provenance-tools-r4" + "eng/ArcForges.Repository/IdentityEvidence.cs": "arcnotes-provenance-tools-r5", + "src/ArcForges.ArcSlate.Core/BuildIdentity.cs": "arcnotes-provenance-tools-r5", + "tests/ArcForges.ArcSlate.Tests/BuildIdentityTests.cs": "arcnotes-provenance-tools-r5", + "Directory.Build.targets": "arcnotes-provenance-tools-r5", + "Directory.Build.props": "arcnotes-provenance-tools-r5", + "Directory.Packages.props": "arcnotes-provenance-tools-r5", + "eng/ArcForges.Repository/ArcForges.Repository.csproj": "arcnotes-provenance-tools-r5", + "src/ArcForges.ArcSlate/ArcForges.ArcSlate.csproj": "arcnotes-provenance-tools-r5", + "src/ArcForges.ArcSlate/Program.cs": "arcnotes-provenance-tools-r5", + "src/ArcForges.ArcSlate/LiveSmoke.cs": "arcnotes-provenance-tools-r5", + ".github/workflows/ci.yml": "arcnotes-provenance-tools-r5", + "eng/version-sources.json": "arcnotes-provenance-tools-r5", + "eng/ArcForges.Repository/DependencyPolicy.cs": "arcnotes-provenance-tools-r5", + "docs/dependency-policy.md": "arcnotes-provenance-tools-r5", + "eng/policy/dependency-policy.json": "arcnotes-provenance-tools-r5", + "tests/ArcForges.ArcSlate.Tests/DependencyPolicyTests.cs": "arcnotes-provenance-tools-r5", + "eng/policy/dependency-review.json": "arcnotes-provenance-tools-r5" }, "artifacts": [] } diff --git a/eng/provenance/records/arcnotes-provenance-tools-r5.json b/eng/provenance/records/arcnotes-provenance-tools-r5.json new file mode 100644 index 0000000..19da4c4 --- /dev/null +++ b/eng/provenance/records/arcnotes-provenance-tools-r5.json @@ -0,0 +1,299 @@ +{ + "schemaVersion": 1, + "id": "arcnotes-provenance-tools-r5", + "kind": "source", + "sourceRepository": "https://github.com/ArcForges/ArcNotes", + "sourceCommit": "b7358bd7b1dca0671cd51cf6d798d5c09911b198", + "sourcePaths": [ + "eng/ArcForges.Repository/ProvenancePolicy.cs", + "eng/ArcForges.Repository/Program.cs", + "tests/ArcForges.ArcNotes.Tests/ProvenancePolicyTests.cs", + "tests/ArcForges.ArcNotes.Tests/CandidateTests.cs", + "eng/ArcForges.Repository/IdentityEvidence.cs", + "src/ArcForges.ArcNotes.Core/BuildIdentity.cs", + "tests/ArcForges.ArcNotes.Tests/BuildIdentityTests.cs", + "Directory.Build.targets", + "Directory.Build.props", + "Directory.Packages.props", + "eng/ArcForges.Repository/ArcForges.Repository.csproj", + "src/ArcForges.ArcNotes/ArcForges.ArcNotes.csproj", + "src/ArcForges.ArcNotes/Program.cs", + "src/ArcForges.ArcNotes/LiveSmoke.cs", + ".github/workflows/ci.yml", + "eng/version-sources.json", + "eng/ArcForges.Repository/DependencyPolicy.cs", + "docs/dependency-policy.md", + "eng/policy/dependency-policy.json", + "tests/ArcForges.ArcNotes.Tests/DependencyPolicyTests.cs", + "eng/policy/dependency-review.json" + ], + "licence": { + "spdx": "AGPL-3.0-only", + "category": "agpl-compatible", + "evidence": [ + { + "path": "LICENSE", + "sha256": "8486a10c4393cee1c25392769ddd3b2d6c242d6ec7928e1414efff7dfb2f07ef", + "finding": "AGPL-3.0-only source/header or owner build/policy metadata from the same immutable ArcNotes revision; original Apache provenance-checker attribution remains retained." + }, + { + "path": "eng/ArcForges.Repository/ProvenancePolicy.cs", + "sha256": "0da29d6f3cd9656640276d27eab25ee38fec68809d4dcc68ef3c1ad96ec1f3b9", + "finding": "AGPL-3.0-only source/header or owner build/policy