evidence: register measured Flow 1.35.1 acceptance manifest - #43
Merged
Conversation
Signed-off-by: abrichr <richard.abrich@mldsai.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Register the acceptance manifest for the published Flow 1.35.1 artifacts from
44e99a48ebf048c18892aa17cef6ae594db0d0c2.The manifest joins the measured decision receipt at main
4a4ae1aceacee1e069b029f498bd996e07821840and workflow admission at mainf0fb9cc812c0d1653b1ec2998749b078f244308ewith the exact wheel and sdist inventory. It preserves the workflow's original receipt reference. Fresh public metadata, artifact downloads, and repository tag controls supply the publication proof observed at2026-09-09T18:40:27Z.The existing
already-published-pypipath applies. GitHub release 385710075 retainsimmutable:false; the repository setting applies to future releases. The record doesn't claim retroactive GitHub immutability. Both public destinations match the exact artifact hashes.Qualification covers one synthetic reference workflow and 18 groups, with three groups per declared class. Customer workflows and product-wide Production require their own complete gates.
Validation: Independent review verified the fresh staging records, exact unsigned plan, signed output, permanent one-use result, and three-file registration at
a654c36eac2c9e2c7b7ce34461025d34123c2472. The unchanged append-only validator passes for revision 6 and its 80 entries. The object issha256:29f74e08af2e5ae5d1665644ed27ac0a3914369217a0aa0d3e491d8adf3b39e0; its bundle issha256:120528ff60306ba4c748519cc1ad212abde9302425b3633acbbb44a9fcdd3361. The original 78 entries and all signer state remain unchanged.