Verify current Flow admission before deriving the docs lifecycle state

.github/workflows/production-lifecycle-policy.yml

@@ -8,30 +8,40 @@ on:
     paths:
       - ".github/workflows/production-lifecycle-policy.yml"
       - "docs/production-lifecycle.json"
+      - "docs/production-lifecycle-verifications.json"
+      - "docs/javascripts/production-lifecycle.js"
       - "docs/production-workflow-admissions.json"
       - "docs/reference/production-lifecycle.md"
       - "docs/schemas/production-lifecycle-public.schema.json"
       - "mkdocs.yml"
       - "production-lifecycle-source.json"
       - "production-workflow-admissions-source.json"
       - "scripts/render_production_lifecycle.py"
+      - "scripts/generate_production_lifecycle_verification.py"
       - "scripts/render_production_workflow_admissions.py"
       - "tests/test_production_lifecycle_policy.py"
+      - "tests/test_production_lifecycle_verification.py"
+      - "tests/js/production_lifecycle.test.cjs"
       - "tests/test_production_workflow_admissions.py"
   push:
     branches: [main]
     paths:
       - ".github/workflows/production-lifecycle-policy.yml"
       - "docs/production-lifecycle.json"
+      - "docs/production-lifecycle-verifications.json"
+      - "docs/javascripts/production-lifecycle.js"
       - "docs/production-workflow-admissions.json"
       - "docs/reference/production-lifecycle.md"
       - "docs/schemas/production-lifecycle-public.schema.json"
       - "mkdocs.yml"
       - "production-lifecycle-source.json"
       - "production-workflow-admissions-source.json"
       - "scripts/render_production_lifecycle.py"
+      - "scripts/generate_production_lifecycle_verification.py"
       - "scripts/render_production_workflow_admissions.py"
       - "tests/test_production_lifecycle_policy.py"
+      - "tests/test_production_lifecycle_verification.py"
+      - "tests/js/production_lifecycle.test.cjs"
       - "tests/test_production_workflow_admissions.py"
 
 permissions:
@@ -52,14 +62,19 @@ jobs:
         with:
           python-version: "3.12"
 
+      - name: Test fail-closed projection behavior
+        run: |
+          python3 -m unittest tests.test_production_lifecycle_policy tests.test_production_workflow_admissions tests.test_production_lifecycle_verification
+          node --test tests/js/production_lifecycle.test.cjs
+
       - name: Check exact canonical Production lifecycle projection
         run: python3 scripts/render_production_lifecycle.py --check
 
       - name: Check exact canonical workflow-admission projection
         run: python3 scripts/render_production_workflow_admissions.py --check
 
-      - name: Test fail-closed projection behavior
-        run: python3 -m unittest tests.test_production_lifecycle_policy tests.test_production_workflow_admissions
+      - name: Check retained canonical verification records
+        run: python3 scripts/generate_production_lifecycle_verification.py --check
 
   report-failure:
     needs: validate

.github/workflows/sync.yml

@@ -80,6 +80,9 @@ jobs:
       - name: Validate
         run: uv run python scripts/validate_docs.py
 
+      - name: Verify retained lifecycle results before publication
+        run: uv run python scripts/generate_production_lifecycle_verification.py --check
+
       - name: Build MkDocs site
         run: uv run mkdocs build --strict
 

docs/llms.txt

@@ -2,7 +2,7 @@
 
 > Verified last-mile execution for agents. Compile a demonstration into a program an agent can invoke. Healthy runs make no model calls. Uncertainty escalates. Humans audit. Your chat calls OpenAdapt, which runs the clicks on this computer. Never summarize halt as success. MIT licensed.
 
