[prk-Jr]

Summary

d885a96 status: frozen at completed Step 1. No further implementation is authorized. The all-seven issue-cargo-npm-build-v1 option is endorsed by the user in principle, awaiting maintainer decision, not adopted. Gate 3 Steps 2–5 and later gates remain held; keep draft, no reviewers.

• Port Phase 3's retained SPDX, collection and distribution foundations from reviewed source 122b78664, restoring the candidate/index assertions split out of Phase 2. This is the approved Step 1, not complete production SBOM generation or index publication.
• Preserve frozen v1 contracts with raw-byte regression guards. Import 63 assigned files (62 unchanged), plus 14 shared support/dependency/test paths; every path's hashes and adaptation reason are recorded.
• Record in-principle user endorsement of the all-seven issue-scoped Build-derived Cargo/npm SBOM option, with explicit native/platform limits, amendment text and cost/CI estimates; maintainer decision remains pending. Production generation/qualification stay closed; workflow-contract restoration remains Gate 4 and v2 Steps 2–5 stay held.

Changes

Files	Change
crates/trusted-server-release/src/{spdx,collection,distribution}/** and module roots	Frozen owning-evidence projections, strict transfer/archive joins and candidate-only distribution foundations
Producer main.rs, error.rs, recipe.rs, recipe/startup.rs	Private module wiring and required shared accessors; ordinary commands retained
Producer recipe/native/document tests and producer/CLI release fixtures	Restored assertions, frozen fixture bytes and v1 policy/schema hash guards
Producer Cargo.toml, Cargo.lock	Required workspace dependencies/DNS feature; 11 added package identities, no existing version changes
docs/superpowers/plans/binary-attestations-phase3-issue-scoped-sbom-option.md	Proposed all-seven Cargo/npm/runtime/declaration scope, mandatory SBOM/guide limits, Gate 2 amendment and Gate 3 consequence; 26.5–44 conditional person-days, unmeasured CI allowances
Phase 3 spec, plans, slice map and port ledger	Two-round spec review log, per-path deviations, execution limits, 11 Gate 4 deferrals and full-cohort cost assessment

Full per-path/test ledger. No workflow, release script, signing or adapter runtime changes; no rehearsal needed for Step 1.

Closes

Part of #1235. Base: Phase 2 #1449; keep this PR draft with no reviewers.

Spec / Plan

Issue-scoped all-seven SBOM option and draft amendment: endorsed by the user in principle; awaiting maintainer decision; not adopted; no implementation. Strict closure remains a tracked future enhancement.

Phase-specific spec and review log · Approved Step 1 / held v2 plan · Gate 2 full-cohort feasibility assessment.

Test plan

Current head d885a965a6f4a488c75751c77accd7a3a41e1102 is docs-only since reviewed implementation 4741ab712. This signed, GitHub-Verified status update changes two Markdown files (+10/−8), with no code, workflow, script, policy/schema or signing changes. Docs lint/Prettier/site build, domain lint and whitespace checks passed locally; exact-head hosted CI has not run: GitHub reports base conflicts against the advanced Phase 2 branch. The stack refresh is left untouched while Step 1 is frozen.

• 57b208a: documentation lint, Prettier, VitePress build, domain lint and whitespace checks; two fresh independent proposal reviews with no blocking findings. No capture experiment or new resources.
• 57b208a: exact-head hosted CI passed (29 successful checks, four expected skips).
• d885a96: hosted CI has not run because of stack/base conflicts; leave the stack refresh held while frozen. Status-only documentation update, no rehearsal needed.

Implementation evidence, retained at its exact SHA:

• 4741ab7: locked host all-target/all-feature producer check and strict clippy; Rust formatting, domain lint and whitespace checks.
• 4741ab7: 198 audited exact pure tests passed, zero failed/ignored; frozen hash guards included. Local tests exclude process/transport fixtures.
• 4741ab7: documentation lint, Prettier and VitePress build; imported Markdown formatting. Independent scope review followed by quality/security review: no blocking findings.
• 4741ab7: exact-head hosted CI: 29 passed, four expected skips. All seven release builds, Fastly reproduction/comparison, adapter/parity/browser/integration checks passed; signing/publication skipped on the PR.
• 4741ab7: Linux producer suite: 1,158 unit tests passed, 12 named ignores; 3 boundary-probe and 18 command tests passed. All 198 selected pure cases also passed on Linux; transport/TLS/timeout/proxy-isolation tests and the negative sentinel passed.

CI: Binary attestations · Tests · Format · Integration. All four run heads are 4741ab712365efa9f578a9b461f9a26a48bb9c5d.

Named controlled real-build/collector tests remain explicitly ignored and unexecuted; the frozen observer supports esbuild 0.27.3 while the current lock has 0.28.2. No ignored assertion is counted as passing. Ordinary release builds do not use that observer. Phase 2's rehearsal .16 covers only its implementation 5fa384336; it is not Phase 3 qualification.

Checklist / Human gates

• Approved Step 1 source port, frozen-v1 guards, restored assertions and two-round phase-specific spec review.
• Complete generator and all Qualified* types stay closed; no v2 files, consumer, publication or fork-trust activation.
• Maintainer decision on the issue-scoped all-seven SBOM amendment, endorsed by the user in principle but not adopted. Maintainers decide whether the precision upgrade belongs within Publish attested release binaries with build provenance and SBOMs #1235 or a follow-up. Strict closure remains a tracked future enhancement; the current contract is not amended by endorsement. Step 1 is frozen; capture and v2 Steps 2–5 remain held, with no implementation.
• Gate 4: restore both workflow-contract files, its command and three process tests with the nine deferred workflow/script/config paths, validating actual release workflows without fixtures.

Allowlist changes needing maintainer review: no new global host. The unchanged frozen collection/transfer.rs:29 carries one allow-domain: api.github.com suppression.