metadata from the same immutable ArcNotes revision; original Apache provenance-checker attribution remains retained." + }, + { + "path": "eng/ArcForges.Repository/Program.cs", + "sha256": "dba5e6b75593631d55418998f7791190933b88b62f646e4c0e3f2a9d38b461ac", + "finding": "AGPL-3.0-only source/header or owner build/policy metadata from the same immutable ArcNotes revision; original Apache provenance-checker attribution remains retained." + }, + { + "path": "tests/ArcForges.ArcNotes.Tests/ProvenancePolicyTests.cs", + "sha256": "286437bd06ea7dd22e58f2007e2b75ab7aa4264595ff1d548b9953adeb6bca69", + "finding": "AGPL-3.0-only source/header or owner build/policy metadata from the same immutable ArcNotes revision; original Apache provenance-checker attribution remains retained." + }, + { + "path": "tests/ArcForges.ArcNotes.Tests/CandidateTests.cs", + "sha256": "f0cc9fce799ff27519689d60b27667f679e21720a2531688566b97d99dc029f2", + "finding": "AGPL-3.0-only source/header or owner build/policy metadata from the same immutable ArcNotes revision; original Apache provenance-checker attribution remains retained." + }, + { + "path": "eng/ArcForges.Repository/IdentityEvidence.cs", + "sha256": "73510ff86c7b6e5b86baeebd95a7df2c7cb355531a265e2a20b67bdcf39e3215", + "finding": "AGPL-3.0-only source/header or owner build/policy metadata from the same immutable ArcNotes revision; original Apache provenance-checker attribution remains retained." + }, + { + "path": "src/ArcForges.ArcNotes.Core/BuildIdentity.cs", + "sha256": "2a1c184214d4b5c49e4f1affa96cc5741d1c1b34b3892477e0c97d31eccb5bc5", + "finding": "AGPL-3.0-only source/header or owner build/policy metadata from the same immutable ArcNotes revision; original Apache provenance-checker attribution remains retained." + }, + { + "path": "tests/ArcForges.ArcNotes.Tests/BuildIdentityTests.cs", + "sha256": "ae11ceb972227aa8e0cc810852e42ffdeebc71493cd07546a59d752ceeb0c444", + "finding": "AGPL-3.0-only source/header or owner build/policy metadata from the same immutable ArcNotes revision; original Apache provenance-checker attribution remains retained." + }, + { + "path": "Directory.Build.targets", + "sha256": "21da49619dc407ca9de526c9aa75cb9a0e67ca6314bddd4770dd165975405bd4", + "finding": "AGPL-3.0-only source/header or owner build/policy metadata from the same immutable ArcNotes revision; original Apache provenance-checker attribution remains retained." + }, + { + "path": "Directory.Build.props", + "sha256": "90a5954ec7685904894ef8d19fea650f9bcebabbde98b0b94058f8b7c68fb5a4", + "finding": "AGPL-3.0-only source/header or owner build/policy metadata from the same immutable ArcNotes revision; original Apache provenance-checker attribution remains retained." + }, + { + "path": "Directory.Packages.props", + "sha256": "ef826d5a6865882ae44e02c03a21e2d94e3146a2027a22bdbc6a558aac260321", + "finding": "AGPL-3.0-only source/header or owner build/policy metadata from the same immutable ArcNotes revision; original Apache provenance-checker attribution remains retained." + }, + { + "path": "eng/ArcForges.Repository/ArcForges.Repository.csproj", + "sha256": "b80fff54a4c877998e66b035a159e790bce4c771244d1d239fa8d58c8dd589a6", + "finding": "AGPL-3.0-only source/header or owner build/policy metadata from the same immutable ArcNotes revision; original