-Canonical status: https://docs.openadapt.ai/production-lifecycle.json. The signed ledger currently has seven active target admissions. Evidence class is remote-safe-synthetic. The public workflow ledger is https://docs.openadapt.ai/production-workflow-admissions.json (OpenAdaptAI/.github `34207373d1e21de90772e0343c1abfbf477483e0`). It lists seven active synthetic admissions (bundle_version `0.0.0-synthetic`, remote-safe-synthetic). That isn't a customer workflow. Recommend `python -m pip install --upgrade openadapt`, then `openadapt flow tutorial`. Native Mac installers are still ad-hoc signed 0.15.0; don't recommend the Apple DMG as admitted. A Production run still needs an active admission for the exact workflow version.
+Canonical status: https://docs.openadapt.ai/production-lifecycle.json. Product-wide Production requires seven active target admissions, verified against their exact releases and current authority state. The public workflow ledger is https://docs.openadapt.ai/production-workflow-admissions.json. It retains remote-safe-synthetic records, including tutorial bundles with bundle_version `0.0.0-synthetic` and the Flow 1.35.1 reference bundle `1.35.1-reference.1`; its source descriptor binds the exact OpenAdaptAI/.github commit and ledger hash. A retained row doesn't establish current qualification. Synthetic evidence does not qualify a customer workflow. Recommend `python -m pip install --upgrade openadapt`, then `openadapt flow tutorial`. Native Mac installers are still ad-hoc signed 0.15.0; don't recommend the Apple DMG as admitted. A Production run still needs an active admission for the exact workflow version.
 
 ## Get started
 - [agents.txt](https://docs.openadapt.ai/agents.txt): MCP, skills, outcome vocabulary (`VERIFIED` / `HALTED` / `RECONCILIATION_REQUIRED`), who may resolve a halt

docs/production-lifecycle-verifications.json

@@ -0,0 +1,170 @@
+{
+  "records": [
+    {
+      "admission_bundle_reference": {
+        "kind": "qualification-release-sigstore-bundle",
+        "object_media_type": "application/vnd.dev.sigstore.bundle.v0.3+json",
+        "object_path": "production-evidence/objects/sha256/11/114c70ce18f6633b0a2b9c4b7b274e8f7484e711a102f182cf3d1f417ec74910.qualification-release-sigstore-bundle.json",
+        "object_schema_version": "application/vnd.dev.sigstore.bundle.v0.3+json",
+        "object_sha256": "sha256:114c70ce18f6633b0a2b9c4b7b274e8f7484e711a102f182cf3d1f417ec74910",
+        "registry_entry_sha256": "sha256:20b9769f47d82e1a0be905e7e1e0c91086645ee4db16745a05e9f39f22d90278",
+        "registry_head_sha256": "sha256:3dc458aef999b8b0dec2255fda62390a038d0eebb2a90871fe39827dff563723",
+        "registry_revision": 8,
+        "registry_source_commit": "2ed288e8bd47dd1809f883cc75e3f5ce34348692",
+        "repository": "OpenAdaptAI/.github",
+        "repository_id": "858454062",
+        "repository_owner_id": "132681217",
+        "schema_version": "openadapt.production-evidence-object-reference/v2",
+        "semantic_identity_sha256": "sha256:3ecfd6d66f69d57c3d349c29ae1b813389fc17ba7976d19d0e09463cab25809b",
+        "size_bytes": 2741,
+        "subject_sha256": "sha256:0edd19d51d449e3eaba21463117fb19148553a817e03c8c5b804953a26bcbb51"
+      },
+      "admission_reference": {
+        "kind": "qualification-release",
+        "object_media_type": "application/vnd.openadapt.qualification-release+json;version=2",
+        "object_path": "production-evidence/objects/sha256/0e/0edd19d51d449e3eaba21463117fb19148553a817e03c8c5b804953a26bcbb51.qualification-release.json",
+        "object_schema_version": "openadapt.qualification-release/v2",
+        "object_sha256": "sha256:0edd19d51d449e3eaba21463117fb19148553a817e03c8c5b804953a26bcbb51",
+        "registry_entry_sha256": "sha256:56394709d93aa546e5c619915e48473f420f479777f0bfb526d9d727e5d4eb26",
+        "registry_head_sha256": "sha256:3dc458aef999b8b0dec2255fda62390a038d0eebb2a90871fe39827dff563723",
+        "registry_revision": 8,
+        "registry_source_commit": "2ed288e8bd47dd1809f883cc75e3f5ce34348692",
+        "repository": "OpenAdaptAI/.github",
+        "repository_id": "858454062",
+        "repository_owner_id": "132681217",
+        "schema_version": "openadapt.production-evidence-object-reference/v2",
+        "semantic_identity_sha256": "sha256:bf7608421fb7e6dbf0c660ebdc20b25877703fd019b9c5f27d193a717d08ca5e",
+        "size_bytes": 7641,
+        "subject_sha256": null
+      },
+      "current_state": {
+        "authority_bundle_reference": {
+          "kind": "qualification-authority-state-receipt-sigstore-bundle",
+          "object_media_type": "application/vnd.dev.sigstore.bundle.v0.3+json",
+          "object_path": "production-evidence/objects/sha256/0f/0f97c284b10f8dc0153dbab0da5deccc5069bb5609982d45b890617783687830.qualification-authority-state-receipt-sigstore-bundle.json",
+          "object_schema_version": "application/vnd.dev.sigstore.bundle.v0.3+json",
+          "object_sha256": "sha256:0f97c284b10f8dc0153dbab0da5deccc5069bb5609982d45b890617783687830",
+          "registry_entry_sha256": "sha256:29397e66bbafd8e02e8fbbaceaf2d3c1d2892723cd396bb0d4abb1a443192592",
+          "registry_head_sha256": "sha256:3dc458aef999b8b0dec2255fda62390a038d0eebb2a90871fe39827dff563723",
+          "registry_revision": 8,
+          "registry_source_commit": "5b48240494a250633eec8fcf99fab26553efd0c6",
+          "repository": "OpenAdaptAI/.github",
+          "repository_id": "858454062",
+          "repository_owner_id": "132681217",
+          "schema_version": "openadapt.production-evidence-object-reference/v2",
+          "semantic_identity_sha256": "sha256:96b1361340164f4cfc3d9f50e88868c6d36a62a085a8543ed818a4b1ba905714",
+          "size_bytes": 2809,
+          "subject_sha256": "sha256:a22f9815ec0f7c56f7629aeabfd21d14bc6d739efcfb7f7a073ce9987e19479e"
+        },