Apache provenance-checker attribution remains retained." + }, + { + "path": "src/ArcForges.ArcNotes/ArcForges.ArcNotes.csproj", + "sha256": "4a4bb4fb53401da31b2f2aafd96f5c733a78f08c60632f717eeb8b8e1eaabdba", + "finding": "AGPL-3.0-only source/header or owner build/policy metadata from the same immutable ArcNotes revision; original Apache provenance-checker attribution remains retained." + }, + { + "path": "src/ArcForges.ArcNotes/Program.cs", + "sha256": "f763a3e5e5db240cb18478dc733db84fbaae03c1276396ebb8302ed1349078a7", + "finding": "AGPL-3.0-only source/header or owner build/policy metadata from the same immutable ArcNotes revision; original Apache provenance-checker attribution remains retained." + }, + { + "path": "src/ArcForges.ArcNotes/LiveSmoke.cs", + "sha256": "0250c74301c91e79dde029788c06cfd9b1307cee519848458650aeb4ec2cb399", + "finding": "AGPL-3.0-only source/header or owner build/policy metadata from the same immutable ArcNotes revision; original Apache provenance-checker attribution remains retained." + }, + { + "path": ".github/workflows/ci.yml", + "sha256": "ec5963a454ab794847a07fd4360fd1708b3aef44385b4eeafd3d0137366ec1ab", + "finding": "AGPL-3.0-only source/header or owner build/policy metadata from the same immutable ArcNotes revision; original Apache provenance-checker attribution remains retained." + }, + { + "path": "eng/version-sources.json", + "sha256": "381adf427140f65717901bb81dff340511831e7414a31eec897e4eb6ef9535f5", + "finding": "AGPL-3.0-only source/header or owner build/policy metadata from the same immutable ArcNotes revision; original Apache provenance-checker attribution remains retained." + }, + { + "path": "eng/ArcForges.Repository/DependencyPolicy.cs", + "sha256": "7bd25806398f343764b190e60c3c13fea45210b2aee31fb7f53422b4fb1fc197", + "finding": "AGPL-3.0-only source/header or owner build/policy metadata from the same immutable ArcNotes revision; original Apache provenance-checker attribution remains retained." + }, + { + "path": "docs/dependency-policy.md", + "sha256": "c2c87a4a8b6402abb1aa82060431b33efc66bbfba09635b58c03fbb6e120a7ad", + "finding": "AGPL-3.0-only source/header or owner build/policy metadata from the same immutable ArcNotes revision; original Apache provenance-checker attribution remains retained." + }, + { + "path": "eng/policy/dependency-policy.json", + "sha256": "ebde30ed1fd96baa1aaa2063ac03dad3336504e64508381008f191f79a380c55", + "finding": "AGPL-3.0-only source/header or owner build/policy metadata from the same immutable ArcNotes revision; original Apache provenance-checker attribution remains retained." + }, + { + "path": "tests/ArcForges.ArcNotes.Tests/DependencyPolicyTests.cs", + "sha256": "459274fcc0cd43412c3cd3a5fdca35d7bec5532819860c80356548abb21d1c4f", + "finding": "AGPL-3.0-only source/header or owner build/policy metadata from the same immutable ArcNotes revision; original Apache provenance-checker attribution remains retained." + }, + { + "path": "eng/policy/dependency-review.json", + "sha256": "34f1b711815d9fbf5cc5ab11aa5c61264a0d312f603ee6566e5fdeefb6a9c1c1", + "finding": "AGPL-3.0-only source/header or owner build/policy metadata from the same immutable ArcNotes revision; original Apache provenance-checker attribution remains retained." + } + ], + "scope": "Extend the retained ArcNotes