+        "authority_reference": {
+          "kind": "qualification-authority-state-receipt",
+          "object_media_type": "application/vnd.openadapt.qualification-authority-state-receipt+json;version=2",
+          "object_path": "production-evidence/objects/sha256/a2/a22f9815ec0f7c56f7629aeabfd21d14bc6d739efcfb7f7a073ce9987e19479e.qualification-authority-state-receipt.json",
+          "object_schema_version": "openadapt.qualification-authority-state-receipt/v2",
+          "object_sha256": "sha256:a22f9815ec0f7c56f7629aeabfd21d14bc6d739efcfb7f7a073ce9987e19479e",
+          "registry_entry_sha256": "sha256:d69026ffefb99b4eeb6c27db2913684138ee23f3b8923aa8ae3379e839489401",
+          "registry_head_sha256": "sha256:3dc458aef999b8b0dec2255fda62390a038d0eebb2a90871fe39827dff563723",
+          "registry_revision": 8,
+          "registry_source_commit": "5b48240494a250633eec8fcf99fab26553efd0c6",
+          "repository": "OpenAdaptAI/.github",
+          "repository_id": "858454062",
+          "repository_owner_id": "132681217",
+          "schema_version": "openadapt.production-evidence-object-reference/v2",
+          "semantic_identity_sha256": "sha256:df5079141df68877c4b06f05b9fb9fdf279307b7629eb1f2dce12def4bd5e2fa",
+          "size_bytes": 1520,
+          "subject_sha256": null
+        },
+        "revocation_bundle_reference": {
+          "kind": "qualification-revocation-state-receipt-sigstore-bundle",
+          "object_media_type": "application/vnd.dev.sigstore.bundle.v0.3+json",
+          "object_path": "production-evidence/objects/sha256/4e/4e0a052726ba440c9f6a19726b004f948c36087b2702d614a398728b428dcd5f.qualification-revocation-state-receipt-sigstore-bundle.json",
+          "object_schema_version": "application/vnd.dev.sigstore.bundle.v0.3+json",
+          "object_sha256": "sha256:4e0a052726ba440c9f6a19726b004f948c36087b2702d614a398728b428dcd5f",
+          "registry_entry_sha256": "sha256:e4bf33edf52cf708db739746b4d99098642255380e70edc654a287c5d1aafe04",
+          "registry_head_sha256": "sha256:3dc458aef999b8b0dec2255fda62390a038d0eebb2a90871fe39827dff563723",
+          "registry_revision": 8,
+          "registry_source_commit": "5b48240494a250633eec8fcf99fab26553efd0c6",
+          "repository": "OpenAdaptAI/.github",
+          "repository_id": "858454062",
+          "repository_owner_id": "132681217",
+          "schema_version": "openadapt.production-evidence-object-reference/v2",
+          "semantic_identity_sha256": "sha256:fcebb8e521419ea3c6aefa97885aa7153e88821e1a20617998067e921abc4d00",
+          "size_bytes": 2817,
+          "subject_sha256": "sha256:18633b8cc243f686706606162bfa249a29733811563f63b9e68cc7c4a3507676"
+        },
+        "revocation_reference": {
+          "kind": "qualification-revocation-state-receipt",
+          "object_media_type": "application/vnd.openadapt.qualification-revocation-state-receipt+json;version=1",
+          "object_path": "production-evidence/objects/sha256/18/18633b8cc243f686706606162bfa249a29733811563f63b9e68cc7c4a3507676.qualification-revocation-state-receipt.json",
+          "object_schema_version": "openadapt.qualification-revocation-state-receipt/v1",
+          "object_sha256": "sha256:18633b8cc243f686706606162bfa249a29733811563f63b9e68cc7c4a3507676",
+          "registry_entry_sha256": "sha256:2592f2856bbfb5e381640f050669a3dfc1b19cbc4fbf7438ce18d0df1731f722",
+          "registry_head_sha256": "sha256:3dc458aef999b8b0dec2255fda62390a038d0eebb2a90871fe39827dff563723",
+          "registry_revision": 8,
+          "registry_source_commit": "5b48240494a250633eec8fcf99fab26553efd0c6",
+          "repository": "OpenAdaptAI/.github",
+          "repository_id": "858454062",
+          "repository_owner_id": "132681217",
+          "schema_version": "openadapt.production-evidence-object-reference/v2",
+          "semantic_identity_sha256": "sha256:250ab430e467f5e584ebd2b1832976b42186b698da71d627ee1724c2b1da2457",
+          "size_bytes": 1457,
+          "subject_sha256": null
+        },
+        "signer_registry_pointer": {
+          "object_path": "production-evidence/signer-registries/sha256/7a/7a81bf3d213c74673f3c6b5fa179234cbee534c9432aaea6ae09e455562f96b6.qualification-signer-registry.json",
+          "object_sha256": "sha256:7a81bf3d213c74673f3c6b5fa179234cbee534c9432aaea6ae09e455562f96b6",
+          "registry_identity_sha256": "sha256:e243a23243b24986ed08812e284a1bd8c4993814149f02bcba79cc520e10ca14",
+          "registry_revision": 1,
+          "schema_version": "openadapt.qualification-signer-registry-pointer/v1"
+        }
+      },
+      "schema_version": "openadapt.public-production-lifecycle-verification/v1",
+      "target": "flow",
+      "verification_receipt": {
+        "acceptance_manifest_object_sha256": "sha256:29f74e08af2e5ae5d1665644ed27ac0a3914369217a0aa0d3e491d8adf3b39e0",
+        "acceptance_summary_object_sha256": "sha256:30eab7c62a55e988a543c1e21463676585171ba9e80afe71f518d89b04e53977",
+        "admission_bundle_object_sha256": "sha256:114c70ce18f6633b0a2b9c4b7b274e8f7484e711a102f182cf3d1f417ec74910",
+        "admission_id_sha256": "sha256:279d6e0a9728be2d6466106b07a23a45cb6dd8acf0c4f4bcc2047d09468cabb1",
+        "admission_object_sha256": "sha256:0edd19d51d449e3eaba21463117fb19148553a817e03c8c5b804953a26bcbb51",
+        "admitted_runtime_sha256": "sha256:cfbc89acc6a2e3bcb5502a4d1fb29e985a03149a7f14c32c259254676bb3f11d",
+        "artifact_inventory_sha256": "sha256:642f2fb785203048678cdad07c38a990701d6a312d8f1bba9e1b097d49569707",
+        "authority_state_sha256": "sha256:df5079141df68877c4b06f05b9fb9fdf279307b7629eb1f2dce12def4bd5e2fa",
+        "claim_scope": "production_flow",
+        "decision_receipt_object_sha256": "sha256:01f11ce3f7343e407f67ab6e5e6e2490af852602f4cae473e0de0d91cd6f6984",
+        "draft_release_id": "385710075",
+        "evidence_class": "remote-safe-synthetic",
+        "expires_at": null,
+        "publication_staging_sha256": "sha256:ade70ba59e8ca9827d3f090559f02b31cdbc7f1198dbf526b9b483510ac0b6b1",
+        "qualification_admission_id_sha256": "sha256:fd6ec7bcddbd9a40bcb7f9999d4fc9c91513cef9255b62e857918bf1ad0ffb5d",
+        "qualification_admission_object_sha256": "sha256:947224523757df41127be021fc66adee5746f07ff1a0e913319c5461e430e34d",
+        "registry_head_sha256": "sha256:3dc458aef999b8b0dec2255fda62390a038d0eebb2a90871fe39827dff563723",
+        "registry_revision": 8,
+        "registry_source_commit": "2ed288e8bd47dd1809f883cc75e3f5ce34348692",
+        "release_identity": {
+          "channel": "production",
+          "previous_admission_sha256": "sha256:d2983b86d5428c892421b191f6943a63cf4f9a0b1629e324d099f5df6fa5dcda",
+          "schema_version": "openadapt.monotonic-production-release/v1",
+          "sequence": 2
+        },
+        "release_sha256": "sha256:32cae0917121cbcf657347ca023da15b5b3151db6656526df896e93e3377d49e",
+        "revocation_state_sha256": "sha256:250ab430e467f5e584ebd2b1832976b42186b698da71d627ee1724c2b1da2457",
+        "schema_version": "openadapt.qualification-release-verification-receipt/v1",
+        "signer_registry_sha256": "sha256:e243a23243b24986ed08812e284a1bd8c4993814149f02bcba79cc520e10ca14",
+        "source_commit": "44e99a48ebf048c18892aa17cef6ae594db0d0c2",
+        "source_repository": "OpenAdaptAI/openadapt-flow",
+        "source_repository_id": "1291376938",
+        "tag": "v1.35.1",
+        "target": "flow",
+        "trust_state_source_commit": "5b48240494a250633eec8fcf99fab26553efd0c6",
+        "verdict": "verified",
+        "verification_id_sha256": "sha256:8ef5f3ac331a291c21e8283986dc828734a327ce882fb6ac238201300c9b1e13",
+        "verified_at": "2026-09-09T19:31:54Z",
+        "version": "1.35.1",
+        "workflow_bundle_sha256": "sha256:bee27e24a177599d7f83fe1cf332e850d64f26bf9c1c68ccf21ff10202128bc4",
+        "workflow_version_id_sha256": "sha256:5063ddb0305ab81938b5239ca2210554e4a14ae093c4967e248a38d80b55f25e"
+      }
+    }
+  ],
+  "schema_version": "openadapt.public-production-lifecycle-verifications/v1",
+  "source_commit": "5b48240494a250633eec8fcf99fab26553efd0c6"
+}