adaptation with offline dependency admission, exact package metadata, immutable coordinate history and upgrade review. Product owner literals and input hashes are adapted to ArcSlate. No source checkout dependency or runtime behavior change.", + "copyingPermission": null + }, + "attribution": [ + "Copyright ArcForges contributors. ArcNotes support identity and tooling: AGPL-3.0-only.", + "Original provenance checker from Contracts: Apache-2.0; complete source terms and attribution retained.", + "ArcSlate adapts product identity and future format/storage owner declarations.", + "ArcSlate owner modifications: reduce hosted CI to Windows/Linux compilation and offline checks; remove mandatory runtime evidence and redundant validation.", + "ArcSlate owner modifications: add reviewed dependency policy, upgrade records and offline negative fixtures adapted from ArcNotes b7358bd7b1dca0671cd51cf6d798d5c09911b198.", + "ArcSlate owner modifications: reviewed dependency updates are recorded in the owner dependency admission and review inputs." + ], + "targets": [ + { + "path": ".github/workflows/ci.yml", + "sha256": "4df50b97f6c50da7faed6609ef2789b412c78679f533d22168a25ad685ac18b7", + "normalization": "lf" + }, + { + "path": "Directory.Build.props", + "sha256": "3152c97565a3f41762fc224fb86cbe723849235ec4010c80bdc9a604d5fe3909", + "normalization": "lf" + }, + { + "path": "Directory.Build.targets", + "sha256": "178d0fc0bbc04d39c2b8c3df01ddcc81fc709d54f435606212625ab5ec58d99d", + "normalization": "lf" + }, + { + "path": "Directory.Packages.props", + "sha256": "ef826d5a6865882ae44e02c03a21e2d94e3146a2027a22bdbc6a558aac260321", + "normalization": "lf" + }, + { + "path": "eng/ArcForges.Repository/ArcForges.Repository.csproj", + "sha256": "e28053fd187e0a8d69a57daecbc038135e094c0f198e0c2ad693c3dae1d7f41a", + "normalization": "lf" + }, + { + "path": "eng/ArcForges.Repository/IdentityEvidence.cs", + "sha256": "c7ad9045566a2ad7c6ae808332c6937f38a8d7fdb52e970ca518a0b61168d044", + "normalization": "lf" + }, + { + "path": "eng/ArcForges.Repository/Program.cs", + "sha256": "b0be509d473779c1c61ea437fa27e174b04a36414b7699a96eb03295680e3f42", + "normalization": "lf" + }, + { + "path": "eng/ArcForges.Repository/ProvenancePolicy.cs", + "sha256": "137fb7fcfae033e55a0a2a085aa0c95709855593ebf757b1c55990622e14cf25", + "normalization": "lf" + }, + { + "path": "eng/version-sources.json", + "sha256": "e692bc8516270a7f3b46fdf1aa653a4030dbb5375c35439fc9cba89118932a86", + "normalization": "lf" + }, + { + "path": "src/ArcForges.ArcSlate.Core/BuildIdentity.cs", + "sha256": "9b95ddc46925a794661927288f41b57b8e8a818f60ad518904c4ad832e781775", + "normalization": "lf" + }, + { + "path": "src/ArcForges.ArcSlate/ArcForges.ArcSlate.csproj", + "sha256": "01b01c44fc3c945c509786dc29bb5f30962b477e58299c756e83ed6645b93757", + "normalization": "lf" + }, + { + "path": "src/ArcForges.ArcSlate/LiveSmoke.cs", + "sha256": "a1a68698b42256975f6549e8ddc98c61a38c6d59a52217f74c98bc563dfde88b", + "normalization": "lf" + }, + { + "path": "src/ArcForges.ArcSlate/Program.cs", + "sha256": "7f2aa582cf9bd437e83dc23b810b172fa5eb085022a874933b5fd77854958445", + "normalization": "lf" + }, + { + "path": "tests/ArcForges.ArcSlate.Tests/BuildIdentityTests.cs", + "sha256": "f800f2097a677c5eeaff435242ec6c9c8236775aaea79094dd4c34ff345bdced", + "normalization": "lf" + }, + { + "path": "tests/ArcForges.ArcSlate.Tests/CandidateTests.cs", + "sha256": "09819858e53b4db695bb8e05054fc3fddc0bf50a52bdffba55b16ba26210045f", + "normalization": "lf" + }, + { + "path": "tests/ArcForges.ArcSlate.Tests/ProvenancePolicyTests.cs", + "sha256": "9f3a1ffed9f06541fd4eb0854fe1fd9fe1ee48a960010b38e05f5fdc1f1e0d16", + "normalization": "lf" + }, + { + "path": "eng/ArcForges.Repository/DependencyPolicy.cs", + "sha256": "f2dc185ed236baad43608b3b5975f163b7bcb1744201118ccd860571b0a357b2", + "normalization": "lf" + }, + { + "path": "docs/dependency-policy.md", + "sha256": "c2c87a4a8b6402abb1aa82060431b33efc66bbfba09635b58c03fbb6e120a7ad", + "normalization": "lf" + }, + { + "path": "eng/policy/dependency-policy.json", + "sha256": "5b9f0fd2b50ea5a36faba8868aa406612b39b1fe29316645f64ad7cfd220e8d9", + "normalization": "lf" + }, + { + "path": "tests/ArcForges.ArcSlate.Tests/DependencyPolicyTests.cs", + "sha256": "5d72258e813baa29a8903939748f569a154814bd8795d45cfba9e01c4c2dce13", + "normalization": "lf" + }, + { + "path": "eng/policy/dependency-review.json", + "sha256": "282a2c39496a2db75949b7713f90bf912aca41e04058b24abcc7b83abfe08f2e", + "normalization": "lf" + } + ], + "artifactTargets": [], + "disposition": "Rewrite", + "verification": { + "kind": "transformation", + "command": "dotnet run --project eng/ArcForges.Repository -c Release --no-build -- check; run targeted offline DependencyPolicyTests using existing tools and caches.", + "expected": "Complete unchanged locked closure, forbidden/floating/mutable/wrong-publisher negatives, immutable source provenance and matching owner policy input hashes. No runtime/public-download claim.", + "artifacts": [] + }, + "notice": { + "required": true, + "text": "Copyright ArcForges contributors. ArcSlate adapts ArcNotes dependency admission and retained support tooling under AGPL-3.0-only; original Apache checker attribution remains retained.", + "files": [ + "LICENSE", + "README.md", + "eng/third-party/LICENSE.Contracts.txt", + "eng/provenance/NOTICE.txt" + ], + "distribution": "source", + "reason": "The full corresponding source retains these origin records and original terms. Compiled support code remains AGPL; portable packages already include the complete root licence and README origin/source pointer. Checker/tool-only Apache code is not linked into the application." + }, + "lifetime": { + "status": "permanent", + "owner": "ArcSlate Licensing and Provenance Owner", + "removalTrigger": null + }, + "generation": null, + "review": { + "owner": "Licensing and Provenance Owner", + "reviewer": "Claude Code (Claude Opus 5.5), acting under the repository maintainer's implementation and review authorization", + "reviewedOn": "2026-09-26", + "decision": "approved", + "rationale": "Reviewed owner-specific dependency admission changes for Dependabot PR #11 (github/codeql-action init/analyze 4.38.0 -> 4.38.1) against the unchanged ArcNotes origin b7358bd7b1dca0671cd51cf6d798d5c09911b198; only the recorded bytes of the updated owner inputs change. Retain every earlier record, licence and package identity; supersedes arcnotes-provenance-tools-r4.", + "baselineCommit": "7b513c45a313d35255e95549555d5f2a07b17dc6", + "reconciliation": false + }, + "supersedes": "arcnotes-provenance-tools-r4" +}